Good morning, everyone. Thank you for joining me. We're going to kick it off with the state of open source security. I want to talk to you about high level view of everything that happens on language-based software ecosystems, container technologies, projects of open source maintainers, and developers as well. So quick introduction about myself. My name is Liran Tal. I'm a developer advocate at SNCC, where we build developer-friendly security tooling to help developers build secure applications. I'm also involved with the Node.js security working group and a bunch of other activities across OWASP and publishing books. If you want to follow me on Twitter and ask me anything about those, I'm happy to help. And I'll be here the whole day and doing the collaborators on it. So just find me around. So kick it off. Today, I think nobody would question the fact that open source has made an incredible impact on modern software development. And it continues to expand every year. GitHub had reported that 2018 had seen more new users signing up than all of its first six years combined. So open source software is really everywhere. And contributions are made across all languages and platforms impacting growth across different industries and undoubtedly an essential part of business technology strategy. In 2018, actually, Java packages doubled. NPM added about 250K packages as well. And we actually surpassed already 1 million packages early 2019, so this year, around June on NPM. So the use of open source is accelerating. However, with great adoption of open source comes great responsibility and risk that we need to mitigate, whether we are owners of open source, maintainers of open source, or just using open source software. In 2018, vulnerabilities for NPM grew by 47%. PHP and Maven had grew by considerable percentages as well, something around 27 and 56% respectively. So we're seeing all in all about 88% growth of application security vulnerabilities in the last two years. What is really interesting is that vulnerable versions have a long tail of downloads. In other words, how long does it take for users to adopt to a new version that has a fix from an old one that is vulnerable? How long does that take? So we turned into Python, the PyPy registry, and they took a look at a pretty popular package called WebSocket. We found that Eventoid has a high denial of service vulnerability. Disclosed in August, you can see that downloads have been thousands of downloads, or tens of thousands of downloads have been actually accumulating even after that. So people are still downloading vulnerable versions of that. Or this could be for different reasons. Maybe there's a legacy. Maybe there's issues to upgrade to a fix. But considering this fact, we're still getting those long tails of downloads, even for vulnerable versions. This trend is actually increasing of security vulnerabilities, even across well-known system libraries. So whether you look at things like Red Hat Enterprise, Linux, Stepian, all of those Linux distros, we're seeing those same trends of increasing CVEs and security vulnerabilities being reported, being disclosed. And we'll get to that in a bit, but I will say that those CVEs that we're seeing here Linux OS libraries are not something far away from us. Actually, they manifest in the container technology that we're using, most probably, to power applications and bundle them with them. So kind of transitively, we are being affected and impacted by these vulnerabilities. So let's take a look at what happens in language-based software ecosystems and how much do we rely and know about those open source dependencies that we use. So recent academic research paper had actually investigated the characteristics and properties of different language-based ecosystems. It took, for example, Python, PyPy, the PyPy registry, and also NPM. Try to compare and figure out what is different, what is familiar, and similar around those. What it found out, for NPM specifically, is that 61% of all packages on NPM could be considered abandoned packages. Now, straight out, that seems very outrageous proposition to say, but it depends what is your opinion on what is, or how do you measure what is an abandoned package, right? So for the sake of this research paper, and research paper being something easily to consume, we have decided, or the researchers have decided, that an abandoned package will be that which did not have a release in the last 12 months. So rightfully so, you could go ahead and argue back that last 12 months did not have a release. Maybe that package had reached maturity. Maybe it's already so well known and well developed it does not need any more new releases. Everything is fine. Except EventStream incident happened, a security issue that kind of, I'm pretty sure some people in the room have heard of. If not, there's a whole post more of them, you will not have a problem finding and Googling this information, but just like put it into a small disclaimer of what was going on there. EventStream has been on the NPM registry for almost eight or nine years since then. Definitely mature, did not see any release in the last two or three years, but someone through a social engineering technique was able to go ahead overtake publishing access and through that being able to inject a malicious package inside transitive dependencies of EventStream that you would usually also probably will use not as a direct one, but as a transitive dependency. So through all of that injecting something into a package that being downloaded about two million times a week. Another interesting insight that this research paper pointed out was that if you take a look at what you install, your average NPM install, there's a whole difference between what happens on Python, for example, to NPM. So for NPM, your average NPM install for a package would pull in four levels deep of nested dependencies, which means this is great if you're tracking something like Express or Fastify, but at the same time, they're gonna pull in a bunch of those other dependencies as well that you need to track and understand as well. Have the exact mindset of a security of what's going on there. Let's do a mental exercise. Imagine you're building Node.js app. Your mental image of the application is this following blob where you see your application being deployed or being used somewhere. Except the reality, however, is that the actual code that you write, the total code that we write as developers is significantly smaller amount than what we actually ship out. So your mental image of your application might be distorted towards the reality of what you actually wrote versus all the app that you are actually responsible for as well. All of us are relying on open source software and community-powered code, which is leveraging this beautiful open source world and boost our productivity, but we need to understand this concept of what we write and what is not ours and then what is our risk and responsibility towards those dependencies as well. So granted, it is, I think, hard to imagine these days writing software, delivering products without being reliant on any kind of open source software or dependency. And managing dependencies for a project is an important task. And it requires due diligence, tracking those dependencies that you use and that you rely upon and making sure that everything is okay. After all, the application that you're deploying is making use of that code and bundled that as part of your dependencies. So we wanted to understand what is going on in terms of where do we find security vulnerabilities. This is all, like most of this is part of the state of open source security for that we published, in which we have taken a look at what happens, both for users of SNEAK and the ecosystem itself, et cetera. And what we found for this example is 78% of the time when we will find security vulnerabilities for users using SNEAK is we will find it for NPM in transitive dependencies. So again, going back to that example, if you are a JavaScript or a developer, you're tracking all of the Fastify changelogs, all of the Angular and React changelogs, et cetera, most of the time, 78% of those, when we find security vulnerabilities for your project as we scan it, as we offer you fixes for it, it will not be for that direct dependency that you will use. It will actually be most of the time for those transitive dependencies. You can see this is actually a bit different between different ecosystem, which could say a lot about what's going on with our ecosystem, but I will not go into that right now. So what can possibly go wrong with transitive dependencies in my applications? So I have a whole different talk about what is happening with malicious packages on ecosystems, and I won't drill into one of them. And these are all examples and use cases of things that happened in security incident that happened in the ecosystems. I'm gonna drill into something that's called GetCookies. GetCookies sounds, I guess, pretty simple in terms of what it does. It parses HTTP headers for cookie data, or does it? So actually, GetCookies is nothing less than a command and control backdoor. It's sole purpose of allowing someone to attack your web server through sending command injections remotely. So any web server that would bundle this dependency, but actually allow a malicious attacker remotely knowing this vulnerability to go ahead and inject any kind of arbitrary code into your app. How does it does so? So the whole kind of exploit code in GetCookies is roughly four lines of code. I've actually summed up the important part here. To process this remote code injection, it has a simple switch case, does three things, reset the buffer, load data into the buffer, which in our case will be JavaScript code, and then execute whatever is on the buffer. So someone having control on this web server could go ahead, input, inject malicious JavaScript code through things like HTTP headers. This will process it, reset it, and run it. Now the attacker had to build a whole pyramid of nested dependencies to hide GetCookies behind them. Mind you, all of these three dependencies are actually offsprings of the same attacker. All of them belong to the same one, but one or two or three malicious packages on NPM having one billion packages inside will not be that much of a threat, as in who would go ahead and install GetCookies, which has maybe zero downloads. So without a vessel to propagate this and kind of claim trust, it's gonna be hard. So what this attacker was able to do is compromise this library called MailParser, which has something like half a million downloads on the registry, and through that, be able to push those dependencies into the MailParser project. Now MailParser itself is not a web server, so having that bundled in or even required in use may not have been put you on harm's way, but perhaps this was all done in order to provide some legitimacy in terms of someone searching for a GetCookies management package and says something gets downloaded half a million times. Well, maybe I'll use it. So this kind of malicious packages happen all the time. Here's an example from the NPMJS advisories. You can find that also as like a sneak. Vuln advisories doesn't really matter which one you're tracking, except I wanted to give you the fact that all of these malicious packages, different kind of typosquirting attacks, happen all the time, right? This is November 27th, this is just like two weeks ago. How do we handle all of that? How do we mature into being responsible to open source dependencies to what do we install? For the sake of that, I've created a project a while back called NPQ. What it does is when you do an NPQ install something like jQuery, as you can see here, this is a wrong abbreviation of jQuery because this is actually a typosquatted package. It will go and do some due diligence. It will check, for example, how much is this package? Is it something that gets 20 downloads? Is it just new? Someone is trying to maliciously inject users or is it something that gets downloaded a million times a month to probably get some kind of trust from the community around it? Does it have a repository, open source repository associated with it to allow you to go ahead and ensure that there's like an open source code base that you can check, et cetera? Maybe it has vulnerabilities in it. Why would you not know about it before installing it rather than after the fact and then finding out ways to mitigate it? Here's one example that we can go ahead and use to be a bit more responsible. And security vulnerabilities happen all the time whether you're using different types of language ecosystems. Here is Mark, for example, a very popular Markdown parsing library for Node and JavaScript kind of used between the server and the front end as well. You can see that there's a fix for it for like a read-os vulnerabilities happen just a while back, just a few months back. And the interesting thing about vulnerabilities at least in the last two years is that they have a bit shifted in terms of the trends that we're looking at. So when 2016, as we look at, the high and medium have like a kind of ratio where there's more medium than high. In the last two years, we've seen this ratio actually flip. So more of these vulnerabilities that we're seeing actually high than medium. So most developers and maintainers, I think, would agree that security should play an important role when we're building our applications. Except there are no textbooks on how do you build secure applications. There are so many guidelines and always kind of like standards or like semi standards. But there's no open source maintainer in this room that would say, I'm following this and that standard and this is how I do secure code. So standards can also vary between different projects which means one project can follow a very good and highly secure guidelines, secure coding convention, et cetera. But another open source project, very, very popular in the same sense would not follow those as well. So all of these security standards things for open source project is very varied in terms of how it is done. So just in this year's 2019 state of the octopus report from GitHub, security was actually the most popular project integration app category. And the more we use open source software, I think that we realize this reach that we accumulate upon ourselves as we're trying to use someone else's code in our application. And having automated tools that we can use in our CIs is our most important, right? Because this is how we're gonna be able to scale up security as part of the way that we scale up the delivery of our applications code. So through this survey, we asked some questions for maintainers and developers. In this part, we asked open source maintainers to rate their security knowledge and how good that is. So we found that 70% of open source maintainers would actually not fill that confidence in handling a security issue if it was this close to them, so averaging their security knowledge somewhere around 6.6 out of 10. Moreover, as much of, you know, we're seeing adoption of CI tools that's things like CircleCI, for example, to help us have a good CI, CD kind of pipeline thing. They still go underutilized, so we're not enabling, we're not empowering the CI integration that we have for applications. This DevOps pipeline to go ahead and put security into it. As a testament of that, when we asked developers how often or what is the cadence of their security auditing, one of four open source maintainers not perform any sort of security auditing for their projects. So security practices are taking many different shapes and forms, and some of which are really easy wins. For example, choosing a really good password so your package would not get compromised, right? Like mail processor, like many other packages and incidents that were happening before on the ecosystem. Another option is, for example, to enable 2FA in your code, whether that is the NPN package registry or Docker Hub or something like that. But how often are we doing that? So what is the state of 2FA, for example, in the NPN ecosystem? Well, as we look back into it, and 2FA had been available on NPN since the late 2017, and maybe despite the fact that it had been there for so long, there's only a very small percentage of the ecosystem of developers and maintenance actually enabling that. And this accounts for a very small, insignificant amount of packages out of the whole million packages happening on NPN itself. So it's the responsibility of all of us enabling 2FA, making that possible for us, making the security possible for users consuming open source software. Interesting take is, how does this affect and how does this look like in adjacent ecosystems? For example, what's the state of open source of 2FA, for example, in Docker Hub as an ecosystem? Well, funny thing is, it's 0%. And there's a whole funny story around it, and that's kind of accurate to October 1st, which I'll get to in a minute. And why does that happen? Because somewhere around June, someone on the Docker repository chimed in on this issue and said, you know, we're planning to rolling out this multi-factor authentication at the end of June. Everyone were thumbs up, great, amazing, let's do it, except it didn't happen. Someone chimed in in July and said, you know, hey, we're July, what's up?  How are we doing there? I like it that they are giving the programmers kind of perspective into it, I'm a programmer myself, how hard can it be? All right, so we didn't have it back in July, back in August. Guess what happened in September? Nothing much, we did not have 2FA available there, reminding you that we're talking about Docker Hub. This is a very primary registry for Docker container, probably firing a lot of applications for everyone in this room, including myself. And October coming up, right? What is happening there? So there's an interesting update. We've been rolling out personal access tokens, which is not the same as 2FA, but maybe a step in a good direction, except we need to remind them that maybe we need 2FA, and then it happened, everyone are happy. So I hope after this talk, everyone is gonna have 2FA enabled on Docker Hub and on MPMJS. So the security blind spots of Blockfile, I wanna talk about this as an example of going back again to maintainers and open source activities, and how often have we as maintainers and as developers are kind of putting this out of pilot mode where we don't even consider the security risk of an attack vectors of things that we do as like a day-to-day activities for the most basic things. So I'll give you an example. Here is a pull request I opened on GitHub. You can see that I have actually part of this pull request for real project, actually changed some dependencies as I needed to. What's part of my contribution? You can see that my yarnlock file is actually not being displayed because we take that kind of for granted. It's a machine-generated thing. Is there anything that I need to look at? Maybe not, there's a whole lot of codes being changed as well. So it's kind of collapsed and do not show you all of that. And if I will open this up and show you what were my contributions along this dependency update, along the code that I actually added as well, maybe those of you with a good eyesight here will actually see that on the left. I'm actually changing something that is an actual package that is being used from the registry. And you can see on the right that my change is actually using the exact same package, but from my own controlled domain, whether that's like an NPM proxy mirror or I can already install it directly as you can install NPM packages from GitHub and it has malicious code in it. So as you will merge this pull request we'll probably not see it because you did not even take care of go ahead and reviewing what's in a lock file, go ahead and merge it. Maybe you're at this point when you're doing an NPM install the next time. Any of those developers, we usually know in a lock file usually being used for authentication developers of a project specifically, not the consumers of it. You might be susceptible to this injection attack. So why don't we have tools to help us with these very simple things? So there we go. I built this thing called lock file lint. I think as JavaScript developers we heavily rely on static analysis and linters. So there we go. Another one that you can add to your CI lock file lint. You can tell it to validate everything is first of all HTTPS, specific sources, what are you using? Just NPM or just yarn. Don't want anyone to inject anything from GitHub or anything other like that. There we go. Another tool that you can go ahead and use in your CI. Perhaps a silver lining in most of this talk, I would say. We're not doing that bad, but across the ecosystem but I would say what is the silver lining here as we asked developers and engineers who is actually responsible for security and the most of the respondents have been around developers. And this is great because we're seeing this strong statement, strong test command of developers being like fools back and it's not just owning the DevOps or the backend at the front end. It's also being responsible for things like performance of application, accessibility requirements, how about security for applications as well. Understanding the risk for us as maintainers of open source software to actually mitigate and push out security fixes is really, really important in terms of how are we actually rolling this out. So I wanna show you an example. Happened not a long time ago. This is a GitHub project for a very popular NPM package. Doesn't remember, doesn't matter the name because these kind of things happen all the time. But I'm giving you one example where someone was trying again and saying, you know, there's a vulnerability that was reported. There's a link to the sneak phone, you know, telling the person to go ahead and release like the owner of this package to go ahead and release like a new version. So this can be consumed as a fix for the package that they are relying upon at the transitive depth that has vulnerability in it. The maintainer did get involved, right? This did happen, you know, everyone were proactive about doing it, except, you know, I think kind of like lack of education of how you mitigate security issues. It was published as a major version. So if version two is vulnerable and you publish as a maintainer a fix in version three, that's gonna be a bit tricky because having an automated upgrade from two to three has different semantic meanings to it. Maybe an API was broken, maybe a very elaborate CI will not go ahead and update it because they are afraid that this will break their applications. So there's a whole lot of security education, not in terms of how you write secure code, but also how do you push that, how do you make that available to users to consume it in a very seamless way that automated upgrades things like dependabot or sneak upgrade PRs would be able to go ahead and pull in those new versions for you. So there's a whole lot of best practices for open source maintainers. I've got this cheat sheet, some of it is kind of left here. You can find it online as well, I've worked on that with Juan Picado who is the maintainer of Redatio, a local NPM proxy. He's been doing an amazing job as well for open source. So moving on, what about open source dependencies impacting container security technology? What is this increase of adoption, I think around Docker and you know, the strong growth around open source that we're seeing and is expected to grow more and more. We're talking about more than one billion downloads happening probably every one or two weeks on the container registry. Docker Hub reported about one million applications in the form of container images being uploaded to the registry in the last, in the Docker Hub registry, I should say in the last year. So this is very much fueling our open source growth except Docker images almost always bring non-vulnerabilities alongside our great value. So if we take a look at just scanning those 10 most popular Docker images on Docker Hub just scanning the most popular page of all of those images, we would find that if you just get default images of each of them, they at least have each 30 vulnerabilities inside them. Notice presumably here with 580 as well. So most of those vulnerabilities actually originate from the base image of your application. So this is why it is so crucial to understand why are you using as a base or as a current image in your Docker file? If you're using something like Debian Jesse, you're gonna pull in something like 700 dependencies. If you're using something like Buster or Jesse Slim or some other variations of it, you're gonna pull smaller images, smaller dependencies of all these libraries inside them and thus also you're gonna pull in less vulnerabilities as well. That's a smaller image. And the thing is that fixing it can be really easy. So if you understand, if you know this fact, you understand that fixing it is something that is very easy to do. For example, 44% of those Docker image vulnerabilities can just be fixed if you change to a newer image. If you do not use Node Latest or Node 10, but you use Node 10 Slim, for example. Here is the open source vulnerabilities in each of those image tags for Docker Hub. So you can see that using Node 10 will pull in 582 vulnerabilities into that image just by using that. You're vulnerable to this amount of vulnerabilities. Now sure, granted, they may not all be exploitable. They may not have all exploits in the wild. But why would you shift by default almost 600 vulnerabilities with your Docker application? There's no same way or same reason to do that. Use a different image. Except I know it is not that, it's a bit of a smarty kind of way for me to just go ahead and say it, but we need a tool to help us do this. This is an example of how stick that so that you can use other tools as well. But the idea of friendly tooling that help us figure out, well, maybe I detected that you're using Node 10 something. It has 900 almost vulnerabilities. You can consider moving to any of these other alternative images that you can try and use and mitigate and the security that you have. So instead of having pulling in 862 vulnerabilities, you'll be pulling in only 54 of them, which may be an acceptable risk in your workplace. The other thing that we should kind of like pay attention to is that just by rebuilding an image, we can go ahead and mitigate 20% of the Docker image vulnerabilities because rebuilding an image may pull in depending on how the image is built. When you opt to get updates or new upgrades coming in and pulling in your versions, if nothing else have been filmed by the dependency manager inside the OS itself. So we're talking a lot about container technology. And we also asked some questions about this. So when do you scan your Docker images for OS vulnerabilities? Interestingly, even though security is such an important part, even though there's a whole trend of security CVs going on in Linux OSes, 50% of developers will fail to do so. They will not scan those dependencies even it is something that is very easy to do. Many tooling available free and some of them open source as well. You can go ahead and take that. What about you have those containers deployed to production? What about going ahead and testing this on production because unlike functions which are very short lived, Docker containers could be very long lived. You could have a very legacy service, a microservice that the team is using has been deployed to production. No one had pushed any update onto it. It's been running for like a month or two. It is now in production. Maybe there are new CVs affecting it, something like a new hard lead or whatever that could be impacting it. Still 50%, almost 50% of developers or engineers would not even find out about it. I guess another silver lining for container technology is that developers are still, even for the sake of Docker images and Docker files and stuff like that, with the empowerment of developers to own their infrastructure as well. We're seeing a good and positive trend in terms of ASAs developers owning the security of our container technology as well. Some best practices around Docker image security that you can find are the whole linters and how to scan them and very easy things that you can go ahead and pull into your pipeline. It's like you can go ahead and think me afterwards I'll give you all the links and all this will be available after the talk as well. But I would wanna end out with kind of like this note where attackers are kind of targeting open source because finding one vulnerability, one CVE affecting, you know, Fastify, Angular, whatever kind of open source project that you may use is also kind of translates into many victims because there's always a lot of users for these open source packages. So if something has a very large popularity, it means they'll probably be able to inspect or attack a lot of consumers as well as not everyone may be up to date, not everyone may be rolling out patches and upgrades as fast as they can. And this is why it is so easy for attackers to just target open source software. What if security wasn't bit easier, was kind of more developer friendly, was actually actionable. So not just allowing you to learn about this new vulnerability, but actually fixing it for you. Like opening a pull request to let you know, I will tell you that I will upgrade your dependency because I wanna pull in a new version for that, maybe a smart minor version upgrade and not pull in the latest version to not break your apps. What if it was something that you would just push into your CI, example, showing sneak what you can use and PMO data or dependency checks in your CI tooling as well, but what if you would have this security integrated into your pipeline, into your workflow. So when someone adds a new vulnerable package, when someone adds a new security vulnerability to a transitive package, your CI breaks, right? You're a bit more conscious in how to do this in a more significantly considerable way, more responsible way to protect your open source dependencies. So thank you for much. Use the open source, you know, stay awesome, stay responsible, thank you. I think we have time for questions if anyone is, yes, it's a good question. I wanna show we are defining a specific ecosystem like NPM if that's what you mean as polluted, as in Java would have, you know, a similar amount of dependent of like open source vulnerabilities growth in a similar kind of, it's not like a, like an order of magnitude difference, it's kind of the same playing field as well. It is more about, I think, understanding these securities can being able to do something about them, understanding, you know, what you should be responsible for not taking those things for granted. So I don't think like a specific industry is polluted or not. There's a whole, if you go and dive into the report itself, you would see that we actually looked into kind of very early stage growth ecosystem is like a goal that would have, you know, they also have kind of like this trend of increasing vulnerabilities and even though it has like a whole significant amount of security vulnerabilities in total compared to something else, but you could attribute that to, you know, maybe Go isn't that popularly used, maybe security researchers are simply not looking at it to go ahead and find vulnerabilities there. So there's a whole kind of wide range of what would be the reasons that we're not seeing this in Go versus, you know, NPM or Java, for example. Go ahead, yeah, awesome, yes, I am. So glad you're bringing this up. So actually the security researcher who found this, his name is Daniel Ruff, he's actually involved with Redatio and a bunch of other projects. He's a very security minded developer as well. He's not a security researcher by profession. And what he discovered is if you're using NPM or YARN, they both, so the NPM kind of like, not the ecosystem tells, but like the tooling around it allows you to distribute binary files. So you could go ahead and, you know, by the way that I was building this NPQ and lock file link CLIs, you could go and build in a CLI where you would install something, make it global. NPM or YARN as a client will go ahead and make, you know, make the whole path and same link changes. So anywhere in your shell kind of prompt thing, you would go ahead and be able to run commands. The thing that Daniel found is that you could have, he called it, like we call it terminology as like a bin planting. The idea is that if say one NPM dependency, we can take, you know, whatever example you want, but if one defined a specific bin file to be executed like a CLI and installed it, and then there's like another one that you install. Like a different package that you install, but it uses the same kind of name for that bin CLI. It will override the original one that was created before that. So you could actually say, you know, for example, if you're using Yeoman, which, you know, I'm gonna go a completely hardcore retro old school kind of thing, using Yeoman as a CLI. I could go ahead and create this Yeoman dash two, whatever, get you to install it. Once you install it, I will actually be able to override the original Yo command, the Yo command that Yeoman had actually declared. I'm actually being able to override something else. It is, you could say that you could do the same thing with scripts. So basically when you install something, you could just go ahead and do like a post install scripts and do the exact same thing, except NPM and Yarn has these ignore scripts, which is a convention that, you know, security convention that you should probably understand and use. But even if that is used, this kind of bin planting could still happen. So it is still a very significant security issue. Interesting to say about it is that PNPM had not been vulnerable to all of the cases that we've seen. And it actually warns you if like, if you're trying to override something that already exists. So yeah, if you are using NPM and Yarn, you should probably update to the latest versions so that you're not vulnerable to that. The only way to kind of become vulnerable to that is if a dependency is being installed and, you know, declaring those bin files, which is something that, you know, could happen if you install it like specifically, like can NPM install something or maybe that gets installed as a transitive dependency as well. So, you know, we don't have a lot of control on what gets there. No, I don't think there have been. And as we've seen, it's a fairly new issue. Daniel actually consulted with me about it. We talked with SNCC security team, we involved both NPM security team, as well as Yarn. Myle is the coordinator for Yarn. We actually contacted all of them, kind of to consolidate all of this messaging and communications. And have all been like NPM and Yarn have been releasing security updates. So we haven't, this is like freshly in use for like the last four days or something. There is one through GitHub that they have requested. I don't know if it's like, have already been a block assigned, but there is like three CVS as far as I remember, concerning all of these core NPM specifically. This one? Yep. Yeah, I graphed that as well. It's basically this one. To consider like also Golang, what is it? Yeah, yeah, that was just NPM specific. Far as I remember that was the one, yeah. This one for ecosystem considers growth for everything, Golang as well, it's all kind of growth. I think historically, yes, because like you can see from the Linux OS, that's almost going, you know, I won't say exponentially, I do not want to go there. But yeah, that's kind of taking that trend. I would say, you know, being a bit more conscious about what does this mean. So first of all, for NPM and JavaScript, we have been having a lot of activity around that. So the security working group being there, you know, being a bit more active and vigilant and what's going on assigning CVS, but there's also been like a lot of activity. So obviously like there will be more CVS as well, if no one had looked at it before. So that contributes. The other thing is not everything is, you know, exploitable. So you have, you know, you may be vulnerable to like some high issues, like for example, just may have a redos attack versus whatever. But you need to understand that, you know, just is maybe a depth dependence. You're not deploying that to production. So that is not something, you know, specifically to like worry a lot, right? Under kind of like a statement here.  That said, I would say, you know, you do not want to go into production with having like 20 low vulnerabilities. If you can just lower it to zero with like zero effort, right? So you do want to go ahead and mitigate these security risks if you can, as much as possible. Good question.


Welcome everyone to How to Get Microsoft Software Donations. My name is Becky Wiegand and I'm the Webinar Program Manager here at TechSoup Global. I've been with the organization for 7 years and prior to that spent a decade working at small nonprofits in Washington, D.C. and Oakland, California, where I was frequently the accidental techie having to make technology-related decisions for my small nonprofits without a whole lot of tech expertise. And it was lucky to be a beneficiary of TechSoup's programs and received Microsoft donations myself for those organizations prior to coming here. So I'm glad to be the host today. Also joining us are Carlos Bergfeld, Product Content Manager here at TechSoup Global where he writes and edits content for TechSoup's product donation program in order to help nonprofits make more informed technology decisions. You'll also hear on the line Casey Livinggood who is an Account Management Specialist here in our client services department at TechSoup Global where he not only determines the qualification and eligibility of U.S. nonprofits within TechSoup's donation and discount programs, but he also provides day-to-day customer support to our members. So if you call TechSoup, you're likely to reach somebody like Casey and he'll be helping you and providing some of his knowledge of what our software donation program has to offer and to help you gain better access to it. So we're glad to have both of them on the line. We are based here in our headquarters office in San Francisco and we are glad to be coming out to you wherever you may be out in the universe listening to us today. Quickly before we get started I wanted to go ahead and talk a little bit about the Microsoft donation program and in particular Microsoft Corporate Citizenship. They are the largest donor in TechSoup's donation program both nationally in the U.S. and worldwide. So TechSoup serves over 120 countries around the world with 63 donor partners delivering technology resources and products to those organizations in those 120-plus countries. We've done that nearly to the tune of $5 billion. Microsoft has been a huge part of making that happen. So they offer a huge variety of donations of their software both installed software and cloud software like Office 365. They offer trainings and other benefits to the nonprofit sector through their corporate citizenship program. You can learn more about it on their website but I just wanted to highlight a little bit of the impact that they've been making because they are the reason we're all here today and they were able to access donated Microsoft technologies. And in 2014 alone they served 86,000 nonprofit organizations around the world. And a large part of that was done with TechSoup's global partners in those 63 countries. We have also helped them deliver 11,000 to 11,000 nonprofit organizations around the world with Office 365 donations which we'll talk a little bit about later in the program as well. And they have served the nonprofit sector just in the past year with more than $940 million of fair market value of their software. So if you are accustomed to going to Best Buy or CDW or Tiger Direct or any of these online sites to buy retail, we are happy to be part of the program and delivering the program with Microsoft to give you those donations so you don't have to pay full retail price to access the newest, latest, greatest software from Microsoft. So you can see on this side of their website here that you can check on what's available, eligibility, those are things you can also check on directly through TechSoup's site and that's where you'll actually come to us to get those donations and then they'll be fulfilled through Microsoft's Volume Licensing Service Center which we'll show you in detail later on in the program. But I just wanted to acclimate people to what Microsoft is doing in the sector and how they are helping TechSoup deliver resources and information and technologies to the sector for good. And we are proud to be part of that. So getting us to the meat of today's content in the Microsoft software donation program, I'd love to have Carlos come on the line to take us through TechSoup's website to show you where to find Microsoft donations, how to get there, what the catalog has to offer, how to know what to look for, some of the more popular programs, discuss some of the eligibility and restrictions, what that all means, and just show you how to get started. And then later on in the program Casey will be taking us through how to get that fulfilled, how to actually get those products from Microsoft's Volume Licensing Center. So thank you so much Carlos. We're happy to have you as part of the program. Take it away. Thanks Becky. Happy to be here. I'm going ahead and sharing my screen now so you should see the TechSoup.org homepage. First off I'm going to start with how to actually navigate to the Microsoft donation program so you can browse all of the Microsoft products that TechSoup offers. So there's a navigation bar at the top of our website that says get products and services. You can hover over it and you'll see a menu expand below it. Under Browse Catalog there's several ways that you can browse our catalog. The easiest way to get to Microsoft though is to go to Browse Catalog by donor or provider. There will be a flyout to the right that will look at the donor partner that TechSoup has. Microsoft is among those. So click on Microsoft. That should load the Microsoft Software Donation Program page. So this doesn't have product listings on it yet. It's just an explanation of the program. You can click Browse Microsoft products to actually get to the products. But before we do that I'd like to point out this text here. So recently we made a big change to the Microsoft Catalog at TechSoup. We no longer list the versions of Microsoft software that are available. For example Windows Upgrade, the product is called Windows Upgrade. It doesn't say Windows 8 or Windows 7. It's probably better explained in a blog post that we have at blog.techsoup.org. I'm going to go ahead and tab over to that now. Our Microsoft Catalog has been simplified is what we said and it's true. So this blog post actually explains the reasoning, the rationale behind it, and it has some common questions that you might have such as how do I know which versions I actually can get if they're not listed, which is a great question and we'll get to that shortly. So I'm on the Microsoft program page. I'm going to click Browse Microsoft products. And Carlos, one thing about that page that you just left that I just want to interject with is that you can browse all of the products the way that Carlos just showed by clicking that blue Browse products button. But on the far right, we do have some of the top Microsoft products highlighted there as well. Even though we have simplified the catalog, we know that some of the most requested products are the Microsoft Office Suite, Windows Upgrades, Windows Server. So we've tried to make those easy to find as well in some of those key spots on our site. So keep an eye out for opportunities to click directly to what you need along the margins. Absolutely. Thanks for mentioning that. And as well, if you know exactly what product you want, you don't have to go and click anything to browse. If you don't want to, you can use our search bar from the home page or any site and just say, I'm looking for Office, type the name of the product you're looking for, Office or Windows or SQL Server or anything like that. So this is just sort of the way. If you don't quite know the product that you want and you just want to see what's available, you could do this. Or if you're new to the Microsoft donation program, follow this method and you can see pretty much everything that's available. So I'll go back now to the – I'll click on Browse Microsoft Products. So this is the catalog and it has a couple of drop-downs here where you can select categories of products. So right now Microsoft Desktop Application Software is selected. And the subcategory that's selected is Office Suites. So this is all of our Office products. And again, notice how I mentioned earlier, it doesn't say Office 2013, that kind of thing. It just says Office Standard, Office Professional Plus. You click the drop-down here and you can browse the other broader categories. Windows PC Operating System Upgrades is a popular one. That's Windows Upgrades. Get Genuine Windows Full PC Operating Systems is also popular. And that's full operating systems that are only to rectify licensing situations you might have with Windows. Let's say you have a home addition or not fully licensed addition. And there's other categories here you can browse. So right now I'm just going to go look at one of these products. So let's look at the Office Standard product. I'm going to click View Details. So here's one of our standard product pages. There's a tab for the description which tells you about what the software is and the features it has. There's a tab for the system requirements, the second tab at the top here that has the system requirements or more often there will be just a link to Microsoft's requirements. And then we have the Rules, Eligibility, and Restrictions here which explain to you if you're actually eligible for the program or not. If you're new to TechSoup, maybe you haven't requested anything from the Microsoft program yet. These are some rules that you'll need to acquaint yourself with. Certain organizations can request software from the Microsoft program. Certain ones can't. And there's some request limits. This page looks kind of scary and long, but once you learn what you can do and what you can't do, it's not too hard. And we'll get a little into that later. I'm wondering for people to know, sorry to interrupt. It is long to read through that, but it's a good idea to do so. But if you're not sure and if you're new to TechSoup, the best way to find out what you may likely be eligible to request is to take this eligibility quiz we have on our site. Carlos, would you mind just showing where people can find that? So it's in that same Get Products and Services drop-down in the far left, upper left of our site. And you can click on Check Your Eligibility. You don't have to actually do that right now, but if you enter in some basic information if you're a 501c theory or a library and what your budget size is, what type of work you do, it automatically updates to show you what you're most likely eligible to request through our programs. So if you're not sure, it's a great place to start. If you are already registered with TechSoup, you can do that Check Your Eligibility quiz as well when you're logged in and it will show you for sure which programs you're eligible to request. So it's a great feature that takes out a lot of that guesswork of going through all of the effort of reading every page because it answers the questions for you. That's a great point. And we have a lot of content explaining the eligibility as well that is helpful, but again it's the easiest way is to just take that quiz and then you'll see if you're eligible or not. There are some other things in here that aren't covered in the quiz necessarily like the donation cycle for Microsoft. And we'll talk about that later. So it's on a two-year cycle so you can request a certain amount every two years. I'm going to go back to the description, this first tab here. And I'm going to scroll down now and you'll see there's a blurb here. Which versions of this software available which is similar to what you saw on the Microsoft donation program page. So let's finally address that. What does it say? So you can choose to download the current version or the previous version of this software. You can find out which version is the current one in the Microsoft title groups document. In addition, you can download the software in any language that's available. So what this is telling me is that I can get the current version of the software or the previous version of the software to check this document to find out which one. So let's look at this document. The Microsoft title groups document is what it's called and I'll explain the name of it later, but now all you need to know really is that this is how you know what the current version is. So if you look at this as a list of all Microsoft software I'm going to scroll down to find what I was looking at which is Office. So here's the Office Suite and the list of the current software is Office Standard 2013, Office Professional Plus 2013, Office for Mac 2011 Standard Edition. So I was looking at Office Standard and that means the current version is 2013. So I can get Office Standard 2013 if I request that product through TechSoup or I can get the previous version which happens to be 2011. Those previous versions aren't listed on here, but you will see them if you request this product and go to the VLSC. You'll see the previous versions of the software. I'm going to go back out of this document now. So I was mentioning this title group document has another purpose which is related to the restrictions for the Microsoft program. And we have a document here that explains, let me see, if you scroll down it's called the Microsoft Donation Program Eligibility and Allotments. So this is a whole basically article to kind of explain what's going on with the Microsoft program, what types of organizations are eligible and their special rules. But one of the big things I'm going to touch on is the quantity and frequency of the Microsoft request. So how much can you get and how often can you request these donations? The Microsoft Donation Program works on a two-year cycle. So every two years you can request products from up to 10 Microsoft title groups. So what are title groups? Well the document we had open earlier, the Microsoft title groups document, I'll open that in their tab, groups, all of the Microsoft title groups. So for example, we were looking at Office earlier in this document. I'm going to scroll back down to it. The Office Suite. So all of these three products listed here, Office Standard, Office Professional Plus, and Office for Mac, those are all actually in the same title group. So if you're requesting each of those products, those only take up one title group out of the 10 that you can request from. Sorry, I clicked to the wrong tab. So you can get products from up to 10 title groups, and you can get up to 50 licenses for desktop applications, operating systems, or license-only products. For server products, there's a maximum of five of them, regardless of the title group. So server products do have title groups still. So SQL Server, for example, is a title group. But you can only get five of them no matter what. You can't get up to 50, for example. Like with Office, you can get 50 licenses. With the server products, you can just get five copies of Windows Server, or five copies of SQL Server, or one of each server, but only five. And there's a lot more to this. If somebody is requesting Office, and they need 10 Mac licenses, that allows them to get up to 40 of the regular PC licenses either in Standard or ProPlus. Is that correct? The total would be no more than 50 from that one title group. Right.  So Organization A has requested 20 Office Professional Plus, 10 Office Standard, and 10 Office for Mac. So this is basically the situation you just described. They also requested 20 Windows Upgrade Licenses. So they've requested from two of the 10 title groups, because all of the Office products are one title group, and the Windows products are a separate title group. So that's two of the 10 title groups, and they can request from eight more during this two-year cycle. In the Office Suite title group, they requested 40 licenses, and they can request 10 more. So they can get 10 more of any of these, but it's true. Like you said, they can't get, for example, 50 Professional Plus, 50 Standard, or 50 for Mac. It's 50 total in that title group. In the Windows Desktop Operating Systems title group, they've requested 20 licenses and requested up to 30 more. So again, the 50 license maximum, that's one title group for Windows, and they can get 30 more. I won't go through all the examples, but there's a lot of great examples here just to go through the various server products and et cetera, and it also talks about returns and refunds and that type of thing. So I'm going to go back now. Scroll up. Something I wanted to call out though was we recently revised a lot of our Microsoft support content. Basically, the Volume Licensing Service Center, or the BLSC, is how you actually obtain Microsoft products after you've requested them through TechSoup. You'll get a couple emails, which reminds me, make sure that your email address is up to date whenever you request a product. So right after you log in to TechSoup and add a product to your cart, or even before you add it to your cart, you'll want to go and do that. So I'll show you how. So you click Log In in the top right where it says Members Log In. I just click that. Enter your email address for the login. Mine's already saved by my browser. And then it'll take you back to the home page. You go back to the top right and click on Manage Account. And then you can either click on My Active Organization Profile up here, or maybe you have multiple organizations associated with your account. You can just click on the name down here. So my organization is not qualified because it's not a real organization. It's a test organization, but I'll click it anyway to show you how to do it. And if you scroll down under your organization information that lists your type and your role, your name, your email is going to be in there as well. So click on Edit. If it isn't correct, make sure that it's correct. And if it's not, if it's old or needs to be updated, click Edit. You'll scroll down to the field and enter it twice. So you enter it once and then another second time to confirm. Go back to the bottom and click Save Changes. I'm going to cancel since I'm not really changing it. And that's all you need to do, but you want to do that to be sure to receive the email that will send you with all the instructions about how to actually obtain your donation. Otherwise you'll have no idea how to get it. You'll notice, sorry, that Carlos logged in with his own personal email address, the CarlosBat address. But your fulfillment emails that you get anytime you request any kind of donation, go to your organizational email that's on file with us. So it might be info at SaveTheKids.org. It might not be Jane At, and that's what we want to make sure that you're looking to that email account to get those fulfillment emails. And to get anything related to your organizational account will be sent to those emails, not your personal email because we know multiple people sometimes request donations on behalf of an organization. You might have an IT person or a board member or a staff person or a volunteer, and they may all access our TechSoup interface to go ahead and request donations on behalf of that organization. So even though you may have an individual email address that you're logging in with initially, your organization email address is what you need to be looking to for those fulfillment emails. Yeah, that's a good reminder. And you'll notice that my email address, my organization email address is testattest.com here which is again fake, but it's not the same as CarlosB at TechSoup that I logged in with. And it will be like that for most of the organizations too. So you want to make sure to update the organization email address or check if it needs to be updated. And don't just rely on your login because that's a separate email and your individual user login. Something I wanted to point out as well is even if you get the email from us, you receive the email after you requested a donation, and you might still need a little help with the VLSC. Microsoft has a lot of great resources, but we've also put together a good guide to the VLSC for TechSoup donation recipients. And if you go over to the top navigation on our website, hover over Support, you'll see this menu here. These are all good resources, but one in particular, the third one down is called Microsoft Download Help. I'm going to click it. And what it is is a volume licensing service center quick start guide. So this guide goes through and step by step, there's five steps. It tells you pretty much the easiest way to obtain your donations. It starts off with registering at the VLSC, accept payment, which is something you'll do after you receive your second email, or actually probably the third email, but the second email from Microsoft. Those instructions on this page kind of tell you what needs to happen for you to use these instructions. So you successfully placed the Microsoft donation request through TechSoup, received an email from TechSoup confirming your request, and received a second email from the Microsoft VLSC notifying you that your license agreement is ready to be accepted. So register at the VLSC, accept your agreement. This tells you how to download your software. We talk about how to burn your software to a disk. That isn't the only option. We have a link here. If you don't have a DVD writer, if you want to use another method, here's an article here for some more options that talk about mounting the ISO file so you don't need to burn other options. But this is a fairly straightforward way to do it. With Windows 8, you might not need to burn it to a disk as well. You can actually just install, you can install it from the file itself and you don't need to do any burning, which is nice, but for a lot of others burning is the easiest way. And then install it. And I'm going to scroll back up to the top here and show the other topics we have how-to guides for. So we have a guide that tells you actually how to get help with the VLSC. There's a lot of videos on the VLSC that you might not be able to find easily, but we have links to them here and it tells you if you need to call Microsoft to get help, exactly what to tell them so you can direct yourself, kind of orient them to who you are and that you've received a donation so they can help you more quickly. There's some more things about just maintaining your account that if you're not familiar with the program they may not be what you're looking for, but these are things that are helpful later on after you've requested some donations and you're looking, trying to find out how to do certain things. Like ordering media for instance, since all of our Microsoft products are download only, you might be wondering what if I need, I don't have a burner either and I need to get media. You can do that. And this article explains how. It's fairly simple in the VLSC and it costs a fee, but you can order media for any donation you get. There's another article about how to use or renew your software assurance benefits which is a good segue. Software assurance is a benefit that Microsoft includes with volume licensing products that are obtained through TechSoup. Other resellers have them as well but these benefits are specific to our program. The best thing about them is that they allow you to upgrade your Microsoft donations for free within the two-year period after you request them. So you can upgrade a product that you requested today to any new version of that product that's released within two years without requesting it through TechSoup without doing anything. You'll just go to the VLSC and you'll see it appear there. If it's released after that two-year period, for example, if today I request a Microsoft product and three years from now the next product comes out then you don't actually have access to it. So you'd have to request it through TechSoup again or renew your software assurance which you can do through a reseller. Sometimes just requesting another license through TechSoup is the better way because our admin fees are fairly reasonable for these donated products. There's a great article we have here that explains actually all of the Microsoft assurance benefits. Software assurance benefits include with Microsoft donations. So the free upgrades is just one of the benefits. If you scroll down on this page Software Assurance Benefits Included with Microsoft Donations, you'll see there's a table and it lists everything that's included and it's a lot. So you can get Office for Home Use for instance which allows you to pay a minimal fee and your employees can then buy a version of Office that they can use at home in addition to having it at work. There's e-learning courses which I think we'll talk about later. So training, how to use your Microsoft products, some more benefits for, you know, there's very specific benefits here like roaming use rights and thin PCs. But it's good to know and if all you need is to access Office and use Office at your organization and you don't think you need this, that's fine but there's a lot of great benefits if you just look into it.  Actually I'll use search this time. So the Windows products like any other product now doesn't have a version on it. It doesn't say Windows 7 or 8 but you should know that since I explained earlier the Title Groups document lists all of that. So I clicked back over to the Title Groups document. I'm going to scroll down and see what it says. Windows Desktop Operating Systems so that's the title group and it says Windows 8.1 Operating System Upgrade. So I know that the current version is 8.1 and I happen to know that the previous version was Windows 7 so Windows 7 is still available at the VLSC as well. But you might be asking, well this doesn't even say Pro or Enterprise which those are two versions of Windows or two editions rather which is true. So Windows is actually special in our catalog because it's the only product where it doesn't list, not only does it not list the version, it doesn't list the edition. The reason is because it's your choice, it's up to you. So the first sentence here says Windows is Microsoft Desktop Operating System. This description applies to the Enterprise Edition but you can choose to download and install the Pro or the Enterprise through the VLSC if you request this product. And like any other product you can also choose the current or the previous version, 8.1 or 7, and you can also choose 32-bit or 64-bit in any language that's available. So basically with the new way that the catalog works, everything is pretty much up to you other than you can't get a version past the previous version but anything else, 32-bit, 64-bit, languages, all that stuff you can just choose for yourself at the VLSC. That makes it easier for us not having to list all these separate products and easier for you when you're browsing just you know what you want. And it makes the title group document a lot easier to navigate because there's only two products on there. So this is the Windows Operating System Upgrade product. I think I should mention the Windows Full Operating System product because it is unique. And let me show you again how to browse to it. So I'm going to browse by donor or provider and go to Microsoft. And it's listed, let's go to Browse. It's actually listed under a separate category because it's actually a separate, technically a separate program. It's within the Microsoft Donation Program but it has its own name so it's called the Microsoft Get Genuine Windows Agreement for Small and Medium Organizations. The subcategory says Microsoft Get Genuine Windows Full PC Operating Systems. So there's an explanation here that's kind of lengthy and sort of buries the product at the bottom but you see there's only one product. And there's a lot of rules here because we wanted you to read these. And the basic explanation is that this version of Windows is only for organizations who have a computer that has one of these operating systems or one of these situations rather on the computer. So if you have a home version of Windows, so the home, if you didn't know, the home versions aren't eligible for upgrades. The starter edition, for example, if you happen to have counterfeit, pirated, or otherwise illegal or improperly licensed Windows operating system, and you know, they're not looking to arrest you here. They're just saying, this is a way to correct that situation. Or Linux, FreeDOS, basically any operating system. You can get a full operating system instead of the upgrade because that's what you need. The catch is that with the Get Genuine you don't get software assurance which means that you're not going to get the new version that comes out in two years. But it is a legal based operating system so after you get this version, the next time you need to upgrade you can come to us and request the upgrade. So you can get the Get Genuine version to have a legal base upon which to upgrade through TechSoup and still save a lot of money because you're only paying the admin fees. The other special thing about Get Genuine is that you can only request one ever which we've put in bold and italics here to emphasize that really you can only get one ever. So you can get up to 50 once and that's it. Right, so if you've got a bunch of PCs that you think will need full operating systems that are sitting in the closet collecting dust and you think you might get a few more, you want to make sure you're requesting as many as you think you might ever need or else you'll have to go out and buy those full operating systems retail. Right, and it's not something again, not something that resets every two years. Every other product you request through Microsoft, two years later you can get 50 more. So if I request 50 office standard today and use all of my allotment, that 50 licenses that's all I can get in my two year period, I can wait two years and get 50 more. With Get Genuine it doesn't matter how long you wait. You just get 50. That's just how it works. And with other Microsoft products you can also make requests anytime you want in that two year period. So maybe you need five now and you need 10 later and you need five next summer. You can do that within the two year calendar with any of the other products but with Get Genuine it is only one time ever request for each organization. So just keep that in mind. That's why we say if you predict that you may have more computers coming in, maybe you're getting donated machines from somebody in your community who's a homemade refurbisher and they don't have operating systems, if you think you're going to get more make sure you're requesting some backup licenses when you make that one Get Genuine request so that you can have full licenses to install when you need them. And at $10 each it's a very reasonable fee to get those on legal licenses that you know your organization then owns. That's a great point. This is great Carlos. Thank you so much for that. Did you have anything else you wanted to show before we move into a little bit about Office 365? I did want to quickly touch on one last thing. So we've been talking about the eligibility and the rules and it sounds confusing so is there a way that an organization can know very simply how many copies of Office have I requested so far? How many can I get? How many copies of Windows have I requested? The answer is yes. So let's do that quickly.  Then you can go to your donation request history slash status. It's on the right side under my member profile and all these links here. So I'll click that there and scroll down. It's a little hard to find but it says my Microsoft donation center. So the Microsoft donation center I'm going to click here actually explains, does exactly what I just said. My organization is a test organization so it hasn't requested anything but you'll see on this page that it says the rules at a glance. So it talks about you can request 10 title groups per 2-year cycle up to 50 licenses and it tells you exactly how many you've used and how many you have left and how many products you've requested. I actually have an example I'm going to show you since this one doesn't have any. I have this open in PowerPoint so let me full screen that. So there's an arrow here and it says exactly when your 2-year cycle begins and when it ends so you know when you can request products again. Down here with the title groups this is an example. This organization actually has requested one product so they've requested one license of Office. So that means they've used one of the 10 title groups so there's 9 more to go. Since they've only requested one license you can see they've received one here, 49 available. So that means it's in the Office Suite title group which includes Office for Mac, Office Standard, all the Office products that are listed on that title groups document. They can get 50. They can actually get 49 more at any time that they want within the 2-year period and then it resets and they can do that again. And again, so this page is a great way to track your donation request through Microsoft. It's an easier way to get to it is just type the URL I suppose. It's techsoup.org slash donation center. But again you get through managing your account going to your order history then there's a link there as well. And I think that's all for my portion. Carlos on that same page as well on the right hand side you should see like a dollar sign. And that's really reflecting the total dollar amount of the fair market value of Microsoft requests that you've received through Techsoup with your lifetime with Techsoup. So I've seen some organizations save like $130,000 fair market value for Microsoft products. It's a good resource to see how much you're actually saving through Techsoup on the Microsoft donation program. Yeah, absolutely. And here it says $5.88 on this example and that's so like you mentioned that's the full donation request history. They've only received one license during this cycle but if I clicked on full request history for them you would see the full history and that's where the $5.88 number comes from. That's great. And you know for organizations that have to track in-kind donations and in-kind gifts having that number at their hands is actually really helpful because you can count those among things that you've received a donation of for your grantors or reporting needs or on your counting. So you can show your community how much you've been getting support from different entities because our process at Techsoup is very much like receiving an in-kind donation from these donor partners. And we're simply the vessel by which they make those donations and we help confirm that the organizations that apply are actually eligible based on the rules set by those donor partners. So Microsoft can decide what types of organizations they want to have their donations distributed to if there's a budget limitation or any other criteria. They can set that and then Techsoup helps ensure with the admin fees that we collect that helps us build these really complicated systems. We call our eligibility engine to determine which organizations are eligible, which are qualified in our programs as 501c3s or public libraries, churches, what have you. We have the system set up to do that and that's why we have so many donor partners that come to us because we make it a lot easier for them to get their donations out to organizations around the world. So we're happy to play that role. And we also try to provide a lot of resources to help you navigate that because it can be complicated when you have to download things. We do have articles that cover some of the topics that Carlos mentioned around how to select the right products. Do you need the 32-bit or the 64-bit? Which version is better for you? Do you want the Pro or Enterprise? We have content that we are writing all the time. We also run events like this to help you make those kind of decisions. So we're doing our part as much as we can to try and make that available to you. So I'm going to go ahead and jump forward and talk about one exception to how Microsoft donations are delivered, and that's Office 365. And then we'll get into the actual Volume Licensing Service Center. We'll give you a peek at what it looks like live so you can have some idea of how to move forward once you've received your donations. Office 365 is the exception here where we do have a product page on our site dedicated to Office 365. It is available. It is a cloud-based product which means it's hosted in the Internet, not something that you download or install with a disk. So it's available through Microsoft directly. So the product page on our site, instead of requesting it and adding it to your cart like with other products that Carlos just showed, this one you click this Get It Now button and it actually takes you to a page on Microsoft's site. Now we still have resources down at the bottom around describing what it is, how do you get it, what's the process, what are the rules and eligibility. So we still have information there. And if I had a better screenshot of this page further down on the right side we have articles and webinars and other content to help you understand what Office 365 does. But without doing that, if you click that Get It Now link it takes you directly to Microsoft's Corporate Citizenship site where they have Office 365 free-for-non-profits information on their site to show you how to get signed up. Basically with Office 365 you select which option you want available to you. They have four options currently available for nonprofits to select from, and I'll show those in just a moment.  And once you start that free trial it pings TechSoup and we have folks on our end that confirm that yes, you are in fact eligible to receive this donation. If you're already in TechSoup's system and you're already eligible for Microsoft donations through us, it's a really easy process because we can say, oh yep, they're already eligible for donations. Go forth and live it up with Office 365. If you aren't in our system yet, we verify that you are in fact eligible to receive that donation. And then after that trial period ends, your account automatically upgrades to a full-fledged account that has no expiration that I'm aware of, and it is a full-functioning Office 365 account. And Office 365 really covers all of your Office applications that you use installed on your desktop, but it instead is hosted in the cloud. So you have access to Word and Excel and PowerPoint in the cloud. You have access to Outlook and what else is there? Link, the communications programs. So you can do instant messaging and video conferencing using their cloud. You can do file sharing and file storage in the cloud with Office 365. Now I'll show the options here because the difference in the options really comes from what you need it to do on your desktop and in the cloud. So really, it has these four different options that you can see outlined here. Some are completely free, so there's no cost to the nonprofit E1 or the nonprofit business essentials versions. Those options are entirely cloud-based, but if you need to have installed Office applications, these two that have fees associated with them $2 per user per month, it's a subscription. And I've heard people describe it as renting versus owning. So if you need to rent access to installed Office on your desktops and you want to be able to use the cloud version, then you have the option of paying $2 per user per month or $4.50 per user per month to have those installed versions through Microsoft directly. The more expensive version also includes some new additions, business intelligence, more enterprise-level software. It includes a few other things that are more robust for bigger enterprises. So that's what that $4.50 per user per month, and that's per person. So if you have 10 people in your office that would be paying $4.50 for those 10 people each month. Now through the Microsoft donation program with TechSoup, you may already be able to get that full installed Office on your desktops through our donation program. But if you need more than the limit of 50 licenses, maybe this is where renting some is worth it to get the installed version and be able to access the cloud version together. When you get those donations through our program, it's like owning. So you're owning the licenses directly through TechSoup when you pay your $32 admin fee for a Professional Plus Office, or $28 for the standard Office version. Over time that actually can be a much better deal to do the one-time owning purchase of that because it comes with software assurance and you can upgrade again. So if you get the 2013 version of Office and Microsoft releases the 2016 version within the next two years, then you can upgrade for no additional cost rather than paying $2 a month per user in perpetuity to have that access. But again, if you need more than 50 licenses, if you have temporary staff, short-term staff, volunteers that you think you'd want to have access to the installed version, this is a great option because with the cloud version and the desktop installed rented version, so to speak, with $2 per month, you can take back those accounts and reassign them to other people. So it's great if you have a lot of short-term or high turnover staff to be able to use this option. Anyway, there is a full chart on their site at this link that's very tiny up top, but we are including that in the post-event resources so you'll have access to that link as well, where you can do a full comparison. In addition to that, we have two upcoming webinars on June 11th and June 25th where we'll do a more in-depth cover of what is Office 365 and what's new with Office 365. Like I mentioned, there's now Skype for Business and some business intelligence software that's now included, Yammer, a number of features that have been added. So in addition to last year there were only two options available, now there's four. So we're going to talk about some of those differences. So I'd like to go ahead and move us into talking about what happens after you've requested donations through TechSoup, not Office 365 since this is an outlier, but what happens when you request Office Professional Plus and Windows licenses or server licenses, and you get a couple of emails, one from TechSoup and maybe a couple from Microsoft. Casey, can you talk us through what happens when you get those emails and how you go through the Volume Licensing Service Center? Casey Yeah, I definitely can. And before I begin, I just want to reiterate that you do got to make sure that your organization's email address is up to date before you place your donation request through TechSoup or else your license is going to be sent to the incorrect email address at the Volume Licensing Service Center. That being said, this is a screenshot right here of the first fulfillment email that you will receive. Now there's a couple pieces of information that are really important in here. The first one to be aware of is right here before you can access your Microsoft donation. It will explain in that section that this is not the email that you're going to be able to use to actually know when your license is accepted by Microsoft. You're going to receive another email within a few days from Microsoft directly saying that your open license has been accepted by the VLSE. And at that point you'll be able to log into the Volume Licensing Service Center and get access to your download. Now there's another section in here right below that one accepting, first-time registration at the VLSE. That really explains how you can access the Volume Licensing Service Center. And it will explain that the first step is if you haven't already done it, create an account with Microsoft using your organization's email address. And that's your business email address. And so you can log into that site and access your download. And really what that's going to look like is there's an email verification process and you're going to have to do it again to acknowledge your business email address. And then once you're able to log into the Volume Licensing Service Center you're going to be able to, granted that we've fulfilled your software and Microsoft has accepted your open license, you're going to be able to log in there and accept the terms and conditions. Let's remove this here. Right here accepting the terms and conditions. And once you've done that you'll be able to log in to your Volume Licensing Service Center account and download your product. This is where it shows you to enter your business email address and to confirm your business email address. And it will be another email verification process for that, like I said earlier. And this is the home page at the Volume Licensing Service Center. Once you're able to accept your, agree to the terms, you'll get to this home page. There's, in case you for whatever reason requested the product using the incorrect organization email address, there's a link here to add an open license to your profile. And that requires the license and authorization number, which I'll cover later on. But that's a resource for you. And really what you want to get to is downloads and keys. And I should mention, just to interrupt Casey, that we're not able to show the VLSC live because it always has real license and account information in it. So even with test accounts we can't really show it in real time. So we're showing you a series of screenshots here to show you the navigation and what's under each section today. But we can't actually walk you through the download process in its real time entirety because of those licenses. And you'll see on some of the slides that we've actually either blurred out or covered up license information that was there from screenshots because like I said, it's always there. There's not a way to fake our way through that. So just to give a note for people who may wonder why we're not showing it live on screen. Thank you Becky for addressing that. It is a security issue if we were able to reveal the licensing information for our products. So anyways, what we want to do is go to downloads and keys. Now that's over here. This is where you're going to want to download your products. And there is a filter option right over here to quickly search for it. But of course you can browse through the pages to locate the exact product. Now you are going to want to find the plain say publisher 2003 or 2010. It needs to be plain. You might see an SP1 or a key management server. You don't want to download those. Your product keys will render useless and you're going to have issues with your activation there. So make sure it's just like if you requested Office Standard 2013, make sure that you select Office Standard 2013, not Standard 2013 SP1 or anything. There is an option here to order your media. Say if you have issues downloading and for whatever reason you're technically challenged or you just really don't want to deal with downloading it and burning it to a CD, you do have the option here to order it from Microsoft. However, bear in mind that it is an additional $20 charge. So you have that option available. Now up here at the top is the download link. You can go ahead and click that and continue with your download. You can select a 32-bit or 64-bit. This is great out here because a publisher 2003 was a physical shipment and it didn't include a 64-bit at the time. But you should have the ability to select a 64-bit if you need to. And you can select your language right there as well. Now before I pass it back over to Becky, there is the product key link at the top here. After you install it, you are going to need to activate it. And your product key will be listed here. Unfortunately this product for our example doesn't have the product key because it didn't come with it. But that's where you will find your product key listed and make sure it's the product key associated with your license ID and not any other key. So I hope this helps you folks find your way around the VLSC and how to download most of your products through here. I'm going to pass it over to Becky so she can describe the Software Assurance program that's included with most of the Microsoft products that you request through TechSoup. Thanks, Casey. So Carlos mentioned Software Assurance a bit earlier and that it is a free thing that comes with nearly all of the donations in TechSoup's product catalog with Microsoft with the exception of those get genuine full operating system licenses. Almost everything else comes with Software Assurance. And interestingly, if you worked for a big company, many of them purchased Software Assurance retail when they buy software because they like these benefits so much. And it's a couple hundred dollars extra on the licenses when they purchase it. And it's totally free to you as a nonprofit or library or church foundation through this donation program because we know that the cost of upgrading and the cost of training is expensive and Microsoft has given it to you for free. And these are accessed not nearly enough I think because these are free benefits. It's a little confusing to find some of them. So you want to make sure if you're in the Volume Licensing Service Center, you're clicking on the Software Assurance tab and this lists out the different benefits available. I've highlighted just a few of them here. The home use program Carlos mentioned earlier allows you to extend the single license that you might purchase or receive as a donation. So say you have Office 2010 on your laptop at work or your desktop at work, and you do quite a bit of work from home. You would like to extend that license to your home machine. You can pay, I believe it's a $10 fee to have that license, the same license extended to your laptop at home or your computer at home. And so it's a great benefit to organizations where you may have board members who work remotely. You're still having to buy an initial license or request an initial donation of a license, but you don't have to buy a second license for that home computer. You can just extend that license to an additional computer at home. And that license does still belong to the organization. So technically if you leave the organization or if you extend it to other staff people who have the license on their home machines if they leave, technically that license and that software is supposed to be uninstalled because it does belong to the organization. But it's a great benefit while you have people working for you that may work from home or may want to have the access from home to some of these resources. So that's one option. Also highlighted here is the Office Multilingual Package, or Multi-Language Pack. If you serve communities, if you run public computing centers where you have populations serving Spanish speakers, or Vietnamese speakers, or whatever language it is, you can access Office in those languages. And so again it comes with it already. If you need access to different languages you can get the Korean package. You can get the Vietnamese or the Chinese or the Spanish or the Portuguese options if you have audiences that you serve, or if you have staff that you want to accommodate that speak non-Native English and they can access that here. I'm going to go ahead and dive into the e-learning a little bit more in-depth. There are some other options and benefits here too. Some of them are a little bit more technical, but there are e-learning applications and there's also training vouchers. And so if you're looking to increase your organizational skill and capacity on any of the options of software that you've requested, you can click on that e-learning for applications or training vouchers, and you can activate that benefit. So right now we're looking at the benefit of e-learning applications. You can see in this little drop-down box here, and it shows, okay, we have licenses that qualify for that. Let me go ahead and move forward into the benefit. It shows me again, okay, with that license and with that donation that I received that these are the benefits that are available that come with it. So I can do e-learning for the applications or server-based learning. It shows me how many users are eligible for that training with that license. So a little bit of detail there then you can click into those and you can choose to activate it. Filling out a quick form that just confirms that you are in fact eligible and you're the contact who's activating it within that organization. And then you can search the Training Benefit Catalog. It's huge and robust. You can search for end-user training or administrator training. So if you have different levels of expertise within the organization and you want to increase your knowledge on a specific piece of software, you can look for e-training. You can also look for real workshops which those training vouchers would be used for. Some of our programs come with training voucher options for real-world training. Some of them do not, but nearly all of them come with some type of e-learning option. So these would be online courses. You take at your convenience that you play. You can start and stop them whenever you want. But these are great options to check out. And you can narrow these fields by a variety of different ways. You can narrow by language. And you can search for specific products as well. So for example, this first option is an end-user training on Microsoft Office 2013. It describes what it covers in the course collection, all of the different programs that are listed out. It shows you how many units this is. So this is a 21-hour set of coursework. You can choose to watch 20 minutes of it or 20 hours of it. So it's really up to you and it shows what language this one is available in and if it's also available in other languages. So certainly a really great benefit if you have like I said a public computing lab or run a library where you may want to run workshops or trainings on some of this software for your own community, you've got all of these languages from which to select. So that's just a little bit on the eLearning benefits that come with your software assurance. And again, software assurance comes with all of the Microsoft donations that are available in TechSoup's catalog with just those couple of exceptions with the Get Genuine program. So it's a great benefit to really dig into what you can get to the fullest extent of those donations to really use that benefit as much as you're able. So we had just a couple of other slides here on the VLSC that were primarily about help and contact. So Casey, do you want to show us those last couple?  Definitely. The subscriptions tab here, most organizations won't need to use this especially requesting things from TechSoup. There are a few that may need to go through here. One thing to know is the Microsoft donation network here MSDN. Like I said, I'm just going to briefly let you know that this is here, but most organizations don't need to worry about this tab. The next tab here is the administration tab. And this allows you to manage your account. Like the link I showed you on the home tab, that was right here. There's also you can add an open license or manage your users right on the drop-down menu. And like I said before, in order to add an open license that you requested your products using the wrong business email address, organization email address, then you are going to be required to add an open license. After TechSoup is able to fulfill your request, you can contact us using our, go through our Contact Us page on TechSoup and retrieve that licensing information. Granted, you're authorized agent and we were able to fulfill this request and Microsoft has accepted your open license. We'll provide you with these numbers. So it's not the end of the world if you forgot to update your, or didn't know how to update your organization's email address or know that you had to, but you do have options if that happens. So really the last thing here is if you do need help, additional assistance with the Volume Licensing Service Center, whether it's logging in, accessing your download, finding your product key, adding an open license or something like that. There are links here that allow you to find out more information regarding those. But you can also, there is a Training Resources right here. It's also included on the drop-down. If you click on Help, there's a drop-down menu and there's Training Resources. And on that page it describes, there's a tab there that gives you how-to videos. It gives you videos to help you walk you through the VLSC. And I suggest looking at through those before contacting the VLSC. But if you do contact the VLSC, you can click the Contact Us button and you will be brought to this page. And there is a toll-free number. I do have some additional tips if you do need to call them. What you want to do is call that 866 number and select Option 3 and then Option 1 to navigate that Automated Voice Message System. And when you get someone on the line, a Microsoft representative, you do need to tell them that you have an open license agreement in regards to a Microsoft donation. So they know that you got a donated product so it helps them know where you got this product from and they'll provide you with some support. And I believe Becky, you're going to provide after the call resource to let them know exactly what they need to say as well. And I believe our website as well indicates that too. So I'll leave it to Becky to wrap our webinar up here today. And thank you for having me here. Thank you. Becky Thank you so much for that Casey. I really appreciate it. And we do advise people to seek help when they need it. And if you run into any stumbling blocks, you can contact the VLSC. You can also contact TechSoup and we can advise you on how to best get what you need whether that's talking to somebody at the VLSC or repeating some of the call-in info that Casey just shared. We want to make sure that you can get the help that you need. Additionally, we have some resources that I've linked here in the slides that will be included in the archive page and that you can access and click on at any time. Just the high-level overview that takes you right to that Microsoft software donation program page. The blog post that Carlos referenced earlier on how our catalog has been simplified that answers a lot of questions about how to browse, how to select, and what options are available to you. Information about the eligibility and allotments, so reminders about how many of each type of product you can request and in what timeframe. That VLSC quick start guide that Carlos showed that has all of the articles that we've created on how to use the VLSC and the steps for going through it. An article specifically about software assurance benefits that we just mentioned a few of. We have a link directly to Office 365 for nonprofits for those of you who are interested in moving your office to the cloud and a link to the Get Genuine Operating Systems which are those full operating systems that we showed you. The Volume Licensing Service Center link to take you right there if you're ready to get started and you know that you've got some donations waiting to be downloaded. Instructions for using your eLearning benefit and that course listing guide where you can search for the different courses available to you. I've also included some links to our most popular featured Microsoft products so a link to those Office suites that we know are among our most popular and most frequently requested products. The Windows Upgrades, Windows Server Software and Licenses, Office 365, and Get Genuine again. I'd invite you to join us for upcoming events. We have next week what is Office 365? So if you're interested in learning more about that, please join us. And then on the 17th we'll be talking about how libraries can use digital advocacy to get their message out online. Feel free to join us for any of those. Connect with us online at TechSoupGlobal.org, TechSoup.org on our Facebook and on our Twitter. Thank you so much to both Casey and Carlos for their support and help today. We hope that you've gotten your questions answered about the Microsoft donation program and you'll be able to access more of those in the future. Lastly I'd like to thank ReadyTalk, our webinar sponsor who's provided the use of their platform for us to present these webinars to you on a weekly basis. Please join us. And if you're interested in learning more about ReadyTalk, you can do so at TechSoup.org slash ReadyTalk. We hope you'll join us again soon. Thank you so much everyone. Have a great day. Bye-bye.