Let's just get started, here's the agenda. This is mostly an introduction to vector databases. How many of you have already used a vector database? Great, that's exactly what I expected. Those two that had used them, you can check your email.  Oh, she's in trouble. Okay, good. All right, next is how are they different from a relational database? Because that's what most of us are familiar with. Where do you use them? So what are the use cases and what does that mean for you?  All right, so this is how we were, I don't know, say about a year, a year and a half ago. I'm also showing my age. How many people recognize this episode? Yeah, so if you haven't, this is a classic, this is the Trouble with Tribbles on the original Star Trek, and you need to watch it. Because we started like this with vector databases, and lately it seems like there's a new vector database or vector capability coming out every single day. Everybody, you get a vector database, you get a vector database. So everybody's got vector databases now, and I want to kind of get you level set with what they are. So what is a vector database? A data store that works with vectors. I'm done. No, so let's talk about what vectors are. And you will also sometimes hear these called embeddings. And I'll tell you why they're embeddings in a bit. So the whole thing here is we're turning things into numbers. This is, vector databases primarily work with unstructured data. You can do it with some structured data, but the main use case right now is unstructured data. These are challenging for computers. And the reason is computers can do numbers really easily. Is two less than three? Yes. Is this kitty less than that other kitty? The computer can't say anything, right? Because it doesn't know. But what it can say is exact, but other than exact, is this image the exact same image? It's very hard for a computer to make a decision about that, right? Because it's not a native data type that it can work with. So unstructured data here can be pictures. It's long bodies of text, not single lines of text. Audio files, basically anything long and unstructured. Or big and unstructured. So neural networks to the rescue. Everybody knows what a neural network kind of is? It's the way you take data and you do stuff with it and then stuff gets spit out the other side. It's like a regression model, except this one's more about prediction, usually. So what happens here is you take your kitty picture, you feed it through the neural network, and these neural networks are optimized to find semantic meaning within whatever you fill inside of them. Like when you hear, I forget how many parameters are in OpenAI, like nine billion parameters in the OpenAI models or something like that. Does everybody remember regression? Yeah? No? Yes? Okay, so remember you had like three things and that was like three parameters, right? This has nine billion of those. So basically this is a very, very advanced curve fitting algorithm. It's basically dividing up the space as best it can, using nine billion parameters to make that space. And then what comes out of the other end is your vector, right? And this vector is a vector representation of that kitty, right, and there's the length of the vector. We probably fed in, that image is not that big, but still big, but we could end up with like only a 512 length vector, which means there's only 512 numbers to describe that kitty picture. Get the most information out of it. New cats were harmed, just letting you know. I'm gonna go into a little bit on the pre-step now. How many of you have heard of tokens and context length, right? And we're like, what is that? So these are important for the API costs and also for context length. So API cost is, when you submit something to OpenAI, they charge you per the number of tokens you can put in. And context length is, the amount of text you can fit into the token determines how much context it can have for the words around it. The longer the length, the more words it can put together to make more longer meaning. This is tokens, right? So this is from the OpenAI site. I put in data on Kubernetes. People love Transformers. And the color below is showing you how it broke that into tokens. So if you submitted that to OpenAI, it's gonna charge you six tokens for that. Make sense? And then when they talk about context length, they're talking about length of tokens. Everybody good now on tokens? If you weren't, okay. The next thing is embedding. So that vector that came out. There are more and more embedding models that are available to use. You'll see press releases. I think the latest with Gina, with like an 8K vector embedding or something like that. It was another one of the big ones. These are the models you hear everybody talking about that are super important. The ones we care about today are neural networks that have been pre-trained on large data sets. So the model, by default, doesn't have any weights on those parameters. But the ones that everybody's are so excited about that they've been trained on large corpus of text or lots of images. They've already calculated all the weights. So if you feed in the picture of the kitty, it's gonna say, oh, that's a cat. Because it's been trained on tons of cats. So you actually really, most of you, really care about the one that's already been pre-trained. Remember that. There are several things to consider when you're picking an embedding model. One is the appropriateness for the task. I'm not gonna go into these, because remember speedy, but remember to come back and think about this. The size of the input, so what is the size of the image? That would actually be preset by that model. So for example, the clip model only takes like a 27 by 27 pixel image or a 112 by 112 pixel image. You have to scale everything to that size to fit it in. The length of the output vector, even within one model, there could be multiple output vectors, because that influences accuracy. But on the other hand, it also influences speed of computation. The shorter the output vector, the faster it can compute it. That's why you can actually do ultra-small models that you can actually run on your phone. And this is the place I just wanna show. This is like the GitHub of the AIML community. It's called Hugging Face. And these are all models here. The ones that we are primarily interested in are probably, oh yeah, this is the new one that just came out. These are the models that are feature extraction. We're extracting features out of the data. Some of these other ones that I showed, like visual question and answering, those actually might just give you the answer. They won't give you the vector embedding. Those are models that'll say, oh, you put in this text, I'm gonna give you the text out. We don't want those if you're gonna use a vector database. We want the ones that give us a vector. Make sense? Yeah, okay. When perfectly clear, nobody has any questions. Great. In case you couldn't tell, I'm a really informal speaker. So if you have any questions, please raise your hand and ask, because if you don't understand it, it means somebody in the audience also doesn't understand. And I want everybody to be along on the journey. So let's go back to the talk. So now that we have our embeddings, what do we do with them? We put them into vector space. So that 512 length vector is a 512, the 512, what do we call it? D space. 512 dimensional space, right? And so what you do is you take that vector and you plot it in 512 dimensional space. And then you take the next picture of the kitty and you plot it in the 512 dimensional space. And what's happening, imagine with your mind's eye, you're looking at a 512 dimensional space, right? But we're looking at two. So what will happen is the kitties will end up next to the kitties in that vector space, if the model did it right, and the dogs will end up far away, right? So similar things should cluster together in space. Does that make sense? Right, yeah. So the question was, do they cluster along all dimensions or do they cluster along certain dimensions? We don't know, because I can't think of a 512 dimensional space in my head. The idea, though, is when you plot those 512 coordinates, if you take this and put it into 512 space, the pictures will be close to each other, just like points on a map, okay? So similar things should end together, yeah. So if you think about your clustering problems, that is definitely one of the use cases for vectors, which is like, does everybody know what K and N is? K nearest neighbors, it's a nearest neighbor's clustering algorithm. And so when I first came to this space, I was like, oh, I've been doing all this, and this is principal components. I basically take a thing and I turn it into a vector, but it's more complicated. There's a fancy model doing all of that, and it scales way better, okay? Any other questions? Okay, so now we've got our things plotted in space, that you say, great, I've got a database, you put these into the database, and you're like, okay, great, now what do I do? How do I work with this stuff? I've got a database full of vectors. So here, we're gonna ask the database to show us similar pictures, right? All the vectors have been put in, so a new cat. So the first step you have to do is you have to take your new cat and turn it into a 512 dimensional vector space, right? It has to, you have to take that image using this exact same model and put it into the exact same coordinate system. Does that make sense why? Right, yeah, because otherwise you can't compare them. So you make that vector, then you take that vector and you send it to the vector database. And you say, hey, find me things that are close by in space. So the new picture is the green dot, can everybody see the green dot? And so that's gonna say, okay, great, I know things that are close, I'm gonna return them to you in distance order. So what ends up happening is the kitty that's closest comes first, the next cat, and then the dog, because the dog is really far away. So typically when you query a vector database, you use limit statements a lot, right? Because it can actually return the distance for everything, but by default, it's usually limited to something like 20 or 15 or 10.  Does that make sense how the query works? Okay, and this is why small models matter a lot. If you're vectorizing something on your phone, it doesn't have as much resource computation as a supercomputer, so you're gonna want a small model on your phone and a small model using for the vectors in your database so that you can compare them. Yeah, can someone repeat the question because I couldn't hear? What a great question! Oh, the question was how is the data stored in the database so that it can be an index so that it can be queried efficiently? Great question! Let's talk about HNSW, which stands for Hierarchical Navigable Small World. Say that 10 times fast. This is the predominant algorithm used, or indices used in most vector databases. We're gonna start at the top, right? So imagine our 512 dimensional space, but here we're just gonna have two, right? And I put in that gray dot. What the index does to start with is it draws the random dot all the way, let me see if I can get the mouse moving. It'll start here. It makes a very sparse node network to start with. It's all nodes in a graph. And the first step is it starts with a very sparse network. It's got the network all built, who's next to who, that's the index, right? The index is like, who's next to who, what's the relational graph? The first question it says is, okay, I'm gonna start at some random place in that coordinate space, and in a very sparse representation of that network and find the one that's closest to my query point. Does that make sense? It's basically starting making that decision very quickly. It's trying, what it's trying to do is find the answer space very quickly, because if it walked the whole graph to try to get to the answer space, it would take forever. So it starts with that big one and then you see, so this is the one that's closest to it, of the two that were in the sparse space, then it goes down to the next level. And then the next level, the network is denser, right? And so what it does here is it does that same thing again. It says in this dense space, what is my closest neighbor to that query space, to that query point? Make sense? Okay, and then when it gets down to the final level, it says, oh, here's the neighbors, rank them, send them back. So there's way more than three levels, just to let you know, but that's the general algorithm it uses to find where it should end up. It basically walks the sparse graph until it gets very close and then picks the ones, when it can't, actually, I know what it says. It says, I can't find anything closer, and then it stops. Yeah, it's its own thing. But I mean, I think Neo4j has added vectors. I don't know how they're implementing under the hoods, but there is that graph, connectivity graph. And it's way more complicated than this. This is just to give you an idea, because you can actually filter this graph using attributes, metadata.  Yeah? What to jump to? The question was, in a 512 dimensional space, does it have to walk through all 512 dimensions to get there? No, there's no correspondence between the number of layers and the number of coordinates. Okay? Yes, question. It's clustering at different layers of granularity. Is that right? So the layers are generated on the fly. Does that make sense? It starts one place, because you have to start in a new place every single time and then start walking the graph. Because you don't know where that, it's this huge space, and there's a point that I'm giving you, and I'm saying, okay, find the ones that are closest. You can kind of think it like, does people know like, what's descent? Gradient descent? Everybody heard of gradient descent or hill finding or any of that stuff? Kind of simulated and kneeling? It's somewhat similar to that idea. The idea is, start somewhere random, use some sort of algorithm to find things that keep flowing closer and closer to the point that you want to end up in. But this way it doesn't, like sparse network, less sparse, less sparse, less sparse. It just keeps walking, but it doesn't want to search that whole space. The other thing is, when it gets down to this dense network, it doesn't have to pull down all the dense network. It's already walked itself into a much smaller space that it has to pull back. Because if you said I only want 10 back, maybe it pulls 100 next to that last one and says, okay, which is the most dense? Any other questions? No fair. He said he's written a ton of blog posts, just heads up, he's written a ton of blog posts on vector databases and they're his favorite thing. Heads up if he gives me a question I can't answer. No, you are amazing and the way you are explaining it, it's fantastic. The question I have is, why is the top layer sparse and the next layer more dense?  So the reason it starts sparse is because we want to move quick, right? If we had a very dense network at the top, we'd have to keep walking, walking, walking, walking, walking, walking. So you start really sparse to get you in the neighborhood. And then once you're in that name, you can think of it like a plane flight, right? Like, oh, I want to go to, what's the city in Europe? I want to go to Stuttgart, right? Well, the first thing I'm going to have to do is pick the airport that I want to go to. So that's the, you can think of that as the course network. I'm flying to Stuttgart, got that part. Okay, now that I'm in Stuttgart, I need to find which part of Stuttgart my hotel is in. So then that gets you down to the next network. Then I have to find actually where on the street my hotel is. And so it's this kind of getting finer and finer coordinates as you get closer and closer to the thing you want. We good? Wait, hold on, let me check timing. Oh, I got seven and a half minutes. One question. So these layers, are they also corresponding to the layers of the neural network that gave us the vector? No, these layers have no correspondence to the neural network. These layers are just in coordinate space, okay? So you basically take your entire graph and you sample it for the sparse graph. Good? And this is one of the things that this is, is an approximate nearest neighbor model. So the guy who before was asking about k nearest neighbors, this is not k nearest neighbors. This is not exact, it's approximate. So doing the query twice, you might end up with, you should hopefully end up with the exact same answer, but there's no guarantee that you will. Because we're getting the approximate answer. You can tell the database is usually I want the exact answer, but be ready to wait. Because it has to do a lot more work. And in most cases, approximately the right nearest neighbor is the answer you wanted anyway, okay? There's other techniques to do this, but I only know HNSW. So what are they good for? This is meaning vector databases. They're good for questions around similarity, right? Usually when we think of relational databases, we think of date equals this, age and this range. These are very exact queries where we can calculate exact things. That is not a good use case for a vector database. Vector databases are like, what's similar? And it actually turns out there's a lot of questions that revolve around similarity. This is what I just said. It's specialized for a particular use case, right? I see some people talking about, oh, should I put all my data in the vector database? No. This is when you want to do similarity type search, this is when you can compute vectors and you use them, right? They supplement your data infrastructure. They provide memory for your AI models. So when you do make those big models and they have the vectors in them and you're gonna do a similarity search, if you don't have a vector database, you have to keep that model running at all time and it has to store all the points in memory, right? Because it needs to be able to make that query or it has to recompute them every single time you make a query. But if you don't have a vector database, that's all gonna have to be in memory with that model somewhere and you're gonna, so for you to be able to search it. And it's way cheaper to put them on disk or in RAM for the database, though. So they reduce your cost for running your AI infrastructure, right? This is my favorite part. So, I got this one from my therapist. I'm a divorced man and one of the things I learned from her, which I think you should use, this is, forget the rest of everything else I told you. If you just remember this one thing, this is the important thing to remember. Clear boundaries, infinite possibilities, right? So if you look at where most fighting happens in an organization between you and your partner, between you and your kids, it's who thinks they own the thing you're arguing about and who's responsible for it. And if you set it up clearly, then it's not a concern of the other, I mean they can say stuff, but you can say, that's great, you said that, but this is what we're doing because it's my concern and I get to do it. And this is where vector databases shine because how many of you are application developers? Yeah, and how many of you want to learn all that neural networking stuff versus just asking a similarity search? A couple, right? But most don't want to get that, that's probably because they're looking for a new job. But the most don't actually want to go that deep into neural network models. They just like, I want a better search. And data scientists, how many of you want your app developers building those models and creating those vectors? None, because that's bad news, right? That's how things go wrong. And so the idea is the data science team or whatever you want to call that in that whole, the very first talk where we saw that whole architecture and feeding of data and going into places, one of those was outputs to places. One of those outputs defined by the data team should be the vectors going into the vector database. And they control everything before it gets put into the vector database and they or the data team decides on the indexing. And then the developer doesn't have to care how they were made, how they were created, all they have to learn is the API to the vector database and make their queries and get the results. So it's a neutral ground where they don't have to argue about how they're gonna implement stuff. Because the data science team can say, this is the model we used, use that in your runtime to make the embedding database. Or we'll give you an API to do it on this end. So clear boundaries, infinite possibilities. Everybody got it? Good. Example use cases, search. Search is similarity, right? Find me things like this. Clustering, like we talked about before, find other things in this area. Recommendations, right? Because you can feed in a recommendation as a vector and get other recommendations back. Anomaly detection, right? If it's not close enough, you can say this is an anomaly. This is a common use case actually. Diversity measurement, how much, how spread apart is everything? Classification, this is very common with images. What's in this image, right? And those are some of the use cases. How many of you have heard or seen all this talk about retrieval augmented generation, RAG? Anybody seen anything about it? Okay, well if you start reading this literature, you'll see stuff about it. It's the new hotness. It's even hotter than vector databases. Then the idea is you have some sort of generative text model. That's like OpenAI's text model, any of those other ones.  And lie, probably. So OpenAI, the other assumption is OpenAI, well we use OpenAI in this case, has trained their generative model on a large amount of data. So it's very broad, right? It's the internet, so it's pretty broad, even though some of this stuff was copyrighted. And then you have those vectors, you have vectors, your own vectors for your documentation in your database. And so what you're trying to build here is a better answer to people asking questions about your documentation. So OpenAI is not gonna give a really great answer because it has the whole space, right? It was trained on something different and your documentation has much better much better information and vectors, but you don't wanna retrain an entire model. So what you do is the user gives you the query, you turn that into an embedding, like we said, same thing as before, search your documentation with this embedding. So find your documentation for the things that are closest to the user's query, get back however many closest documents you want, add those documents as context, augmentation to the original query. So if I said, let's say a VM, what is a VM? I'm at VMware, right? Our documentation has a lot more than the entire internet. You would pull back and it would say, what is a VM? Here's some information for context, blah, blah, blah, blah, from our documentation and then put that to OpenAI. You put the context back in the original query. What this helps you avoid is fine-tuning, right? Because what other people will do sometimes is they'll say, I'll take the OpenAI model and I'm gonna fine-tune it with our stuff. With this, you don't have to do that as much. It's just like this competing space. Remember this, fine-tuning versus retrieval augmented generation. Too many acronyms. Any questions? Just let this one flow over you. I'll give you the URL for the slides at the end, but next time you see RAG, you'll be like, oh, I know what that is. I know where I can go look that up. There are two types of architectures, really. For vector databases, right now we're seeing add-ons to existing databases. And in this case, it's usually a new data type with new indices and functions. Or their single purpose. There's quite a few in this space as well. They're not transactional. Those new ones are not transactional. They're built under the base, the whole consensus, eventually consistent horizontal scaling, right? The systems tend towards scaling as the same as their base system, right? So single purpose are built to go horizontal and some existing databases are built to go vertical, so that's the way you're gonna scale them, even in your Kubernetes architecture. It might be easier for some of us with the single purpose that knows how to horizontally scale because you can just spin up another pod and it'll know how to automatically put itself into the cluster. So what this means for you, we're almost done. They tend to be horizontally sharded or distributed, so plan accordingly. It's much easier to add, like when you're running out of memory for your index, add another instance and it'll take some of the memory and put it on that instance. There's a lot, and I mean a lot, walking that graph and pulling back the data because they're all over the place. There's a lot of random reads. So IOPS is crucial here. You are not doing network attached storage. This is like, if you get an instance in some ways, NVMe locally and then make sure you've got it high availability so that if one of them dies, you can replicate it somewhere else. But this is definitely where you wanna use NVMe at least SSD. The indices are big and you want them in RAM because you want them to walk that graph as fast as possible. So if I haven't said it before, you need fast disks and lots of RAM. What's new for a database? But this case, it's really, really sensitive.  Most of the databases do not create the embeddings for you. You have some sort of pipeline that pipes the embeddings in. There's a bunch of libraries like Lamaindex and LangChain that make it easier for you to create embeddings if you don't know as much. Take a look at them. And contrary though, nice squeak, going through puberty again, they reduce overall data stored in the database because actually this is a compression technique. Turning something into a vector is actually a compression technique, right? Because I took that whole image and I just made it into 512 floating byte numbers. So that's a lot, much smaller in terms of it. So the data actually stored on disk for those things is actually less than the original. And given the new bigger AIML push, they are definitely going to be part of your data infrastructure. There's no avoiding this. So my talk here was a hopefully, like when I go to read the document, when I go to read about this or start to learn more, I was trying to give you some grounding in space about, whoa, that's what that means and this is what's happening here and now I get that. So sum it up, in A-M-I-A-L, vectors refers to generated numerical representations of unstructured data. The vector encodes meaning into a multi-dimensional space. Vector databases allow you to store and query vectors. They handle questions related to similarity. They're usually distributed. Hang on, it should be an interesting ride. Thanks and enjoy the vectors. So that is the URL for the talk. Any more questions now? I don't know if we have time. How much time do we have? How we do it? We're going into a break. You guys don't need a break. OK, any questions? Or you can come talk to me afterwards. Yeah, question? The vector databases, when we query them, we'll return a set of nearest vectors, right? So let's say we query with some picture of CAD. It will convert it into a vector, query it, and the output is like 10 vectors. How do we go back from that vector space to the actual CAD picture? Do we store references? So the question is, how do you get from your, once you've done that query, right, like we got that vector back that was the cats that was close to the other cats and the dog that was far away, right? We didn't get back the actual pictures. We just got back the ranks and the orders. You have to put something in the metadata that links the two together, like a foreign key kind of idea. Like so usually, if I'm doing stuff with images, I'll put a URL to the image in the metadata. I won't index on it because I'm not going to search on it, but I'll return it and then pull it. So for most of the vector databases I've seen, so if you use something like PG vector in something like Green Plum or Postgres, then you're going to actually probably have really nice structured data, and you're using the vectors as an augmentation to your structured data. In something like the new ones, what you'll probably do, they usually take unstructured JSON as the metadata, and then the vector is attached to that, right? That's usually called the payload and the vector. And the payload is the metadata, and it's usually unstructured JSON and have at it. Yeah, can you use it to do it? Yeah, thanks. Yeah, you're welcome. Can you go back to the previous two slides where you said store embeddings in memory? So indices are big and should be in RAM. How big do these indexes get? And how much memory are we? You know what I'm going to say to that. It depends. Exactly, right? So this is another part where I talked about vector length, right? It depends on how many you have, and it depends on vector length. The larger the vectors, the bigger the index, right? So that's why if you can get away with a 512 one and it's accurate enough, you're going to pick that rather than a 4K one, right? If it's good enough, like you have. So there's always a period of experimentation when you're using these. Just find out if it's good enough. Again, what did I say neural networks were? They're a fancy regression model. Do regression models make mistakes? Yes, by their very nature, any statistical model will make mistakes. So you're not going to get 100% accuracy with this.  So no clear answer about it's just a lot. From what I've seen, it's a lot. I think I saw like what did I see? Like a million open AI, normally open AI embeddings with something like six gigs of RAM to start with just for the index. So I guess if you start getting into billions or lots of databases going on, it starts adding up quickly. Any other questions? I think we're out of time. I want you guys to get up and get drinks and stuff. Thanks, everyone. It was fun.


So, heat night it is then, here we go. And again, a very nervy start for the man on the inside. Max Frick has got there. Watch out for Madsen. Oh, Madsen gets so much drive-in white and round the outside. Jason Doyle, what a move from the 2017 World Champion. Madsen now comes back on the inside. Great move from Leon Madsen. Max Frick is third, and the man in the back is Jakob Toshel. The water race here! Brilliant stuff from Doyle to repay the compliment. Madsen once again, stunning round the inside. Got so much speed.  This is unreal. Jason Doyle has just pulled off a fantastic ride. Second place, Madsen. Max Frick third. That was another great race, and well done. Doyle and Madsen putting on a super show up front. Well, he worked overtime there, Jason Doyle. He had to have all his strength there, his upper body strength there, because a couple of times on the outside, he didn't turn to the bike, lifted quite violently. Madsen's bike is so rapid once again, running hard in second place. But Doyle needed that big win for him. Tremendous win for Jason Doyle transforms his evening. He's on four points from three rides now. Leon Madsen on seven, though, and when you bear in mind his injuries of eight days ago, that's brilliant. He pulled out of the European Championship last Saturday, round three or four, and is a defending champion, of course. But what about this fella? Great ride, Jason Doyle. Yeah, he was searching for it. Leon Madsen initially made a poor start, but he utilised the inside line brilliantly and came charging into second place. Doyle on the outside, but this move again here on the inside, coming out of turn four. Look at Madsen's bike, just driving forward. Incredible speed he generates there, but Doyle. Wow, what an effort from him. Sticks it around on the outside, a couple of times on the outside in turns too. Certainly the bike really dug in, and he had to work very hard indeed. Madsen's bike was way quicker, but that man just wanted it a little bit more.


Because our talk is about to begin. It will be domain name system, the hierarchical decentralized naming system used since 30 years.  Please give him a warm round of applause to welcome him. Thank you. As Karen was mentioning, I'm Hannes, and I will talk about the domain name system. This is part of the foundations track at this conference, so if you already know a lot of details about DNS, I don't expect you to learn anything new. And if you don't know anything about DNS, I hope to explain it to you. So what is DNS all about? Well, its purpose is to resolve human-readable and human-memorizable host names to IP addresses. That is the only purpose of DNS. So it's basically very similar to a phone book. You may know it from the old days. It's a piece of paper or a real book where you can look up a human name and find their phone number in a specific city. But DNS is actually not as static as a phone book, but it's de-centrally managed. So we can push updates much more frequently. And we have a de-central and hierarchical delegation system so that people who own a domain name, they can update their records. And DNS is used in a lot of applications and all around the Internet. So there's a command-line utility called host on Linux and other Unix operating systems. And if you type in host of events.ccc.de, which is the main website and so on, you get a reply from this program. And this program uses DNS, so the protocol I'm talking here about in the background, and requests a record for it. Obviously, a host then can also fail if the name doesn't exist at all. But here, host of events.ccc.de returns an IP address, which is 195, 54164.66. What is DNS as well? Well, DNS is specified by the IETF, which is the Internet Engineering Task Force as a collection of RFCs. It started in November 1987, so more than 30 years ago, with RFC 1034 and 1035, which specified the basics of the fundamental protocol on how to resolve host names into IP addresses. And DNS has evolved over the time, as you might be able to see here. And DNS is nowadays maybe 20, 30, or 40 different RFCs. So it's a quite complex protocol, but the same basics and the same fundamentals are still used. And since DNS is used since 30 years, I expected to be used for another 50 years or so. So I believe that we won't outlive DNS so that DNS will be around when I die. That's why I care about DNS. DNS, in other terms, is a distributed key value store, which has been standardized and specified 30 years ago. It uses a hierarchical name system, and it uses delegations to get some decentralization aspect in there. It has built in redundancy and built in caching into the protocol itself. So let's look how the names look in DNS. So we saw, as a first example, events.ccc.de. And the name system, as I mentioned, is hierarchical. So it is a tree-like structure. We have the root at the top. The root is empty here. And then below the root, we have, for example, the top-level domain DE and the top-level domain ORC and other top-level domains. Then below the DE, we have also some second-level domains like ccc and various others here. And then below ccc, we have, for example, the events name. So it's a tree-like data structure. Each domain name, so a domain name is events.ccc.de consists of a sequence of labels which are separated by the dot character. So if you actually type events.ccc.de, the DNS protocol itself knows it is the top-level domain name is DE. Then you have the second-level domain name, which is ccc.de. And the third-level domain name is events.ccc.de. Each label now may contain only alphanumeric characters, which is a to z, lower and uppercase and zero to nine. And dashes, but dashes may not be the first character. The label length may be only between one and 63 characters. And the textual representation, so the representation using the dot format, which is events.ccc.de, for example, has a maximum length of 253 characters. Domain names are case-insensitive. So in any case, in whichever case you ask a name, DNS server for, you will always get the same answer. The data format, the data format on the wire is in respect to some requests. So your client or your resolver asks request to some service. And the request is a triple of a name, which we just saw, then a record type and a class. The reply contains the very same information, so a name, a type, and a class. But additionally, it includes a time to live, a length, and a data field. And the data field is interpreted differently depending on the type. The time to live field specifies an amount of seconds for how long this resource record may be cached. So we have built-in caching and cache timeout. What are potential types or resource record types? There's one which is the address record, which we just saw. It's also called a record. Then we have other types like name server record, which is also named NS, and start of authority, which is ZoA. The classes which we saw up here, so it's a triple where we now discuss the name and the type. And the class is usually used Internet. That is basically the only one used in today's networks. But there are others as well as DNS was developed back then. There's also a chaos net, which is not really used these days. How does a DNS packet look like? So we have a request. A request is this triple, and the reply is set or a list of these triples together with a time to live and some data. A DNS packet has a header of 12 bytes. But the first two bytes are some transaction ID, so some identifier, which is just echoed from the client to the server. Then we have the next 16 bits which contain flex, the operation code, and the return code. And then we have four fields, which are each two bytes in length, and they contain the amount of questions, answers, the amount of authorities, and the amount of additionals. And then after this 12 byte header, we have arbitrary length of these things. So an arbitrary number of questions, well, a number of questions as specified in the question count, then answers, then authority, and then additionals. Each of the questions, as mentioned earlier, is this triple, and all the other fields are this whole structure. So how does, we have seen the host command. Now there's a different command called dick, which is used for debugging and for looking into DNS packets. If I type into my laptop, dick of the record type A, so I want to resolve the host name events.ccc.de with an A record, so I want to get the address record off of that. And I'm asking now, not my default resolver, but the specific name server, which is this ns.cccv.de, which is an authoritative name server for that domain. I get back as a textual representation here.  And I get here as an answer back. First I get the question repeated, so I get events.ccc.de. Then I'm in the class internet, and then I'm using the resource record type A, so I'm interested in address records. I also get an answer, which is events.ccc.de. The time to live is 600, which is five minutes. Then also the class is in the record type as A. And then the actual content, the actual data is now the IP address. We've seen it earlier. Then I get some additional information in the authority section. I get which name servers are responsible for this domain. So for events.ccc.de, I also get time to lives. And then name server entries. One is ns.cccv.de, and the other one is ns.ccc.de. And then I get some additional information, namely that ns.cccv.de has also an IP address down here. So how does this whole delegation, we have now seen names and the query. How does the delegation system work together? Well, first of all, you need to set up your name service for the specific domain or subdomain. So you need to insert into your name server some name server records and some start of authority record. And then for the subdomain you want to serve, you need to insert into the super domain. So into, for example, ccc.de, you need to include the delegation that now my name servers are responsible for this subdomain. What is this start of authority resource record type? Well, it consists. So if you, you can also use dig to request other resource record types. For example, the start of authority as done here. And then you get as an answer, and I only copied the answer section here. You get events.ccc.de, then a time to live again, and then you get the start of authority record. That one contains first of all, which name server this information originated from. Then an email address where the first ad is replaced by a dot character, which is the responsible email address for that zone. Then a serial number, which is here pretty high. And then some timers when you should refresh things in the zone and what is the minimum time to live in that zone. Then if you ask for the name servers of events.ccc.de, we just saw that as a part of the authority section. But if you specifically ask for the name server records, you get those two names of the records back. And you get as in the digital section again an IP address. DNS works that you have now a service and servers have some delegation and the root of the system is part of the root service. So they are organized or deployed by IANA and every client has information about which are the root name service whom you can ask to do resolutions. So how does a resolver work? So on the other side we have a resolver and there are two kinds of resolvers. One is an iterative one and forwarding one and I will go into detail of an iterative resolver. So my unique system, my laptop, for example, asks by using the get host by name API, asks for the record for events.ccc.de and that one sends a query out to the local configured resolver which asks for the resource record type A and then for the domain name events.ccc.de. What does the resolver do? Let's consider the resolver doesn't know anything apart from the root name service. Then it queries, oh, what is the name server? Who is responsible for the de domain to the root name service? They reply with, oh, here's a list of name service which are responsible for that. The resolver then asks that name server, one of these name service, what is the name server for ccc.de? That one replies with those name service. Then it asks, oh, who is responsible for events.ccc.de and that one replies with the IP address. This IP address is then answered by the resolver to the get host by name unix function. That's how an iterative resolution step works. So you have noticed there are multiple packets from the resolver sent to various other hosts. Now here the host only have names but no IP addresses. So how does the resolver actually know who is z.nick.de? That is a problem which is also called glue. So DNS answer as we have seen earlier needs to include some IP address if the name servers inside of the domain of the responsible server. So since events.ccc.de, since the name server for ccc.de is also responsible for ccc.de, whenever you ask it for a name server and it says, oh, it's ns.ccv.de, it also needs to reply, oh, by the way, ns.ccv.de has the following IP address because otherwise you wouldn't be able to find out which name server or which IP to ask. The iterative resolution I just showed in the earlier slides uses query name minimization to improve privacy. That is a concept that you don't ask the top level so that you don't ask the root name server for the entire address, for the entire domain name. So you don't ask the root name server for who is events.ccc.de. This is a privacy feature which has been standardized in 2016 and is nowadays deployed by at least some resolvers, but not by all. Otherwise, it is a privacy feature because otherwise you leak the information to the root server which shows you are interested in. What about caching? Well, every resolver since there's time to live for every resource record set, every resolver can as well cache all the data and all the records and then reuse the cache data for new replies. Usually a setup looks like I have my laptop over here and then I have on my router likely a DNS resolver, forwarding resolver which doesn't do iterative queries but which just queries all the time. Another resolver run, for example, by my ISP. And that resolver run by my ISP is then asking the alternative name servers. That is a common setup. Another possible setup is that you just don't ask the ISP name server but you just ask your router and that does iterative queries. The resource record types I just showed to you the three ones are not, that is not a complete list. There are many more. Some useful ones which I use quite a lot is, for example, a way to introduce aliases. So if food.example.com should always redirect to bar.example.com, we can use a so-called C nondical name or resource record. That one will just reply to every query for food.example.com, independent of the resource record type which is requested with, oh, look at bar.example.com. Another resource record type is MX records or mail exchanges which contain a priority and the name of the mail server which is responsible for this domain. Then similar to the address records, we also have quad A records which I used for IPv6 addresses. So A for IP vision 4 and quad A for IP vision 6. TXT is a record which just contains some text data and it's used by a variety of protocols. Ediness is an extension mechanism and the extension mechanism is also done just by using DNS and resource records type. So they have an in protocol extension mechanism which is pretty interesting and pretty nice. I mean DNS, since it's 30 years old, has to be developed over time and you need to whenever you want to extend it, you have to be sure to be backwards compatible because you have a huge deployed server and resolver base out there. So you don't want to end up in interoperability problems with earlier versions. Ediness has been developed a long time ago but there's next year reflect day to say, oh, now it is actually required and service should behave well if there are ediness records requested by the client. What transport does DNS use? Usually it uses UDP because it has a very low overhead, only eight bytes of header and a very low delay. But you can also use DNS over TCP and that is actually done if the reply is too big for UDP frame. And then if the reply is too big, it is just truncated at the point at, let's say, 512 bytes and the flag in the DNS header said that, oh, by the way, this answer is now truncated. And then the requester has to re-request or can request the same request using TCP. TCP then requires it to set up a whole TCP session. TCP, if you use DNS over TCP, it uses the very same packet format as we have seen earlier but it's prefixed by the length of the content. And the ediness resource record we just saw that contains or carries the datagram size of the maximum UDP packet. What more about DNS? Well, first of all, if you want to register a second level domain, you are forced to run at least two authoritative DNS servers which are in disjoint IP networks in order to have some fault tolerance because some one IP network may be offline or the routing may be broken at any given time and in order to resolve your host name, you need to have another one so that clients will always be able to resolve that. You can now, since you are running multiple instances of the same data, you need a way to synchronize that. DNS has a methodology called zone transfer to do that within the protocol itself. And this zone transfer uses the serial numbers in order to compare where the zone transfer is actually needed and also some timers which are part of the start of authority resource record type. So it's all very much in the protocol encoded how you can do synchronization and fault tolerance and redundancy. DNS has also extensions in order to do dynamic updates. So instead of having to restart your server whenever you reconfigured, you have an in protocol update where you can say, oh, now let's add this domain name with this IP address or let's remove this domain name. Since now we have DNS updates and only this timers for the secondary, for the synchronization, there's also a notification mechanism specified. So the primary server where you do the updates, where you do the dynamic updates, that one then tells or notifies the secondary name servers to say, oh, by the way, the serial number of my start of authority has increased. Please update yourselves. And since sometimes if you want to do updates, you don't want to allow it to everybody and only filtering by IP addresses might be a bit weak. There's an authentication mechanism called TSIC, which usually uses HMAC secrets, so shared secrets, which you need to pre-share across the different servers. But you can also use some Diffie-Hellman key exchange in that layer. You can use DNS to do load balancing. So if you encode multiple address records for the same name, the server will reply with all of them in a random order to all of the clients, so to all of the requesters. And the requester will pick the first one or again one at random. And so if you have two address records for the same domain name, the probability that roughly half of the clients will use one of the address records and the other half will use the other address is very high. So we can actually do some sort of load balancing via DNS. This is also called DNS round robin. Mod DNS features, well, there's some security mechanism which has been specified and standardized, but it's not yet mandatory to use. And it only protects, well, it mainly protects the iterative resolver, the communication between the iterative resolver and the authoritative name service. There's, DNS is also used in a multicast setting for service discovery, something like Rondevue or ZeroConf that is all based on DNS. DNS can also use internationalized top level domains and domain names by using some puny code and coding for them. What are DNS threats? There's on the one side censorship. So anyone who runs a DNS server can filter domain name or if you use a DNS resolver like the one from Google or the one from AT&T or the one from CloudFair, they can at the central point filter domain names in there. And don't give you any reply, for example, for domain names they don't like, like libgen, the library genesis.org is in such a problematic situation. In some countries there are people or some governments want to filter certain websites and they do that by requiring all the ISPs to have filters for specific domain names. Cash poisoning is another threat. So since DNS by default doesn't use any authentication and every request has a very low entropy, so it's very aesthetic. An attacker, for example, in the local network can just reply with a huge amount of replies and will maybe faster than the other one. So the low entropy is because we only have the 16 bits in the header as a transaction ID and apart from that we can only do some entropy by modifying the casing of the domain name and that's it basically. We can also play with the UDP source port to get some more entropy. What else is a threat is definitely user tracking. So if you run a central resolver which is used by a lot of people you see a lot of information from all of those people and you can track those people. So you know about which domain names are around, which domain names are asked for and so on. Another issue which has been discovered in the DNS was amplification attacks, so-called amplifications attacks. And the issue here is that your request, your DNS request is usually very small. So it has a 12 byte header and then only contains the domain name type and class. Whereas the reply, the response to it might be very huge, especially if you use DNS and use cryptographic signature on that. So the ratio between the bytes you requested versus the bytes which was replied with is very small. So as an attacker, you can fake your IP address and ask a resolver with your fake IP address with a lot of very small packets and that DNS server will then reply to that fake IP address with a lot of large packets so you can amplify your attack instead of putting all the packets to your victim directly. You put them first to a DNS resolver and the DNS resolver will amplify it and put that all onto the victim. DNS over TLS is another privacy enhancement. It's specified in RFC 7858 and it's a connection between the caching resolver and the iterative resolver so between your router and the iterative resolver. You have to verify the certificate of the iterative resolver and the iterative resolver needs to be trusted to avoid any man in the middle and it protects against eavesdroppings and modifications. So if you are in a country where DNS is censored, you can use DNS over TLS in order to connect to some remote server, some other country where DNS may not be filtered. And you might happen to know some people who run such iterative resolver and who are more trusted than your ISP servers. I think I'm now basically near by the end of my talk, I will talk a bit about MirageOS, which is an operating system with a very tiny attack surface and less attack vectors than a Unix system and it's developed in a functional language called OCaml. And DNS and MirageOS, how does that fit together? Well, I implemented over the last years the DNS server and resolver, including dynamic updates, authentication, using HMAC secret. Let's Encrypt was also implemented by other people and I also integrated it there. We have persistence storage in a Git repository and we can provision those Let's Encrypt certificates using the DNS challenge so you can get a certificate from Let's Encrypt. How does that work out? Well, the idea is you start a virtual machine or a MirageOS unicom, a so-called unicom with a static seed just for its private key and an HMAC secret. And that one then generates its private key from the static seed and a certificate signing request. Now it requests the certificate from a DNS server, which uses another resource record type called TLSA, used, well, specified in the Dane project. And then if that certificate is found and the private key matches and the certificate is still valid, then we continue and can serve some web server or some mail server. If it is not found, then the certificate signing request is uploaded to the DNS server and the DNS server is then pulled periodically for a certificate. In the meantime, another unicom, which is a DNS server, is notified and communicates with the Let's Encrypt and tries to provision that certificate. So that's how I do my deployments of DNS and Let's Encrypt Sign certificate. So I'm now at the end of the talk to conclude DNS is widely deployed and has been around for 30 years. I believe it will be around for another at least 50 years. It's a redundant and federated distributed key value store and it already includes in protocol caching and dynamic updates and authentication. So it's a pretty complete protocol. That's it for me. Do you have any questions? And the questions works as follows. You stand up behind the microphones and then you're allowed a question and not a comment. And those of you leaving, please leave quietly so that we can do the Q&A. We have a question from microphone number one. Yeah, I got a question regarding MirageOS. What are your plans for 2019? So like I think we have a new release of Armin coming up, but what do you guys have in store for next year in general? I think that's a bit out of scope for this talk, but we are organizing Hacker retreats in Marrakesh again next year. And we have some plans for next major version of MirageOS and also of integration with the DNS and automated Let's Encrypt things. I also want to integrate some DHCP stuff in there. We have some questions for microphone number two.  Well, with a proxy you have at the end a single point which needs to handle all the load. So which needs to handle all the connections. Whereas with the DNS based load balancing, you can just set up a set of service which all gets distributed load.  So you have a central instance. Some in some setups DNS round robin is not very suitable, but in others it is. So if you need some common shared state between all of the connections, you better use a proxy and have somewhere the shared state. Whereas if you don't have shared state like if you have a static website or a static server, then you can use DNS round robin and you don't lose anything. And next question for microphone number two. Hi. In the last time I heard about techniques like DOH, DNS over HTTPS, what are the pros and cons? Well, DNS over HTTPS is now an extension where you don't have to use UDP or TCP, but you can transport DNS directly over HTTP, which is an advantage if you already speak HTTP and you are happy with a JSON and so on. But it also adds some, I mean, some more work, some more data because you need to do a HTTP request for getting that data. So there are some pros and cons in various setups and the DNS working group at ITF is currently discussing the sole DNS over HTTP in detail. So one disadvantage is that usually with DNS you use UDP and you have a very low delay, whereas if you use TCP you have to first do the connection establishment and you lose quite some round trips until you get to the point where you can send and receive data. I can see from the signal angel we have a question from the internet. Useful for ham radio like mapping call sign to the main name or vice versa? I didn't, I didn't understand the question. Can you repeat please? Do you know if there's any DNS extension useful for ham radio? I unfortunately don't know that, but IANA, the internet assigned the internet authority for names and numbers. They have assigned all the resource record types and that is a central list and you can browse it so you can maybe find it in there. There is still time for more questions so please get out of your seat if you have a question there will be time for your question as well. Question from microphone number two please. Hey my question is about a geo DNS and so for example if I want to connect to Wikipedia.org from Singapore or from Europe so I would connect it to a different data center how that's being handled by DNS? Well as it depends so you can set up for example your DNS service as anycast nodes and anycast is a routing extension or routing mechanism that you have the same IP address at different geo locations and then the closest one is used. So using that mechanism you can have your data center in Singapore and your data center in Europe both sharing the same IP address for the name server and then hand out in the in your Singaporean data center in IP address which is also hosted in Singapore and in your European data center one which is in Europe. You can also use well the one motivation for the EDNS flag day for next year is to be able to deploy that and to deploy having the ability as a client to add some information into the request about its own IP address so you if you know at the server side that your client is hosted in Europe you can reply with an IP address that is also in Europe. So there are various mechanisms and you have to find out and choose which one is suitable for you. One more question from microphone number two. Could you elaborate on DNS tunneling attacks as a means to transport information ex filtrate information out of an organization like in order to get undetected? Yes unfortunately I didn't talk too much about exfiltration but certainly since DNS uses these domain names you can in a request already impose or include some information like using the domain name and using automatically generate domain name or encode some information in the domain name and then if you're in control over the server you can exfiltrate some data from the client or the client network to the server which is very useful if you are in scenarios where your client shouldn't be able to connect to the outside but DNS is fine and DNS works DNS also works via the proxies so you can exfiltrate information using DNS and domain names and then as well you can there are even implementations that you can talk IP over DNS so if you are in some setups where for example a wireless network hotspot where all internet access is forbidden and you have to pay money for it but DNS is still open then you can have if you are in control over the server and over your client then you can actually communicate via DNS over that not paid for wireless hotspot we're nearly out of time we have two more questions first from microphone number one how useful do you judge DNS to ship certificates for other protocols like SMTP or for the web I think that is very useful if we would have a trust chain in DNS so for example using DNS sec if we have DNS sec and we have a trust anchor then we could ship any other certificates just via DNS that's the Dane protocol working the Dane working group working on that extension and I think the weakest point at the moment is that DNS six DNS sec deployment is not so huge or it's not widely deployed so the last question is from the internet what do you think about using DNS services from big enterprises like Google, Cloudflare and so on concerning privacy yeah you shouldn't use that there are independent DNS resolvers run by non-profit organizations which also have some data privacy laws and they don't log anything so I would recommend to not use those <IP_ADDRESS> or <IP_ADDRESS> or <IP_ADDRESS> do not use those centrally organized DNS resolvers because there you don't pay anything but the company nevertheless gets all your data what you should do though is thank khanis for his talk


Hello there everyone and welcome. This is Melissa Armo with the Stock Swoosh and Reviewing MGM. This was the Stock Swoosh Show Play of the Day and it went to the dream target. Actually it went past the dream target which is completely, completely, completely insane. 42 was the dream target. Low of the Day here looks like 41.68. So I saw this last night. I liked it. This is an earnings play which we do sometimes and then sometimes we do gaps for other reasons too. There are many reasons a stock can gap but we're in the thick of earnings season now so a lot of the trades we're doing are yes in fact earnings. It's not close here at 45.66 gap down open in the morning at 44.10 on Valentine's Day. Happy Valentine's Day everyone and I said let's have an easy day today. Let's have a great day today. Let's have a quick fast beautiful day. A first one this open. I wasn't 100% sure if it was open like it was trading weird. Then I missed my entry to be honest with you. Then I said oh my god this is gonna go. We gotta do it. We gotta do it. We gotta do it and we did it and we squeezed our way in and then we got this massive bar here. This gorgeous bar here all the way straight down and we were out but it kept going and a really nice play today and a really good trade and I did not call an option in this but you could have done an option this. I didn't even look at what the cost of the volume but this was a day trade. A trade you would have done on margin in the room that I called live and again went to the dream target which sometimes happens. I always tell people you can't plan when something goes to the dream target. You're in it. You're in it and it just goes or you are holding it waiting for it to go and maybe it goes with you overnight in a put or a call when you're in an option overnight and it gaps through the strike through the number bigger than expected. If you're interested in learning how I find the best gaps to trade and in what direction like MGM which I did today. Perfect, perfect, perfect call. Perfect day. Perfect Valentine's Day. Love red. Love shorting. Love it, love it, love it. Then you can take my class which is February 24th and 25th. It's in two weeks, not this weekend but the following weekend and you can email me at Melissa at the stockswush.com to sign up. Have a great day everyone.


Jordan Spieth almost died. Oh, my God.  Oh, yeah. He got your eye or he got your arms. I'm going to go get his entire head like Happy Gilmore did for old Chubbs. The fact that he danced with this 70-foot cliff to hit a shot, a golf shot, just one slip, one sneeze, one slip, we see a dead Jordan Spieth live from a helicopter aerial cam. He obviously hits it, makes good contact, survives. We appreciate you for putting your life in danger to make a good time shot or a big time shot. But his left foot is sitting on grass that probably within the next five years is going to wither away at any given moment. We appreciate you, Jordan. Thank you, Jordan. Thanks for your sacrifice. Jordan was willing to die for that program. He ran backwards pretty quickly after that shot.


G'day, I'm David Williams from CFA. Today I'm going to speak to two authors, Neil Grant and Adrian Highland. Adrian Highland's book, King Lake 350, is a remarkable story of survival and heroism on Australia's worst bushfire disaster, Black Saturday.  He suggests that we're too connected to our computer screens and not connected enough to our environment. He also asks, can we learn from history? Highland himself is doubtful. I remain optimistic and certainly both of us remain hopeful. Adrian, your book is a great achievement. How did you come to write it? I didn't actually set out to write a book. The first thing I should say is that because we knew so many people who died in the fires, and for me the most important thing was why I felt so emotionally involved, I think, was because my youngest daughter was at Strathew and Primary School. They had gone through Strathew and all of her primary school. We lived in St Andrews, but we felt probably more of an emotional attachment to Strathew or as much anyway, and you just sort of build up those friendships and relationships through your children's school. So we felt like everybody, I suppose, pretty emotionally ravaged by it, and I suppose I actually didn't feel, I wrote a few articles and things, one of which was for example about the Strathew in school and the teacher's amazing efforts in getting that school open just a couple of days after it burned down, which was a pretty amazing thing. But I certainly couldn't imagine writing a book about it, but one of us began maybe just talking to Roger Wood, who's a friend of mine, who's a fellow parent at Strathew, and he's also a neighbour of mine, lives along Putnamam's track in St Andrews, and our daughters are both very good friends, and various people who'd been directly either in danger or threatened, who sort of felt they owed him either a debt of gratitude or in some cases their lives just for the way he and his colleagues sort of ran around responding on that day. Yeah, people just sort of time a little glimpse of that story, and I don't think Roger was in a position to sort of talk about it himself for a while either, but gradually over that year when we sort of, he was injured on the day and in the follow-up, and just sort of over over a few discussions we had in the course of those six or eight months after the fires, I had to maybe write a small article just sort of outlying his day, and then somehow just like it just seemed such a massive sort of thing, it just sort of kept growing in my head, and particularly from Roger, if you're really going to, he was a bit extremely reluctant initially to look at me like there were these people from the CFA doing this who we worked with and SES, and I sort of built up a bit of a picture of the whole day, and sort of just through his conversation, through this conversation, so I have with him, and so somewhere in there it sort of grew from wanting to just tell his story to the idea that maybe in telling his story and putting it into a broader context, I could one, pay tribute to all the emergency services people who were out there working, trying to save lives in many cases while they were losing their own homes, and two, try to come to some understanding of it, which is sort of what you do as an artist, and that's where I sort of had these ideas of trying to weave in the science and the ecological history and even the psychology and the cultural history and those sort of things, so it just sort of grew I suppose, in summary maybe about a year after the fire, I think I actually made this a book, I was particularly struck when I heard about some of the fire, like I joined the CFA very soon after the fires, and particularly meeting some of the people at our own brigade in St Andrews, particularly some of the people who met from King Lake, they'd lost their own homes while they were out there, it just felt quite very very touched by that, and quite a few, there was quite a few people from St Andrews either lost their homes or had their families threatened and gone through a really tragic experience, and I just felt, I think I felt compelled to do that, and I had no idea it would actually be published as a book, and I just decided to write it with it, I thought I might have maybe self-published it or do it as a series of magazine articles or something like that, if no one else wanted to touch it. My basic technique was to first just make the initial approach, in some cases people approached me who'd heard I was doing it, look I just had this bit to that and I might have particularly in the CFA there's a little bit of a sort of a network there, someone hears that you're doing it and so it is, and they sort of get back in touch with you. My basic approach was to interview people, and then I would transcribe the interview, show it to them, and then I would rewrite their story, and again I'd show it to them, and there were a lot of them, in every case I was just, actually it's interesting to reflect upon how many things I've got wrong just from people's, you know, just misunderstanding what people were saying, and I think basically from a little I've seen of, you know, journalism and non-fiction writing it seems the closer you know a story the more likely you are to get things on there, but I mean the closer you are to a story the more you'll notice things that they've got wrong, so I basically just would write up the stories and I'd show it to them and then I'd get them to give me their feedback in many, in almost every case there was dozens and dozens of changes. As a novelist were you sort of tempted to write a fictional account to try and bring all these things to bear within a fiction, I mean I can see, because I can see how you've, I can see how you've used, it's definitely you've used a novelist approach in a non-fiction sense you've taken Roger Ward as a protagonist. Yeah I have, yeah. And put him through the, that's sort of the only way I know how to work really, I've sort of, I mean I did, obviously I'm particularly my crime writer and I try and bring some of those, some of those techniques I left things hanging here and there and you know a lot of it's in the crafting of a single sentence, I think people ask me what's the difference between writing non-fiction and fiction and to me there isn't a huge, in the craftsmanship there isn't a huge amount of difference but of course in social relationships and ethics and those sort of things, there's a lot of differences now and I've, I mean basically all these people, almost all of the main characters are my friends and I sort of told their stories. I did approach some people on sort of Roger's suggestion, people I didn't know because I sort of got to know was over the course for the booker who, who were happy to have their stories told. But if in regard to the fiction, non-fiction thing a lot of people there are a lot of things I knew that I didn't want to put in the book or else sometimes people had given me their stories and were initially happy to perceive but then changed their minds for some reason for very understandable reasons and of course so in those situations I just just pulled them out of the book completely. I was really just trying to capture the stories of a handful of people who I knew and writing something which I hope would be in honor of all of the people and even that even goes as far as the some of the stories I wrote of the people who were the victims so many times I drove back from King Lake there with tears in my eyes just some of the things things that people had told me but like it seems often been a matter of luck whether you survived. I mean preparation obviously had a lot to do with it. You guys both know this better than I would being King Lake people but you know we all, I mean I heard stories of people who were brilliantly prepared who perished and others who sort of you know broke every rule in the book and bumbled around and did wrong things and came out untouched you know so so much luck and depending on when the wind chains what it was doing yeah but there's not to deny the importance of preparation now for the same time I've got people I know who are involved in fire brigade groups you know feel that having been in those fire brigade groups saved their lives and some of the preparations they took and I remember one woman I described in the book you know she's she's taken when the she's taken every precaution possible got the beautifully prepared house they've got pumps and you know gravity fed lines inside the house and the fire but then the fire's actually around about to hit them and she's still sitting there thinking this can't be happening this isn't real it's still not going to happen to me and then it does so as I said that odds chance luck it all comes into it it lulls us into a false sense of security I think is part of the concern your chapter fire plan really illustrates how unprepared some really were doesn't it this is just a little scene which Roger Wood described to me on the morning of the fires when a woman came in who was new to the air and had no no idea about what fire plans were what to do about fires and she just asked him should I be worried and I've got this I'll just quote read from read from Rod Wood scratches his head truth she lives in one of the most fire prone communities in the world it's been hit by fire time and again in its 130 year history today is the worst forecast ever and she doesn't know what a fire plan is and she's asking if she should be worried so I suppose I wanted to quote that as an example of just you know how we as a culture tend not to be very engaged with our environment there were those who prepared and prepared well they activated their fire plans they had fire plans some left early others arranged their defences they primed the pumps laid out the hoses gave the property a final cleaner but there are many more who did few if any of those things there were some even in positions of authority who suspected that major conflagrations were a thing of the past who are so much more sophisticated now we had sky cranes and water bombers improved communications bigger better trucks and of course we had the internet the cfa website gave you regularly updated summaries of all fires reported across the state if there was any danger surely the authorities would let you know there was even talk that the drought itself had made a mega fire unlikely that after 12 years desiccation there simply wasn't enough fuel left to sustain a monster fire and if by any chance a fire does come you know the routine let the main front pass give it maybe 10 minutes then nip outside start up the pump if you've got one if not to mop and a bucket should do the trick there was that fellow in angles here Nash Wednesday back in 83 save his entire street with a mop and bucket extinguish the spots remain vigilant watch for further outbreaks way to go fire seems to appear as a character throughout the book I think in some ways the fire is a character in the book and again that probably harks back to experiences with Aboriginal communities where they would have would have had that sort of idea of of nature being that way um I suppose my I think I I reckon I think that section there we're talking about the change when the when the fire can sort of forms into these tornado type things and they can sort of come it could be coming at you from the back that's where I was calling it a snake in the grass then I use the metaphor of it being a hydrated monster because I um which will be more the fact that I did classics and Greek in my original degree and anything that than fire science but these are some of the images that sort of spring to mind you use very interesting language to describe fire throughout the book perhaps take us to a part which shows this we're describing the change now when when different weather systems collide and the fire grain goes berserk on the fire ground it's the horror moment the slow-mo sequence the snake rearing in the grass if you do think if you do think of it as a reptile it may help to imagine it as one that suddenly transformed from a single slithering serpent into a hydro-headed monster you make a point a number of times throughout the book about how people were looking at their computer screen and not being aware of what's happening outside I mean that's the thing that one of my the images I got from talking to a lot of people involved in this thing was a people just seemed so dependent upon technology that they were losing touch with their senses this was actually one of the most astonishing I'm still like I'm sure it was it was from Frank Allen who's a very experienced done a fantastic lieutenant out of King Lake West who contacted the Kangaroo Incident Control Center at around 2 p.m. to ask about the fire and he was stunned to realize that they didn't even know that that because it was still a formerly part of Kilmore's responsibility the Kangaroo grand people he spoke to didn't seem to know about it and he just assumed that they were so busy looking at their computer screens they hadn't actually stepped outside but of course that was an image I heard lots much from the CFA but from individuals through the whole of the community I had lots of examples of people who's as I said somewhere whose whose last contact with the outside world was via a computer screen which told them that the fire that was coming over the hill and in fact about to kill them was um still a grass and scrap fire back in Kilmore 30 kilometers away on page 143 you use imagination to describe a family caught in the bushfire and it's quite powerful you know I just I just tried to sort of imagine what it was like only somebody who's lived through that dread filled noise can begin to imagine what it's like it's still kilometers away but the air shakes and the trees shiver the ground begins to vibrate cockroaches and ants scuttle for cover disappear into cracks in the ground then it rips into your eardrums your brain into the depths of your being soon the rooms fill up with smoke the alarms go nuts the kids and the dogs go mad the walls bubble the ceilings glow red ribbons run along the crossbeams burst into open flame you creep crab like to the door and by christ it's still too hot out there and you wonder when it'll be safe for you to go outside the realization falls on you like a cold hand the one cold thing in this black hell it never will be safe outside not for you your life the regrets the joys the unfinished business the chances half taken the words of love unspoken the precious pitter patter of irrelevance cavalcades through your head time storms and the blood stands still as you huddle under the blanket and gaze at each other in disbelief you watch their faces twist their eyelids grip their foreheads red reflected pain you stroke their hair you tell them it will be all right and it will be you kiss their devastated lips and pray that it will be quick your final chapter reflections seems to be a personal essay what were you trying to achieve in that chapter i suppose i wrote the reflection i just wanted to synthesize the thoughts and insights i'd had into fire during the course of the writing of the book to think about what fire meant for us and for our culture and our future particularly in the light of the changing environment that we live in and also the demographics of the fact that people are moving out into into the bush i just struck with it the way the world is changing the way our population is changing it's it's a pretty important it's just an important physical thing that we need to learn to live with and if we don't learn that not just fire but the environment itself if we don't learn to respect it then ultimately there's no escaping but ultimately going to come around come back and bite you i'm really interested in what you say on page 245 then when the unthinkable occurs we search for scapegoats it's all the fault of the cfa the dse the local council the tree changers the police the greenies it's always somebody else the accusing finger sweeps out searching for a target only rarely does it turn back towards its owner yeah that's how i feel i suppose at the whole but if we're going to live here we just need to take it seriously and we can't oh there's still people who seem to expect the fire trucks going to rock up and protect their house if if a fire does come anything about a town like king lake now there's two fire trucks for i don't know how many hundred houses there are there but the only one you've really got to rely upon is yourself and really for me if you're sure that if you'd if you'd take the advice that it's the best wooden that we have in our culture at present is that you know you're either going to be well prepared or you just don't be there you've got to leave early you seem to be quite touched by the plight of the emergency services personnel who did their best on the day that was one of the sadder things i found that almost all of the essential services people i spoke to be their police rangers or um you know said very often they felt particularly those have been really badly hit themselves felt a sense of guilt as if they had someone's well they've been out there heroically doing you know trying to defend their community is it obviously had still been a disaster and a lot of them seem to carry you know a certain guilt and often because of the sort of people who contribute to community organizations that are very good hearted people they will feel of a sort of a feel a sense of failure from my descriptions of what other people have given to me it did say that there were quite a few people who did behave very heroic that was why i decided to focus on a minor handful and so we do need to acknowledge that i think and give them the respect that that they deserve particularly given that most of those people who perform those heroic deeds came out of it pretty badly they came out of it pretty scarred a lot of them had a lot of them had um you know psychological trauma and post-traumatic stress and things like this and we're also very worried about their own families and so and and also in a sense in some ways though it was their job to sort of make up for the failure of the rest of us the first sentence in your book is we were lucky at first the last is what are the odds do you feel that we've learned from the past it's a reflection on how the fire has changed the way some of the people involved think about the bush and the fact that they're sort of more aware of it being just an eternal fires being an eternal just a component of that world we're going to have to live with we've discussed a musical comedy written by one of the most deeply affected people the community and what a heart heart-rending and you know bravura performance it was i say a few meters from the bush the bush is a few meters from the hall the bush is stirring tendrils twist tendrils twist and creep trifid like buds are bursting seeds are responding with astonishing alacrity to the twin forces of fire and water the growth this year has a wild profusion most observers have never seen looks like an oil slick to me now comments firefighter dimer cloud as she surveys the lush new growth a year or two the fire threat will be worse than ever in millions of homes across the country residents switch off the television adjust the air con kill the lights and slip into bed some on the fringes of the city might spare a thought for the looming summer threats but few will do much about it really what are the odds so i suppose it is harking back to the idea that i suppose in one sense that people like the firefighter dimer cloud have sort of been somehow to carry the carry a burden from the rest of us because she was also very much involved in the defense of the community there but for the bulk of our society is not taking it seriously and we've well sadly many of us will fail to learn the lessons which is a black Saturday which is why i wrote the book really to try and bring those lessons home to a wider audience


OTAN Outreach and Technical Assistance Network. Hi everyone. Thanks for joining us today as we report on our learning experience with OTAN in the D-LAC Digital Leadership Academy 2018-2020. Today we are going to tell you how OTAN saved Corona Norco Adult School. And for this presentation it's time for a casting call. To begin, I'd like to introduce our amazing team. We have Toyby Roblitus who's been our principal and one of our greatest pillars of support over these past two years. We also have our Dean of Students and Tech Team Advisor Omar Andrade. We have our inspiring leader for our D-LAC team, Marcy England, who unfortunately could not be here today due to unexpected circumstances, but this presentation would not have been possible without her. My name is Kevin Belcher. I'm an ABE and ESL instructor as well as a tech team member and I'm here with Christina Hyatt, who is also an ABE instructor and tech team member. And we have our amazing and legendary D-LAC coach, Susan Gair. So now that the cast is set, let's get started. Today we're going to share the background of where we started. We're going to discuss our blended learning project and the tools that helped us achieve it and the highlight the future plans stemming from our D-LAC project. However, we're going to reach our objectives in an unconventional way. When we reflected on our accomplishments over the last two years in the D-LAC program, we recognized that this process was much like the hero's journey. Please join us as we take you through this journey. We will discuss how we recognized our powers, used our skills to conquer our first tasks, how we recruited and taught our staff and students. We'll share about the ultimate battle that we were all well prepared for and how we will now regroup and prepare for the sequel. And now it's time for a flashback, a little backstory. Allow me to introduce our principal, Toyby Reblidis. Toyby will tell us why she decided to enlist your staff members in the D-LAC push to blended learning. And Marcy and Hi, I'm the principal of Corona Norco Adult School and Marcy and her team of the D-LAC project have asked me to say something about why Corona Norco Adult School chose to be part of the D-LAC project. And I am a new principal, but I was a member of the TMAC in 2014 and from OTAN I have learned that there was a huge potential in using technology to prepare our students for the 21st century. Besides that, distance learning is something that is very near and dear to my heart because students who are the type of students who we serve have lives and jobs and things to take care of. So when they have the opportunity to learn on the go and whenever they can, it is a good opportunity for them. And I also know that Corona Norco Adult School under our leadership in the past have always been in the forefront of new challenges. And when we have leaders like Marcy who chose to be the leader of the D-LAC team, we took the opportunity and it has come to be really, really advantageous for our school because when COVID hit in the last five, six weeks, we have learned that because of our team, we were able to put a distance learning plan within a short period of two to three weeks. And our teachers have had all the support they needed from the technology team, which has been immensely helpful. And we are now in the cutting edge of adult education programs by piloting the CUSES as well as the IELCE remote testing. And this is possible because of the leadership of our tech team members. So to anybody out there in the adult education field, I would say take this opportunity to be part of D-LAC because there's huge learning in this process. Thank you so much, OTAN. Thank you so much for your leadership, Toyby. And so now like every good superhero movie, after a call to action, the hero received some sort of supernatural aid. For Clark Kent, it was his father's crystal. For Peter Parker, it was a radioactive spider bite. Well, for Corona Norco Adult School, it was OTAN training. First, throughout the two years, we had ongoing support and leadership training with a mentor by our side, Susan Gair, supporting our growth. Second, we had Destiny Simpson leading the Ideal 101 and 102 courses for how to build a blended learning program. We also participated in TDLS that allowed us to recognize the best practices throughout the state and adult education field. We also had accessibility training in which we learned how to create curriculum that is equitable. And finally, Dr. Porter helped us find our individual leadership strengths and learn how to use them effectively. All of these aids have helped us reach our potential as technology leaders at our site. Christine will now share about our blended learning plan. To be successful superheroes need a plan. For us, that plan was to create blended learning for our bridge courses. Our bridge courses in language arts and math fill the gap between ESL achievement and high school level requirements. We chose Canvas as our learning management system and NROCs fully developed math and language arts courses as our primary curriculum. We liked what we learned about NROC during webinars and conferences hosted by OTAN. Along the way, halfway to victory, we realized we also would need some gadgets and tools. We implemented a second orientation where students learned to use the technology and navigate courses online. We also focused on teaching students how to log in and work from home. Built-in supports included face-to-face interactions to build community among students and more access to teachers using Canvas tools and apps like Remind. We created a rubric to help us identify the most important features of our curriculum, and we also instituted open lab hours for student orientation and to provide a dedicated time and place for tech and technology for the students that needed it. We're working on building better advertising, single sign-on capabilities, and bring your own device Wi-Fi access to our school. Hundred percent! That is a really big number. Every student from the blended math B course that attempted the high set math test in the fall of 2019 passed it on the first try and scored 12 percent higher on average than the students enrolled in the non-blended course. Comparing the fall 2018 and 2019 costs us, we saw over 20 percent increase in student level completions. The blended program was working. We were seeing students better prepared for the high stakes tests and courses coming their way. These small victories built the confidence of our heroes and piqued the interest of others wanting to join our distance learning team. Now Kevin's going to talk to us about how we blended. So how did this get delivered to the students? Well by combining forces of course, in the blended learning ABE program we assembled all the strongest types of instruction we could. We combined the face-to-face instructional strengths of critical thinking, application, collaboration, and community as student motivation with the strengths of distance learning through Canvas, providing immediate feedback, extended learning time, and individualized and differentiated learning. But what does this look like on the ground? What does this look like from the other side of the desk? Let's hear from a few superwomen of the blended learning ABE program. This is Lou, Alicia, and Luzma sharing their experience transitioning from brick and mortar classrooms to blended learning and eventually when the pandemic hit full distance. I feel wonderful on my class because I can't, I don't drive to attend the class because my kid is at home, stay at home, and all the people stay at home. So I can have more time to take my kids. So this has helped me a lot and I learned a lot through them online classes. And I think I have progress. A bit of progress. Do you think? For me it's, I think it's work better than in class because I was planning and switching class since the night class and I was a little bit worried that I won't be able to have my teachers with me. I'm going to see someone different and I feel so comfortable working with with Mr. Belcher and Ms. Ayert so well. So I feel like I learned more since I'm home. I understand it better. I don't know because I also get one on one just to ask questions and it's just focusing on me. I feel like I've grown more since the past month that I'm online working. I love to continue online learning for the rest of this time if it's available. I feel like I have more connection with the t-shirt with you. And I feel less mentally less relaxing and 100% in focus in that class. And before it's like it stressed me because it takes time for my home driving back and forth and takes probably like three hours or four like good things back home and coming like as stress they had to do these and now it's in focus 100% in the class and I feel like a connection. Like more relaxed and I understand more.  Thank you so much ladies. So this was our blended learning program was was growing and building but it all couldn't be so calm forever. When all felt at peace and one battle of implementing blended learning was done it felt like a war rose. With the pandemic the school was tasked with transitioning from one blended learning program to four distance learning programs. Although the task was monumental the Krona Norco adult school team remembered their training and got ready for the fight to transition all classes to distance. We began by working closely with the tech team offering weekly webinars and trainings to help our teachers through the process of reconnecting with students assembling curriculum delivering it with power and patience and reporting attendance effectively. However change like this requires constant support. Accordingly our tech team were closely with teachers under their wing offering office hours both daily and by appointment. In the end as the fight to transition to distance learning pushes on so do we building our teachers our students and community along the way and as we know the fight will one day end and what will what will that look like for Krona Norco adult school. When we return to some sense of normalcy Krona Norco adult school will continue to increase blended learning throughout all programs continue building our teachers to be stronger distance educators integrate canvas as the learning management system of all programs and for our WASC 2020 action plan goals to improve and expand alternative learning options for our students and provide rigorous and relevant learning opportunities for all. This has been a fight of comic proportions for all of us. We have been we have all been tasked and tested and we at Krona Norco adult school want to thank OTAN our fellow D-lackers and our brave admin team for giving us the power strength and support to push on and soar even when things seem impossible because it wouldn't be a story if it didn't seem impossible right. Thank you so much for spending your time to share this presentation with us and if you have any questions please feel free to um to send them to the Q&A as well as you can send emails to Marcy, Christina or I. Thank you very much.