Hi everyone. I'm Cara. This is Pedro. We're both members of the Google open source security team so I'm a software engineer with the open source security upstream team, which is a sub team and So we actually spend 100% of our time contributing to critical open source projects and Offering help making security improvements via issues PRs, etc. And I work on documentation. I Write documentation for open source security tooling and I explain security concepts in blog posts so today we've joined forces to talk about open source projects and supply chain security and Some thanks first this talk has grown out of many people's efforts all of ghost our team has contributed to the tooling We're talking about today And those tools are supported by the open source security foundation, which is a cross industry collaboration We also want to call out especially our teammate Geoga Santana who contributed to crafting the story. We're talking about today So what is that story? We'll start with an explanation of what we mean by supply chain security just to get everyone on the same page We'll talk about a tool called scorecard. I think it's been mentioned a lot already at this conference, which is great It helps you improve your project security And we'll talk about how we used it first to purposefully make a project as insecure as possible so that then we could use it properly and Improve that project and we'll share a couple lessons from that experience and leave time for questions So first what is supply chain security? What are supply chain attacks? We're really hoping that some of you or maybe even all of you in this audience are new to the topic So there's an official definition of the top but for today's purpose for maintainers We can say that a supply chain attack involves injecting code into your project to harm those who depend on you And while this definition is about attacks not everything we'll talk about today starts from a malicious mindset Some things just start as innocent bugs that nobody noticed For example, one of the big name supply chain emergencies in recent years started as an innocent bug that had been overlooked But when it was discovered it set the internet on fire That was a headline everywhere It was a vulnerability and log 4j an open-source project relied upon by a huge portion of the Java ecosystem And it sent developers around the world scrambling to patch this accidental bug that opened a major security risk across the ecosystem Where there was left pad which wasn't an attack per se But just a few lines of code that when they disappeared they broke the internet and that was also the real headline Where any of these other headlines from banking? To business it seems like most hacks we hear about these days are related to supply chains An open source is a major target. There's been an enormous increase in attacks on open-source projects This headline is actually old. It's now 742 percent And there's a reason for this You may have seen this before If not, this is the classic xkcd comic for this topic Anytime people talk about supply chain security. They show this comic They usually show it to emphasize the point that open-source projects are foundational to the software world and they absolutely are That's what's made them a target But I think from the point of view of the maintainer that that little block that's holding everything up I think this comic also illustrates how software comes in all shapes and sizes with different resources and different needs The security solutions that work for those those big giant blocks the big companies Those might not work for Nebraska dev here Who's a solo maintainer likely working on the project to do the evenings and weekends as a volunteer? outside of their paying job and Their family and their life responsibilities So though this comic shows all of modern digital infrastructure today We're going to focus on the most important piece, which is your open-source project and how to protect it So to get us started here's a fictional this is fake example of what one of these supply train threats might look like What if you saw a commit like this in a project? What's wrong with this commit? Yeah, we're laughing There's obviously the funny business with install crypto miner and steal crypto wallet. That's not not great But arguably that's not the main problem with this commit That part's sort of working as intended since the intention was obviously malicious We'd argue that the main problem is that this commit actually entered the code base and it went directly to the main branch of the repository Meaning it's basically okay for the next release and it came from the maintainer That little block or did it These slides were fake. This next slide is real So this is from a real discussion in the immediate aftermath of a supply chain attack that was based on the exact same idea as the previous slide A malicious actor asked just asked for ownership of the project and the original maintainer gave it to him for the reasons explained here And why ask for ownership? The project was used by a crypto wallet. So the new maintainer after being given the project added some code Added some code that would steal bitcoin from the crypto app And one thing that I find really striking about this example is the simplicity of this compromise So we hear about well-known supply chain attacks big names like Codecov and solar winds that are super complex and have nation-state level of backing But others are really simple just social engineering to get access to a project So your project might not be directly involved with anything Sensitive or critical or so you think but it could still be at risk based on what is connected to I'm going to hand this over to Pedro now to talk about some of these risks So the question now basically becomes like how can your project be affected by such attacks? And the answer honestly is that it depends on let's call it your project's maturity So let's actually walk through like a project's lifecycle to see how these risks start to come up Every project starts with an idea right you think i'm going to create this new tool. It's going to do xyz. It's going to be awesome So you spin up a repository you push it onto Your hosting platform of choice to get hub get lab whatever and you start hacking Honestly at this point in time the greatest risk to your project is You right you're writing code which means you're writing buggy code because that's what everyone does But this is especially true if in your excitement you just focus on like the actual code That's going to go into production and it's going to be really cool without investing some time on things that can At least reduce the number of bugs in your code things such as automated unit tests or static analysis tests And also over time as your project starts becoming more popular or starts being used by other popular projects Another risk is that your code might Not actually be yours A hacker might determine that the easiest way to attack your project is to simply take over your account So it's really important that you think about taking steps to make sure that your account remains your own That being said one of the first things I do when creating a new project is that I actually add a dependency to another package And let's be honest. I don't add one dependency.  They're human too. They probably write just as much buggy code as you do, man And this problem is aggravated by the fact that your dependencies often have their dependencies and they have their dependencies It goes like turtles all the way down Therefore the risk that your project will eventually become harmed by a dependency having a bug Kind of increases exponentially the more dependencies you have And also the more dependencies you have The more version updates with security patches you need to keep in mind and you need to keep track of But you're a busy person. We all are So it's really easy, especially if you have many dependencies. You just kind of like forget to update one at some point But also dependencies aren't the only type of what we're calling here other code in your project Because after all like people will eventually discover your project They'll use it and it's awesome, right? So they'll love it But eventually, you know, they'll notice there's a feature they want or a bug that needs fixing So they might send your they might send a prs implementing those changes And receiving prs can be like a massive scaling up factor for a project Right, it means that you no longer have to like implement everything yourself, right? External contributors can just come and implement those features and those bug fixes that you didn't have time or honestly patience to implement yourself And how they might even come up with some really cool ideas that you hadn't even considered But obviously accepting prs also has its downsides, right?  We all do And imagine how much harder it is for external contributors who don't have all of that context by nature So prs are just much more likely to have bugs accidental bugs well-intentioned accidental bugs So this means that as a maintainer you may have to spend a lot of time reviewing prs Making sure there aren't any bugs or any nuances that the contributors weren't aware of And this can like honestly stress out and in some cases even like burnout maintainers If they don't come up with like systems that can at least help them triage all of these contributions But you know, let's say that you've gone through all this and with your code and with the help of your the world's greatest dependencies and Your external contributors everything is everything is running smoothly And you realize that your project has reached a level of maturity that you are happy and satisfied to release it into the wild So at this point you package it all up and you release it to the world This is a huge milestone for any project up until now anyone who wanted to use your package had to Go to your repository clone. It's install locally. It's a pain to install. It's a pain to maintain. It's not really fun But once you actually release your package Users can now use it Just as easily as you've been using your own dependencies. It's really really powerful stuff But it does raise a new concern Right the code for your package is in your repository But for most languages Users are actually installing the artifact from an index How can users really know that the package in the index really corresponds with the code in the repository? After all like what if someone stole your credentials and published a malicious version? It therefore be a really good idea to come up with some way to closely tie the package to the repository So here i've just described a whole bunch of things we need to keep in mind while developing and honestly There's a whole bunch of other stuff. I haven't even mentioned Uh, so now i'll actually pass to the word back to cara. We'll actually talk about a tool that'll help you keep all of this in check Yeah, so pedra touched on some of these aspects, uh, but the overall risks to your project There's just a lot of them and they can depend on a lot of different actions that you take and that the people behind the projects You depend on take It's pretty much impossible to keep track of all of it manually So the open ssf the open source security foundation developed a tool to help you measure these risks scorecard So these are some sample scorecards. That's three different projects not three for the same project Um, scorecard is an automated tool that runs a little under 20 checks on open source projects So a check evaluates an aspect known to correlate with risk So for example, one of the biggest risk signals is whether a project is maintained If it's not maintained is no longer getting bug fixes. It's not getting security updates. You'd want to know that Another check is vulnerabilities. It looks at whether there's known unfixed vulnerabilities in your code in your dependencies and in some languages in your dependencies dependencies those indirector frames that are dependencies A question we get sometimes is why would I need scorecard? I'm already using security tooling for example sastre tooling If sastre is like the guard in front of the bank Then scorecard is like the security consultant who comes in and tells you hey you need a guard in front of your bank and Also points out a whole bunch of other risk factors and solutions that you hadn't even thought of And despite the name I swear despite the name scorecard isn't just scoring you It really is meant to help maintainers It also gives you advice on how to raise any scores that indicate areas for improvement So that makes scorecard super useful not just for evaluating a project To understand the potential risks of adding it say as a dependency But also as a checklist of things to do to improve your own project security So this slide is one of those pieces of remediation advice It explains how a secure security policy can help people safely report vulnerabilities in your project It suggests where you should place the file or it tells you what you might say in that file You can click through and find even more guidance And scorecard gives a lot of info and the info is available in lots of ways There's three main ways that I think are useful for maintainers as opposed to say big query data for researchers There is the web viewer. You can just find that link on the front of the repository Towards the start of the read me. So there's a web viewer where you can look up I think it indexes about one million projects Each week it runs a scan There's a cli tool for any projects that aren't in that one million projects on the web viewer And there's a github action which you can add to your github project And it'll run on every change to your repository and you'll find out immediately if anything you do causes a security regression And then at the macro level scorecard gives us a snapshot of an ecosystem security health So this slide shows scores for 10 000 critical projects on github And that's critical based on how essential they are for digital infrastructure So that's calculated with another open ssf project the criticality score project And there's there's quite the spread here There are some projects that are up there in the nines, which is amazing I think honestly anything above like a six into the sevens is really really impressive But there are also some projects down there in the ones Which made us a little concerned and also made us wonder What would it take to get a project all the way to the left? And then what would it take to get it all the way back to the right? So We did that We mentioned that you can use scorecard as a checklist of things to do to improve your project's security So we did the opposite Pedro created a project cronk. I might say we in this section, but really Pedro did all the coding work in this area And cronk cronk is a real project developed by Pedro, but it's actually Nebraska dev up here And what it does is an important It's written in python, but it's meant to be a stand-in for any project Almost anything we're going to talk about today is agnostic of code or language or purpose So when cronk started out Just setting up the project using github defaults gave it around a four out of 10 score So that was right around that big peak on that chart a couple slides ago pretty normal score But by using scorecards checklist as a reverse list of what not to do We were able to lower cronk score pretty far Down to a 1.9 out of 10 So for reference out of the roughly million projects monitored regularly by scorecard only 0.7 are in that range And of the 10,000 most critical projects, there's only 22 that have a score in that range So you can see all those red zeros as scorecard just freaks out Much of this low score came from an absence of proactive action didn't actually have to do anything So not setting up automated tests like Pedro mentioned not setting up branch protection But getting the project to rock bottom required some intentional sabotage Intentionally looking for dependencies that had vulnerabilities that we could add Creating an automated workflow that intentionally could be easily exploited to inject code into the repository Overall fun exercise of doing everything you normally try not to do So now that we've got cronk score down to like rock bottom It's time to start climbing backup And the good news is that we realize that you can do just a few small things And increase the security of your project by quite a bit Naturally everything we're going to talk about from here on out Hinges on you being the person in control of your project Like if someone else takes gains control all bets are off game over So, you know, here's the same advice you've probably heard a thousand times before Please have a good password and set up two factor authentication This is so important actually that github is starting to require 2fa for all maintainers And so will pi pi by the end of 2023 Most other platforms don't yet require it But do it anyway. It's really important And that's because maintainer accounts do get hacked and this will help keep you in the driver's seat For example the solar winds attack from a couple of years ago that affected multiple united states government institutions And cost tens of millions of dollars of financial damage Likely began due to a leaked password, which was solar winds 123 We also recommend that you cryptographically sign your commits This adds a comforting little green badge next to all of your signed commits and a spooky orange badge next to all of your unsigned ones And this is something that would have been really useful in that very first example commit that kara showed In that it would have given users at least a hint As to whether that commit came from the maintainer or just someone who'd stolen their credentials So Now that nebraska dev has protected her account and started signing all of her commits Cronk's users can be confident that whatever code she submits to the repository actually came from her Now she just needs to make sure her code is actually any good And it's already very common practice to work on a feature branch or a bug fix branch And then when you're done you merge that work back into your main branch Our suggestion here simply takes that one step further And that is that we suggest that you configure branch protection rules for your repository So that everyone yourself included as the maintainer must contribute code via prs And that's because contributing via prs has huge advantages Most importantly it makes sure you don't forget to run tests on your code My personal experience is amazing every single time I forget to run tests before I push something There's an obvious glaring bug that I it's impossible. How did I not see it before? And also it just gives other people an opportunity to take a look at your code, right? Humans may write buggy code, but they're also very good at finding bugs in other people's code And and therefore it kind of also just lets you explain your idea more clearly Since you can use the pull request description you can link to issues all that stuff It lets you have a conversation with other contributors But yeah, let's be real like this request can be kind of annoying for the maintainer like honestly It can really can be Because this suggestion is actually the only one that we have that actually requires you to change how you work How you change how you change your workflow? But the advantage you get from it can be so important. We still made it one of the primary things we suggest you do So once nebraska dev set up branch protection and configured some automated testing workflows Cronk's score rose significantly to a 3.3 And honestly it could have gone further like nebraska dev is Cronk's only maintainer If the project had another maintainer they could review each other's code And that added code review alone would increase the project score by almost an entire point to a 4.1 So now that nebraska dev is a bit more confident that her own code is bug-free or less buggy at least It's time to put to ensure that the project is also safe from other people's code And part of that is to ensure that pull requests from external contributors are also bug-free ish And here is where those automated tests that help you avoid bugs in your code become especially important, right? Because this not only speeds up how quickly a pr can be approved Since the author can submit the pr notice its failing tests and fix the bug before you as the maintainer even see it And therefore it increases the health of your code base But and you could even say this is actually more important It can even help with your own mental health as the maintainer since you don't need to spend as much time and energy And honestly like stress on every single pr making sure they don't have any bugs. Oops. Sorry. They don't have any bugs or like any other problems Because you have those automated tests as backup giving you some confidence in the quality of the pr And then there's your dependencies And here the first question really is how well do you know your dependencies? Like are you sure you actually want to rely on these packages? But really that just leads to another question, right? Which is like what do you need to know Before you can even make an educated decision on this So here's an idea First, you know check a dependency scorecard score You have an idea of the project security posture See if it's something you're comfortable with Or there's also depths dev which is a website that will have more information about your dependencies than you'll even know what to do with Finally and honestly just as importantly Take a look at the packages at the packages repository yourself Like is the project active our maintainers interacting with issues and prs and like how many stars does the project have? like basically You want to make sure that you're looking at node j s with a hundred thousand stars and not accidentally looking at node gs Once you're sure you're comfortable with your dependencies You still need to like remember to have their latest security patches. So it's really important like remember keep your dependencies updated or Follow our suggestion and don't remember Instead we suggest that you embrace the robot overlords and use a dependency management bot Just as you'll receive a notification on your phone or laptop letting you know about the new version of the operating system With all the security patches and new features These automated tools will send you prs updating your dependencies as soon as new versions come out And if you have automated unit tests set up, you'll even know whether there were any breaking changes in the new version So just for the record, uh on github, there's dependent bot There's also renovate bot that's available on basically all platforms including github And many languages actually have their own dedicated tools So after nebraska dev set up dependent bot on krunk And actually fixed its uh vulnerable dependencies with dependent bot prs The project score went up to a 4.3 So now that nebraska dev is confident that all the code affecting krunk is reasonably bug free and up to date She's ready to release it to the world But how can this be done safely? The common method here is the most common method is just doing it on your laptop, right? The code is already there all you need to do is just run a few commands to build the package and then release it And this works just works But it's opaque Your users can't really know what's going on during this process And there's no way to be sure whether the package that ends up in the index is exactly the same as the code in the repository Also, it's just annoying for the maintainer for the vast majority of projects creating a new release isn't like an artisanal process It's mechanical. You're running the same commands every single time And each of them usually takes a while especially for larger projects And you need to just sit there and wait for them to finish We therefore suggest that you instead adopt an automated release This is an automated workflow that follows your instructions step by step to build and release your package And automated releases fix most of the issues we just described The workflow is in the repository so users can know exactly how releases are being made And they might even have ideas for improvements or use that information to build locally And the process also just gets easier for the maintainer, right those commands as I said they take a while But once it's automated, you just trigger the release and take a nap So once Nebraska dev set up Cronk's automated release workflow the score went up to 4.6 That's nice, but not a huge increase compared to the 4.3. We had before But it is important to remember here that this is Cronk we're talking about The project still has that ridiculously dangerous workflow. We mentioned and it doesn't even have basic things like a license that we haven't touched If we were talking about shall we say an ordinary project with a single maintainer that hadn't been sabotaged as thoroughly as Cronk was The improvements we just talked about would get the score to somewhere around a six And notice that this would already make your project better than the half that most of the 10,000 critical projects we talked about before And if it's a project with multiple maintainers that can review each other's prs the score actually goes up to 6.8 So from now on to more closely track the average project I actually removed the awful workflow. I added a license I miraculously solved the great problem of open source development, which is finding additional maintainers and found a friend for Nebraska dev And so that got Cronk up to the 6.8 like an average project would have by now and Yeah, 6.8 is really really good. I think sometimes people think it's about 60 seconds. We've got about five minutes left Projects on your bell shaped curve What source did you use to generate that list? The list of projects or the list of scores? It's the open ssf criticality score. It's a another project that uses a bunch of heuristics to determine things Okay, so we left off at a 6.8, which I want to emphasize is like really really really good But what if you wanted to go higher and enter that truly verified security space? Everything up to this point were the main tips the main takeaway For this talk if you did only that much your project will be in good shape But if you want some bonus tips, here's how you can go further The easiest way to know where to go next Just run a scorecard on your project Whether you use the cli tool or the github based action You'll get scores for each individual check and then remediation tips for any of the weaker areas But there's a lot of checks. So how do you prioritize? We suggest focusing on these three for the next steps Number one is token permissions. That's workflow permissions because it's incredibly easy For about 90 of projects just changing the right permission to say read only Is going to stop compromised workflows from being used against you The vulnerabilities check is just super useful It'll immediately notify you of any known vulnerabilities that enter your dependencies And signed releases it takes a little bit more effort, but it's super powerful Since it will help you create a process that helps users verify that your releases actually came from you So cronk is getting up there these three additional bonus changes Token permissions volums and signed releases push cronk to a 7.9, which is really the upper echelons of scores Getting through the final checks Cronk cronk all the way to the right basically off the chart to a 9.6 This last stretch was harder. We are not going to lie about that Pedro put more effort into this final point in half than all the other All the others combined, right? Yeah The addition of fuzzing was the most labor intensive part because fuzzing was actually the only part of this process That required actual project specific code to be written Everything else was changing settings or just adding some simple boilerplate code And that's it that's as far as cronk can go Getting it to a 10 out of 10 would mean having enough maintainers to require multiple approvers for each pr Which we didn't think was representative of what's realistic of a project of this size And that's okay. This is amazing. No project out there has a 10 out of 10 Yet, so I'm hoping one of you will first get that 10 Okay, coming into the end just to summarize If you improve these three areas of your project security just as a start You're going to be far above average in terms of reducing risk And I kept bugging Pedro. I kept telling him we need to say something about timing. How long did this take you? I wanted to emphasize just how quick most of these recommendations are But he rightly pointed out it's not so simple Even though branch protection will take literally minutes to add Regardless of the size of your project and adding a dependency management tool is less than probably 10 minutes It's thinking about making the change.  They're everywhere Um help them out with some code review. All right. Thank you everyone. We have time for questions Um GitHub has actually worked a bit on this already. So uh one of the Try to say previously most quote-unquote problematic default that it has what that was that Workflow permissions were uh default write all But since I believe it's February of 2023 They've changed that so any repository created since then starts with Read-only tokens however projects created before February 2023 have been grandfathered in with uh write all permissions So if you have any projects, please go to your settings and change that That that setting it's literally takes like seconds to fix uh, yes a write all token uh on a A write all token Could be used to modify the contents including like the actual code base of the repository You can have like branch protection rules that require a pr And then it becomes much more challenging to make that exploit But if you have no branch protection rules and you have write write all tokens a The workflow could potentially be exploited to literally change the code in your code base That was the only critical. There's there's one critical check The checks used to be low Mile medium high. I forget moderates high. Um, and then when the dangerous workflow check came out created a new category critical Yeah, and uh, so yeah, I mean like that's like Because like dangerous workflow is basically when your workflow is structured in a way that you can actually have code injection in the workflow To then be used to maybe modify the contents of your repository But also it could also be of uh malicious dependency. Maybe you use I don't know a github action that's been exploited or just uh Build time or test time dependency that maybe was exploited and could be then be used to modify the contents of your repository Not that i'm aware of not going to say no, but not that i'm aware of either. Um, I mean like most uh containers like in in broad use are usually Are usually like Maintained shall we say in the repository so you can at least like ensure that the development of the maintainer is secure But those things really to like guarantee other than maybe signing the having like a signature for the container image Um, that's like the best that I can think of but i'm not going to say no. I don't know everything um, so I mean like all sorts of dependencies are problems at different stages Right, so runtime dependencies. It's kind of important to keep those like just naturally updated Um, because especially if you have like you have a especially if you have an application Because right log for j is a runtime dependency that burnt down the internet But then there's also like build time and release time dependencies could also be used to Actually modify the very artifact that's released So your code base looks 100 clean But your dependency could be used to modify the artifact and actually send a poisoned release even though your code base is perfectly fine So he's asking our build time dependencies included. Uh, yes, they are the Like I mean like the the our point is about like keeping your dependencies updated and then dependent bot renovate bot Those kind of things can be set up to make sure that all of your dependencies No matter if they're in the package json or requirements txt in the root or in some other folder or wherever they are They can be registered and they'll be updated. I'm not sure I'm answering your question though Uh It's uh, I mean like dependent bot requires like a tiny little bit of setup You need to create a very simple file. That's like 10 lines long Uh, that says my my requirements files or wherever are in this folder or in that folder Whatever and then once it knows where the files are it, uh updates them all renovate bot I believe actually does it automatically. I don't think you need to register anything for the bend about Renovate bot, but uh, don't quote me on that even though it's recorded now Not gonna lie Some of the scorecard checks can be fooled, shall we say Like the dependency update tool check Currently mainly looks at like do you have it installed? It's not looking at whether you're merging the prs though And so and like the security policy It actually does parse the security policy to like guess like is this actually like a reasonable security policy But you know, it's impossible to like really create a robust parser Uh, so it could also be somewhat easily fooled as well And like here basically the Like the question once again becomes the matter of like, do you want to trust these packages? And that's also why I said that just as important as look running a scorecard is actually looking at the repository yourself And uh, seeing if it's a project that you trust Um, and so yeah, I wouldn't say that it's Uh It's yeah, please um If I think I understand your correct question correctly, it really depends on the situation I would actually um go to depths.dev look up your project Look at the tab that says dependencies and dependence See how many projects rely on your project and judge is this, you know A little experimental thing that I play around with to try out new things or oh my god, there's a thousand projects relying on me Um in that second situation, maybe when you look at your dependencies, you're gonna have a higher bar And just judge where your risk tolerance is and if it's just a you know, little toy project Lower your bar. Um We're not giving you a hard and fast like don't use anything below this cutoff. That's that's up to you to decide Yeah So This was I heard this stat. I can't answer that exactly in terms of vulnerabilities versus score But a stat that was actually mentioned earlier today That I remember 2022 Sonotype state of the supply chain report it found that there were two factors that Best predicted whether there was a vulnerability in a project and the two factors were Meantime to update how long it takes you to update and whether the project used scorecard You can show that you use scorecard by adding batch. Yeah, and also um having Um And that stat for example actually scorecard is now working or exploring How to perhaps add uh meantime to update As an actual check and let me clarify I don't mean that you're more likely to have a vulnerability if you use scorecard It's inversely proportional I don't have that we don't have that stat here Can you repeat the question for everybody? Oh, sorry. Yeah, the the question was whether there are any stats on like whether projects in rust are more secure for example And uh, I don't have that stat here But it is something that can be easily accessed because there is a big query data set Um, and that data set does include I believe language information Uh, not entirely sure I admit, but I believe And so then you could do your own exploration on that on that topic Um, this uh, so scorecard currently runs on uh, oops, sorry currently runs on Both github and git lab repositories and both public and private repositories Yeah, be my guest Yeah, so, um, please be inspired But uh, that's it. Uh, any other questions? One last question Uh scorecard scorecard scorecard is uh, we have it. Yeah, if you go all the way back. Yeah, we have we actually have it here as one of the three Was where is it? I'm getting it No, no that was that's crank There it is 9.4. Um, that score is from That's of course from like 10 days ago or so so it might be a little bit different now, but it's thereabouts I believe that's it everyone. Thank you very much


Live from the Congress Center in London, England, it's theCUBE at MIT and the Digital Economy, the second machine age. Brought to you by headline sponsor MIT. Welcome back to London everybody. This is Dave Vellante with Stu Miniman. Dean Dave Schmidt-Line is here. He's the MIT Sloan School Management, the Dean of the School. Dean, welcome to theCUBE. Great to see you. Thanks for coming on. Thanks for having me. So MIT IDE, we're here in London. How's London treating you so far? You know, from Boston, we come to London for the spring weather. It's fantastic to see you. How about that, right? One is gloomy and cold and the other one's London. Yes. So tell us about the initiative on the Digital Economy. Yes. Why IDE, why now? Yeah. You know, Moore's Law changes in information technology. That's a 20-year story. So it's a fair question to ask what's new now. And it's a qualitative change in what business opportunity looks like. It's a qualitative change in what products and services look like as they're being designed. This is not just the next stage, it's a new stage. And I think some of your viewers have been seeing and hearing some of that. So I don't want to cover or recover that ground too much, but the, you know, if the first machine age was about replacing muscles, the second machine age is really about replacing mines. And so what that means is very different in terms of opportunities for individuals and for companies. Yeah, of course we're here. I said earlier we're here at the site of the first machine age, really, which is the steam engine right now. We're launching the second machine age. It's apropos, I think, to be here. Where does IDE fit in with the broader agenda of the Sloan School? Yeah. So, you know, the Sloan School is MIT's School of Management, and we want to be MIT's School of Management, not just another B school teaching MBA students and so on. What are the themes that are central to that? It's understanding complex systems, doing deep analysis, innovation and entrepreneurship. And I would tell you, by the way, that modern finance was invented at MIT, not in Chicago or Philadelphia. And so the themes for the school are around innovation, entrepreneurship, analysis and complex systems, and finance. And this fits right in the center of all of that. So it's very important to us. It fits with our history. It fits with our connectedness across the rest of MIT. We're not just a standalone business school, but we draw on the rest of MIT very significantly. Okay, so it's very relevant to the broader MIT agenda, and we are talking off camera how we've done a number of MIT events, the chief data officer or the data quality event. And always such a focus on the alumni. We've got such a broad network. I wonder if you could talk about that a little bit and how it relates. Yeah, so we have an amazing alumni network. Not everybody knows that. It's not the biggest network in the world, but when we put together the way that we reach out to MIT's alumni network, it's 125,000 people around the world. Those are people who are, you know, yes, some of them scientists and engineers, but at this point in their career, they're driving innovation in major companies. And so the network that I serve as dean is largely the MIT network, not only the business school network, but we have an amazing network here in London, you know, just all over the world. And people who are so incredibly proud to be associated with MIT, a place where new ideas are born all the time. So you've taken the second machine age message around the world. We're here in London.  How do you decide sort of where to go and what does London mean? Yes. Well, London is a centerpiece in so many ways. You talked about the first machine age and the commitment here in London as well to innovation and entrepreneurship is very strong. One of our faculty members, Fiona Murray, is advising David Cameron with respect to entrepreneurship policy here in the United Kingdom. London is seen as such a global center not only for finance, but also for new business activity. And so it's quite natural to be here in London. You certainly would wonder why we went anywhere before coming to London. There's also a historical role for education and knowledge creation that is very special in the United Kingdom. And we at MIT have been deeply engaged with the UK in that regard also. So just great to be here. And they like complex problems over here, as we know. So I'm wondering, actually a little bit of a personal question from your job. Second Machine Age talks about a lot of disruptions and how technology is creating its huge opportunities but huge challenges. In an age of MOOCs and people saying, I mean, everything needs to be from government and education, as Dean, what have you been seeing? How is the business that you're in changing and how is it going to look over the next couple of years? Yeah, you know, honestly, it's a great question. And I'm asked that quite often. I would give the schools a high grade with respect to curriculum, with respect to understanding or helping our students understand this, but with respect to using the technologies, using the digital world ourselves. You know, maybe a passing grade on a good day, that's about it. There are some things that we do that I'm very proud of. So you talked about MOOCs, these massively open online courses. They're fine. I like them. Yeah, I mean, MIT, I can go as just not an MIT alum, but I can go online. I can do MIT MOOCs. Absolutely. And if all you want to do is learn, you can learn for free. If you want to be certified, it's knowing some topic. There's a modest fee that you pay for that and so on. What I think is more maybe interesting around the digital and online world for education is not creating an almost as good experience at a lower price, but adding to the experiences. That's really been, I would say, more our focus at MIT and at the Sloan School is to do some new things. So I can give you just one little example of that. Look at developing people as entrepreneurs. So we have a massively open online course introducing people to entrepreneurship. We have our faculty. We have some of our prominent alumni who lead that course. That's got about 50,000 people who take it as a course for free. Some number of people would take the test to see how well they're doing. We approached a subset of those people who did extraordinarily well in the course and asked them to talk about their entrepreneurial experiences. And out of the very best answers of that, from that original sort of group of 50,000 people, we came down to about 60 people that we said, we really need to bring these people on campus at MIT. And we did. And these are already successful entrepreneurs that we had not engaged with at all before this online experience. And they've now been wave one of an entrepreneur's network that we're creating out of people that initially came through the online door. So how do you do things in, yes, online that aren't only videotaping someone showing it to people and then maybe giving them a test? I love that example. It's not, as they say, paving the cow path. That's not what MOOCs are about. It's about finding new innovation and new business models. And actually, you know, it's one other example of that from non-degree executive education. So we have had, as I mentioned, some weather challenges in Boston on occasion. In one setting, we knew that people were not going to be able to get physically to campus to participate in a big data online course. And so over a very short time frame, we recreated that program so that you could be there in person or you could participate electronically. Everyone, in person or electronic, had an avatar.  And some of the most powerful experiences that people said in person that they had during that executive program was with people who weren't there at all. And so in some ways, the avatar-to-avatar connections were stronger than the people-to-people connections. I hope that's not just the truth of MIT, but we need to learn what the possibilities are to do more and to do different. It's an added dimension of communications that you're bringing up. So Dave, set up the day for us here. What can we expect? So we have the co-directors Dave, the initiative for digital economy here, as you know, Andy McAfee and Eric Brynjolsson. We have other leading faculty who are visitors and permanent members of our community be talking about some of the huge changes in the world as a result of digitization. Roberto Rigabon is going to be here. He's the person who has told the truth about inflation rates in some parts of the world where the governments work very hard to make sure nobody knows what inflation looks like. He uses online prices to be able to know day by day, item by item, what's going on with the institutional environment, the macro environment in over 100 countries around the world. It's quite extraordinary. So we have people who are really leading for new kinds of applications of big data and digital experiences. We also have people who are quite interested in the social impact of the digital economy, what it means for not only business opportunity, which is great, but what it means for economies, for societies, and how some of the policy choices that are going to need to be made over the next few years are going to be hugely important. So digital business is obviously a big theme and it's something that's a huge opportunity for us as we've heard from Andy and Eric. How are you evolving education to accommodate the future of digital business? So you think about one of the big themes in management education recently, it's been global experience. Having people get out of the classroom, get to Vietnam, get to Kuala Lumpur, get to Columbia, for instance, and engage with entrepreneurial firms in real project settings. What does online, what does digital do for that? So how do you give a sliver of the experience that an MBA student is having in Vietnam to some of their classmates? How do you crowdsource in real time some ideas that they can bring to the table in those kinds of experiential learning settings? Again, some of the best of the ways that digital and online are affecting education aren't as a substitute, but there is a supplement to what we would typically do. So of course, things like accounting courses and introduction to finance, some of that material is going to the web, that's all great, but ways to take some of the special sauce from an MIT Sloan education and make it even better through digital is a huge focus for us. And of course, the knowledge about the digital economy's future, that's in the curriculum as well. So those are some of the innovations that you're working on. What else can we expect from the Sloan School of Management in this regard, so they're going forward? So we are deeply engaged around the world with our partner institutions. One of the ways that technology will have an impact is in how we work with them. So we've been deeply involved in China for 20 years now in helping change the landscape of management education in that country through the leading institutions, the leading business schools, who are our partners in that effort. We've done that in Korea. We'll be announcing tomorrow some activity in Malaysia that I'm not supposed to talk about. I'm going to talk about MIT in Portugal and so on. So in those partnerships, the use of technology as a way to bring faculty together, to bring students together is hugely important and that's also something that's been changing very rapidly over the last couple of years. So you'll see more of that. Well, Dave, thanks very much for coming on theCUBE and having us here. So it's our pleasure to really collaborate with MIT and use theCUBE to bring your content to our audiences. It's been an excellent collaboration over the last several years. So thanks for having us and thanks for coming on. Please keep coming back. Okay, keep it right there, buddy. We'll be back with our next guest right after this. This is theCUBE. We're live from MIT IDE in London. We're right back.


We are at lecture 28 today. We talked about concepts that the test will cover. The test is tomorrow for this group of students in this classroom this semester. So pay attention if you're doing this course on DVD or cable TV that you pay attention to your particular pacing guide for when your test is, but these students are taking a test tomorrow on 6.5 up to 2 and including 7.5, the logistic model. Now there are some sections we deleted in there. The end of chapter 6, a couple of sections that are not part of this course. So we deleted those, obviously not included on this test. I handed out an old test. Actually this old test is posted under the Distance Ed Math 241 thing on my web page. But there is quite a bit of overlap with the test that you're going to be taking tomorrow. There's the center of mass. Question number 4, how much work is done in stretching or compressing a spring? Number 5, pressure, hydrostatic pressure? Number 6, average value of a function is not for this particular test for you. So you might just put a line through number 7. Differential equation is given. Initial conditions are given in number 8. Use Euler's method. That is something you're responsible for. And then actually solve it exactly, get an exact solution, and see how close the approximation was. I actually like that kind of line of questioning because then you have an idea if your answer to A is even in the ballpark because you have the exact solution in part B for the y of 2. Number 9 was mentioned right before the cameras were rolling about just regular exponential uninhibited growth if you're given two data points. So that's fair game for tomorrow's test. And number 10, orthogonal trajectories is also part of this. Now there's some things that didn't make it to this that are also included but there's quite a bit of overlap with this test in your test. So we talked about the topics yesterday. So I think we can pretty much set up problems and work problems that you want to make sure we look at today in class before tomorrow's test. Briefly, what did not make it to this test tank problems? So we might want to look at a tank problem today, set it up, see what the initial conditions are, and go about at least getting to where we have a solution. Newton's law of cooling did not make it to this test but has a chance of making it to your test. Number 9 is an exponential growth problem. It's a population problem but continuously compounded interest would be the same exact mathematical model. So we've really kind of got one on this previous test but it doesn't say continuously compounded interest. And then we did not get a logistic growth problem on this previous test that you need to be responsible for for your test. So you do the prioritization and tell me which ones we should look at. What do you want to make sure you look at, Nicole? You look at one like number 10 and one like number 6. Okay. All right. Do you want to take a look at 10? I mean you have the solution to it here. Can we do a different one if you want to? All right, so let's take a look at what this one has first since we can kind of just browse through the solution just to look at the process. So we are given, what is that that we're handed here in number 10? What is that original set of points? x squared plus 3 y squared equals c. An ellipse. An ellipse. A family of ellipses, right, based on the value we put in for c. So we've started with this family of ellipses. We want to find out what are the slopes, right, of the tangent lines on the family of ellipses. So we take the derivative implicitly. Solve for dy over dx. If there is by chance a c or k value in our derivative, then we want to replace it with what c or k is in the original x and y relationship. That is not the case here because the derivative of c disappeared. So dy over dx is negative y, excuse me, negative x over 3 y. So we're not going to write the whole thing down, but we have this equation. Then we find what are the slopes of the tangent lines to any point on this, any of the ellipses. So there's the slopes of the tangent lines on that. What do we do to find the orthogonal trajectories? Negative, reciprocal. That's what the word orthogonal means, is that they're mutually perpendicular. So on the orthogonal trajectories, we want the slope to be what, 3 y over x. Then what's next? What does it look like happen next on this solution? Separate the x's and dx's from the y's and dy's. So it's kind of a separable differential equation problem as well. Integrate both sides and it looks like, actually that's not the one that resulted. I think the previous equation is one we should look at. 3 natural log x equals natural log of y plus k. So after we separate, integrate both sides, we come up with that. The 3 that's out in front can be replaced in that position, right? If we can take it from that position and bring it out in front, we can certainly take it from the out front position and put it back in the exponent position. What happens from there? I write that down right? Yes. Exponentiate, right? And you can get it down to the point where you have x cubed equals y times a constant. And you could solve for y by dividing both sides by a, but if you divide by a constant it just becomes another constant so you can see the final result is y equals b times x cubed. So this is a family of cubic polynomials that all go through the origin. Kind of picture how those would look. A typical cubic polynomial through the origin would look like this and they must be mutually perpendicular to the set of ellipses that we started with so you can kind of picture them and the plane is where they meet. They're going to form right angles. So that's the process. Let's try to find an example in the book. Let's try to find one that has a k in it so we have to make a substitution for, which would be slightly different. All right, solutions of differential equations, initial value problems. Here we go. 23 through 26. Find the orthogonal trajectories of the family of curves. 23 is a lot like the example we just did. I'm trying to remember the examples we did in class. Don't want to do the same problem again. You want to try 26? I may abandon it if it doesn't have a k in it in the derivative because that's what I want to get for the next example. But let's see what this looks like. Any ideas what that is? What is this family of curves? What would they look like? Just try to picture some different numbers in here for k. x over 1 plus 3x, x over 1 minus 5x. What would that look like? It's the thing with the asymptotes. It's got some asymptotes. It's got a vertical asymptote at negative one-third, right? Would all of these have some kind of vertical asymptote? Right? Based on k. And how about a horizontal asymptote? One-third. Degree is the same. x to the 1 over x to the 1. So isn't it the quotient of the lead coefficients? 1 over 3. So it's got horizontal asymptotes as well. And if you pictured this, let's see if x were zero, we get zero. So that means we've got this one. Probably this one. So some hyperbolas, right? In the plane. Family of those. Let's see what dy over dx is. How do we go about finding dy over dx? Let me go back. I don't think I sufficiently read the directions. Find the orthogonal trajectories of the family of curves using a graphing device. Draw several. We're not going to do that. Okay. So let's just find them. Tell me what to write down. 1 plus kx times 1. So quotient rule, right? Numerator times derivative of denominator. K. All over original denominator squared. Square. Wow. We've got to get rid of k, don't we? Bad example, Katie. Sorry. Bad. Bad choice. Let's see if we can do it somewhat painlessly. You just throw it away. Multiply, add, and divide by x. Yeah. Maybe it's not quite as bad as it looks up here because if we take off to the side, y, and call it y over 1, we cross multiply, and if you wanted to solve it for 1 plus kx, it's what? x over y. So we've got a 1 plus kx here, right? So we could call that x over y the quantity squared. Let's see how bad this is. This may not be kind of a fair test question. We've got a 1 plus kx here. So what is 1 plus kx? It's x over y times 1. Here's the one we probably have to work at and solve for k. So if we solve for k, divide everything by x. So if we divide everything by x, what do we get? So we'd really multiply this side by 1 over x. 1 over y minus 1 over x. That would go... I have a question. The 1 plus kx minus kx on the top, wouldn't that just be 1? Yeah, wouldn't that just be 1? Oh, do we just drop them? That would be even better. I think we're going to see that right now also. So if... Because we'd have x over y minus x over y, so they're going to drop out. So it would be cleaner to see it up here. And if your teacher had any sense, he would have seen that earlier, but he doesn't. But either way, we're going to get them to drop out. So we've got a plus kx and a minus kx, so they're going to drop out. They would also do that right here. So we have a 1x times 1 over x, so we have a 1. And... x over y quantity squared in the denominator, which is... what? y squared over x squared? Any other obvious reductions that I'm not seeing here? So what's the next task? That we got a derivative, marked out some like terms, got rid of the k, which I wanted to make sure we had one of those. This is the slope of the tangent lines at any point on this curve. I don't know, is that realistic? For this curve, for the slopes, what about the slopes of the tangent lines here? Aren't they all positive? Right? Because this curve is increasing everywhere. So is that true about these? Seems to kind of match up in that respect that at least the slopes are always going to be positive. So we want the orthogonal trajectory. So the slopes of the tangent lines should be what? Negative. Just so we make sure we get to several examples today. What would be the next step? Right there. Actually, you can cross multiply here, right? Get the x's and the dx's and the y's and dy's together. Integrate both sides. We're going to have a y squared dy, negative x squared dx, both pretty easily integrable, right? So I think we can get it to that point. I just wanted to make sure we looked at one that had a k in it so we could eliminate the k. That suffices for a second problem. And then we'd have this family of curves that have a c or a k or some a or b letter in there based on the fact that we had to do a general anti-differentiation. All right, what else did you say, Nicole? Number six. Actually, let's just set this one up because I think that's the work to the problem anyway once we get it set up. Water trough is ten meters long. That really doesn't have much bearing on the problem with triangular ends that are one meter high and at the top two meters wide. So I guess this is one. And this is one. The density of water is given. The gravitational constant, 9.8 meters per second per second. Find the hydrostatic pressure on one end of the trough. So our trough is actually here. Setup only do not integrate. Now that's a possibility for your test too is get it to the point where it's set up and then we've done different types of integration. We've already been tested over that. So that's a way to kind of save time to make sure you have plenty of time to set each problem up. What do we need for hydrostatic pressure? Depth of what? Not the trough itself because different parts of the trough are different depths, right? So don't we need the depth of some generic horizontal strip, right? And then each horizontal strip is different depth which we have to describe. So the depth of one of the strips and what the area also of one of these horizontal strips. And it does say full, okay? I was looking for that very last statement. It's full so the depth, there's our water level up here. Let's kind of go to the end of this first. How about the area of this horizontal strip? Wouldn't it be this distance doubled, right? Mm-hmm. 2x by dy, delta y. I'm going to go ahead and call that dy since we're already in the integrand. Why is it delta y? That's how thick it is or tall. There's a little increment of y, sorry. So it's 2x wide and delta y tall. So that's delta y becomes dy in the integrand. So if we were doing a segment notation setup, we could have a 2x and a delta y and when that becomes the other s, then that can become our dy. So that means we're going to be integrating with respect to y. Let's go there. So from y equals, where do we start these little strips? Y equals 0 and our last one is up here at y equals 1. So we've got that taken care of. See a problem with what we have thus far? 2x dy, we're going to integrate with respect to y and we have an x here. Don't we have to get it some way to describe what x is in terms of y and don't we need to use this line right here to do that, right? Don't we need the equation of that line? So we have, it goes through the origin and what is this point right here? Over 1 and up 1, right? So that's a pretty easy line. What's that line? Y equals x. So we can replace x with y, which we'll do. Alright, so that looks pretty good. How about the depth of this particular horizontal strip? Here's how deep it is. How do we describe that? This is 1 and what is this from the x-axis up to this point? That's y. So what we want is 1 minus y for the depth of that horizontal strip. So here's 1 and there's y, so what we want is 1 minus y. And density, don't we just throw in these constants, right? We've got meters, so 1,000 kilograms. So are we going to be able to get rid of cubic meters here in the integrand? What is 1 minus y? Isn't that meters? 2x was also meters and dy or delta y was also meters. So there's meters cubed, so we're going to get rid of this. And then we also need the gravitational constant, right? In this case, because we're working in meters, 9.8 meters per second per second. If it's in pounds, like if it's 62.5 pounds per cubic foot, that's kind of got the gravitational constant already built into it, but if it's anything in terms of meters and kilograms in seconds, we need to throw that in. Now, how does this match the setup? What problem is this? Problem 6, I think I threw a G in there and then I put that gravitational constant in the integrand the second time through.  Not a whole lot left, you've got a y and a 1 minus y. So the integration is by far the easiest part of this problem. Distribute the y, so you've got an integral of y minus y squared, which is y squared over 2 minus y cubed over 3. Evaluate from 0 to 1. So the setup is the important part. And really, that's, I mean, we did, I think we did a trapezoid. The end of a water trough was a trapezoid. If it's something like a rectangle, that you can't really get a whole lot easier than that because the x value wouldn't vary as you work your way up this line that serves as the edge, the x value would always be the same, right? If it were rectangular, it would be 2 or 1.5 or whatever that distance is. What would change if the tank is only half full? Okay, that's a good question.  What changes in this problem? So from the depth standpoint, from where the water is, we'd have to get our horizontal strip picture down here, but if it's half full in a sense that it's up to a half instead of all the way up to the top, which is up to 1, then this would be a half minus y. That's how deep beneath the surface that horizontal strip is. The area of the strip stays the same, and then where do we form our horizontal strips and where do they stop? They would go from zero to one-half, right? I mean, how much of the tank is above where the water is, that becomes irrelevant, that there's no pressure created by the fact that the water level is here and you've got some more tank up here, or water trough in this case. Anything else before we leave this one? All right, what else? What else should we look at today? Orthogonal trajectory, pressure, tank, okay? And there isn't one on this test, so let's find one. We've done several as examples in class. I don't think we did... No, we did the one with pure water, didn't we, because we had zero salt coming in. That's probably the simplest case. Let's see if there's any in the chapter review that we could pick off as an example. I don't know, the best one on the review page is here. We can address that after we set this up. This is on page 553, tank problem. Now, when I say tank problem, I don't mean any problem that's talking about a tank. We just did a water trough, which if you want to think of that as a tank, but I don't classify that one as a tank problem, that would be a pressure problem. So a tank problem is a mixing problem or a change in dilution problem. So this is problem 18, looks like pretty standard tank problem, testable problem. A tank contains 100 liters of pure water, brine that contains 0.1 kilogram of salt per liter enters the tank at a rate of 10 liters per minute. So we've got the rate coming in. The solution is kept thoroughly mixed and drains from the tank at the same rate. How much salt is in the tank after six minutes? So I think the WebAssign type question was how much is in the tank after T minutes so you get kind of the formula and then plug in a specific value. All right, so salt. So let's let S equal the amount of salt in the tank at time T. So the rate of change of salt is based on two highly scientific things. The rate that salt is coming in, kind of wrap your mind around that, and the rate at which salt is going out. Not a tricky beginning for tank problems. Now, to address chandlers, there may be two different spickets coming in. You just analyze them separately, and it better be true that the sum of the flow of the liquid here is equal to the liquid that's going out. Otherwise, this type of problem falls into a different category and you're not responsible for it at this point in time. You can mix them if they're different densities. Yes, so they might have different concentrations of... one might just be pure water, the other might be some concentration of brine. They're both coming in. But the sum of the liquid flow coming in for us at this point in time better equal the liquid flow going out. So the tank is going to remain constant at 100 liters. Now, can you envision what's going to happen if they're different? When we start to do the concentration of the stuff coming out, it's not going to be S over 100. It's going to be S over 100 either plus a certain amount because it's growing because we got more coming in than going out or 100 minus a certain amount because we've got more... it's a mess. It's quite a bit messier when the flow in and the flow out are not the same. Somebody said something. Yes, Shayna? So like if one's coming in at five and the other's coming in at 10, the rate going out has to be 15. Yes. All right. So what do we have here? Brine that contains 0.1 kilogram of salt per liter. So here's what's coming in. It enters the tank at a rate of 10 liters per minute. So I usually take a couple seconds to say, does that sound like to me the rate at which salt is coming in? So many kilograms per minute. Kind of sounds like the rate at which salt could be coming in. The rate at which salt is going out, well, it better be leaving at 10 liters per minute. And then you ask yourself the question, how much salt do I have in the tank at any point in time? Well, it's already written down on this sheet. How much salt do we have in the tank at any time, too? S, that's what S is. And it's... so that'd be S kilograms out of 100 liters. So that might look like a five. That's an S. So our... So 0.1 times 10 would be 1 minus, what? S over 10. Pretty simple differential equation. I always kind of cringe when I see the minus here because some kind of minus problems. I like all multiplication and division and I kind of get a little uneasy when I see subtraction, but I think we'll be okay. Before we separate what recommendation did we make the first time around? Pull out the coefficient of S. So we're going to pull out a negative 1-tenth. Don't have to do it, but I think it makes it easier from this point. And that would be negative 1-tenth S minus 10. Is that right? This is probably not one of those problems where you're just going to set it up and not finish the problem because there are some conditions that are given in the problem. So we want a specific amount in the tank at the end of six minutes. So this will be a complete completion type problem. So that's gone. That's gone. So we integrate both sides. This is where I think it's advantageous to have factored out the negative 1-tenth that's in front of the S. This left side becomes what? Natural log of S minus 10. We did the absolute value route and we see at some point in time later in the problem we can dispense with that. So let's just dispense with it right now. Next, exponentiate both sides. Left side is S minus 10. The right side, we've done this enough. Let's just skip a couple steps. B. Does that work? Right. It's going to be E to this, times E to the C, E to the C is a number, so we'll just call it B. All right, so we've got it solved for S. Let's go back to the problem. A tank contains 100 liters of pure water. What does that tell us? Initial conditions. At time zero, what is S? Zero. No salt at all in the tank. So there's E to the zero, which is one. So that's just B. So B must be what? Negative 10. So there's our equation in terms of T. And as long as everything was given in terms of minutes, which it was, as our original unit time, we want to know the amount of salt in the tank at time six. We just plug in a six. Is that correct? Yeah. So for T, we'll plug in six. Do the arithmetic button pushing, whatever you want to call it on the right side, and it should give us the amount of salt in the tank at the six-minute mark. Is that all right? The very first statement in the problem, a tank contains 100 liters of pure water. Right. So keep in mind what we're talking about in the problem. Are we talking about a pesticide? If it's pure, there's zero pesticide. Are we talking about some concentration of salt? If it's pure water, there is zero salt. Okay, what else should we look at today? Can we do something out of a tank? Pump something out of a tank? The work? Yeah. A work problem? Okay. Center of mass. Okay. There is a center of mass on here. Let's look at this real quickly, and then we'll go to a work problem, and that's probably all we have time for. Center of mass on here is number four. Off to the side on the center of mass problem, you will probably want to find the area under that curve, because X-bar, I think the formula in the book says one over A, or just remember to divide through by the area under this curve. What do we have for X-bar? X, F of X, DX for Y-bar, one-half F of X squared. So we do need the area. So in this problem, let's save a few moments, we need the area. So the area under this curve, it is the square root of X curve from zero to four. I don't think that's an issue at this point in time in this course to integrate this and evaluate it from zero to four. It's on the sheet, and that is 16 thirds. So that's going to go here and here for the centroid or center of mass. So for the numerator, zero to four, we want X, F of X up here. What is F of X, the square root of X, right? So I'm going to divide that by 16 thirds, so I'm going to multiply it. Now let's just put it down here. So for Y-bar, one-half F of X squared integrated with respect to X divided by the area, which is still 16 thirds. That ends up being really nice and simple. Square root of X squared is just X. That's a pretty easy integration and evaluation problem. For the numerator there, you're going to get 16. Is that right? I'm having trouble picking out the arithmetic there. No. Actually, we're going to get eight. So that ends up being three-fourths. No. I've got my arithmetic wrong here somewhere. So X squared over two from zero to four. Now it would probably be four, right? Yes. So there's Y-bar. This X times the square root of X is just X to the three-halves integrated would be X to the five-halves over five-halves. Evaluate it from zero to four. And that ends up being two-fifths of... So we'll bring that up three-sixteenths. We're going to have a two-fifths from the division by five-halves. And so four to the five-halves. Yeah, square root of four or two to the fifth, 32. So there's the arithmetic on that one. Which X-bar is 12-fifths. Might be helpful on a center of mass problem. Here, it's just X, and we're going to integrate with respect to X. So that just stays the same. I put four in. Yeah, four to the five-halves. So it'd be the square root of four, which is two, two to the fifth, which is 32. So there's our region underneath this curve from zero to four. So X-bar should be 12-fifths. This curve looks a little bit heavy on the right side. So it should be larger than two, right? Which it is, two and two-fifths. So it's over here somewhere. And Y-bar is three-quarters. What is this right here? Two, right? So probably right in here. So it seems like a reasonable answer for that region. And I think that's certainly a fair test question. A good indicator that I thought that was a fair test question is because I put it on a test. Therefore, I must have thought it was fair. Actually, it's probably on the easy end of fair. All right, a work problem. Let's say that we have a... So let's say we have this trough, or lack of a better word, and it ends our trapezoids. And let's say that this, I'm just making up numbers. Let's say this is two. And up here, this is five. And it is six feet deep.  So we want to know how much work is involved in pumping the water that's in this particular water trough out to the top of the tank or trough. So work is going to be force times distance, so we're in feet here. So we need to take a... And not just a strip of area, because we don't just want pressure on the end. We want kind of how much volume is in that particular slice. And then not just the volume, because it's not just volume that's going to be able to move it. We want to know how much that actually weighs. That's going to take that amount of force to actually move it. So that distance is x. And so we want 2x by delta y. So I'm going to off to the side do a little volume. 2x by delta y. Don't we also need to know this dimension? Which we don't. So let's put in a number. Let's say it's 10. That's going to be given to you. So that's the volume of water in that particular slice. So that is feet, that is feet, and that is feet. So we've got cubic feet. Now that's not the force required to move that. So what is the force required to move it? That times 62.5 pounds per cubic foot. So we've got a 2x, we've got a 10, and we've got a dy. That's the volume. 62.5 pounds per cubic foot. So that's the force now that's going to move that. And how far do we have to move that particular slice to get it to the top of the tank? Don't we have to move it this far? So 6 minus y is how far we have to move it. We've already got our incremental value, which is delta y or dy. So we would start with the strip at the bottom of this tank, which is what? y equals 0 and go all the way up to the strip or slice at the top of the tank, which is y equals 6, right? And then what work is left? Okay, all the y's are okay because we've got dy's. We've got to get rid of x. Don't we need the equation of this line? Do we have two points on that line? What's this point? 2, 0. And this point is 5, 6. So you would use that point and that point to find the equation of that line. Once you have it, you can solve it for x. It'll be x in terms of y and replace that quantity for x. So there's a work problem and we're out of time. I don't want to keep you from your next class. Tomorrow is the test. We can start it at 5 minutes before the normal time and end it 5 minutes after the normal time. So that way you get it out.


Why choose Manipal Hospital? Manipal Hospital probably brings one of the most advanced state-of-the-art MEZOR-X guidance system along with a synergistic combination of a 3D O-arm which allows us to give precision and safety during any spine surgeries that involve spinal instrumentation.