Welcome back. This is Ona with Art of Awakening and I'm going to do a little bit of an art reading here for Eclipse Season. I've been, I actually technically don't have the time for this today but I'm doing it anyway because I'm being guided to. And because it's my joy to do so. So I am being asked to bring forward an angel of light for this eclipse season because we are in the midst of eclipse season right now. And we just had a solar eclipse last week. We're looking at a lunar eclipse coming forward next week and it's pretty intense. And I don't know about you but I'm seeing a lot of just disturbances, right? And I know we have the earthquakes in California that certainly counts. I've been hearing a lot of people with experiences with insect incidents. I had bed bugs, yellow jackets I'm hearing, people getting stung, paint your bugs, all sorts of stuff like disturbances, bugging things, bugging, right? Just coming out of the woodwork. I'm also getting a lot of just noise disturbances, jackhammers, pounding in the night, weird mechanical noises, you name it. All this stuff is coming forward and of course it's all metaphorical, right? As we move forward in our spiritual journeys it's like it becomes very apparent that all this stuff that comes forward in life really is just sort of a mirror of what's happening spiritually and you know collectively we're going through a huge, huge shift so we just came through that summer solstice so it is no wonder that a dark rebound kind of happening. Eclipses do that, right? So what an eclipse is is the sun that the light being blocked. And so when it happens like spiritually it's a time of a lot of vulnerability, right, in a way or it's just a time where dark energies can come forward because there's actually, there's some spiritual people that believe that during an eclipse it's actually less, you know, spiritual light that gets through than at night time so, you know, it's pretty it's pretty significant. So if you're experiencing stuff like this, you know, the way I'm looking at it is that it's really a good thing in that it's allowing us to, it's allowing that stuff to come to the surface so we can look at it, right? And this angel really she's got this she's really looking and she can see through this stuff, right? And that's what we're being asked to do is to see through it and to see through something you really have to look at it. I'm going to share a very humbling story that happened to me this week. I belong to a, well I belong to several private groups on Facebook but this particular one acquaintance of mine, this one is all healers that I'm talking about at this group that I belong to and an acquaintance of mine kind of put forward that she wanted to, you know, was open to trading sessions and so I decided yeah sure let's do that. So I met with her on Monday and it was my turn first to be the receiver and I just found myself really, really, really resistant and this particular healer is, she's really good at just kind of digging down, right? And kind of seeing what's underneath and my inner child was like man, super not wanting this to happen. Hold on I'm gonna, well it's gonna try and find an eraser but maybe I'll just make do with what I got. Yeah so it was like, I was super, super resistant and it was like I'm fine, I'm fine, I'm fine and finally, finally you know she kept working at it you know and I just kind of that part of me broke down and I was like yeah you know what there's all this stuff and to be honest it was like really it brought up like I was just pissed. My inner child was like or you know part of me was just like you know what I have been doing this work for years and years and years and you know and I have come a long way you know but part of me has been like oh well you know I've come this a long way but now it's really time to look at okay where's the deeper stuff right there's a deeper layer and so this ties in with some patterns that I've been seeing you know people come into me whether it's clients or people simply emailing or just people in my life or myself I'm including myself in this like these patterns that I'm seeing and one of them first of all before I go into this I want to say that it is a really wonderful exercise to look back and and I really encourage you to do this because I'm going to say things that are you know maybe going to be triggering egos right that are meant to trigger the ego but but before that it's also really really important to take a look at the progress that you've made right because we all you know if you're watching this you're I'm sure you have made like look back at yourself from two three four years ago even a year ago and it's going to be like a different different person right and I almost feeling like she needs to be she's holding up a mirror let me see how this is going to work anyway um yeah so so first of all just really pat yourself on the back because it's been a tough road a whole whole these past um a few you know months and you know there's that I know that you've made huge progress I know I have um like I look back and and I'm really in a different place than I was um even a year ago but certainly like four years ago way different place manifesting all sorts of things it's been a wild ride and um a lot of good stuff right um okay so that said you know just really give yourself credit but in doing so what you've liberated yourself into is being able to now look at a deeper level a deeper level of you know stuff um um so you know what I'm asking us to look at this this is a mirror but she's also it's also light right get this other hand up here okay yeah so I hope you can see this yeah how good looks looks like it's picking up on the camera um so okay so here are the couple of the patterns that I'm seeing one is patterns of pride right and just straight up pride and that's what I'm talking about with like you know myself that didn't want to see it um you know the the the deeper things that need to be addressed and but there's also there's like different ways for pride to manifest one is like but the one I'm thinking of right now is that I'm fine oh okay there's a couple that are coming forward one is comparing oneself to others right um especially on the spiritual journey um and the way I look at it is like we're all each other's twin flames ultimately right so we're all eventually you know after eons and eons we're all so we're all just facets of god we're all facets of the divine right so eventually we're all gonna kind of meet up in the same place so there's really no no no no such thing as a head or behind spiritually there just isn't um and then also we all have our own gifts and strengths right just like each animal like I'm thinking of like what if a beaver was trying to run like a deer and comparing himself to that and he wouldn't be really in his joy right and we probably wouldn't have the beaver dams because he'd be out there in the forest trying to run like a deer so really it's like but if I mean if he's comparing himself to a deer it it looks like he's not really getting anywhere or doing anything right um maybe not the greatest analogy whatever but I think you know what I'm saying it's like you know we each have our own path and our gift and it's really the encouragement is to really look for the truth of what brings you joy because there's your gift and you know we each have these spiritual gifts and they're brought out in our joy okay for a little color here and uh so you know what's what's holding it back from your joy think about that and then the other one aspect of pride and pride you know we all have it okay so I'm not pointing fingers at anybody except maybe myself right you know because we we all we all have this it's it's the ego the ego is um you know it's a prideful thing and and this is not the same kind of pride as I'm asking you to have when you look back and realize just just how far you've come that's that's that's the light side of pride right you know we we we need that acknowledgement we need that validation um you know that is nothing to avoid right we need to to to hear it from ourselves we need to hear from other people you know I mean it's nice to hear it from other people it helps um but then when the pride becomes like you know this judging kind of deal that's what we want to just sort of avoid it so another type of pride is I'm fine I'm fine I'm fine and I've you know I've been doing the work and I I I know this oh yeah um yeah we've been doing the work and we know this we do know it and that's the thing it's like we do know it underneath and all your higher self does know this stuff right um so the the tricky thing about this kind of pride is that there is like a lot of truth in it right um and that's what makes it so tricky right it's it's easy to see illusion that is pure illusion it's not so easy to see illusion that is mostly truth right but but like um corrupts the truth right that manipulates the truth okay that's a little harder to see so this is why I'm bringing it up um just because it's it's something that we all deal with um so I'm fine look at your life and see where you're where you're telling yourself I'm fine I'm fine I'm fine but it's really not right um you know I'm I've been doing the work yeah if you've been doing the work but you're still experiencing blocks you're still experiencing um you know whatever it is the depression that comes up you know don't feel like these things are bad they are there to just call to attention and bring stuff to light right every time the shadow comes up it's simply asking that we look at it it's asking to be acknowledged right um so when we just look at the truth and accept it that's when you know that's when we can start to shine the light I'm thinking this is a beautiful angel where else we can do what color hair should she have I'm almost getting sort of like this it's just almost like I don't know why I'm thinking kind of purpley purpley hair I've been having purple come forward a lot there's like a lot of purple around lately so purple you know it's the violet flame and it's a transmutation so here's the the encouragement I'm gonna be putting a little shadow in here you know fixing her up a little bit here I may not finish her right now I may just post her later so if you want to see the finished one I'll post her when she's done and you'll need to subscribe for that not pushing you to subscribe I'm just stating the fact here um hold on let me find some purple okay so violet flame you can always call on the violet flame right to transmute things but um which is quite powerful you can meditate with it or just you know call it in maybe this is the angel amethyst but um part of what I'm being guided is really to that it's it's okay so here's here's what I'm being told here's what I'm really tuned into it with nature right because we're dealing with our animal self right um because we're dealing with darkness and darkness comes up and we've all dealt with a lot of darkness and that's why we're you know we're we're coming out of that um so when an animal is injured a lot of the stuff goes back to injury of some sorts to having suffered and you know whether it's this life or past life or whatever it is um so when an animal is injured it it it doesn't like even if it's in a lot of pain um typically a wild animal even a pet is not going to show that pain it's it's they they can be in a huge amount of pain before we you know they even give any whimper right um and there is a reason for this because in the wild any show you know if an animal is obviously vulnerable if it's showing its vulnerability that animal becomes a target for predators absolutely a target okay and so this is an instinctive reaction um it is a survival response okay so when we're in pain when we're feeling threatened or in pain it is a survival response I'm fine right um so I think it's really important to have compassion for ourselves when we have that response um because it's therefore a reason and somebody recently um kind of posted something about the ego being the protector and I thought that was a really wonderful insight um because the ego really developed in animals and we can see that animals do they don't have as strong an ego as we do but um you know they they do have ego right um you know if you've ever seen it can't get pissed off or something right you know they've got an ego um so it's like the ego developed in the animal world as a protector right um and in the mind which is really the ego is really hangs out with the mind a lot right um it was developed as a protector thing for the survival thing to help animals to deal with a harsh environment um so there is this this um inborn tendency in all of us that's our animal part to um to just like say I'm fine and the thing is that when you know and that actually served as well as as humans right in this you know when the world is in 3d well we're shifting out of 3d and it's no longer serving us because it keeps us in 3d right that that idea of I'm fine I can deal with this and what happens is that we it keeps us in those situations that aren't serving us because we're saying I'm fine I can deal with it and then we want to stay there right we don't want to change and so um in order to shift out of that it's really necessary to actually solve the root problem you know address the root problem of what's going on so we can heal so we can move forward because the other um you know because that's that's one aspect of an animal is the fight or flight or the um you know the stiff upper lip kind of response um you know that's one aspect of survival in animals is is that whole stress response but then the other aspect of survival that really doesn't get as much um attention as I think probably it should is the aspect of you know the thriving aspect and that's when you know they're they're they're having their um you know they're meeting behavior and they're feeding behavior and they're giving birth and they're they're happy right and that's where they spend most of their time really and so you know animals because they live in the present they very easily default back to that normal you know um thriving kind of mode okay that's what we need to actually teach ourselves to do and in order to do that because we are so um caught up in the mind um we need to bring it to consciousness right anything that is not um serving us or anything any old wounds we need to actually bring them to consciousness in order to heal them the animals don't necessarily right they just default back but we do and and that's why we go through all this work so um so here is the suggestion is to spend some time spend some time this week this is eclipse season it's also mercury retrograde so this is really really a good time to um sit back and and and um do some reflecting and maybe that's what this mirror is all about right um that she's got in her hand it's a good time to reflect and to really be honest with ourselves looking back looking at and the other thing I'm getting a lot is inner child work okay um dialoguing with the inner child asking the inner child you know um what how they feel it's a lot about feeling feelings coming forward and allowing the feelings to come forward because the feelings are what tell us they show us what's what's you know where where needs to be healed um so a few ways that I found really useful to do this um or one going out in nature is always healing um but you can journal is a really good way um another really good way is through the arts any of the arts um because like just and don't think about it beforehand just either start to paint or start to dance or start to you know write or whatever it is um and see what comes out ask your inner child what she wants to paint or dance or write right um see what comes forward and it might really surprise you it might delight you but it also might bring up stuff you know that to be healed uh like my inner child was you know it's like all about kind of being acknowledged and being recognized and um we all need that right so so see what comes up for you see what you have been denying yourself or see where it feels like other people have denied you remember that it's always a reflection of our own self right even though originally it might be something that happened to you as a child that was beyond your control but you know we all assimilate that stuff so all right so hopefully this has been helpful like I said I'm gonna finish her and um I'll post her as a as just a post when she's done and uh just really have a have a nice relaxing eclipse season uh it's a really good time to just sit back find some stillness breathe and relax and I believe you know I'm feeling like after mercury retrograde is done it'll be a good time to move forward again um but uh take a little celebration have fun I'll catch you next time


As-Salam-Alaikum viewers, welcome to virtual university. In today's lesson, we will be looking at a reading text, which is about primary and secondary memory in a computer. We are going to follow the same pattern as established in the earlier lessons. You are required to listen carefully as I read the text and then together we will do the exercises that follow the reading passage. Now the passage is about primary and secondary memory. The term memory is usually used to refer to the internal storage, refer to the internal storage locations of a computer. It is also called real storage or primary memory and is expressed as quantities of K. For example, computers are advertised as having memories of 16 K or 152 K depending on their storage capacity. Each K is equal to 1,024 bytes and each byte is equal to 8 bits. Primary memory is closely associated with the CPU because it stores programs and data temporarily, thus making them immediately available for processing by the CPU. To facilitate processing, two things are needed, random access and speed. The former means that any part of the memory may be read or accessed equally quickly. This is made possible by the system of addresses in primary memory, where the storage locations are like a series of tiny compartments each having its own address. These addresses are like the addresses of houses in that they do not change because they are always fixed, the control unit knows where to find them at a very high speed. When it finds them, it puts into the compartments whatever must go there and wipes out whatever was stored there. The information present in these compartments is called the contents of the memory. Primary memory is costly and therefore it is used transiently which means that a program or part of it or parts of it is kept in internal storage while the program is being executed. This however is not true for mini and micro applications where the computer performs the same function referred to as a dedicated function all the time. But since computers must process vast quantities of data and programs, a lot of storage space is required. For this reason various secondary memory technologies have been developed. Primary memory devices fall into two categories, sequential devices and a random access devices. Sequential devices permit information to be written onto or read off some storage medium in a fixed sequence only. In order to get at a particular data item it is necessary to pass over all the data preceding it. An example of such a device is the magnetic tape. Its cost is low but access to specified data may take a considerable length of time. On the other hand random access devices are designed to permit direct or almost direct access to specified data. These devices bypass large quantities of irrelevant data and therefore reduce access time considerably. An example of this technology is the magnetic disk which is faster than the magnetic tape and also more expensive. When disks are hooked up to the computer and used as an extension of internal storage in order to increase the capacity of primary memory this is called virtual storage. For example a computer with 256 k bytes of real storage may seem to have 512 k bytes of virtual storage by using disks to provide additional storage. Now take time and read the text I am sure you were reading it while I was reading it aloud. Now to test your reading comprehension 3 statements are given you. Which statement of the 3 best expresses the main idea of the text? After you have done that you must state why you eliminated the other choices. Number 1 there are two types of memory primary and secondary. Is this the main idea of the text? Is this what the text is about? Number 2 primary memory is more important than secondary memory. And number 3 secondary memory devices are unimportant in a computer system. Now out of these three which one is the main expresses the main idea of the text? Simple it is statement number 1 because this is what the whole text is about about primary and secondary memory. The other two the text does not say that primary memory is more important than secondary memory no and neither the third one. So your first choice is the correct one that the text mentions that primary memory is very costly it does not state that it is more important than secondary memory neither does it state that the letter is unimportant in a computer system. So it was statement number 1 that was that states the main idea of the passage. Now number 2 understanding the passage the number of statements are given and indicate whether the statements are really stated in the text or are they not stated in the text. Number 1 the term memory can be expressed in other ways the term memory can be expressed in other ways does the text say this or does it not yes it does it is stated that the term memory can be expressed in other ways. Number 2 computers are often advertised according to their memory capacity does the text say that yes it does that computers are often advertised according to their memory capacity this statement is also stated in the text. Number 3 the CPU can easily access information from internal storage statement number 3 the CPU can easily access information from internal storage is this statement stated or not yes it is the first 3 statements are there very clearly in the text these are all statements that are there. Number 4 mini computers and micro computers have a similar memory capacity does the state does the text say that no not at all so that is not stated. Number 5 the control unit needs to know the location where information is stored or needs to be stored the control unit needs to know the location where information is stored or needs to be stored not at all it is not stated so number 4 and 5 are not stated. Number 6 primary memory is more expensive than secondary memory number 7 there are 2 types of secondary memory device number 8 information stored on magnetic disk can be retrieved faster than if that same information were on tape all 3 6 7 and 8 all 3 statements are there in the text if you refer back you will find that they are there. Number 9 disks and tapes can be stored in a library disks and tapes can be stored in a library now does your text say that no this is not stated and take the last one computers can process information even if complete programs are not put in internal storage. Number 10 computers can process information even if complete programs are not put in internal storage this is also not stated look at the third exercise which is location information you have to skim the text go through it quickly to see where in the text these ideas are expressed now in which paragraph is it stated that speed and random access are important in processing information speed and random access are important in processing information if you scan it is very early in the text is paragraph 2. Number 2 random access devices are more efficient than sequential devices this information you will find in paragraph 4 and the CPU and primary memory work closely together this is in paragraph 2. Number 4 virtual storage increases the memory capacity of a computer virtual storage increases the memory capacity of a computer this is in paragraph 4. Number 5 real storage internal storage and primary memory are all the same this you will find in the very first paragraph statement number 6. Information is stored in memory in compartments with the specific location information is stored in memory in compartments with the specific location this information is to be found in paragraph 2. Number 7 there are 2 classes of secondary memory devices there are 2 classes of secondary memory device and that is in paragraph 4. Number 8 only parts of programs are kept in primary storage while a program is being run through only parts of programs are kept in primary storage while a program is being run through and this information you will find in paragraph 3. Now we will look at exercise 4 contextual reference now look back at the text and find out where the words that are given in bold type occur or where they referred what is it that they refer to this is always a very interesting exercise. Number 1 it is also called and this is in paragraph 1 find this phrase it is also called and what does it refer to what does it refer to it refers to memory. Number 2 depending on their storage capacity and the word is there on whose storage capacity whose storage capacity is being referred to it is in paragraph 1 and it is referring to memories computers. Number 3 thus making them in paragraph 2 you will find this phrase thus making them now what does them refer to it refers to programs and data it is in the plural so it has to be 2 things it must be them it must be programs and data. Number 4 the former means that the former the phrase former the former what does it refer to in paragraph 2 you will find this phrase and it refers to the former it means random access. Number 5 where the storage locations where the storage locations and this is in paragraph 2 what does the word where refer to it refers to primary memory. Number 6 each having its own address each having its own address what does each refer to each refers to compartment each compartment has its own address and number 7 in that they do not change what does they refer to they refers to in paragraph 2 to addresses of houses. Number 8 where to find them them them refers to addresses it is in the plural it is referring to more than one thing so it has to be something in the plural it is addresses. Number 9 whatever must go there whatever must go there t h e r e and there refers to compartments and the last one number 10 all parts of it in paragraph 3 find this phrase all parts of it and what is it referring to it is referring to program. Let us move on to exercise 5 which is a vocabulary exercise by this time you must have realized that all of these passages are on the same pattern and number 5 is always a vocabulary item it tests your it teaches you vocabulary now you refer back to the text and find the synonyms finds find words that are more or less the same in meaning. There is a word in paragraph 1 which is the same in meaning as the word represented when you think of a word can you locate the word which means the same as represented and it is the word expressed. Number 2 erases in paragraph 2 there is a word over there which means the same as erases it might not be a word it could be a phrase and the phrase is wipes out wipes out. Number 3 the phrase carried out is there a word in your text in paragraph 3 which means the same as carried out to carry out something carry out orders you carry out the orders of your superiors and the word is executed. So for before and in paragraph 4 there is a word which means the same as before and that is preceding you have got your prefix preceding that which came earlier on right it is on the preceding page. Number 5 very much the phrase very much in paragraph 4 is there a word in paragraph 4 which you could substitute for very much and it is the word considerably considerably. Now go back to the text again and look for words that are opposite in meaning to the words that I shall read out. Number 1 er number 6 the word latter is there a word in your text which is the opposite in meaning to the word latter, latter means opposite the opposite of latter is former. Number 7 disallow in paragraph 4 find a word which you can which is the opposite in meaning to disallow when you disallow somebody the opposite would be require required. Number 8 unnecessary paragraph same paragraph the word unnecessary and the word that is opposite in meaning is permit.  And number 10 imaginary is there a word in paragraph 4 which is the opposite in meaning to the word imaginary and it is the word real, real is opposite to the word imaginary. Now we will do an exercise in word forms how the form of the word changes and you choose the appropriate form of the words to complete the sentences. And then you can check the differences in meaning the words are number 1 4 words expression expressive express expressed different forms of the word information sent via a computer is faster than using system of airlines or postal services which form of that word of those words would be appropriate over here and it is the word express, express be such as he or she has a computer of a brain means that he or she is a fast thinking person. So those words that are in inverted commas there is a word in the English language which you can use for that and that is expression you have got many expressions tit for tat that is an expression right computer of a brain right that is an expression. And see computers understand commands in the form of 0 and 1 and the word is expressed number 2 again there are 4 words equality equal equally equalize right verbs nouns adjectives sometimes you even have adverbs over there and you have to see which one would be appropriate in which context number a the symbol and the symbol is given you means that two things are not equal are not equal notice the symbol two parallel lines short parallel lines with a line going through them which means that it is not it is in the negative are not equal right be a micro computer does not a mini cube computer in flexibility and the only word would be appropriate word would be equal number see the two computer languages Pascal and PL1 are equally difficult right number 3 again 4 words consideration consider considerable and considerably number a there is a difference between written and spoken English so which words which word would be appropriate can't have consideration consider considerable there is a considerable difference between written and spoken English be it is important to consider the capabilities and limitations of a computer before buying one and see new printers can print results considerably faster than previously right number 4 and it is the word design design designed designation designer and designing a due to the advances in computer technology computer are faced with a more challenging job so it has to be a noun computer designers not designer but designers because the gap is followed by R faced in the plural so due to the advances in computer technology computer designers in the plural are faced with a more challenging job be computers are to process information accurately and quickly computers are you got a clue it is a verb are designed the helping verb is there you have to have the other part of the verb are designed and see computer art architects are constantly trying to improve improve on the the and you know that the word the always accompanies a noun or a pronoun and the noun over here is on the design of computers right and number five you got three words advertisement advertise and advertised right a there are many computer related jobs in the New York Times simple advertised in the past tense advertised number B the computer center will soon for more operators and programmers the computers center will advertise and see career opportunities in computer science and related fields can usually be found in the section of newspapers again use your knowledge of grammar the grammatical knowledge and the word is advertisements because you have got there before that coming before so it has to be the advertisements right now let us do an exercise in which the contents of the text are reviewed and you have to match the words in column A with the words given in column B look at the two lists and quickly match phrases in A with phrases in B column B internal storage internal storage what would it match with what would it match with does it is it does it go with a means any part of memory can be read quickly equally no the information contained in the storage locations all right move on move on our storage locations in internal storage no refers to memory contained in the storage locations that is it number 1 matches with number D right now let us look at number 2 number 2 says real storage real storage means any part of memory can be read quickly and equally B the information contained in the storage locations C D E E hooking up sometime it is F F sometimes called primary memory right now let us go back to number 3 random access means let us look at from the beginning means any part of memory can be read quickly equally and quickly yes number 3 matches with number A and number 4 addresses yes it matches with number C our storage locations let us look at number 5 contents what are contents what does the word contents match with let us go to the beginning contents matches with B the information contained in the storage locations all right let us look at number 6 so we use the elimination process now you which ones are left now sequential access could refer to information must be read from secondary memory devices in a fixed pattern yes it is G and number 7 virtual storage virtual storage would match with yes you are left with E so it is hooking up secondary memory devices on to memory to increase their capacity right let us look at focus review now in this lesson we are going to focus on how writers use examples to explain a point or to illustrate an idea which is given in a text and it is important to differentiate between the idea and the illustration of the idea with examples and writers often say explicitly very clearly which things are examples by using connectives and these connectives are for example such as right now you look at the following table a table is given you and you complete it by referring to the text right the text on primary and secondary memory and you locate the connectives that have been used for illustrations and examples right now in paragraph 1 the table has 3 headings one is items or item to be exemplified in some the items are given you in some you find the example of the marker that has been used the marker meaning example and then you have an actual example are you with me the table has 3 3 parts the first part refers to the item that you have that the writer tries to illustrate then there is a column where the connective where that word is used which is used for an example and then in the third column you have to fill out the actual example as it is given in the text in paragraph 1 the item has been given you the item is quantities of k what is the example marker that is used the marker used is for example and the actual example given is memories of 16 k or 152 k in paragraph 4 you find an example the word an example is there you have to find out what item is being exemplified and you have to give the actual example scan paragraph 4 and you will find that the word the phrase an example refers to sequential devices and the actual example is magnetic tape in the same paragraph you will find an example given you the example is magnetic disk and you have to locate the item and then the example marker and the item is random access devices and the marker is an example notice sometimes it is an example sometimes it is for example and in paragraph 4 still in the same paragraph there is an item given you and the item is virtual storage look for the example marker and the actual example just look for the word for example this time it is for example and for example it is followed by the phrase 256 k of real storage may be seen to have 512 k now I am going to tell you something else and this is about how writers add information there are many reasons why people read but in an academic setting reading is primarily done to get information on a particular subject now it is important for the reader to understand the relationship between the information given and the information which preceded it the information that came earlier now often information is presented in such a way as to suggest a reinforcement a reinforcement of what has been said or to show a similarity of what has been said before now when writers give explanations about something they usually offer examples to support their argument in favor of a particular point now they can do this in two ways they can present the information deductively which means that a rule or a generalization is given first and then examples are given in support of the general statement or principle some writers like to do it this way others prefer to give examples first and then make the generalization this form of presentation is known as inductive so there are two ways of presenting information one is deductive and the other is inductive now when writers use argument to reinforce to support what they have said earlier they use typical markers and you as a reader if you are aware what is the meaning of that marker it will help you in grasping the point that the writer is making for example on your screen you will see this statement in addition to the speed computers are accurate and can do repetitive operations over and over again without becoming tired or bored now in that statement there is one phrase which is a phrase of reinforcement it is reinforcing it is repeating saying again what is it has said earlier and the you can pick out the phrase the reinforcement marker and that is the phrase in addition to the second example microcomputers are cheaper than mainframes as well as being compact and portable now you pick out the reinforcement marker in that statement microcomputers are cheaper than mainframes as well as being compact and portable there is a phrase over there that reinforces what the first half of the sentence says you pick it up pick it out right now the other technique is that of similarity and I will again read out two statements I will give you the example the first one and you look up the example in the second one in the first statement microcomputers can have a storage capacity of up to 32 k likewise mini computers now in that sentence there is a phrase mark there is a marker which denotes which shows similarity and that is the word likewise what is said in the first half of the statement is repeated again and it is the word likewise you read the second statement and you find out for yourself what marker is used there many mini computers are used merely for a fixed application and run only a single program microcomputers operate in much the same way as in the case as is the case in automobile emission control systems and with that we come to the end of today's lesson hope to see you next time Allah Hafiz.


With great pleasure, I welcome everyone to the session by Ben and Gerald today to talk about Charmed Secoing Digital. We are just glad that both of us could make the session today and share their experiences. Hello and welcome to how HMRC digital secures services at scale. Gerald and myself will introduce ourselves and then we're going to split this talk into two sections. So I'm going to go first. I'm Ben Conrad, head of product at MDTP, which is the tax platform at HMRC. I'm listed that Agile India is working for Her Majesty's Revenue and Customs, but like our national anthem, we've already changed the words to His Majesty's Revenue and Customs. HMRC are the UK tax authority, broadly equivalent to the Inland Revenue Service in the USA, or I believe the Department of Revenue in India. And I'm an APSIC snooper. So I'm going to start by giving some background to the platform, why we care about the security of the applications we host and what we wanted to do about it and improve it. And then Gerald is going to talk about what we're able to do and where we go from here. I'll give a really quick overview of this. HMRC are responsible for ensuring that people and organisations in the United Kingdom pay the right amount of tax and duties. The custom side of the organisation has needed to expand in recent years as a result of the decision for the UK to leave the European Union. Long before that, in an effort to reduce our postage costs, HMRC have been building digital services in line with the approach defined by the UK Government Digital Service, GDS, and that is broadly digital by default. To make all of this easier, HMRC have a multi-channel digital tax platform, MDTP, or just the tax platform. I'll probably switch between the names throughout this talk. The platform exists to make building and hosting digital services as easy as possible. MDTP is a platform as a service where the infrastructure, logging, metrics, alerting, CICD, testing, prototyping, templates, everything you need to build and develop a digital service is provided out of the box and nearly all of it is self-service. MDTP itself has been in existence for the last eight or nine years, so we're really quite mature and we host nearly all of HMRC's customer-facing digital services. As a platform, we provide a set of infrastructure and tools to allow people to build, test, and deploy services written in Scala with the play framework, and we think that we're pretty good at it. The platform is hosted in AWS, but the platform abstracts AWS services so that developers writing services to run on MDTP do not need any AWS credentials. We could in the future move MDTP to a different cloud provider, and although that would be a lot of work, the services running on MDTP would hopefully not need to make any changes. We often talk about MDTP being an opinionated platform. The opinions we hold define the paved road, the golden path, the bowling alley of success that we provide to our users, and the intention with that is that with people following that paved road, it will allow the teams to build services quickly and efficiently. The headlines of these opinions relate to technology, so use Scala for writing services, use Mongo for persistence, but they're also just as much about practices. We have opinions about using continuous integration, deploying frequent small changes through automated pipelines, and having really good test coverage. The payoff of this, why we do it, is that if you follow our opinions, stay within those guard rails, keep to the paved road, then you can focus on solving business problems and deliver value really quickly. The other result of this is that the services on MDTP are built using common technologies, where possible common components are reused, and there are common patterns. And as we'll talk about later, there's a huge advantage that stems from that, from that degree of consistency in the applications that we host. So what is AXEC? For someone like myself with a mild speech impediment, there's a risk that it will sound much more rude than it normally is. Application security, which we differentiate from our platform security team. We've always taken responsibility for the security of the platform itself, the infrastructure, the features that we build. However, it should be clear that just concentrating on the infrastructure is only one side of the coin. The platform itself can be hardened and held to be relatively secure, but that doesn't really count for a lot if the applications we're hosting are riddled with vulnerabilities that are easy to exploit. We may be able to build really strong walls that withstand all sorts of attacks, but if the windows and doors are wide open, it's not going to provide a high level of protection. The services hosted on MDTP have always, and I certainly hope always will, have responsibility for their own security. But because of the consistency that I've mentioned, we're able to effectively look for vulnerabilities, not just in a single service, but in hundreds of services at a time. We can also provide tooling that enables the teams themselves to proactively check the known vulnerabilities in their code, and all of that is part of an automated CI CD pipeline. Yeah, this is what we're trying to avoid. Whether it's our platform security team or the application security team, that the goal is essentially the same. We want to prevent security incidents. A security incident for HMRC can be categorized in a large number of different ways. There's reams of text on what defines a security incident for us. The point I'd like to make is that we're a large target. We process payments of hundreds of billions of pounds every year, and we legitimately pay out billions, even in years without a global viral pandemic during the COVID, we built services that paid out an awful lot more. The applications on the platform process the data for around 45 million individual UK taxpayers and around 5 million different companies. And that data in itself is really valuable. And the UK government has legal responsibilities to protect it. And the APSEC team are focused on looking at the security of those applications in the whole. There are three aspects of APSEC to find here. Finding vulnerabilities, fixing those vulnerabilities. And if you can find and fix them before anyone else is able to exploit them, then you'll likely prevent them from being a problem. Indeed, there are other steps you can take to prevent even widely known vulnerabilities from being exploitable if you've got the right protections in place. I guess as an example of this, there have been recent attacks where an application might have been susceptible to the initial vulnerability. However, something like a proxy blocking egress back to the internet to everything other than a list of allowed URLs would likely be an effective mitigation in blocking that exploitation, which is defence in depth. But rather than focus on a single service, we have a slightly bigger challenge. We have a microservice architecture. And another of the rules that we have is that we are services to reuse functionality that is already offered by the platform. So there are some microservices that are used by nearly all the others. But the numbers on this slide fluctuate a bit. There have been around 170 new microservices created on MDTP so far this year, but not all of those we're running in production. Sometimes we get to decommission old services if they get replaced or aren't needed anymore. And how you count teams is quite difficult because whereas sometimes there's a one-to-one relationship between a team looking after a single service, we also have live service teams who they may look after 50 or more services and there are plenty that fall between those two extremes. And the teams can vary in size as well. The number that isn't on here is that there are over 250 digital services hosted on the platform, different journeys. And that's because the UK is really inventive at coming up with new taxes. So the point here that I've been labouring, I realise, is that we're operating at significant scale. We have our own in-house catalogue for these services and it's a really important tool for operating them at this scale. As I mentioned, one of our opinions is that the services on MDTP are built by agile teams. We ask and expect all teams to use continuous integration. There should be no waterfall development happening here. To enable this, we provide CI-CD tooling and at its most easy screenshot, that currently means Jenkins. Each commit on GitHub can trigger a pipeline of actions to build your software, generate a slug, that's an artefact that is stored in Artifactory. And then it will be scanned in Artifactory and it will be deployed to the first pre-production environment, tested, deployed to the next environment and different tests are run, depending on what the team have configured. And the testing will vary depending on the purpose of the microservice. So a front-end will likely include things like browser compatibility testing that obviously is no use for a back-end or an API. As a platform, we provide tools to allow automated security testing as part of those pipelines as well, which at the moment means ZAP. And again, I think this just highlights the scale again. There's quite a lot of changes to code happening here. On this graph, you can see Christmas and I think Easter to a lesser extent. Each of those lines of codes could be built into a new artefact and then be tested through the pipelines I've just mentioned. If a test fails, then the pipeline fails and the artefact won't progress any further. Deploying to production, by the way, remains a manual step. And all of this does create a challenge for HMRC because things are constantly changing on the platform and we want to know that we're not introducing security holes with those changes. Again, there are lots and lots of changes, lots and lots of deployments. I don't think it ever drops below a thousand deployments to production in any given month and in pre-production environments, it's generally well over 4,000. There are a lot of changes being made across the platform and a lot of these changes will be being proactively scanned with tooling research such as ZAP, but that in itself is not going to be effective in preventing vulnerabilities from being introduced. I just want to be clear here because it's easy to get the wrong impression. The number of changes in itself is not a security problem. Indeed, it's very much the opposite. If we implemented a change freeze and set the whole platform and aspect for the next year, we would become more vulnerable to security incidents, not less. A sizable portion of these deployments will be to upgrade code to remove older versions with known security risks. All of these changes are improvements for services that HMRC make available and higher numbers are better. I've already briefly alluded to the catalogue. This is an internal tool that we've developed in-house, but it is now possible to use more generic alternatives if you wish. As a tool, it's something of a Swiss Army knife. It holds a vast trove of information about the applications and nearly all of it, pretty much all of it, is automatically generated. So there are no manual updates required to anything here. What's shown on this slide is one of the most basic tools. It's what's running where. It's a really, really simple thing, but it's really useful when you're running at this sort of scale to have an at a glance site of which version of any given application is running in which environment. There's also information about every repository, every deployment, and we've got other features that allow you to view the microservices in many different ways. I think that's quite enough context and I'll get onto the security stuff. I hope I haven't bored you all too much. As I've mentioned, HMRC is a target for all sorts of people. The motivation of such people might just be disruption. We're a department of the UK government and not everyone around the world loves us and what we do. Not everyone in this country loves us and what we do. Some of them might be motivated to attempt something like a denial of service attack. There are also 60,000 civil servants of HMRC, so this is around the unauthorized access. All of those people will have been security cleared to varying degrees, but it's generally not very high. There are also thousands of people working at HMRC as contractors and just ensuring things work on the leavers process is a huge challenge. We are big supporters of coding in the open, but that does come with a bit of a risk that sensitive information will leak into GitHub repositories. We also have a lot of personal, if not sensitive information, running through the platform all the time and some of it will be logged. We try and ensure that we don't log anything which contains personal identifiable information, but it does happen from time to time. And then, as you can see in the slide, there are also those people who are always portrayed as hoodie-wearing types with a fear of direct sunlight. Some of those will be looking to gain access to the platform and the services hosted on it, whether they are motivated by a dislike of the soft-drinks industry levy or financial gain, or perhaps because they are being paid by a foreign state. And then that last point, vulnerable dependencies. It's something that's been a growing concern for a while now. There have been a large number of high-profile instances. It's important to be able to scan those dependencies, which is something that Gerald's going to talk about more in a moment. It's also really important, before you're even scanning them, to know what dependencies each service has. And that's a hugely valuable feature of the catalog. We recognise for some time that our success, our scale, has created a problem. Our platform security team was our first attempt to make security a first-class citizen on MDTP. We wanted to start looking at the security of those things that we had direct ownership of. And in a way, that was the easy part. With application security, there are other challenges. Services on the platform are, they're regularly reviewed from a security perspective, but not as often as we're making changes to them. As the platform teams, we decided that we could do more. And that's where the idea of a platform-based application security team came from. And the first remit was really just to go and lift some rocks, pull on some threads, and see what problems there are. And then secondly, investigating what we can do to fix those problems, and preferably do that at a platform level so that we can protect all the services running on MDTP and not require individual changes across thousands of repositories. And at this point, I'm going to hand over to Gerald. He's going to delve into some of the details about this stuff. Thanks, Ben. So I'd like to start by talking about the relationship between those service teams and the APSEC teams. So I've tried to borrow from the idea of team topologies. And we've got service teams that are sort of stream-aligned teams that build the actual thing. And we've got APSEC as an enabling team. Now, the first version of this slide looked a lot different. I sort of had a hub and spoke design with APSEC at the center. And then I thought, no, that's sending completely the wrong message. The service teams, they shouldn't be marginalized when we're talking about security. They shouldn't be pushed out to the edge. Every security issue depends on context. And the only people who are going to know the context are the people who are working on the service themselves. So this is my sort of idea of using this double robberos of the two snakes eating each other, that the APSEC team can't function without the service team, and the service team, they can't do all the security themselves. Right at the beginning, I said that my title is APSEC Snooper. And what that means is that because we've got this opinionated nature of NDTP, we've got that paved road, it allows me to look at services, to kind of go, is there anything wrong? That wouldn't be possible if we had 15 types of languages and four different platforms. So the important thing is that as an APSEC team, we're looking at things in general, sort of try to find issues. And when we find them, it's not about blame, it's about collaborating and making it better. And the catalog makes this easy because if we find an issue in one of the thousand services, we can look up, well, where's the Slack channel that allows us to talk to the team. And this collaboration works both ways. When a service team finds an issue themselves, they can feed it back to APSEC. They can ask about the best practices, they can ask for advice on how to fix it. And now for this collaboration to work, we need tools. And Ben has already mentioned a catalog. I'd just like to take a moment to look through some of the APSEC related tooling. The first that I'd like to mention is we've got a leak detection tool, which essentially keeps tabs on all the GitHub commits. And if it finds something which looks sensitive, like if something looks like a password, if something looks like an AWS secret, it will send out Slack alerts. But importantly, the security teams can look at the bigger picture rather than just individually having a huge list of alerts. The next tool is probably one of my favorites. It's the dependency explorer. This allows us to search through all of the dependencies by which I mean libraries of all of the services. Now, this screen is specifically why the log for shell vulnerability, which happened around Christmas 2021, was scary for us for only about 10 minutes. For anyone not aware, the log for J vulnerability was that you could send us specifically crafted text, which is then logged. And that logging could trigger information leakage or remote code execution, which is very nasty in itself. But we have a dependency explorer be typed in the specific dependency, and it showed that, oh, we're not actually using it in any of our services. Great. No problem. And an additional tool that we have is something that we've called Bobby. It's used as part of a build. And essentially it fails a build if it's got a dependency in it that we think we don't like. Now, there could be multiple reasons why we don't like something. It might be that we've upgraded some functionality and we want to make sure that everyone uses the same library or we found a security issue and we don't want people to use it. Now, importantly, we also have this idea of warnings of deprecation warnings so that failures don't come as a shock to teams. And the problem is with lots of these warnings, we don't want to overwhelm teams because otherwise with the scale that we're operating at, we don't want to be in a situation where lots of teams get lots of warnings and they start ignoring it. And the important thing about this tool as well is that it can be bypassed. So if there is a team that has got a critical update that they need to do and they need to do it today and they don't have the time to test all the dependency updates, we can get past it. Now, next, I'd like to sort of do a bit of a deeper dive in one of our latest tools. And one of the issues is when looking at vulnerabilities is that there's just so much of them. Now, each of the services, as I've mentioned before, has got dependencies. Typically, there are open source libraries built by somebody else. Sometimes they're supported by large companies or large communities. And sometimes it's just Jeff from Nebraska who's doing it as a hobby. Now, in MDTP, all of the dependencies get pulled into Artifactory. And Artifactory also hosts all the build artifacts and they're scanned by X-ray. The first issue with that scanning is the scale. When I first looked at the outputs of X-ray, I had a report with 800,000 rows. Now, the scale, unfortunately, is not the main issue that we've had with X-ray. I mean, look at this user interface. Maybe if you have a bank of 42-inch monitors, you could stretch the columns to be able to read it, but not with a laptop. And do I really want to look through 140,000 pages of the report? I don't think so. I think that's impossible. So just to sort of go over the numbers of what we found, and again, there's sort of very rough numbers, we were looking at for a thousand micro-services. We're looking at 100,000 reports covering 180 different dependencies up to about 600 different CVEs. Now, CVE stands for common vulnerability exposure. And it's what's used in the security world to refer to any issue that was uncovered. Again, I cannot overemphasize that the paved road here is very useful because we only use one particular language. It means that the amount of different vulnerabilities is restricted. I'd like to have a quick note on those vulnerabilities. The vulnerabilities use a vulnerability score, the CVSS score. And very often, I find that in tooling that is out, the severity of the score is used as a risk score. So you've got a severity between zero and 10, and people tend to use 10 as saying, oh, we need to fix this. But it isn't a risk score. We actually went back to all the CVEs that we found, all those 600 of them, and investigated them. And some of the worst issues that didn't have the worst scores, and some of the worst scores that just weren't an issue, it really depends on the context. You can have an issue that is really bad if it were to happen, but because of the way that you use a library, it will never happen. And this information isn't reflected in the scores. So if there's one thing that you take away from this talk, please don't define any policies like anything less than eight can go through because it's okay, and anything above eight needs to be fixed. So we've already established that x-ray is no good at the user interface, but what it does have is a really good API. So what we did in an agile fashion, we looked at how can we take those vulnerabilities and summarize them. And we came up with a couple of scripts that eventually essentially created a simple data pipeline. And that pipeline, we actually just used Google spreadsheets. Spreadsheets are one of my favorite tools, because I think they're very underestimated in the kind of things that they can do. So we now went from 100,000 reports and we aggregated them and used pivot tables, and we were able to draw first conclusions. However, that still wasn't really a great way of operating at scale. I can't expect 100 teams to all look at the same spreadsheet and all understand it. So what we did in true agile fashion, we sort of said, okay, well, let's plan out some way that we can visualize these things using the catalog. So I used this very simple three-by-three board to look at the different roles of what we want to get out of the vulnerabilities and look at, okay, well, what is a minimal viable product? What could we do in the next iteration? What could we do in the iteration after that? Really, really high-level planning. This board was essentially as much as it took us to sort of plan it, because we didn't know where it was going to go. So in less than a month, we had an MVP. And that's what it looked like. Instead of a fairly awful spreadsheet, columns that you can't read, we created something that can be used by the service teams to check how secure their services are, and importantly, contains the assessment by the APSEC team. This means that service teams don't need to look at every single vulnerability themselves. They can see what is something that will be investigated by them based on the experience of the APSEC team. So the whole point is not to overload the security teams. Now, I want to talk about that application security is hard. It's very easy to leak sensitive data, even if it's just into your own logs. It's very easy to miss something, and that could have a serious impact. I'd like to make an example by sort of look at an own goal that we sort of scored. We were looking at the development of the catalogue. We wanted to increase the sort of observability and started to record the HTTP request payloads. Separately, we also forced everyone to log in because we wanted to see who was using which part of the catalogue. And oops, we've just logged everyone's passwords. Now, the important thing here was something bad happened, but it's not the bad thing happening that's important. It's how we reacted. We found it. We calmly fixed it. We identified the users that were affected.  We learned from it. Another thing that I'd like to sort of point out, and after the sort of vulnerabilities, it's not the whole picture. It's to help keep services safe. We need to be proactive. Scanning the vulnerabilities is good, but we need to spot the problems in our own code as well. And what we did here is we created a risk ledger, which is essentially just a set of spreadsheets that identify areas where risky code could be, for example, XML parsing. So we looked at all the code and developed a way of finding every place where the XML is being processed and then put it on the list. Now, this, again, is an issue of scale. It's possible for some developers to remember this for 20 microservices, but not when you've got a thousand. And I'd like to, again, go back to the really important point what made this possible and feasible in MDTP is having that paved road, having that opinionated platform that allowed us to have a certain amount of centralization. But it's also important to stress this exactly the same benefits for developing services quickly. Ben mentioned the COVID support services. Now, some of those were developed in four weeks. They went from the design on the back of an envelope to being deployed to be used for millions of users in just four weeks. And it's important to state that no corners were cut. And because we have that sort of application security, we can provide a platform that provides speed and security. So I'm slowly coming to a close here. The conclusions for MDTP, again, the paved road is really important. The tooling is really important because it allows the centralized team to reach out to service teams, but it also allows the service teams to self-service looking at what vulnerabilities have been found. And it means that we spend our days doing better things than chasing down individuals and having lots of really good engineers helps as well. There's just a couple more things that I'd like to mention. I was listening to Jeff's keynote this morning, and there was struck by the fact that he was talking about being radically transparent to include the buy-in to agile methodologies. And I think security is agile. It must be agile because you can't predict all the threats that are going to happen. And the way to sort of deal with security is to work together, is to communicate, to collaborate. And by being open about it, that gets easier. Now, when I say open, it doesn't mean that you put every vulnerability that you have on Twitter. It doesn't mean that you give everyone your passwords. But to effectively secure a system at a scale, it's really important to communicate effectively. And when you can be open, when you can be transparent, that makes it possible. Now, here's an example of what we try to do to encourage that openness. We've created the APSEC amnesty. It's a lighthearted attempt sort of to encourage people to share the skeletons in their closets. Now, in closing, securing a complex system is hard. But you don't have to do everything all at once. You can start small. I would recommend you start collecting this threat intelligence, find out which service writes to files or talks to a particularly sensitive backend system, make a list, use a spreadsheet and then take it from there. Aggregate the data, script it, automate it, scale it in one word. It won't be agile about it. And thank you very much. Okay. Thanks, Kiral and Ben. I think it was a very informative session.


Now, in some cases, you'll be the one collecting all of the data, but in other cases, you'll rely on data that's collected by others, and rather than dropping a whole mess of numbers into your lab, typically this data will be summarized in tabular form, and so it'll be important to be able to find measures of center from tables. So for example, let's suppose that they have a large class of students taking a five-point quiz, and their tabulated scores look something like this. And from this table, we want to find the maximum, minimum, mid-range, mode, mean, and median. So we can see from the table the highest score represented is a five, while the lowest score is a zero, which gives us our maximum and minimum. And once we have the maximum and minimum, we can find the mid-range. Remember, the mode is the most common value, and so according to our table, we see that the most common value is four, which appears 35 times, which is more than anything else. How about the median? Remember the table is a compact way of listing all the scores. What it really indicates is that our scores are 0, 3 times, 1, 5 times, 2, 18 times, where we won't list all 18 twos, but we'll use the ellipsis to indicate we've dropped out a whole bunch of scores that are still there, but just aren't going to be written down.  Now remember, the median is going to be the middle score when all of the scores are put in order. So now all of our scores have been put in order. We just have to figure out where the middle is. So first, we can compute how many scores we actually have. That would be 3, plus 5, plus 18, plus 25, plus 35, plus 21. That's 107 scores altogether. So now I want the middle number. So since there's 107 scores, which is an odd number, if I subtract 1 I get 106, and I want half of those scores to be above the median, and half of those scores to be below the median. So that means there's going to be 53 scores above the median, and 53 scores below the median, and the median itself will be the 54th score from either end. So there are 35 plus 21, 56 scores of 4 or 5, and so that median is going to be listed somewhere in this set of fours. And so that means the median will be one of the fours. How about the mean? Since we have all the scores, we can find the mean by adding all the scores together and then dividing by the number of scores. There are three zeros, five ones, 18 twos, and so I can start to add them up. Three zeros, five ones, that's a lot of twos. Maybe there's an easier way of doing this. And definitions are the whole of mathematics. All else is commentary, and here the one definition that you'll want to remember from previous courses is that multiplication is repeated addition. So let's take those three zeros we're supposed to add together. If I add three zeros together, it's the same as computing three times zero, and so that sum is going to be zero. There are five ones, so I should add those five ones together, but that's the same as computing five times one, which will be five. Now the real time saver comes when we try to add together those 18 twos. So we don't actually have to add them. We can say that's the same as 18 times two, or 36. The 25 threes added together will give us a sum of 25 times three, or 75. If I add together 35 fours, I get 140, and if I add together 21 fives, I get 105. So I can find the sum of all scores. That'll be three zeros, five ones, 18 twos, 25 threes, 35 fours, and 21 fives, which gives me a total of 361 points, and there are three plus five plus eight plus 25 plus 35 plus 21, that's 107 scores, and so the mean will be the total 361 over the number 107, which will be about 3.4. One problem arises if our bins are larger than a single unit. So here maybe we surveyed 50 graduates of a college, and they reported their annual income, and we might get the following data. We'll still try to find the median and mean income of the graduates. So first of all, we notice that there are 50 graduates, so that means if we put the income of the graduates in order, that median will be midway between the incomes of the 25th and 26th graduates. Now the 25th and 26th graduates will be someplace in this second bin, between 20,000 and 29,999, and that's because the nine lowest incomes are the first bin, the next 17 incomes are the second bin, and the 25th and 26th will be among the next 17. The problem is we don't actually know what the income of the 25th and 26th graduates are, so how can we find the median? Since a bin includes all data values that fall within its range, we don't know what values are actually present, but we might use the middle of the bin as our value, and so we might take the median 20,000 plus 29,999 over 2 is 24,999.5. Now we can't use this number because that would commit us to all six significant figures, so we might say the median is 25,000. How about the mean? We could do the same thing as we did before, which is to use the middle of the bin as our representative value. So for the first bin, the income values are between zero and 1999, so we use the midrange, and it's important to keep in mind that we have to use this value without rounding because we're using it in a computation. Likewise, the income values of the second bin can all be treated as having a value equal to the midrange, 24,999,50, and for the third bin, fourth bin, and fifth bin. So our sum of values, well, there's nine at this 99,999,17 at 24,999,50, 12 at 39,999,50, 8 at 74,999,50, and 4 at 149,999,50, and that gives us a total income of, and there's 50 incomes altogether, so our mean is going to be, and we could say that the mean income of the graduates is $43,899.50. And if we wanted to lie, we could say that, but we can't guarantee this accuracy. Since we're basing our conclusion on a table where we only know the incomes to within one significant figure, we should only include one significant figure in our answers, so the correct way of stating our conclusion is to say that the mean income of the graduates is $40,000.