Ladies and gentlemen, welcome to the sixth first annual Ink Nobel Prize ceremony. Inflicted upon you, the annals of improbable research, better known as AIR, and by the Harvard Computer Society, better known as the Harvard Computer Society, the Harvard Radcliffe Science Fiction Association, better known as HRSFA, and Tangents, the Harvard Radcliffe Mathematical Bulletin, which wishes to be better known. We are gathered here tonight at Sanders Theater at Harvard University. And we begin with the entrance of the Nobel laureates and other dignitaries. We begin with the entrance of the Nobel laureates and the other dignitaries. We would like to begin with the entrance of the Nobel laureates and the other dignitaries. We begin with the entrance of the Nobel laureates. Are they coming at all? Get eventually to the entrance of the Nobel laureates and the other dignitaries. But first, it is time for the delegations to enter. And as I introduce, thank you. OK. As I introduce each delegation, please greet them with the respect that they deserve. And now, the grand entrance parade of the marching delegations, led by the exalted grand high pen gendrons of delegations, Margaret Ann Gray, Dee Dow Chase, and Ed Jacobson. Delegation number one, the Harvard Radcliffe Science Fiction Association. The delegation is, I have something to say about them here. And I have it right here. They are dressed this year as the Wild Life of Cambridge. That's W-Y-L-D-E. They are doing an authentic recreation of ancient ritualistic war regalia Harvard professors used to don before raids on Yale. Delegation number two, the non-extremists for moderate change from Finland. Finland is a delightful country located roughly 60 degrees latitude by 26 degrees longitude. You'll notice, by the way, that the non-extremists are wearing neutral colors. Delegation number three, the wearing school marching mathematics and chowder society. Delegation number four, tangents dedicated to the wacky, fun-loving side of trigonometry that we just don't get to see often enough. Delegation number five, Boston Mensa. And I've been asked to announce that in an effort to be more politically correct, its organization is changing its name to Personsa. Delegation number six, the junior scientists. Now look at their shiny little scientific faces, aren't they cute, ladies and gentlemen? Delegation number seven, the society for the preservation of slide rules. Delegation number eight, the parents of the junior scientists. Couldn't make it. Delegation number nine, the editors and former groupies of the annals of improbable research. Delegation number 10, Dilberts in disguise. Delegation number 11, the Museum of Science. Delegation number 12, CS50. Delegation number 13, the Museum of Bad Art. Delegation number 14, bearded men of both sexes. Delegation number 15, the Harvard Computer Society. There they are. It's just a virtual projection of them, actually. Delegation number 16, re-engineered process owners for jargon as a secondary communication unit. Delegation number 17, lawyers for and against biodiversity. Delegation number 18, Newhart and Daryl, Daryl and Daryl, who I was just told could not be with us this evening. Aw, working on that 12th Newhart comeback. Delegation number 19, the American Society for the Prevention of Cruelty to Martian Life Forms. And finally, delegation number 20, the Black Jokers. And as they all make their way to their seats, ladies and gentlemen, boys and girls, vertebrates and invertebrates, trees and shrubs, fruits and vegetables, amoebas, yeasts, and slime molds. May I introduce our master of ceremonies, the editor of the Annals of Improbable Research, the chief airhead himself, Mark Abrams. Before anything else happens, may I introduce the people who were supposed to have made it on stage about 20 minutes ago, but they're too important. So we save them till the end. Our dignitaries, the Nobel laureates, this year's winners, and a few other assorted robes. Well, welcome to the sixth first annual Ig Nobel Prize ceremony. The ceremony, as you know, is inflicted on you by the Annals of Improbable Research, the Harvard Computer Society, the Harvard Radcliffe Science Fiction Association, and Tangents. We're gathered here tonight to honor people whose achievements cannot or should not be reproduced. Tonight, 10 prizes will be given. The achievements speak for themselves, all too eloquently. Please direct your attention to the ceiling. To honor tonight's winners, we have refurbished the giant Sanders Theater Van de Graaf generator. We will have the privilege tonight of seeing it in use for the first time in 40 years. Now we begin with the introduction of our dignitaries. First, our Nobel laureates, a 1976 Nobel Laureate in Chemistry from Harvard University, William Lipscomb, a 1986 Nobel Laureate in Chemistry from Harvard University, Dudley Hirschbach, a 1979 Nobel Laureate in Physics from Harvard University, Sheldon Glashow. Professor Glashow telephoned us 20 minutes ago to say that he was indisposed. We noticed some of his friends are attending in the balcony and have that nice sign referring to Olestra. We'd also like to introduce a 1993 Nobel Laureate in Physiology or Medicine from New England, Biolabs, Richard Roberts. Now he had planned to join us, but for some reason instead chose to attend his daughter's wedding in California. Happily, happily, happily we have a plaster cast of his left foot, in which you will have the pleasure of seeing a bit later. We also have with us after a fashion a 1990 Nobel Laureate in Physics, Jerome Friedman, who for the sixth straight year was not able to join us at the last moment. However, he does appear now via the magic of audio tape and slides. The results that are being recognized here are truly awesome. Are enjoying this occasion as much as I am. Thank you, Professor Friedman. Let us meet some of our other authority figures. Our major domo, Gary Dreyfus. Our minor domo, James Mahoney. Our performing chemists, Yoast Bonson, Isabel Rosenberg, and Daniel Rosenberg. A ignoble referee, Mr. John Barrett. We will hear Mr. Barrett express much these same sentiments again later. Those worried about sex and violence, here is our V-Chip Monitor. Attorney William J. Maloney. The V-Chip Monitor will attempt to block anything offensive from reaching your eyes, ears, or fingertips. On with the introductions, our distinguished jazz harpist, Deborah Henson Conant, our distinguishable ignoble pianist, Greg Neal.  It is Mr. Morris who is handling all of the technical arrangements for tonight's live telecast over the internet. There are other important people up here, and you'll meet them a bit later. Tonight's ceremony will be broadcast on National Public Radio's Talk of the Nation Science Friday with Ira Fletto. That will be on the day after Thanksgiving, American Thanksgiving, not Canadian. And this year's ceremony will also be telecast someday soon on C-SPAN. And after covering Congress, apparently C-SPAN needs something dignified to put on the air.  And so here to give the forecast for tonight's ceremony is Channel 4 WBZ TV weatherman, Bruce Schweggler. That's cold weather tonight, but not inside here. For those of you with a sense of place, we are inside a building, so we don't have to worry about the weather in here. It's a perfectly regulated temperature of 70 degrees, except over there in the balcony. That's the Radcliffe side. It's frigid 22 over on that side. Breeze coming down from this side, I figure there must have been a faulty batch of beano the other day, and there's a little breeze coming in from that mesonene over there.  Could you calm things down over there? Calm things down a little bit here. Here's my forecast. There's a 20% chance of precipitation in here tonight. 90%. I'm talking it's going to rain cats and dogs. Well, better yet, I think it's going to rain tongues and cheeks. So we're going to proceed with the proceedings. And to leave you with a little weather proper, red sky at night. How about Nobel laureates delight? Red sky in the morning, Nobel laureate take warning.  Thank you. Thank you. And now, please give your attention to the Reverend Chandler Newton. Will you join with me now, please? In a moment of science. Tonight's entertainment report here is Sarah Edwards. This year, the Ig Nobel ceremony is a global affair. They're televising the ceremony over the internet to more than 100 countries. So I thought we'd join in the excitement and watch the action live over the internet. We'd like to thank Bill Gates for donating our spiffy new sound system, too. Ladies and gentlemen, please rise for the king and queen. Their majesties, the Swedish meatball king and queen. Your majesties may be seated. Your majesties may be seated. No, no, no, not you. Just you may have difficulty getting seated. Now you may be seated. And now, Harriet Provine will deliver the traditional Ig Nobel welcome, welcome speech. Our attention, please, for a musical interlude. Ladies and gentlemen, the third attempt to premiere the symbolic duet in F major with psychological undertones by Ted Kaczynski, performed by Dudley Hirschbach and Deborah Henson Conant. Does anyone in the audience have any symbols on you? Well, while they're looking for the symbols, we have two pair here. The editors of the Annals of Improbable Research have chosen a theme for this year's ceremony. That theme is biodiversity. We begin with some brief tributes to biodiversity first. First, here is the spokesperson for the Committee for Bacterial Rights, Kate Eppers. Good evening. We live in a diverse society. Our biggest ethnic groups are not the Asians, the Africans, or the Caucasians. Our biggest ethnic groups are the bacterias. Excuse me, Kate, there's a linguistic peculiarity here. The plural is not bacteria's oz. I speak in the vernacular. See, I used to wash my hands every day, my mom made me. But then I learned about ethnic cleansing. Every time you wash your hands, you wipe out billions and billions of bacteria, ah! That's not fair. Bacteria have rights, too. So let's be grown-ups about this. When your mom asks you to wash your hands, just say no. Thank you. The next three very brief tributes to biodiversity will be given by past IGNOBEL prize winners. First, please welcome back Dr. Robert Lopez. In 1994, Dr. Lopez won an IGNOBEL prize for the series of experiments in which he extracted ear mites from his cat and placed them into his own ear and then carefully recorded the results. Dr. Lopez, I like bugs. Bugs are a treat. They just can't be beat.  Be that baked or roast, and we've got some coming up here, they're more delicious than most. Why a cricket salad is sweeter than a ballad.  I want you to eat them now. We're going to have a bug bash. What can be so rash because bugs are low in fat? Here they are, they're in cookies. They slim you where you sat. Please pass them around. Bugs are high in vitamin B, really take one. So healthy you'll ever be. So don't turn up your noses, just think of chocolate. They're good, pop one down your mouth. They're delicious. Here are the chocolate crickets, they are delicious. Have a couple. Pass them around, they are great.  We would like to thank Harvard Food Services for their advice and assistance in preparing tonight's meal. Another of our returning Ignobel prize winners has gone a wandering. Is John Martinez in the house? Mr. Martinez apparently is trapped at or near the airport. If you're here, come up please. Mr. Martinez won an Ignobel prize last year in the field of nutrition for his involvement with Luak coffee, which is made from coffee beans ingested and excreted by the Luak, a bobcat-like animal native to Indonesia. We do have some coffee that Mr. Martinez sent us. We have that prepared? Oh, that's still down in the dining hall. It'll be up a bit later. Well, let us welcome back then. Better to arrive a moment late, but brewed perfectly. Gentlemen, to your health. Take a good look at them while you can. We'd now like to welcome back another returning Ignobel prize winner. Professor Hirschback assures us it is good to the last drop. Now, please welcome back another prize winner, Jim Knowlton. In 1992, Mr. Knowlton won an Ignobel prize for his classic anatomy poster, Penises of the Animal Kingdom. Mr. Knowlton shared his prize with the National Endowment for the Arts, which encouraged him to extend his work in the form of a pop-up book. Mr. Knowlton. Thank you very much. My research has revealed a surprising diversity in the members of the Animal Kingdom. Some of the members are large, others are less so. Thank you. Well, while I'm here at Harvard, I'd like to put in a plug for one of my favorite books, Stephen Jay Gold's The Mismeasure of Man. A Final Tribute to Biodiversity. Here's one of the authors of the landmark study, The Taxonomy of Barney. May I present from the Academy of Natural Sciences in Philadelphia, Earl Spommer. Into Harvard. Okay, Barney, the television dinosaur, is both loved and despised by American families. His agents purport him to be a dinosaur. And unsuspecting children are led to believe that dinosaurs sing, dance, and say sickeningly sweet things. Unindicted co-researchers and I became alarmed over this unscientific portrayal of dinosaurs. Our studies led us to the remarkable discovery that Barney is not a dinosaur. But a hominid like humans. Here is our evidence. Next slide, please. Barney appeared at a local shopping mall where we set up x-ray machines and left them on. This x-ray shows that the Barney skeleton is not like a reptile skeleton, but is remarkably human-like. Next slide. Computers are used to defy evolutionary trees for different groups of organisms. These trees, called cladograms, are produced by comparing the number and appearance of the characteristics, same characteristics on different animals. In keeping with scientific practice, we selected and discarded characters until we achieved the results we expected. We compared Barney to other dinosaurs, birds, whales, humans, and live and dead salmon. We looked at the differences in skin type, skeleton, blood temperature, and other things you might not understand. Next slide. The object is to produce the tree with the least number of segments in the branches. This tree compares Barney to dinosaurs, and it has 32 segments. Next slide. We were surprised to discover that when we compared Barney to dead salmon, the tree had 31 segments, one less than the tree comparing him to dinosaurs. Barney is more akin to a dead salmon than he is a dinosaur.  Next slide. Barney's smooth oral display is not made up of teeth. The teeth are hidden from view in the human-like skeleton within. The oral display may be a territorial display mechanism. On the next slide, we see that territorial displays are commonplace in humans, as illustrated in this picture of the Kaiser. The last slide corroborates our findings. The tree that compares Barney with humans contains just 29 segments. Barney is not a dinosaur, and our children have been duped by clever marketing agents into believing unscientific gibberish. Thank you. The preceding scientific report was not peer reviewed, nor do we in any way vouch for its authenticity. Mr. Sparmer will be returning later with something which is completely genuine. Now, the world premiere and final performance of a new mini operetta for Nobel laureates and mezzo-sopranos is called Lament Del Cockroach, and stars Margot McLaughlin and scientist supermodel Symmetra as cockroaches and the Nobel laureates as insects. The other voices you hear will be plants, singing plants. Those of you listening on the radio can read the words on our website. There are three acts, one now, two later. Here is our narrator, Lisa Mullins. Our opera takes place in the future. Various environmental disasters have caused most species to disappear. Now, something mysterious has appeared in the sky. Look, up there in the balcony, and you'll see it. The object is headed toward the earth, and it's threatening everyone with extinction. All the insects are desperate to mate with the one species that they think could survive anything, the cockroaches. It's a desperate time for everyone, cockroach and common are alike. But there are only two cockroaches left, both females, Thelma Laroche and her friend Louise. As act one begins, the insect laureates are ogling Thelma, but Thelma believes that mating should be only for love. Her heart is not stirred by these loathsome insects. Join us now as Thelma yearns for a tall, dark, handsome cockroach. 96 Ig Nobel prizes. We're giving out 10 prizes. Tonight, the winners come from six countries or territories, Japan, Norway, Great Britain, England, Greenland and the United States. This year's winners have truly earned their prizes. Lisa, tell them what they've won. This year's winners get a brand new supermarket bag, their choice of paper or plastic. Inside is a treasure trove of goodies. An Ig Nobel prize, a plastic travel mug, an autographed picture of Bill Gates, a week's supply of Pepto-Bismo and a matching set of finger and toenail clippers. This is the coveted Ig Nobel prize. And now our winners. First, the biology prize. 1996 Ig Nobel biology prize goes to Anders Berheim and Hogni Sandvik of the University of Bergen, Norway for their tasty and tasteful report, the effect of ale, garlic and sour cream on the appetite of leeches. The winners were unable to travel to Cambridge but they are watching us tonight live on the internet from Norway and they have sent us a videotaped acceptance speech. Members of the Ig Nobel committee, fellow laureates, colleagues, friends. We accept this prize with profound gratitude. We accept it as a tribute to our partners, the leeches, who showed remarkable enthusiasm during our experiments. Lab animals sell number six credit for their scientific achievements. The leeches' reaction to this honor was predictable. They celebrated it. Since the leeches are in no fit state to accept this award today, we have to rely on understanding. As is not the leech, we are confidently willing to behave with proper dignity. We again, thank you very much. We are honored to have with us here tonight to congratulate our winners the honorary consul of Norway to Massachusetts, Mr. Terry Korsnes. Thank you, thank you, thank you. My countrymen, Berheim and Sandvik couldn't make it. I don't know if they made it to Iceland or if they didn't leave at all, but they didn't arrive. Clearly, this kind of breakthrough research should be recognized, and it now is. And I'm sure this is the kind of recognition that the scientific community in Bergen has been waiting for. But I do fear that this topic is not taken seriously here in Cambridge. And perhaps in this audience with many bright minds, there is someone who likes to leech on to this topic for further research. And to facilitate that, I have brought these to distribute among you so that you can start your project. They have not been fed at all since this morning, so you can establish some kind of a benchmark right away. So if there is someone who really wants them, we can... Once again, we would like to thank Harvard Food Services for their assistance in preparing the ale, garlic and sourd cream for our little visitors. We now present the first Heisenberg Certainty lecture. These lectures are named after the Heisenberg Uncertainty Principle developed by Nobel Laureate Werner Heisenberg. The Heisenberg Uncertainty Principle states that while you can determine either the location or the momentum of an elementary particle with great precision, you cannot know both at the same time. Here are the rules. Each Heisenberg Certainty lecture can speak on a topic of his or her own choosing. Each talk is strictly limited to... The time limit will be strictly enforced by our referee, Mr. John Barrett. Mr. Barrett, would you like to repeat your advice for our lecturers? Gentlemen. And now the first lecture. Will the undergraduates bar the doors? Heisenberg Certainty lecture number one will be given by Nobel Laureate William Lipscomb. Gribbleland to position and momentum are spin about an axis and the angle of that axis. Now, to the candidates in the forthcoming election. If your speech has too much spin, you cannot cover all the angles. This Heisenberg Certainty Principle is analogous to my dedication to Congress. If your position is everywhere, your momentum is zero. I will sadly regret that our delegation of junior scientists is up past its bedtime. We now give the members permission to go home and do your homework. His Majesty, the Swedish Meatball King, wishes me to convey our thanks to you for coming and helping us tonight. A hand for the junior scientists, please. While they're departing, let's move on to the medicine prize. The Ignobel Medicine Prize for 1996 goes to James Johnston of RJ Reynolds, Joseph Taddeo of US Tobacco, Andrew Tish of Laurelard, William Campbell of Philip Morris, and the late Thomas E. Sandefur Jr. of Brown and Williamson Tobacco Company for their unshakable discovery as testified to the US Congress that nicotine is not addictive. The winners could not or would not be with us tonight. Regardless, they will be congratulated via audio tape by Nobel Laureate Walter Gilbert. Tree in 1980, on your prize-winning work, I'm sure that you find this reward is richly deserved. Thank you, Professor Gilbert. Just a word before the next prize. As those of you who read the journal Nature Know, the science advisor to the British Prime Minister has asked that no more Ignobel prize is be presented to scientists. Nevertheless, the physics prize. The 1996 Ignobel Prize in physics goes to Robert Matthews of Aston University in England for his studies of Murphy's Law, and especially for demonstrating that toast always falls on the buttered side. Now, the winner could not be with us tonight, but he prepared a special acceptance speech which he mailed to us and which is at this moment speeding its way to us through the Cambridge Postal System Murphy's Law. So we shall move on to, has that courier arrived yet? No. Will the graduate students bar the doors? Heisenberg certainty lecture number two will be given by the inventor of the plastic pink flamingo, Don Featherstone. We're going to talk to you about the durability of plastic lawn ornaments. They're probably going to be around for many, many a century. They're made of polyethylene. They don't disintegrate. And I'm sure archaeologists someday are going to find all of these things out and people's burned out, decaying sellers and wonder, what did they have them for? Because they really don't have any value like gold or diamonds, so they won't be pilfered by the crooks of the previous centuries. And they're going to just be there. So let's keep the archaeologists guessing and get out and buy as many of these lawn ornaments as you can, as much as your neighbors will allow. 1996 Ig Nobel Peace Prize is awarded to Jacques Chirac, president of France for commemorating the 50th anniversary of Hiroshima with atomic bomb tests in the Pacific. The winner could not or would not be with us tonight. However, we do have here to congratulate him via audio tape, Nobel laureate, Ellie Wiesel. Once again, we'd like to thank Bill Gates for our sound system. The public health prize winner of this prize has very graciously traveled all the way from Norway at his own expense to come and accept this prize. The 1996 Ig Nobel Prize in the field of public health goes to Ellen Kleist of Nuck Greenland and Harold Moy of Oslo, Norway for their cautionary medical report, transmission of gonorrhea through an inflatable doll. Ladies and gentlemen, I'm honored and delighted to accept the famous Ig Nobel Prize. I guess, however, I should not be too honored because this kind of research may easily be punctured. The biggest problem in this case was how to perform the mandatory partner notification and treatment. No reference in the literature on pharmacokinetics or antibiotics in inflatable dolls could be found. So what else could be done than just to give a shot and puncture? Thank you. We have a demonstration. We would like to remind you that when you date an inflatable doll, you're dating everyone who ever dated that inflatable doll. We'd also like to announce that Dr. Moy will be giving a special lecture on his topic tomorrow afternoon at 3.15 at the Channing Laboratory of Harvard Medical School. We invite you all to attend Heisenberg's certainty lectures. Will the postdocs bar the doors? Heisenberg's certainty lecture number three will be given by internet celebrity and convicted felon Robert T. Morris. Thanks a lot, Mark. Before I launch into my lecture, I have a proposal concerning the security of our national information infrastructure. Recently, the administration suggested that we all entrust the government with the secret keys that would allow the FBI to read all encrypted or scrambled messages. Many people objected and not just criminals. I think, instead, that some ordinary citizen, not upon of the government, should hold such keys. Now, let me tell you who I propose that person should be. The Chemistry Prize, 96 Ig Nobel Chemistry Prize, is awarded to George Goble of Purdue University for his blistering world record time for igniting a barbecue grill. Three seconds using charcoal and liquid oxygen. Here to accept, on behalf of Professor Goble, is his colleague, Joe Sykos. Roll tape, please. Well, it's hard to believe all that work started back with a hairdryer and a lot of hungry people who wanted to eat really quick. And on behalf of George, I'd like to thank the Board of Governors. Have a demonstration. Oh, look at the time. While we're running a little short on fire insurance, we'll try this particular demonstration another time. And now it's time for the Win-A-Date with a Nobel Laureate contest. Dudley Hirschbach, Nobel Studmuffin, is a 1986 winner of the Nobel Prize in Chemistry. Dudley is a connoisseur of fine wine and cheap cigars. He loves Chinese lunch trucks, synchronized swimming, and the poetry of John Keats. His wife respectfully requests that you have him in by 10.30. Please give a Win-A-Date welcome to Dudley Hirschbach. Professor Hirschbach just requested that we disqualify all inflatable dolls from winning this contest. Now, let's see which lucky audience member will win a date with this Nobel Laureate. When you enter the hall, you are given an attractive printed program. Please turn to page 12. One program has a special picture of Gregor Mendel eating a bowl of mashed peas. If you have that program, you've won a date with a Nobel Laureate. Come up and claim your prize. Please give your attention to Sister Christine McGurk. Please join me of science. This year's Ig Nobel Prize in Biodiversity is given to Chonosuki Okamura of the Okamura Fossil Laboratory in Nagoya, Japan for discovering the fossils of dinosaurs, horses, dragons, princesses, and more than 1,000 other extinct mini-species, each of which is less than 1,100th of an inch. We are privileged to have with us someone who is familiar with the many published works of our winner and who will explain them to us. Again, from the Academy of Natural Sciences in Philadelphia, please welcome Earl Spommer. The halls of science are emblazoned with the portraits of genius. Some men remain too long in these dark reaches, but true giants of science are pursued. This is Chonosuki Okamura. He lives in Nagoya, Japan, where for decades he has been cutting open rocks and examining them under microscopes. The next slide shows one of Okamura's many books, where he has published his sensational findings. He has done no less than portray serious flaws in the conventional theories of evolution. Next slide. According to Okamura, man and civilization were spontaneously created in Japan 400 million years ago. We are not descendants of apes or shrews, but a direct lineage from tiny human ancestors. The culturally refined fossil humans were just a few millimeters tall. Yes, just two or three millimeters. On the next slide, the tininess of ancient animals belied their true stature in the history of evolution. This is the miniscule ancestor of the giant Brontosaurus. It is two millimeters long. Next slide. Every modern organism, too, was revealed in Liliputian form in Okamura's microscope. The evolution of horses has now to be rewritten. These two equines were less than two millimeters long. They developed legs later in their evolution. Next slide. Dragons terrorized the tiny humans 400 million years ago. This dragon is just a few millimeters long. Had Darwin gone to Japan instead of to the Galapagos, our knowledge of evolution would be vastly different. Next slide. This is a mini-man, just two millimeters long. Okamura named it as a new subspecies, Homo sapiens mini-lorian talus. On the last slide, I want to say, on behalf of Chonosuke Okamura, I thank all the little people who made this ignoble award possible. Will the junior faculty bar the doors? Heisenberg, certainty lecture number four will be given by Betty, a distinguished chicken from the Museum of Science. Offer something not so completely different? Act two of our opera. Here is our narrator. As act two begins, the mysterious object in the sky draws closer. The insects are now desperate. They buzz around Thelma's friend Louise, each hoping that she will choose him as her mate. But Louise does not want to mate outside her species because the offspring would be barren. Join us now as Louise expresses her contempt for these decrepit droning insects. This supermodel Symmetra, P96, Ignoble Literature Prize, goes to the editors of the journal Social Text. For eagerly publishing research that they could not understand that the author said was meaningless and which claimed that reality does not exist. The winners could not or would not be with us tonight, nor would they return our phone calls. Now, a special announcement about the legal aspects of biodiversity here is prominent attorney William J. Maloney. Has your species or genus been injured in a biological catastrophe? Know your rights. Don't become extinct without compensation. For a free consultation, call us at 1-800-BIO-DEVERSITY. Thank you. Ladies and gentlemen, we now ask you to take out your wallets in your hearts and leave your heads behind. We have commissioned some special works of art, which will now auction off. We have commissioned scientist supermodel Symmetra to make plaster castings of the feet of the Nobel laureates, the left feet. And so now, behold, if you will, behold, if you will, the feet of the Nobel laureates. These plaster casts are one of a kind items, even though the laureates each have two feet. These particular feet belong to Nobel laureates Richard Roberts, Dudley Hirschbach, Sheldon Glashow, and William Lipscomb. Gentlemen, would you stand and take a bow if you are so able? And also, also, behold, if you will, the foot of Symmetra. Now we'd like you to understand this is a real auction, so don't bid unless you mean it. All proceeds from this auction, should anyone actually bid on these fine collectibles, will go for the benefit of the science programs at the Cambridge Public Schools. Now here is our auctioneer from Cornucopia Auction Sales, Lynn Calista. OK, hold on to your wallets, because Steve will be collecting money right after this. This is for real.  Those feet look great. Let's see. Who's first? Dr. Lipscomb? Let's see his tag first. Oh, there's the foot if I ever saw one. And what would you say for it? Would you say, that's reasonable. $0.10 I have. I have $0.10 on gentlemen right. We'll say $1.50, $1.50. $2.50, $2.50, and now $3. I have $5.50, I have $5.50, I have $5.50, I have $5.50. I have $5.50, I have $5.55, somewhere. Someone say $6, I say $6, we're going to go to $6. Where do you go? $6.50, $6.50, now, good shot. $6, I have $6.50, $6.50. $70, everyone say it, we're going to go $11 now. We have $11. Keep up. Who said that's $11? We're going to take $11 right up here in the balcony, wave your hand, because I can't see for anything with these lights. And Steve will collect those monies right now. That was well worth it. Okay, for all those who got the idea, these are feet of plaster, not mirror clay. So let's start with another one. And what would you say for it? Who was next? Ah, now there's a photo I ever saw one now. How about walking in his shoes and would you say $10 is on him? Would you say $10 will start? 65? A dollar 65. Nice even figure. Dollar 65 and a dollar 75. $1.75 and now $2 would you say? I want $1.75 and now $2. I have $2 and now $3, $2 and now $3. I have $3 and now $4 and 3 and a quarter. Five, okay, have your own auction. Five, I have $5 and a quarter. Five, and now $5 and a quarter. Five, I have now $5 and a quarter. Someone's saying it's gonna stop at five. Six is a nice number. Six, I have six and a, seven up there, seven and now eight. And 10 is higher than eight. 10 I have. 10 I have and now $12. 12, there's a new bidder. I like a new fire right there. $12 in the front, $12 and now $13, $12. $15 right there on the right. Well worth it. Okay, step by step we go. And next one is, Stug Muffin. Here we go. And what would you say for? Would you say $20 for that put? I had $1.65 and two I have would you go three. That's making it easy counting. 20, well hold it. I heard a 20. I heard 20 down here first. 21, someone in the back. 25. A little decorum please. 25 and now 26. 25 and now 26. I have 25 and now 26. Stroke me, stroke me, now six. 25 and now 26. 26, 32, 15. 32, 15. At least the guy that's not here. Ah, 10 cents it sounds good. It just, a quarter. Folks they're small, they're light.  25. 25 out here, 25. And now what'd you go? 26, we take this slow. Like something easy, 26, 27. 26 and now 27, 26, go between. 28. 28, 29. Save it for the next one. I have 28, 29. All right so summing up was your last chance. Have you got to hurry up because that guy where the whistle's gonna show up any minute. Scientists and that's $20 to start on, super muscle. There's the foot you wanna be in. And we're just saying $50. 265. I have 265. Man with taste, 265. But not that yours aren't very nice. To 10, 10, 65, 10, 65. 15, more like it. 15 and 20 someone, 15 now 20. 17, 50 someone, does that help? 17, 50, he's got the idea and now 20. 20, yes, 20 and now 22, 50. You have change. We like quiet, nice folding money. It's quiet. 22, 22 and now 24, 22 and now 24. Does this have any rhyme or reason? 23 someone, sounded only $23 for scientist, super muscle, Metra's foot. So, 24, right down there. Thank you all very much. And then came for school section. Really successful bidders if you haven't already paid, find one of our technical crew afterward. All of the successful bidders, we invite you to return here every year and get up on the stage and play with your feet. The economics prize. 96, Nobel Prize in Economics is awarded to Dr. Robert J. Jenko of the University of Buffalo for his discovery that financial strain is a risk indicator for destructive periodontal disease. The winner could not or would not and probably should not be with us tonight. Will the tenured faculty bar the door? Eisenberg's Ernie Lecture, number five, will be given by the creator of the stud muffins of science calendar, Dr. Karen Hopkins. It's a symbol of biodiversity and to present myself as a candidate for the presidency of the United States. They call himself green, but I can actually photosynthesize. I believe my running mate, Betty, actually discussed our platform during the previous Eisenberg lecture, so I won't repeat myself or her, but I will promise you this. I know someone who's not going to be featured in next year's stud muffins of science calendar. And now the final prize of the night, the art prize, 1996 Ig Nobel Prize in Art is awarded to Don Featherstone of Fitchburg, Massachusetts for his ornamentally evolutionary invention, the plastic Lawn Flamingo. He will be congratulated via audio tape by Nobel laureate Mel Schwartz. I miss him a lot, and I hope that you will treat it seriously. The artists have to die before anybody ever notices they've done anything good, and I'm lucky you didn't wait that long. I'm glad to be here and appreciate it. Thank you very much. Now, to top off the evening, here is the final act of our opera. Will the ushers please distribute the do-it-yourself Martian meteorite kits to the balcony audience? Those of you in the balcony, please prepare your meteorites, but do not fire them until you see the giant meteor enter the atmosphere. Now, here is our narrator. In the final brief act, the mysterious object falls from the sky. It's a meteorite from Mars, carrying bacteria that have been dead for a billion years. Alas, the cockroaches will never learn this interesting scientific fact because they are about to go extinct. All the other insects will be unharmed and they will celebrate with a new burst of song, dance, and evolution. Sit back and enjoy the thrilling conclusion to this epic tale of punctuated equilibrium. A traditional ignoble to pick up the list of winners from the ushers as they hustle you out of the building. If you have email, you can also obtain a complete winners list by sending to our automatic information address, which is info at improv.com. And if for some reason you want videotapes of this, they will be made available. You can see someone out in the lobby. On behalf of the Harvard Computer Society and on behalf of Tangents, the Harvard Radcliffe Mathematical Bulletin, and on behalf of the Harvard Radcliffe Science Fiction Society, and on behalf of the Annals of Improbable Research, thank you for helping us honor these worthy individuals. Now, ladies and gentlemen, let us honor the 1996 Ig Nobel Prize winners. Please whack your hands together and shower them with self-esteem. Final thought, if you didn't win an Ig Nobel Prize this year, and especially if you did, better luck next year.


My name is Aaron Banks. I was an industrial engineering student at Purdue, graduated in December. During my time at Purdue, I played football for four years, was quarterback on the football team, and I was also student body president. When I was initially deciding to come to Purdue, I had wanted to be a biomedical engineer since about sixth grade. We did a little dissection lab and I was really into it and I really liked it. However, when I got to Purdue and realized that biomedical engineering was a little more intricate than just a simple sixth grade dissection lab, I realized that I didn't really have the same passion or that I thought I did. The overall goal was to help as many people as possible and I saw a biomedical engineering as a way to, I don't know, create my own prosthetics or some of the type of new technology where I could help a lot of people. But through my experiences at Purdue, I kind of realized that I could do that in a way that I'm more passionate about, even through business. So that kind of sparked my shift from biomedical engineering to thinking more about industrial engineering because I still wanted to have that engineering background but also wanted to learn more about business. So I was able to make that transition and that inspired a lot of the current thought process about business and my passion for helping people that I still have today. And I was able to see how entrepreneurship could play a role in a lot of the different extracurricular activities that I was already pursuing. So for instance, when I ran for student body president, the idea was to also give myself an experience like running a business. So I tried to mirror student government around what I thought was a successful business. And it worked out pretty well. I was able to do some very cool things. We partnered with Just Water which is a sustainable water company founded by Jaden Smith to bring that product to campus and have it sold on campus. But we were also able to bring Damon John from Shark Tank as the founder of Fubu and I was able to orchestrate a conversation with him as a part of the Giant Leap series. Very excited about both of those things. Both were sparked by my passion for entrepreneurship which was again continuously fostered through my experience at Purdue by the people I met mentors that I was able to interact with. I had been working towards that in my final semester at Purdue this past semester I was able to actually have one of my, the starter company that I'm working on as my senior design project. So I was able to work on that all semester with a team of very, very smart senior industrial engineers who helped take the business from just a vision to something actually tangible that I'm continuously working on now as well as starting my career here soon at Accenture doing management consulting as an analyst. So very excited about what's ahead for me and very thankful for the foundation that Purdue has allowed me to create for myself through the different opportunities that were available to me at the school.


Welcome to the Deviant GGG packaging box at the top 15. My hope is that folks who are here today are interested in the health of GGG and GGG and Deviant. Whether you're explicitly a member of the team or not, we want to encourage participation. So Eric and I wrote some outlines of things we could do. If it turns out that we can breeze through this outline, I'd be happy to break out into small work groups if folks are interested in actually doing some of the concrete work that we have ahead. And we can talk about that. So if anybody has questions or whatever, just speak up at any time. This should not be a one-directional operation. Yeah, and this list may not be complete. So if you actually have ideas for things we should be doing, we definitely want to hear those too. So concrete next steps that we have for the packaging. We plan to cut over the user bin new PG to move that. We'll do this in experimental first so that user bin new PG will come from the new PG2 package. Oh, sorry. In case you don't know, new PG2.1 is in unstable right now. So we will continue to maintain that. So we plan in experimental to make new PG2 packages, which are new PG2.1 to make those the user bin new PG. And we'll move user bin new PG in the new PG package to create a new PG user bin new PG.1. So that's going to be an experimental. We're hoping to put a call out for people to try that once we've got it up there. That's just a simple cut over of the names. For the debut installer work, we want to move the UDEMs to be created from the new PG2 package instead of the new PG1 package. Creation of the UDEMs is a little bit of a tricky thing. And I'd be happy to talk with people who have debut installer experience or multiple build package experience. If you have that experience or if you know somebody who has that experience, when I say multiple build, I mean, one who uses source code, you build in several different ways because the UDEMs that we're building are being built separately, possibly with different configurations. So if you know how to do that or if you know who have other packages that are like that, be happy to hear about them so we can look at what the different options are. We need to be writing better news files instead of just announcing stuff at DevCon. So if anyone wants to step in and just do a straightforward documentation task, straightforward, ha ha ha, do it with humans, we welcome contributions to news.dev to the people who are following their package updates can see them. For example, the issue about switching over from traditional key rings to key boxes may throw some people for a loop if all of a sudden we're looking at different files. I'd like to update the Devian, the 1.4 packaging for Devian to minimize Devian rules. I think that can probably wait until we've done the cutover and the UDEM move and all of that. But if we can minimize the Devian rules for GBG 1.4, it should make it easier to maintain that going forward. So those are the specific plans that we can complete. And there raises a bunch of open questions, which you can see up there. One question is just a logistical one about package naming. The source packages are currently GNU PG and GNU G2. The binary packages are GNU PG and GNU PG2. Do we change the names of the source packages? Do we change the names of the binary packages? There's also GNU PG agent, which just comes from the 2 package. But it's invoked as GBG agent.  I'm not up for making huge changes, but I'd like to figure out how we're going to do the names. Do we have a preference? Then we have a preference for the naming switch. This is kind of like a meaningless question we just have to decide when we're going to go. Do we change? So here's two proposals that you can come up with. One of them is that we keep the source packages named exactly as they are. The GNU PG package now produces a GNU PG1 binary package. And the GNU PG2 package produces a GNU PG binary package. And the GNU PG2 package produces a dummy GNU PG2 package that just points to GNU PG. So that's one option. The other option is that we change the names of the source packages to be GNU PG1 and GNU PG. And then the binary is followed from the source package names. And the third option is that we change the names of the source packages from GNU PG. We just changed the name of the source package for GNU PG1, so it's now GNU PG1. I don't know. I don't know that it matters, but we can decide. Preferences? Also a matter of what's the specific use case other than what's the technical use case for retaining GNU PG1.4 after it has made the switch of GNU PG that might be conservative, but it sometimes specifically needs it. We have a specific reason. And that reason is people, so sorry, Marko, if you watch this, Marko Diitri is a great example of someone who has secret key material that's associated with old style, like old style crypto, old style certs that we know to be cryptographically not very useful. But he still uses them to interact with systems that he cannot update. And if we take away the 1.4 package from him, he's going to be stuck. Now you could say Marko Diitri is someone who can build his own GPG, and that's probably true. And I don't want to see GPG1 on anybody's computer who doesn't have this kind of specific need. But there are people who do have a need to do some older interact with systems that they can't fix on the other side. So that's why we agree. Then there is another case. If you have old data, it could be a PGP2. You need to have a GPG1. So if you want to run, there's no support anymore for old keys, old data in it. That's a reason. Some people do have this old data. But that would indicate to me that the more appropriate package name would be something like a GPG that's legacy or something like that, to indicate that otherwise it sounds like this. Otherwise it sounds like this classic line that's Apache 2.2 and 2.4 both are great. But if I need something specific, I'd pick 2.4. I like that. So the binary package would be GPG legacy. Or GPG obsolete. The bootstrap, I would like that the GPG package is built from the GPG source package. So when you do the switchover, I need to switch over the package as well in the bootstrap process. And if you rename the source packages as well, then I have exactly nothing to do. Because it changes which source packages built by renaming them. OK. So all of these tools are going to build multiple binary packages. And obviously some of those binary packages will not have the same as the source package. What I mean is the property that is desirable is that the GPG source package continues building the GPG binary package. That's a desirable property for the bootstrap response queue. OK. Not very important, but if it can be established, that's nice. So I have no objections to that. Are there issues with changing the name of the source package that nobody knows about from the R-Craft perspective? So I don't think there's any issue from the R-Craft perspective. But if we change the name of the package, it could be issues. You need to re-sign all the bugs. Sorry? You need to re-sign all the bugs. Yeah. Also, if we change the source package name, do we change the git name? Do we, will that be confusing as well? Like the name of the repository? To be consistent, that would be good. But it would also be confusing because then that suddenly was used to be pointing at the, they're not in the same repository right now. So the things that we're pointing at, 1.4, would suddenly now point at 2.1, which would probably break people's checkouts or clones or stuff like that, which maybe is OK. But it would be a little bit of a, it might be a bit of a pain to switch over. So refer that renaming would be good for bootstrap? Mine would be good. But not the strong argument. OK. You're making me worried when we get repos. So I'm kind of inclined to leave the source package names the same. We could always change the source package names later. OK, yeah. I don't think it's, I don't think it should be a high priority to fix it. Can I ask? I'm sorry, you're Moritz, right? Hello. When you're saying GBG1 should be GBG Legacy, is that the package name? Or do you think it should be user of NGBG Legacy? I think it could possibly retain the old problem of scrolling opinion there. I mean, if people have wired up some scripts or something like that, they would probably need to adapt that. But if it's just like the Markov use case, then you can probably also say it should be. Well, if they have wired up scripts that rely on user of NGBG, those are going to be called NGBG1, what do you mean by that? Or do you have a preference of the NGBG1? You'd rather call it NGBG1. Should we have completion? Yeah, but not completion. So the thing that should be annoying to type is installing the package. That should probably be a NGBG Legacy. But the invocation should be convenient. Yeah, although there is an inconvenience of saying, I'm going to install NGBG Legacy. Of course, it's called NGBG, and the binary is GBG anyway. So we already have this other thing. There's also a little bit of a problem that the diagnostics wouldn't show up as GBG Legacy, but as GBG1. Right, maybe as GBG1. I mean, I agree with this. If the thing is installing out of the box, once this cutover has happened, I know new installs are actually getting GBG1. Is this really the naming? Is that necessary, or is that desirable to have it be different than the binary name? And already no one's going to install it unless they explicitly ask for it, right? At the end of this, there'd be no dependencies on it anymore in the archive as far as I can think of. I hope that shouldn't be anything. There's no way that people can get this unless they install it. Intentionally, and we can definitely put in the description, like, you don't want to use this package unless you have these use cases. So yeah, just making it inconsistent from the binary as other things, a little bit undesirable. But I have an understanding point. OK, so discourage. So I'm hearing like people might be OK if we have the package name between GBG Legacy, the binary as user bin, GBG1. We might change the diagnostic string as well, so it's the diagnostic string that it emits. If there are a lot of files or whatever, we can distinguish them from a GBG diagnostic. We'll probably leave the source package as a load. Is that OK? Cool. I think we can't change the diagnostic string, because scripts rely on this. I'm pretty sure. Oh, really? Yes. But the scripts are going to have to change to call GBG1 anyway. And if it starts to pass, they... There are too many scripts. They're regular. Those scripts are broken. Yeah, they're broken. I actually don't care about breaking those scripts. If someone's parsing human-readable output... Well, if my... If my code changes, this script is OK. Anyway, it's about to dimension this. Yeah. You will receive the binding problem. Yeah. Well, I'd like to say, if your scripts are parsing human-readable output, that doesn't make any sense. Yeah. That's the one I also always think of. I don't know what to do with the front line. In a Sage transition from bash to dash, some people will continue to use bash by mounting it onto Windows Sage. Some users might do the same for... You could mount a non-directory file. Yes. You can bind non-directory files. OK. In that case, they can do that. We've got some more little pieces, right? Yeah, that's kind of our problem. So, let's move on to other open questions. So, the key server access, at the moment, we are defaulting to keys.mov.net, which is a C name to pool.sks-keyservers.net. The pool itself actually also has an hkps variant. So, it's conceivable that... So, do people know about hkps? You're accessing the key server basically over a TLS link. But if you want it to be a pool, pools for TLS are a little bit strange because you wouldn't need to deal with that identity. And the person who's coordinating the pool is Chris John Fisterstrand. And he has a certificate authority that's specific to the pool. So, we can ship the CA for his certificate authority and do something like have the default be an hkps query so that people's... so that people's queries are not sent to be clear to the key servers as a privacy presenting measure. So, that's something that we can consider doing just shifting away that GPG has it. People have thoughts or concerns or questions about that. The hkps pool is active. I use it regularly. I haven't noticed any problems with it. It doesn't mean it may first keep the key server out of the pool. No, it may first keep the key server out of the pool. It's just one key server. Actually, it's in the pool and there's the main first key server. So, depending on how people access it it provides a different certificate. How do we ship their CA and how do we handle the rotations of the CA? I have a general dislike of adding my CA to the certificate package. There's no reason anyone should rely on Chris John Fisterstrand and he probably wouldn't want you to rely on them for anything other than pool.sks. So, I don't know what the perfect good policy is. We're just shipping in GPG as they're asking. If we ship it as a separate package so we can easily change it if it needs to be updated for whatever reason or if it needs to be updated for whatever reason or if it needs to be updated for whatever reason Yeah. Well, if some key service comes from the rotation the certificate should be revoked. How do we handle that? Well, there should be CRLs or CSP or something but I don't want to think about GPG and deal with that. No, we don't change that. So, it sounds like we should talk to Chris John. So, what is he using? Isn't he using a library to do this or is it just doing it by itself? Yeah, sure. That's a good problem. The old GPG was the GDG but I don't think that makes any more sense because it should be a property of a deal manager who doesn't have all the access so I'm trying to remove this anywhere on GPG. It is in the general manager. Yeah. What would you think about saying if the key server that you asked for is hkps.com then use this custom CA as the default. So, you change the default based on this one particular string because we know about that operation and that's a special thing. And if they override the default fine but if they don't override the default then instead then with that exact string this feels like a gross hack but it seems the simplest thing to do. So, if it matches that exact string then the default is different than if it's we use the system model otherwise. Sound okay? So, we should talk to Chris about it and see how he feels about the idea of the CA being shipped and how he thinks it should be handled if he needs to switch CA's but that is something which will also be done in our stream. That would be great. Yeah, sure. What about also the load of the pool because if we talk TLS, KCPU they've got there's a dozen servers answering the pool and all of the servers because it's hkps are required now to have basically a front end reverse proxy to handle the requests.  Like, you could start a key server query if you were talking directly to an SKS instance and it wouldn't be able to do anything answer any other query until you finished it. So, it's like slow Lawrence attack but time is 100. But that's not true if you have a front end in place like a reverse proxy in place but the way to do hkps is with a front end proxy. So, it's actually the higher end load is better in the hkps pool. So, we should talk to Christian about it and see what he feels like. And if he's okay with it, then we'll make a patch and we'll ship it to you upstream. Isn't this a generic problem? We're talking about one key server but it would be nice as a general policy to use hkps against key servers but we don't want to ship a lot of strange CA's. So, we do handle hkps to arbitrary key servers but not all key servers support hkps. So, we're talking about this particularly because this is actually an hkps pool and there's a nice property of the pool which is that you get better availability properties without leaking your traffic queries to the network itself. And this is a specific pool that's maintained by someone who's in the community who's done a pretty decent job at keeping it up and running and coordinated a wide group of people. It doesn't actually provide you with a ton of security because anybody can join the pool if they just meet a certain technical threshold. So, if you were a nation-state adversary and you wanted to find someone else's find out who's where and what you could just add a key server, put it in the pool and you'd get that key server running 12 at a time. I'm just concerned that they're giving some false sense of security by adding others. Well, but it's... You didn't see that. No, you didn't have that way of using it. You realized that. Yeah. Yeah. Yeah, but this...   There's a bunch of different servers that are part of this pool. I operate one of them.  And Christian says, okay, you've met this particular technical bar. Your server has been online. It's been synced. It's offering TLS properly. So I'll make a certificate for you and you can install that on your HTTPS front end for your key server. So the reason that you need a special certificate is because there actually are basically a dozen different servers that are authorized to respond to that. Yeah. So it's not signed by a regular CA or a less incredible inside. Who's going to pay that? Well, we said it's not the payment. Are you sharing the secret key between all these machines? You need to. If you're doing a TLS front end, you either need to share the secret key or make separate certificates for each of them with different keys. And now you've got, dealing with the CA's to say, oh yeah, I need 10 certificates for the same name. It's pretty unlikely, actually. That doesn't work very well. Yeah. I mean, I see what you mean. Yeah. Well, at the same time this lets us say there's only this one point failure instead of the 400 points of failure in the system. Yeah. Okay, so let's move on from this. It sounds like people are kind of okay with it. We have some open questions. It's not 100% fixed, but it's probably better than nothing. Yeah. The GNU TLS team, which is basically Andreas Metzler, as far as I can tell, is still maintaining the KSBA and the Gcrypt, despite the fact that GNU TLS no longer uses the KSBA and the Gcrypt. So Andreas seems fine continuing to maintain those. We don't want to take them over. I'm happy to let you continue to maintain them, unless we think that there's specific changes that you need to make. Do you see any changes coming up in either of those that seem to take care of instead of Andreas? I mean, I have no problem with that story. The KSBA is only used by GBG for KSBA. So KSBA is the easy one to take over. Gcrypt I found a little bit more scary to take over. It's a separate project. Okay. So, I guess we should mention that those two are also part of the GNU. They're still part of the GNU TLS packaging team, as far as I understand. So if you want to work on them, there's another team you can join. And these Gcrypt is used very widely even in SystemD. Gcrypt is used in SystemD? Yes. Gcrypt is used in SystemD for GNU. Don't talk about it with that burner. I'm a fan of SystemD. So the GNU PG docs package, seriously out of date, nobody seems to be working on this. I've asked Don Arms, did any of Don Arms run this year? Probably so. So I've asked Don if he was the one who'd been packaging it before. I kind of feel like we should just drop this from there. Isn't getting a lot of attention, and I don't think there is an active upstream PG docs collection. Are there documents that you could introduce when they do? I don't know. You have too many docs, and it's not too nice. That's kind of why I'm looking for someone who is doing this, just to sort out all these different documentations. But I've not found anyone. So is there any more? So if we drop this, that gives you one less piece of dangling. Alright, so... So basically you put the PG doc, which is that so by... But that doesn't have to be a dangling, does it? No, it's one. So unless Don Arms strong has a strong objection, we'll just encourage a removal of this. It's not technically under the team umbrella at the moment, but I offered to put it under the team umbrella. It got no feedback, no changes for me. So I'll just push him on that further. Where do we want to put the UDEM rules? For smart cards? They're currently in the GuruPG package, which is made from GPG1. Do we want to break it out into a separate package that just has the UDEM rules? Nime, do you have a preference? We could move it when we move the name user-bin-gpg and the package name, the buyer package name. Or we could just break it out into a separate package and have GuruPG and GuruPG2 depend on those UDEM rules separately. I don't know which one. Yes. Strictly speaking, the smart card access by GuruPG1 and GuruPG2 is a bit different. And the supported readers by GuruPG1 and GuruPG2 are different. But I don't think most of users don't care. Why you just mentioned this maybe you should consider to remove all the smart cards from GuruPG1 Yes, that would be easy. We recommend the use of GuruPG2 for smart card access. So the UDEM rules should be maintained by GuruPG2 package. Okay. Do you want them in a separate package or are you okay with them being SCDemon? I think this is also I mean, I worked on UDEM packages and we see this problem for UDEM in non-PGPG situations as well. And I think the real solution is to move UDEM rules to the UDEM package. That could be an option for GuruPG. We are trying to get UDEM rules in there but we don't think I'll file a bug but it seems to be opaque to UDEM. But I think they belong in there. The upstream UDEM project seems to be missing. So maybe the thing to do would be to file a bug against UDEM to get those rules into UDEM. Yeah, why not? And then if they don't act on that there's no reason that we put them in just SCDemon. Because I don't see how do we make sense to have them in a UDEM package perform in UDEM so sure, it seems to be the same problem. I guess it could be complicated too for these new UDEMs and a bunch of other things too. So I don't know why I have their UDEMs in two places. So how do we coordinate that transition with the UDEM? Does that mean that UDEM is going to break an older version? Is there like a conflict or something? I mean, you don't have to use the same file and if you just put them in different files So then there's two... But then you have... Yeah, we have over enough potential for you in some time when we have the same rule in two files but it doesn't cause problems and once it's in UDEM you can remove it from all the packages and I can look forward to the UDEM. Why don't we just conflict against all the versions of UDEM? It breaks in two places. Yeah, so I mean that's a bigger ask of the UDEM. I would just ask them to add or if you've talked to them and see if they think this is a good idea. Is there any chance I could ask you to volunteer to do that? Because it sounds like we have a pretty good sense of what it is to do. Yeah, it's been on my to-do list for a long time. Are you signed with Josephson? Oh, nice to meet you. Why do you think the UDEM rules should be inside the UDEM package because actually you can't use smart cards without having installed new PTP. So actually you can also argue that these UDEM rules only make sense if you have the package installed for it. No, you can use them without. The UDEM package contains a lot of rules for various hardware. So maybe it's a question for the UDEM if they think the UDEM package should contain rules for all hardware or if it should be in all the packages. Probably, if it's all the packages then the UDEM rule means we need all packages that require that level. I think the biggest problem here is the area of maintenance and control. If you're submitting to UDEM you're submitting to a system D package with a rather central piece of package which most people wouldn't. I mean, for example, if you need more updated UDEM rules and you need an UDEM package by what if you actually submit it to a system D which builds UDEM then you would either need to make some local hacks or actually back port it completely and there's also the the people who are maintaining all these market infrastructure properly more up to date and more dynamic then. There's probably no one within system D where there's specific domain knowledge. There's some patches from the steam, right? Well, of course, we'll put that out as a practice in UDEM rules. I don't know, maybe it's a discussion to guide it up if they have a preference. I think that you would have to worry about the part. So, if you're okay like spearheading that it sounds like you've got a sense of what the risks are. Yeah, I don't know. Yeah, I can try to reach out to them beyond the four options because there may be some sort of it's not a number but I can suggest something to trust them. Okay. So, in the meantime, we'll leave the UDEM rules in the the actually legacy package when we're doing this cutover in experimental. Does that sound right? I mean, I just if we're going to try to do the cutover do we want the cutover? We don't want the cutover to block on the part. Right, don't block on the part. What's going to happen if it seems like somebody could lose their smart card access in my case, right? During the cutover? Because if they just do app get upgrade and don't remover, I mean then when you want to remove it from the new package then you don't know. But maybe they need to be swapped into SCDEM and if UDEM is unresponsive maybe for the cutover in experimental it's swapped into SCDEM Yeah, I don't have it. But that's where you also have break in good place you can make sure that Right. Right. So, it's probably some time to try Yeah, so we'll go directly to SCDEM first I don't know. And this is not going to be done as a UDEM you have to be in the school but I think it's set some property that much Does that sound right, Live? Yes. Yes, and So there's this open question about divergence from upstream that we might adjust some things in terms of maybe the next specific hard name or changes to the default algorithm or the default preferences or whatever I think this is going to be an ongoing discussion but I'm already getting notes from people saying, hey, you should change this and you should change that. Most of the notes that I've gotten have been very broad of like here's my dpd config file this should be the default so I don't have to modify it and I don't want that I think that's a bad idea but I do think we should be willing to do some divergence in that sense so we need to figure out how to keep track we'll keep track of the divergences in the data that patches folder but we need to think about how we accept new requests and how we make those decisions I'm happy to like What kind of divergence are you thinking of? Is it like hard and default code patches? So we have some examples of divergence and now we've averaged a little bit in terms of dpg agent turning off the PR setupable the process control got it, thanks conceivably we could change things like the default preferred hashes we could change the default key sizes we could change the default algorithms but I don't want to at the moment I hope there's no reason to but like in Debian right now when we say for Debian developers when you're going to make a new key the instructions that are out there actually require you to do a handful of changes so that you get a key that we think is going to be good going forward in the long term those changes may in some cases be have an issue with interoperability with people who are stuck on much older systems so there's some tradeoff to be done there and I'm hoping that if we make a divergence and it demonstrates that there isn't an interoperability concern we get no complaints from folks who are using it in Debian unstable and no complaints from folks using it in Debian testing that by the time testing gets stable that might be an okay thing and we can then advise upstream hey, we didn't get any bug reports about the interoper we got three and they were from these predictable use cases and now all the guys say here's how you set up your key though man that's a special case I'm happy to talk to somebody who's using an old system but I would rather have that corner gate the special configs be something that our people do have special needs so thinking that specific use case you're predicting I think you could still come to a conclusion where this is even upstream but for example I was just talked by Niko from Nuzela's upstream who's doing this work in Fidora where they have like a little bit of a various set so for example if you just build new PG with a dash dash compile option or something like that then you adapt those sign of strict or harder default settings so I'm not sure if that would work for you but I think many of these changes can could be made in a way that they are also applied in a modern way sure, I mean I hope PGP is quite different because we have these previous systems it's quite different so that the old has its own mission to select algorithms so I'm not sure whether there is a way to it's also different because the algorithm selection mechanism is done asynchronously like in a TLS algorithm negotiation is done you have a hint and it's going on right now no man, this just has to go along I mean this is often even because it would break it's strict about it's made but it's bad to approach I mean if we're doing that it might be interesting also for people to work building with PG from TLS right even if it's well I mean if we make a change we can make it a configurable change and put the switch in our configur and then if you want to take it upstream but if you're not interested in doing that then we might as well use a simple change well I hope we get to that some point on that standard sure, but we have an opportunity to do some experimentation within Debian that maybe you don't feel comfortable doing the GBG upstream I mean GBG for win might have a different that's one problem we use different versions so anyway my goal is not to diverge from upstream anyway that we can avoid diverging I'm happy to but there are some things in some of the versions that would be useful so we'll run it long time we should keep going so ongoing work for folks who want to participate there's bug tree off we've got a bunch of open bugs some of which I think no longer apply and it would be great to just go through try to get a test case try to get a test case for the bugs and see if they no longer apply can I even close them there's ways to get other people to participate we should think about how to do it I think our relationship with upstream right now is pretty good as it goes but there's other ways that we can be useful in packaging to you Jonathan McDowell asked for a back port of 2.1 once we have it in or 2.2 or whatever it ends up being once we have it in a way that seems reasonable with the goal of being able to use it on Debian infrastructure so that we could verify say other ticker signatures in Debian infrastructure before the next statement would be cycle whether DSA is going to be comfortable doing that or not, I don't know but Jonathan McDowell did specifically offer to do some of the back porting work I did have a thought now that as we do cut over the back port becomes a little more scary it's not just back porting to the version it's back porting the swap of the versions which is a little more terrifying it is a hub for it that's not just the US case it won't be needed hopefully the Debian infrastructure is not relying on every product of PGP2 keys we did a bunch of work in the last several years to get rid of all that stuff what I just mean is like any bugs that we figure out during the swap we have to back port those fixes to make sure that those are also back ported this could break people's systems more readily than if we just reporting a new version of the new version 2 the architect infrastructure certainly requires doing a back port for deploying that there's no question about that but I'm not convinced that during the swap is the intention or required over there having it installed as PGP2 and appointing those tools and with the newer signatures seems like a feasible thing to do it sounds like a lot more work since DAC already has these parts as computerization but it's not just DAC either so I'm just learning that should back port maybe we need to talk about see what he thinks there's going to be a lot more work to make it without the path slot so a couple of hardening ideas have come up in burners talk you talked about this idea of privilege separated gpg agent you could do a privilege separated third manager debuts in a good position to actually do that kind of work because we're at the distro level if we need to add user accounts or make sure that you're running on linux to use some teacher or whatever if folks have ideas for how to do that hardening we should do it what you were talking about forwarding the agent over a network my big concern about that is that the agent currently just goes ahead and uses the secret key material yeah I know the big question is how you can add a connect to the confirmed which has an extra also I have an idea how to do this in a general way meet a data along with private talk okay so I'm also interested in the idea of a gpg agent that runs as an isolated process on my machine that it's signaling mechanism of something like the light on my laptop so not on the x-lab at all and my ability to say yes go ahead and use it goes through like an acpi trigger or something like that and I could write this would be like a separate pin entry maybe but so if it's just a confirmation account that's needed nothing running in my accession can cause an acpi trigger nothing running in my accession can flip the LED light so the idea of just having sort of a soft smart card something separate anyway we should talk about that more but this is also related to you because the separation yeah so we're pretty much out of time I was hoping that we get to actually maybe start hacking on a cutover so folks have other things they want to talk about what you should bring about that did you have your does anybody want to help or does anybody want to take on any of these tasks themselves somebody want to volunteer to triage five bugs from your deviant BTS come on five bugs four bugs it's a reverse auction one you'll triage one bug I'm going to write that down in the notes yeah I think if people can't do any book triage or just watch on the main list and if you have domain expertise in some aspect of this it would be great there's bound to be a few bugs no metal fence but there's probably going to be a few bugs that's true in GBG and in our packaging that people will want to deal with can folks try out the experimental packages with the cutover is that something we can make in there and I won't write you down in the notes thank you that would be definitely useful yeah how much will we have any particular keys to test it so I think we shouldn't be encouraging the creation of the Curved Keys anytime soon but there are already some people within them if you have them of the Curved Keys right so we can test the verification of encryption mechanisms do you have the NIST current so long then what do you mean we need to talk to the media because they are coming to the page of the NQC something it's probably the mysteries so I don't think we should encourage people to create them but I do think we should encourage people to try using them we should be able to use them so I think Eric and I are going to try to do a first pass at the cutover at DevCon if we can find a few hours to work on it if anybody has any warnings about what we might write into it we would be very happy to hear about it you mentioned that is the UDEP differently from the rest it is it's minimally configured so there are fewer dependencies and fewer options I think that's it our time is up and I know the video team needs a break any other questions are people here subscribed to the mailing list for package.devian.org please subscribe to the mailing list we'd love to have your feedback on that it's not a super high volume there's also a pound of devian.vmpg on the left there's also very little traffic so yeah, if you've got issues that you're running into find us on the mailing list or the BTS so I think that's it thanks everybody


This is what happens when you call people, not trying to sell them anything. This is what I believe. I'm sharing that with you for nothing.  Hope everybody's doing super well. Look, man, I'm telling you, I'm gonna reiterate here. Fired up for 2021 and it all starts right now. All starts right now. Matter of fact, guys, I'm about to drop something on you. Y'all, I bet y'all are gonna be excited about this. I haven't released this yet. This is just for people watching this video. Let me get in here and find everything I need. Boom, boom. Okay, here we go. I'm gonna drop this. Hi, Ms. Janice. Hi, how you doing today? This is Tim with EXP. How you doing today? EXP Realty. I'm a local realtor. I'm a local real estate agent. I was just calling to see how you're doing today. That isn't perfectly okay. I was actually just calling to see if there's anything I can do for you. Do you have an agent that you would work with if you decide to make a purchase or sell in the future? Would it be okay if I stayed in contact with you in case that day does come? Yes, that would be wonderful. Wonderful. What's your bestie? Wonderful. What's your best email? Gotcha. At gmail.com. Wonderful. I will stay in contact with you and touch bases every now and then. I look forward to talking to you in the future. Wonderful. What timeframe are you looking at? Perfectly fine. Is it okay if I call you like every three months? Wonderful. I will be giving you a call in about three months. My pleasure. Have a great day. Yes, dude. Look at the air. Look at the air, bro. That was about as smooth as ice. Man, I'm gonna call you the ice man, bro. You heard the ice man. So what's going on three months? I didn't catch all that. So she just got divorced. She just signed a one year lease, but she's talking with the financial advisor because she wants to purchase again in a year. So she basically just said follow up with her every three months and that way we don't lose contact. And if her situation changes and we can do something sooner, we will. Isn't it amazing how someone says I'm not ever gonna look to do anything, right?  Is that, is this not amazing? Yeah. This is what happens when you call people not trying to sell them anything. Yeah. And you actually try to connect with them, right? Through your tone, through your questions, your intentions. Look at what just happened here. You got an email from someone who said they're not looking to do anything. Absolutely. And it turned into a conversation and like you're gonna check on her every three months to sell her a house in a year. Beautiful. Love it. And yeah, I did a lot of like events before which COVID shut all that down. That was my main lead prospecting before. And this has honestly been a blessing and it's been coming across your contents just been amazing. Yeah, absolutely, man. It's all the stuff that it took me decade to learn, you know, decade and a half.