Felly, amddangos wedi'u cael eich bod yn ymdw i'w'r boff. Felly efallai'n agender i'r llwysgol, ond hwnna'n mynd i'w gwbl yn ymdweud o'r gwaith ar y dda o'r Unedig i Ylwllol pan yw'r 45 mhenud. Mae'n gweithio'r boff, dyma'r fawr. Felly ydych chi'n gweithio'r gobydol, mae chi'n gweithio i'r gobydol, byddwn i'r gweithio'r gweithio'r gweithio'r gweithio. I will do my usual thing of sending out a summary of what's discussed here and what goes in that document to the mailing lists after the conference. I think that's really important for other people who can't be here and also so we get a proper record of what's been said, agreed and people blamed and all that kind of stuff. So, in order, going backwards for once, you'll see why in a moment, ARM64 is the newest of our current ARM ports. It's working quite well, we released it with Jesse, we're starting to see more devices coming available that will actually run ARM64. Debian quite well, we're starting to see we'll serve a hardware actually turning up and there is more coming. Thankfully, there are better standards available for ARM64 than for previous generations of ARM hardware that mean that we don't need to have 17 different kernels, we just have the one and it should all just work with device tree or now ACPI is becoming more of a feature, especially if you're running server hardware, ACPI is the way you should be running these things. I work with some of the guys who've worked on device tree and ACPI and the two are basically equivalent in terms of the functionality they give, but ACPI is the better choice for the future just because there are better standards for it. So, ARMHF, going back a bit, we first released with Weezy, it uses the ARMv7 hard float ABI, which depends on VFPv3D16. I will explain what that means if anyone wants me to. Good, sorry? Good, good. It is the standard across 32-bit ARM Linux distros. This is the thing that Debian, Fedora, SUSE, all of the big well-known distros agreed on as the baseline for their 32-bit ARMv7 ports now, multiple years ago. So, you actually have a fair chance of binaries from one distro actually running on another distro. For those people who are used to the x86 world, that may not seem like much, in the ARM world, this was a, oh, hallelujah, this was a major, major win for us. Again, we have a reasonable chance of all of the hardware out there now running just using one standard kernel, the ARM MP kernel, MPB multi-platform. Again, device tree makes that possible. We have a second kernel available, which is ARM MP LPAE. So, if you're fortunate enough to have a V7 device with more than four gigs of RAM, you'll want that instead. More memory is better, obviously. UEFI is now a thing on ARMv7. There are some boards that people are talking about shipping with UEFI firmware by default. Also, due to the work that's been ongoing in Uboot, there is support for enough of a UEFI interface in Uboot for some hardware that you can now boot by UEFI that way, which actually means you might get things like just working out of the box if you plug in a USB stick, that kind of thing. This is really, really good. If I remember correctly, it was Alex Graff from SUSE who did the work for this. He's an awesome guy, much kudos to him. He's continuing to work on improving this as time goes on. So, ARMvL is the oldest of our current ports. Have I suddenly just got louder? Okay, fine. Not just me having a stroke or anything. That's fine. So, ARMvL is the oldest of our current ports for ARM in Debian, using the soft float ABI targeting ARMv4T and newer. It's still supported upstream in the kernel, in the tool chain and whatever-ish. I'll expand on that slightly. While, obviously, people care that you can still build the kernel compilers and lots and lots of core libraries for ARMv4 and so on, because, hell, ARM still sell or ARM licensees still sell a huge number of v4 devices and even older, there is a problem, and it's been coming for a while, that lots and lots of the bigger applications and libraries further up the stack don't care about v4. This has been fairly obvious for quite a while. We do have problems, for example, if you want to run anything like a modern browser, if you want to get Firefox, if you want to get Chrome or almost any of the really big, large applications running, you're probably going to have problems. People don't care about this stuff anymore, which is why we've been talking about this for the last couple of years. We are planning on dropping ARMvL from testing soon and not releasing with Buster. That is not a done deal. There is still scope for people to step up and make sure it's supported, but we've been calling out for wheel commitment from developers for the last couple of years to help out with issues as they come up on ARMvL, and they have been not exactly forthcoming. I appreciate this is going to be unfair to people out there who have ARMvL installations on older hardware, but it's the same way whenever any port is dropped from Debian, there are always users, and we appreciate that, and we have to apologise to those users, but unfortunately for us to continue to keep something in Debian, we need developers too. By semi-announcing this last year and the year before, we've given people plenty of warning this was coming. As we did release with Stretch, and of course we're going to be continuing to support ARMvL for the lifetime of Stretch for security, people have at least three years worth of life left in that existing hardware, which is not bad even if you just bought it last week. There is a fair chance that when we get round to Stretch LTS, just like Jesse LTS, we will get ARMvL supported there too. You might get five years, but definitely if you're depending on ARMv4 machinery, ARMv5 machinery running ARMvL, now is the time to start thinking about moving on. You have plenty of warning.  Any comments on that? Do we have dull acceptance? Do we have anybody awake? Do you want to grab a mic to make sure? I'm told the microphone's in here okay, but it doesn't hurt. Like you say, without the developer support, so it seems also now is the time to really step up and stand strong if you want that to be supported in cluster. I mean, dare I say, if you have that kind of device, it's possibly also worth considering do you need a full Debian port for it? We've had the discussion around this again for maybe three years now, and people have continued to suggest that we should do other things. Could we do a partial port? Could we do, as in just strip out, the larger applications that people don't use on this hardware, that kind of thing, like X and LibreOffice and the browsers and things. That sounds attractive, but again, what it comes down to is show me the code, show me the effort to make it happen. For all that, yes, it is certainly something that is technically possible, it needs actual work, and without that actual work happening and being done by actual developers, it will continue to be pie in the sky basically forever. It's not too late, but people need to be demonstrating work on it now. Do you want to grab a mic? Sorry, Bill. The builders for ARM EL, are they ARM V4, or are they bigger machines? They are ARM V7, and that's currently just what I'm about to talk about. So we have a mix of machines for our buildees. We have the main ones, this is a really bad dark photo, these little orange Marvell boxes that Marvell donated to us a few years ago, on one of XP's, we have seven of those currently building away, doing both ARM HF and ARM EL. They're really nice machines, they are quad core, they take lots of memory, they're absolutely wonderful if you'd want a V7 server box. The scale way folks actually have a number of machines in the cloud that you can rent, which are essentially this hardware but in a different form factor. They're really nice and I'm still very happy and very grateful to Marvell for giving us those. Those are awesome. The only downside is they don't have neon. So if you are running, if you're building software for example that has a test suite, if you try and run it on one of these and it depends on neon, you will get undefined instructions and exceptions, you will see problems. Specifically for that, we still have a free scale IMEX 53 port-a-box, Harris, which has been running now for seven years I think, maybe six. When we first started, previously to the Marvell boxes, we had a whole whack of these instead. They were great at the time, but they're only single core Cortex-A8. They only have one gig of RAM. Trying to build something big on them is awful. However, if you need to debug a neon issue, that's deliberately why we've kept this around. So ARM64 does give us more options. We have an AMD Seattle hosted in the data centre at ARM. We have multiple APM Mustangs. I've got one in ARM, there are a few that Lenovo are hosting. We started off the port for ARM64 with a couple of ARM Junos. We still have one of those running. The other one is on my desk because it's disk died. To be honest, we don't need it running anymore. There are more machines coming. I've been promised, I've been talking to several of the silicon vendors who are very keen to help with the ARM64 port. By the way, they might have customers who are demanding that Debian works on their hardware. The two are not entirely unrelated, we shall see. What we've been considering for quite a while is trying to move on to more and more ARM64 hardware and start building on HF2. One of the nice things about ARM64, as I said, is it's proper server boxes. Proper server boxes come with nice features like they go in a rack properly. They have proper power control. They have real ethernet. They have all of the nice features that you want, lights out management, all of that kind of stuff that you want if you're going to put these things into a data centre and not have a monkey like me going round to go push buttons to reset them when they break. It matters. The flip side of that is you can't rely on running ARMEL or building ARMEL stuff on ARM64. There are instructions from V4 that have been deprecated for a very long time and if you try running some of the ARMV4 code on ARM64 you are likely to start triggering exceptions, particularly with the old Bowyer code. I had a question kind of on that vein. We've been running some ARM64 boards but building ARMHF for the reproducible build stuff and we're encountering some issues with the builds actually working correctly. It seems like there are some ARMV6 instructions that were gently deprecated in ARMV7 and more harshly deprecated in ARMV8 so we're running into some issues there. Are they V6 instructions or are they older? I think V6 but the CP15 barrier exception is an older than ARMV6. It goes back to ARMV4 and that is the one that specifically causes issues. Over time obviously for the people who might not be aware, the ARM instruction set has evolved over the years. CP15 barriers were about the only thing available in V4 and there was very little else in terms of support for atomic code. However, once we moved forward to V6 and then on to V7 there were significantly better designed memory barriers and atomics available and that's what you'll be using now. If you're seeing CP15 in an ARMHF build you've probably got an embedded copy of LibGC that is too old. Yeah, it's in anything that calls GHC basically. Great. Which is a lot. Essentially this is where it comes from. I found, I did a scan in Lenovo again three years ago, maybe four now, looking for embedded assembly in places. I found for example there were many many copies of LibGC, the Garbage Collection Library, the Bone Garbage Collection Library, that were more than capable in a modern version of using proper V6 and V7 atomics but the upstream software that had embedded the copy had embedded one ten years ago and you never need to update, do you? So those are quite possibly where these problems are coming from. So that seems like an issue we're going to have to explore in greater detail? Oh absolutely, yes. The compatibility issues of running an ARMHF charoute on an ARM64 machine? Sure. The one that found this that showed me this was I ran W3M on the console of an ARM64 box. I think our need is to download a .dev specifically and I didn't have any other way. And yeah, it seg faulted. It faulted immediately at startup and I thought, what the hell? And that was when this one really hit home for me. We need this fixing properly so definitely file bugs, mail the ARM list and we'll go from there. So I dealt with an analogous situation on PowerPC because the E500 doesn't have a W sync instruction that is all over the archive. And the solution that is kind of a sleazy hack that worked extremely well was I emulated the instruction in an undefined exception handler and the slowdown was imperceptible. So if these instructions are not common. Sure. So we've spoken about this. There is support in the kernel for emulating CP15. Like back in the day people added support for emulating the swap instruction which was the other common way people did atomics on ancient ARM hardware. You can do it, but what we're finding now is as more and more code is built that depends on these atomics, particularly the C++11, the ARMv4 and ARMv5 cannot provide hardware assistance to match the model that is needed for C++11 atomics. So you need to have a handler, you need to have support in the exception handler in the kernel. That is painful and it's not something we should be depending on. So, Adrian. At least the thing for C++11 is that actually you've probably seen that, right? They recently added the feature that they can implement standard future without atomics and hardware. You can. They have fixed that. So this is what kept us from building LLVM on ARMrill and it's building now again. Right, but what's the performance cost? There's got to be something involved. We can come back to this again in a moment. Anyway, this is where we are with the buildees and we're looking for using more ARM64. One thing that we can do now with more of the ARM64 hardware is actually run buildees in virtual machines. This is great for better separation and better security, all of those good things. So we're going to see more of that in the future. So now, what else can we be doing and what else should we be doing? So, Adrian. Well, I'm just saying that this particular bug was fixed but I think, sorry for being late, we still have this problem with that basically we don't have fast CPUs available which can have these old instructions, right? Because ARM dropped some of the instructions. Exactly, sorry that we were talking about just before you came in the room. Yes. Using emulation is another question, I guess. Because I know they actually do that in open SUSE for ARM. Sure, it's technically possible it's not the right answer long term. Specifically with the CP15 exceptions, I think it's emulated on ARMv7 and then on ARMv8 it's still emulated but it complains very loudly into the tune of several thousand log messages per second. Yeah, sure. So exactly, if you're using now common code that is coming out of QT, for example, anything like that, which is designed around assuming the C++11 atomics, again, your code can be made to work. That doesn't mean you want it to be if it's running potentially tens of times slower. We've seen this problem coming for a while, which is why. Again, for the sake of Adrian who came in late, it's why we're looking at dropping RML from Buster. As I said, we can technically carry on with it. It will need consistent developer effort focused on keeping it in. None of the existing ARM porters have committed to doing anything about this, which is why after a couple of years of discussion, we're now at this stage. This would make history. We'd be the first port in Debian to voluntarily drop out of a release instead of being told by the release team it's happening. Does that mean we've anti-vancouvered? Does that mean we've Montrealed maybe? I don't know. That's what we're up to. Anyway, we have about 20 minutes more. I will say, please, more porters are always welcome, particularly if you care about this topic. We have a fairly active group on IRC in Hash Debian ARM. Nice imaginative titles for these channels and mailing lists. Please talk about stuff on the mailing list. Look, ARM has a new logo, by the way, in case anyone hasn't noticed. The engineers all love it. Can't you tell? That's it. We spent quite a lot of money, as I understand. I don't know the exact number on going lower case. It's special. Sure. I don't know who wins, who loses. Yes. Are there any implications? I've heard rumours of ARM being bought out or something. Yes, you might have heard last year that ARM ceased being an independent company. We were bought by Softbank, a very large Japanese technology company. The visible effects externally are basically we're not on the stock exchange anymore. That's about it. Masa san bought ARM, he told us. I am an ARM employee in case that's not obvious to anyone. Bought us essentially because he loved ARM and wanted to be part of it. Had some ideas on things ARM could do more of, but promised us faithfully. Of course, this always happens after a takeover. How big your pinch of salt is is a personal thing. He did promise at the time he didn't want to make any big changes. If you're going to spend $30 billion on something and then make major changes, you're probably doing it wrong. The only thing that has come through more is that he is clearly interested in IoT devices. It's not so much that there are less people in ARM working on everything else, but if anything, we are hiring more people to do more IoT things. We already had a lot of those. It's slightly more focus, but not less effort elsewhere, if that makes sense. So far, absolutely, it all seems to be a really good thing. I'm happy with it. Hector. Hello. Paquet.net gave us an offer of hardware. Okay. It's in the cloud, but it's not like real hardware. It's hardware. Sure. So how comfortable are we running build demons and writing things on the cloud instead of supporting our own debt boards and tickering with them? That's a good question. We have traditionally always wanted to run all of our official builds on Debian-owned or at least Debian-controlled hardware. So we do have machines, obviously, in data centres all around the world. We don't always own all of it. So, for example, Lenovo are letting us use a couple of mustangs, and those have been very useful for the ARM64 port, or IBM, where Unicamp have given us access to, but I believe not total control over I could be wrong, a few power-weight machines which are hosted there. I think that's still different to just running things in the cloud. What do people think? I think probably for porter boxes makes plenty of sense, like take them up on it.  And then, of course, with my reproducible builds had on. If we had reproducible builds as a real world need, all of a sudden, that makes... We need more hardware. Yeah, and then we could do multiple builds on multiple different providers, and we'd have greater assurance that nothing fishy is going on. Yeah, exactly. That would be great. So, as a background, the packet.net stuff, they have some Cavium Thunder X machines, which are incredibly parallel ARM64 hardware. They have, like, 48 cores, lots and lots of memory. They're designed more as network processors rather than general purpose, but, of course, they've got so much CPU horsepower, they can work very well that way. And then you split them up with KVM, so we wouldn't necessarily get a full machine, obviously. We'd be getting a two-core, four-core, eight-core, whatever virtual machine running on those. It's 96 CPU cores, 128 megs of RAM. Gigs of RAM. Yes. Yes. Yeah, it's easy mistake. So, yeah, it's 48 cores per socket, and then they've got two sockets in these boxes. I've seen one of them running in my office briefly. I don't normally get bothered by fan noise, 96 cores in a 2U box. We turned it on and it drove everybody out of the room. Almost physically just from the air movement. One question. Is it true that the Thunder X does not support ARMv7? It has only ARMv8 implemented? No, I'll explain. Because we're trying to build... Sure, yeah, yeah. ARM's naming is incredibly confusing, even for those of us who work for ARM and have access to all of the documentation. So, ARMv4, ARMv5, and V6, we are currently up to ARMv8. ARMv8 was the first ARM processor to include support for the ARCH64 execution state, which is the first ARM64-bit instruction set. We now have, and some of this was invented years after the fact, they've now renamed what previously used to be the ARM instruction set is now called A32 to make it clear it's 32-bit. What was the thumb instruction set is now described as T32 to, again, to make clear it's 32-bit. And we now have A64, which is the brand new AR64-V8 instruction set. It is possible to buy V8 CPUs that are 32-bit only. It is possible to buy V8 CPUs that are 64-bit only, and the Thunder X is one of those. Yes, it does not run A32 natively. Sorry, an apologies for being pedantic, but unfortunately the only way I can keep it straight in my head is I have to explain those things to me every time I think about this, let alone anybody else. It is confusing. So one of the potential issues with using the packet.net machines is absolutely we could not run native A32 code. We could not run RHF on those. We could run straight on 64. We could definitely run as a port-a-box. That sounds great. Personally, I am happier with the idea of us keeping our official buildies on machines controlled by us. It gives me warm fuzzies even if technically it does not necessarily give us any more wheel security. It makes me feel better. I do not know about anybody else. As we have been talking about doing things like secure boot or like Matthew Garrett who was talking yesterday about signing code and whatever, we are going to have to think more possibly in the future about actual security of our buildies if we want to actually make better security, be better security and not just a pretend. Because of course if we go and sign a load of code that has been built on machines that we do not necessarily have full control over, I think we are failing ourselves and the community. The timing of this, the first thing in the morning after the conference party is awesome, isn't it? Thomas? I am pretty new to the ARM architecture and I like to start playing around a little bit. I want to concentrate on 64-bit and I need some suggestions on which hardware to buy. I know that this 48 cores server hardware is something a bit cheaper. I think I would like to have four or eight gigs of RAM, maybe four or eight cores. Any suggestions? Grab a mic if you want to talk, please. There are lots of options, many, many options to the point I've lost track of what to recommend. Peter might tell you. I've been looking, the problem I've been finding is that they've all been out of my price range. Once you get beyond the kind of hobbyist boards with a gig or two of RAM, which are quite affordable, you get up to the... What are essentially demo boards for server hardware? They get one to the better description and they have price tags. There was a gigabyte one, for example, that had a price tag in the £700 range, which is far, far more than you pay for a comparable Intel-based board and far too rich for my taste. There's a dichotomy in the market at the moment. Most of the boards that you're going to see are mobile CPUs, because obviously that's what most of the ARM 64 things are going. Almost any mobile phone you buy now is going to have an ARM V8 processor in it, whether they advertise it that way or not. There are lots and lots of the cheaper dev boards are based, obviously, therefore, around those CPUs, which is great, it works, but it does mean that you're then going to have typically soldered on very limited memory, you're going to have not great IO, you may not have Ethernet, you may not have SATA, and again, depending on your needs, those boards are great for some people. If, however, you want to be able to have something you could run as your own home development system, you're going to want, as you said, 4GB, 8GB of RAM, a few cores, a SATA port, wired Ethernet, the kind of thing to make it usable as a computer. That's exactly what I'm looking for. I totally get that. The hard thing is, I honestly can't really recommend anything today, that's great. Thomas, maybe you want to look into the devian infrastructure and we're running, we got a donation from Gigabyte, they're running APM moustangs, you can get this hardware from Gigabyte and it's sort of kind of desktop motherboard thing, it's 100,000. Also Softiron. The Softiron 1000. There's also a nice price range, but you might have experienced some issues, but if you... The issues you're likely to experience, unfortunately, are that the CPU that they're using is end of life, so they're not going to be making those for very much longer. As I understand, I'd love to be corrected, because I would love them to carry on. The Gigabyte boards, in fact, there were two Gigabyte boards available. One was using the Mustang and we have a couple of those that we're using at Canova. No, don't we? Yes. They also did a cavium-based board, but I have no idea how available those are at the moment. Again, as Peter says, they're basically the moment they're demos of server hardware more than actual... Please give me a retail price and you can order it from your local reseller. We're not there yet. Also, only Max is building some kind of hardware-based all-winner-based, like Chinese CPUs. What I read, there are two versions of the Gigabyte board, one with U-Boat and the other with UEFI, so what would you suggest? Always UEFI. It should just work. I had to fix a couple of bootloader versions, at least in the past year, so I'm a bit inclined towards the U-Boat version, because it may sound weird to the server folks, but the impression is that a lot of these UEFI stuff is a bit locked down and then also similar broke like other bootloaders as well, and you might be lost. I will admit to some bias. I'm also part of the Debian UEFI team. If you're going to run a mobile device, if you're going on a dev board, whatever, U-Boat is perfectly fine. It's no problem. It's a sensible U-Boat. Finding a sane U-Boat for your board can be harder than it should be. If it's all upstreamed, wonderful, you should be able to replace the U-Boat with something that we know will work. I've been bitten over the years by far too many U-Boat implementations on various dev boards, which inexplicably don't support the file system I want to use, or don't support the onboard networking properly, or all kinds of stupid things which just make it more painful. If you want to use your ARM64 machine as a wheel computer, plug it in, use it just like you would with an x86 machine, I would every day recommend UEFI instead of U-Boat to get something that looks more like a computer, not a dev board. I appreciate I'm not... Other people would disagree, but I don't agree with that. Other people would disagree, but that's my personal recommendation. With my U-Boat maintainer hat on, there's a world of difference. There's this thing called mainline U-Boat, and then there's all of this other stuff that forked off of it, and most of the problems are in all of that other stuff, which is essentially unfixable. The machine I'm currently using myself, I went out and spent $500 on a machine is a Macchiato bin, which uses Marvel's next generation CPU, which is ARM64, is clearly going to be in the core world, maybe the next generation of NAS boxes, and it does networking acceleration and whatever as well. It's got a couple of 10 gigabyte ethernet ports on board, it's got, in fact, six separate ethernet connectors on board, you can't use them all at once. It supports 16 gig of RAM, it comes with U-Boat, but there's UEFI port we're actively working on. It has a PCI slot that almost works. It's a quad-cork ARM Cortex A72, which is plenty of horsepower, and it's got all of the bits you'd want. I said, unfortunately, the PCI is quite broken, and that is a limiting factor. If you don't care about the PCI, you just want a computer that basically works. It's got three SATA ports on it, and whatever, it's got USB. It's actually the machine I tested for the first time ever. I tested the Stretch 9.0 and 9.1 releases on anorm 64 box that I owned in my own home on the day of release, and it worked well. It's the Macchiato bin. It started off as a... Yes, in fact, that's a good point. I have the gobby. I hope that some nice people have been updating this as we go. Also on the U-Boat topic, some machines that we cannot upgrade to Stretch because you would want that. So that's how it's spelled, Macchiato bin. There's also the Espresso bin, which is another Marvell-based small machine. It's only dual core. It's a bit more limited. I said, the Macchiato bin, there's been a number of us who bought these. We were hoping to be able to put it into... I put mine into a little mini-ITX case. We were hoping to be able to plug in a small graphics card and actually have a proper on 64 desktop for reasonable money, but without working PCIe, that's hard. As it is, as a box I can just leave running on my home network, I actually do have something that is reliable and not bad. Of course, if you want everything to work, you will need a kernel newer than Stretch, such as life when you're running on machines that are still actively developed every week, is running a Debian stable release is hard. Other machines that I know a lot of people have, the Pine 64, is... I mentioned earlier about the mobile platform. Again, that's a mobile SOC that they've put onto a board with... are the half a gig, one gig or two gig of RAM, on the version you got. It's almost all upstream at this point. Andre, one of our kernel hackers in ARM, is doing a lot of this stuff on his own time because he wants to make it work. They now have the U-boot that pretends to be UEFI, running on that very well, to the point where he was chasing me wondering why the Debian ARM 64 net instance didn't work on it at the box. We're finding bugs and fixing them as we go. You will probably need to run a back port kernel if you want some of these machines to work well. In some cases, absolutely, if you want all of it to work, you're going to be needing to run an upstream kernel rather than anything in back ports even, but of course, that will improve over time. Yeah, I can speak. I've got a number of ARM 64 boards in the build farm. The Jetson TX1 is pretty good, but you need to patch the device tree and get a patch that hasn't yet landed in mainline for SATA, but otherwise basically runs Debian kernel. There's the Odroid C2, which I've had some troubles with, but working on it. If people can put some of these into the Gobi as well, that would be lovely so we can list them later. The fun we always have is exactly this, and I knew it was going to come, so thank you, Thomas, is always, what board should I buy? I'd want something that works. It's much harder than it should be, and I apologise for that. Steve, do you know something, what's the current status of the big endian port or ILP, is that being developed or what's going on? Sure, we have one minute remaining, so I can quickly say, forget they ever existed, please. People have a number of times done lots and lots of other ports on ARM hardware. ARM hardware is, by design, endian neutral. You can run it either way, little endian or big endian. The default has always been little endian. What we've had Army B in Debian years ago, for the sake of the slug, I won't go into details, it's years ago, we also have people, I've worked on this myself, running a big endian ARM port on V7. There is also, on ARM64, there is a port Wookie is working on right now in Lenovo, ARM64 ILP32. It is not going to go into Debian. I am quite adamant on that. It is utterly pointless as a day-to-day thing for Debian users, so let's not spend any time on it. There is a big endian version of that too. It's complicated. Imagine X32 but on ARM64 instead of X8664 is exactly what it is. The reason that X32 has claimed uses, I've never wanted myself to agree or disagree much, is that you get a significantly bigger number of registers than you do on I386. You're not register-starved, you get better performance, and you're using 32-bit pointers so you don't use as much memory in typical code. X32 should have a win on benchmarks. I've never seen any convincing numbers. Admittedly I've not looked hard. ARM64 ILP32 is exactly the same thing. It's a 32-bit pointer ABI running on 64-bit hardware, with 64-bit instructions. It is not the same as A32, which is the 32-bit ISA that is standard on ARM. They're not at all binary compatible, but they're claiming that it will make porting your 32-bit code to ARM64 easier if you don't know how to port code, essentially. That's exactly it. Run your 32-bit code in 32-bit rather than port it properly. Jolych, grab a mic. Just as a remark on X8664, there is actually a true performance gain. If you use Intel's own C++ compiler, it has this flag which does auto ILP32. It analyzes the code and it will just generate X32 code. We can see that on the build these. It is quite fast, but as you said... How much for difference do you see? Do you have a percentage? Obviously, it depends on the code you want. It can be up to 50%. I've seen people talking about maybe 5% in typical code, at which point I don't think it's worth it. ILP32 on ARM64 gives you smaller memory usage so you should get better cache life. The other thing is, it also does extend you from the 16 registers on A32 up to the 31 registers available on ARM64. To be honest, with 16, you're not registered staffed on almost any code that's sensible anyway. Unless you're doing hand-optimised assembly, you're never going to notice. We don't see the same performance improvement for ILP32 that you might on X32. I don't think it's worthwhile any of the general purpose distros caring about this in any way. ARM64 with 64-bit use it. Is my take? Other people will argue, I think they won't. Unless anybody has any last points, we have just overrun by a couple of minutes. Maybe the last one will not care about RML in this room. I want to know what specific work needs to be done to still include the RML in Buster stage. We need people to basically pick up on bug reports as they happen if they are RML specific. They tend to be quite rare because most of people running RML don't tend to file bugs. I do. We need people to get involved in the tool chain areas and make sure that things continue to work. Deal with issues as they arise. Upstream folks and the tool chain people in particular have been pushing us for quite a long time saying they don't want to support this anymore. You'll need to talk to them to find the exact details. I will admit I ceased caring a while ago, so I've stopped tracking it, I'm afraid. Mention on the... If you want to get involved and make RML continue, please announce that on the Debian Arm List. Make a point of looking for the bugs and talking to people and go from there. We haven't taken it out of Buster yet, but we will soon, unless we see that happen. Okay? Now that really is past time. Thank you for coming along. As I said, I will send us somewhere to the list later. Please, if you want to get involved, get involved. We're friendly, we don't bite much. Thank you.


Ladies and gentlemen, the President of the United States, accompanied by Congressman and Mrs. Connie Mack. Thank you very much. Thank you very much. Thank you. Connie, I could have listened all day. Thank you all very much. Connie and Faisella, Governor Bob Martinez and Mary Jane, Jeannie Austin, Alec Cortellus, Tommy Thomas, Jeb Bush, Paula Hawkins, ladies and gentlemen, I thank you all. The Florida Republican Party fills my heart with sunshine. You know, it's always great to be in Florida, but it's not true that I keep returning just because Ponsa de León thought that this was the place to find the Fountain of Youth. The fact is, Ponsa de León never did find the Fountain of Youth. I know I was with him on that trip. Well, actually, the truth is, you know what keeps me young, it's cutting taxes. The other thing that keeps me young is helping to elect outstanding Republicans, and that's why I'm here today. I came to campaign for the next United States Senator from Florida, Congressman Connie Mack. Now, of course, Connie Mack's grandfather, and namesake, was the grand old man of baseball. Back then, if Connie had told his grandfather that he wanted to go to Washington to be a senator, Mr. Mack probably would have figured that Connie meant the baseball team, the old Washington senators. In those days, we used to jokingly say Washington, first in war, first in peace, and last in the American League. But next year, thanks to you, Washington will have a new winning team, and I mean real major leaguers, Senator Connie Mack and President George Bush. And Connie, you'll have to pitch because he was a catcher. Well, since his election to Congress in 1982, Connie has stood with us for reducing taxes, spending, and government, strengthening our defense, expanding world freedom, and restoring a strong, proud, and free America that puts its faith in God and trust in the people themselves. What the 1988 elections are all about is whether we continue to build on that progress and move ahead to an even brighter future or whether we hesitate and return to those worn out policies that Connie mentioned that bring high taxes, low growth, and a loss of direction and purpose. When George Bush and I took office, the other party, which had long controlled Washington, had left America with its economic and foreign policy and disarray. Government spending was soaring out of control. Business was being crushed under massive regulation and taxation. Unemployment and business failures were climbing. The prime rate was at a record 21 and a half percent. And working people had suffered under two consecutive years of double-digit inflation that had raised consumer prices and incredible 27.3 percent. Yes, soaring prices and a sinking economy. That's what the other fellows with all their lip service about compassion inflicted on the American people. The economists called it stagflation. The Democrats termed it malaise. The liberal pundits said it was part of America's inevitable decline. But we came in and said the only thing that was inevitable was that bad policies produced bad results. We said there may be no easy solutions, but there's a simple solution. Get government out of the way and let free people and a free economy work their magic. We refused to believe the so-called experts who announced that fuel shortages and gas lines were here to stay, that we had entered an age of scarcity and Americans would have to learn to get by with less. Instead, we deregulated oil prices, said goodbye to federal price fixing and fuel rationing, and helped put America back to work. When we proposed cutting tax rates and letting working people keep more of their own money, the Washington establishment immediately launched a counterattack, rolling out a liberal economist to warn that lowering taxes would cause runaway inflation. Well, we pushed ahead and cut the tax rates, as you know, and the result was that inflation was slashed to a fraction of what it had been. Interest rates were more than cut in half. The economy boomed. Employment soared and federal revenues actually increased. The top tax bracket has now been lowered from 70% to 28%. And in the Senate, Connie Mac will help keep the rates down and work with George Bush and his fellow Republicans in Congress to cut the capital gains rate and open our economy for more jobs and growth. But what about the Democrats? The $64 billion question is this. Should we expect that if the Democrats, all but certain presidential candidate, is elected that he would raise taxes? Yep. In fact, he just did. Not only has he hiked taxes as governor of Massachusetts, but in the last five years, he has increased Massachusetts state spending at double the rate of federal spending. He spent every dime and more of the revenue generated in his state by the Reagan Bush recovery. And since 1986, while the federal budget deficit has been cut sharply, his deficit in Massachusetts has ballooned.  The sad truth is that whenever liberals talk about reducing the deficit, it's just a code word for boosting taxes. And once they raise taxes, they raise spending even more. This November, if the people of Florida don't want an increase in federal taxes or a big spending Congress, all they need to do is to go to the polls and vote Republican. See, I know what I'm talking about, because for most of my life, I was a Democrat.  I thought as a child. Then I put aside childish things. Well, Connie Mack knows that to fight the deficit, you must control spending. He supports the balanced budget amendment and the line item veto, which your governor has, which I had as a governor, but which, for some reason, they just don't want to give it to a president. He helped lead the fight to pass Graham Rudman. And that law is already helping to put a lid on federal spending. Connie knows that the American people are not undertaxed. The federal government overspends. Isn't that the kind of man Florida needs in the Senate? See, the new liberals, or the liberals, not new, the liberals in Congress have opened a new front in their assault on limited government and fiscal responsibility, with a tactic designed to circumvent the budget process and slip past Graham Rudman. Their new strategy is to try to enact their mountain million dollar social agenda by requiring private businesses, primarily small businesses, to carry out and directly pay for expensive social programs. And here's an example. Senator Kennedy has tried for years to pass an exorbitantly expensive program of socialized medicine, and it hasn't happened. So now he's proposing, and the expected Democratic nominee has endorsed this plan, that the government pass a law requiring private companies to directly pay for a federally mandated health insurance program, a program not targeted to the needy, and which would not provide for the retired or unemployed. According to the Congress' own budget office, this law would cost the American people a whopping $27.1 billion a year. But the political angle of this scheme is that the tremendous expense of this mandatory program will not be called what it obviously is, a gigantic tax, a $27 billion tax, mostly falling on small businesses that would reduce jobs, growth, wages, and economic opportunity across every segment of American society. The fact that the liberals try to disguise their big government ideology inside a legislative Trojan horse is proof that they haven't given up. It's up to conservatives, like Connie Mac, to just say no to big government and to lead the fight for greater opportunity and prosperity for America. In 1988, the American people face a choice, really the same choice we faced before, and much the same choice most of the world has recently had to make. And each time, the people have made the same decision to continue in the direction of economic freedom, entrepreneurship, and individual opportunity, and to move away from the heavy hand of government, which seeks to control the people and the economy. Now, I have to tell you, this reminds me of a story. Actually, it's an old baseball story. You see, one day, old Lucifer down there from his headquarters, called St. Peter in Heaven, said they wanted to challenge him to a baseball game. And St. Peter says, sure, let's play. But be fair, I have to tell you, all the great ones are up here. We've got Babe Ruth, Lou Gehrig, Satchel Page, Roberto Clementi. We've got all the best players. And our manager is the legendary Connie Mac. You won't have a chance. Well, old Lucifer says, that doesn't matter. We'll win anyway. And St. Peter says, how do you expect to do that? And he says, simple, we got all the umpires. You see, we can either have an economy that puts the private citizen at the center, the consumer, the worker, the entrepreneur, and lets each individual be the judge of what to buy or sell, where to work, where to invest, and what to create.  What is euphemistically called government corporate partnership is just government coercion, political favoritism, collectivist industrial policy, and old fashioned federal boondoggles nicely wrapped up in a bright colored ribbon. And it doesn't work. This kind of approach was tried in Europe, and it's being abandoned because it only resulted in economic stagnation and industrial decay. The fact is that in the last five years, while American businesses, mostly small companies, were creating nearly 17 million new jobs, Western Europe created none, not one. Back in 1981, we passed a true jobs bill. We cut taxes, spending, and regulation, and got government out of the way, and let free people create new jobs and businesses. Well, our jobs bill, what was once dismissed as Reaganomics, funny they don't call it that anymore, has produced over 250,000 jobs a month over 66 straight months. And that is a record that no spending program or political gimmick can ever match. And do you know that most of those new jobs, those almost 17 million, were created by small independent businesses in these 66 months? Connie Mack and the Republican Party stand for opportunity and jobs. We represent working people and entrepreneurs. The liberal leadership of the Democratic Party represents big government at the expense of the American worker and taxpayer. But the fact is that the Democrats have controlled both houses of Congress for 27 of the last 33 years. And now more than ever, it's time for a change. Let me add to those figures I just gave you with regard to the other party. When we took office in January 1981, the Democrats had controlled both houses of the Congress for 44 of the preceding 48 years. But in the 1980 election, we won control of the one house, the Senate. And for six years, we had that. Now we're back to the Democrats having both houses. We couldn't have achieved the economic recovery we have if both houses had remained in Democratic hands as they are now. We must get the Senate back if we're to continue our economic growth. And let's talk for a moment about foreign policy. Let me offer here a simple straightforward message. No more Vietnam's, no more Nicaraguas, no more Bay of Pigs, never again. Connie Mack and I stand with the Nicaraguan resistance. We will not rest until we've won for them the full support they need and until they've won for themselves the genuine democracy and freedom for which they've so bravely struggled. By supporting courageous freedom fighters around the world, we're shining a light on the path out from communism and nowhere is that light shown brighter than in Afghanistan. And isn't the time we apply the lessons of Afghanistan in Nicaragua and show the same commitment to freedom fighters in our own hemisphere as we do to others in distant lands. I just came from a meeting with Cuban-American leaders, and I want to tell you what I told them. In communist Cuba, a man like Armando Valladaris is considered a criminal. In the United States, we're honored to have him represent our nation before the world. In communist Cuba, a man like Ramon Puig is labeled an enemy of the government. In the United States, he's a respected citizen and a hero. While Havana spreads communism, terror, and death in Central America, many Cuban-Americans, like Dr. Manuel Azugarai, are providing food, medicine, and humanitarian assistance to the victims of communist aggression. So yes, there is an unbridgeable gulf between the governments of the United States and Cuba. It is the gulf between freedom and tyranny. And as far as this administration is concerned, freedom for Cuba, liberty for her people, is a non-negotiable demand. And so long as Cuba remains an inhuman communist dungeon, so long as it exports terrorism and revolution in the Western Hemisphere, has some 60,000 military secret police and other personnel propping up brutal communist dictatorships around the world, and yes, so long as Cuba is used as the personal instrument of Fidel Castro's violent anti-Americanism, there cannot and must not be any normalization of relations with Cuba. You can count on Connie Mack to defend freedom, to defend America, to defend the taxpayer, and to defend the family. He supports the Strategic Defense Initiative that would protect us from nuclear attack. And he supports tough federal judges who would put violent criminals behind bars. And to protect our children from menace of illegal drugs, he favors the toughest, most comprehensive drug enforcement policies, including the death penalty when narcotics traffickers commit murder. And when it comes to looking out for the rights and concerns of retired people, you can count on Connie Mack to be there. He has staunchly defended the social security system to ensure that it will be fiscally sound and available for Americans who worked so many years to earn his benefits. Yes, Connie Mack cares about people. Ask Anatoly Michelson, I'm sorry, who emigrated to America 30 years ago only to have the Soviet Union keep his family from joining him. As a member of Congress, Connie took up their cause, and last year, after three decades apart, a reunion took place. And Anatoly, who is here today, was reunited in America with his wife, daughter, and grandson. And when I look at this tremendous group here today, all of you, I just wish I could take you all back to Washington with me. But I have to leave you here so you can get out the vote in November. I want to thank each one of you for everything that you're doing to help put Congressman Connie Mack in the Senate and to help build the Republican Party throughout the state of Florida. So thank you all. God bless you all. I have a special presentation I would like to make to the president. Since we have talked just a little bit about baseball, I thought it was appropriate that I present him with a jersey that says Mack in 88. And now it is my opportunity to introduce the Mount Sinai Baptist Church Excelsior Choir that will lead us in America the Beautiful, or we'll sing America the Beautiful.


The study evaluated the immunogenicity and safety of an inactivated chromatographically purified varicelled-arrived Japanese encephalitis vaccine, CVIJE, in 152 healthy Thai children, with an average age of 14.4 months. All subjects had seroprotection after two doses and the seroprotection rates at one year were 89.3% with a geometric mean titer, GMT, of 49. Local and systemic reactions such as fever, vomiting, and poor appetite were noted within 28 days post-vaccination but were self-limited. The study concluded that CVIJE is safe, immunogenic, and provided high-neutralizing antibody titers. This article was authored by Pornthep Chantavanich, Kriangsaklim Kittakul, Chukiatsiravichayakul, and others.


So guys I am back with another amazing solo XP farming spot This one guys you don't want to miss. How's it going people? My name is DP Jane If you enjoyed the video, leaving a like really helps add to anything like what you see and want to see more be sure to subscribe Okay, so the whispering pines is a dungeon. We are farming today. It's located right here on the map I actually ran through this yesterday and I actually called a little instance of it to remind myself to go back to it Completely forgot my pal on my discord Yakub said try it out. It's unbelievable Especially if you're farming those nightmare dungeons as well. This is even crazier So if you get a nightmare dungeon got a nightmare schedule guys For this one or even a schedule activated turn this into a nightmare dungeon. It's even crazier for the XP gains Okay, so this is one of those dungeons just run it you run it and slay everything and the Strugglers you want to group up the first part requires you to slay gatekeepers fair enough But any stragglers like these guys here group them up until there's a group of a bunch of them like this and just slay them Because there's so many ads in here. It's unbelievable and you'll see guys They're just non-stop and this is the first area the second area is a killer a slay all it's even wilder people It's even wilder Now obviously when you come across any events You gotta do them you gotta do them. I mean look at this look at this. I mean it's just wild It's just wild My birdies are working progress guys. I can't kill things as quick as I will be able to But hey if you this necromancer build looks appealing to you We'll be bringing a guide on it soon a Guide and it's soon to come on come on stragglers group all up group all up group all up Now when it comes to farming XP, you have got a build that's great for taking that goose at enemies like this That's what you want really This is what you want now what we'll say this is a massive area It's a big big area loads of enemies in every direction So this would be even well if you don't just weigh more fish in a group. That's just common sense, but He's blow it blows to my head in but if you do this in a group, it's gonna be unbelievable Again this can be done Quite easily solo Honestly, they're the band of my life and blow your dues They had a band of my life now. I was running the capstone dungeon yesterday level 70. I ran through the entire thing Perfectly fine. The only issue I was having trouble with I don't blow your dudes They were mapping me.  I don't even know they were absolutely mapping me But yeah, I've run for the old dungeon completely fine. I was five levels below it until I got to the boss Until I got to the bus where I just best I got was talking down to half-half Oh look an event took him down to half-half and Yeah, he just kept slapping and broke all my armor basically. I just you know, oh wait until I'm a couple levels higher You're gonna start Stop them all in There we go. That's what I'm trying to do But what come on start it already, but yeah any event like this I do I do recommend you doing They're just so so easy to XP. I ain't keeping nobody alive. I mean every time I've tried this I've always all died I'm here for the enemies The loot ain't gonna be that great here anyway mastery or not Come on group up group up lads Group up we have lost somebody Maybe try hiding in the bush instead of lying on the floor. Come on stragglers.  I don't know if any of you guys have got kids watching this look when you got kids Almost every kid has one of those right at the toys. You think it's a good idea when you first bite your kid But then all of a sudden you realize That's the biggest mistake you ever made in your life So I don't fake vacuums kids can push around and I made a hobbled Rattling noise.  I just pay you as you all did I get mastery when you're looking We've got a pick-up whistle. It's all money. It's all money. It's all materials. Okay, so yeah This is a big big dungeon of them Tons of ads but elites here Come on. Come over this way Come over this way completely miss that group up get stung Now Get blown up Come on combo stack combo stack when a combo starts stacking That's when it starts working Okay, so that's one gatekeeper then I'm guessing that was there didn't even realize So the other guy's gonna actually there's not a group of ads here. This is xp This is xp. This is what we're here for There we go There we go. I'm guessing the other guy might be up here somewhere We take a look at the map when I clear all that you'll see that It's just wow. Wow. That's a lot of spiders That is a lot of spiders The blood misses my safety net by the way, I mean deep trouble and all Sheets going down I'm just gonna pop it and get out of there I always I have to you'll learn this as well when especially on necromancers. You have to keep an eye on your health bar because you just I mean look at that. Did you see that then my health just dropped so quick So quick Okay, so this is a big big area So, okay, so I've done what I've got to do. So now we just got progress on There's another group of ads ads here I'm gonna take them out Take no time at all kill them all Okay, so which way have I got progress? Is it up that way? It's got to be up that way Got to be off this way. It should be a while. There's normally a red misty door here Or a mid event. Okay, so now we get all the beautiful little spider man No, good thing. Well, these used to I'm not sure if they're still the same But a little spiders here used to give you the same xp as the bigger enemies But they're way easier to take out which is just a bonus. So Keep that in mind when you're running dungeons and they got lots of spiders in See them little ones then they were dead as soon as they spawned in Okay, so this area I do believe now will be a slay all just basically kill everything That's what we're gonna be doing Slay all enemies. Oh, no, not you guys Not you guys you guys can follow me. Come on Nope, I'm not I'm not falling victim to them below you dudes.  That's for you. You're annoying bastard get out of here Now this will be one of those places where when you've got like 15 or 20 ads left They should all spawn on top of you Which is cool So if you're running back to try and find the ones you may have missed Okay, so I can see a couple of elites in there. Okay, so they're down They are down Now this is I will say is a farm. I haven't I don't believe I've seen anyone post on Which is great Now it means Blizzard are less aware of it. So you get to use it for a little longer When everyone starts covering the same old farms That's where wow that guy just slapped me then Yeah, but when everyone starts covering the same farms, that's when Blizzard are like, no People are not allowed to have fun. No, no, no Okay, so is this going to be an event here? Nope for all my days. I got the best shrine going I actually had one instance. Yeah, this one my last my last uh, last necromancer build Uh, well, I've done a dungeon and a butcher spawned behind me and he chased me for about five minutes I couldn't do anything I couldn't do anything and it was that moment. I just realized that my um My minions weren't Very effective for me. They were good early game But getting to the later game and seeing how much damage all the people could do on the simpler worlds But you know what I don't need that in my life. I don't need to be worrying about minions and reviving them all the time Even my golem got it. My god.  I felt a vulnerable now It actually happened about Two days ago just when I respect and change things up But I just activated one of those shrines. I get a little electric ball and I obliterated him I literally couldn't about five seconds. I obliterated him to look at the ad See what I mean about when that number pops up on the screen all spots start coming to you And now when you take all these guys out, you'll see that more elites will spawn Come on. What are you doing? Well, I mean Okay, my tendrils just didn't want to work then but that's fine. Okay, so we should have well that's is that done now? Okay, so we've got to travel to the fallen sanctuary Okay, so there's another section which I forgot about which is great. Just more ads for you like that Or is it the bus? It could be the bus I think it's the bus, but if to be honest efficiency wise Here I'd Quit at the dungeon and start to farm over again, but we're just going to do the bus anyway. Forget it Why not? We'll do the bus anyway. Why not? We may as well people The thing is about this build. I need smaller ads like this to uh Be here so I can spawn those beauties I'm gonna spawn those beauties That's when things start going crazy And I can stack that damage and you know It's just things to start to get much much better. Again, this is sort of a work in progress build Um, I've got so many things. I've got an aspect here I'm looking to apply this will change this build drastically this while I work into more critical damage will be unbelievable Uh, but I've just got I gotta find a way to put that in and at the minute. I'm struggling The only place I can really really change is my boots my boots, uh I love these things Make it so you dodge you can run quick and get out of there you leave behind this ice trail But yeah, my boots I can change But it also means That aspect won't go into boots the aspect goes into Gloves and my ring basically so I need to Probably apply this somewhere else If you can apply that to my boots, that's fine, then I can probably Apply that aspect to my gloves. Yes, I can that's probably what I'm gonna have to do Yeah, so we'll see you guys. But yeah guys, that is the farm It's actually a great great spike really is when she's done Obviously as you do leave the dungeon and quit out the game a lot back in it really is that simple guys But yes, there we have it guys. You've enjoyed the video leaving a like a really helps out If you like what you see I want to see more diablo 4 be sure to subscribe and hopefully guys I will see you on that next one


If the diagnosis is cancer, time is important. Call the PMC Lawson Cancer Center and we'll see you quickly with the goal of starting your plan of care within two weeks of diagnosis. Our purpose is saving lives. As the holidays approach, many are gearing up to attend get-togethers and parties which potentially involve alcohol. The Pikeville Police Department wants to make sure all drivers are safe and as little intoxicated drivers are out on the roads as possible. DUI is the most avoidable thing that can be done. You know, it doesn't have to happen at all for any reason. Phone a friend, stay where you're at, call a taxi. We have taxi services that cover this area and very reasonable prices.  You know, it doesn't have to happen. Sober drivers on the road need to be paying close attention, avoid texting, and use hands-free devices while in the car. Just don't drive, don't drink and drive. It's real costly and it could cost you the ultimate, ultimate, pay the ultimate price for it. Somebody's life or your life and it's a totally avoidable thing. There's no reason you should be on the road intoxicated. There's absolutely no reason for it. You know, as police officers and first responders, firemen, people like that, we see firsthand exactly what happens in these crashes and, you know, the trauma of that to families is terrible. So there's no reason to put people through that, especially during the holidays or anytime, but especially during the holidays.  So if you think you've had too much to drink, do not get behind the wheel of a vehicle, call a taxi, friend, or if possible, make plans to spend the night at the place you will be drinking. For Mountain Top News, I'm Kelsey Deen.


All right, what is going on everybody welcome back another video My name is John Hammond this time showcasing some of the hack the vote CTF or capture the flag competition That's been going on this weekend November 4th to November 6th. It's still Saturday right now just in the middle of it I haven't gotten a whole lot of flags admittedly But I figured I'd be able to show off some of the small ones that I have been able to get this has been admittedly Really difficult CTF at least on mine. It's organized by RPI sec So be sure to give them a check out and a thumbs up for an awesome game And it's online at Pone Dot voting and this is their interface, which is super cool so That is just the map of the United States for the hack the vote Theme and they do have their Jeopardy style display if you just want to look at it by category so I want to show off the web 100 in this video and that is titled Bernie Sanders fan club. It only has 185 solves so again out of the scheme of things I think there are about 900 people registered 930 or 950 or so at this point now So 185 is a good amount for the people that were able to solve things So okay, it's the Sanders fan club about a hundred points The challenge description is these deplorable Sanders supporters are still fighting shut the site down by finding where the idiot stored his credentials So it gives us this URL. So I'll go ahead and follow that and Check it out Bernie Sanders fan club field the burn Man, I just love Bernie Sanders. He's still got a chance. It's that or it's that or the site is a little work in progress It only works in Firefox. I think I'm not very good at web dev So I just copied and pasted a bunch of config files from Stack Overflow. Hmm. I Think I left my credentials somewhere, but I can't seem to find them. Let me know if you see them Okay, thanks remember And I guess there are some pictures here of flags, but that's all that's on the web page Literally, literally, that's it. There's a login And it's just a password input box You can enter anything and you will try and authorize although the password is the flag is the only alert message that we get so I Admittedly spent a lot of time on this challenge kind of just going through rabbit holes. I asked around on the IRC channel I tried to talk to some friends and admittedly I would not have been able to solve this challenge without the help of some very generous people and Bouncing ideas back and forth and explaining a worthwhile process here so I'm thankfully running Firefox right now. That's why this only it only works in Firefox. I think as an interesting tidbit Although the thing that really put me down a rabbit hole was this I just copied and pasted a bunch of config files from Stack Overflow So I think a lot of people from individuals that I was talking with on the IRC channel They were like trying to Google things that were like oh in the URL of Stack Overflow or like configuration files for bootstrap considering like it is it is a bootstrap web design page or The back-end server because initially you want to reach for like the low-hanging fruit, right? Is there is there a robots.txt? No, all over we can see it's an nginx server. So we'd want to see oh, are there any nginx like configuration files stuff like that Be able to look for that on Stack Overflow just basic configuration files etc So some other stuff that I was interested and curious about I wanted to try and run like other low-hanging fruit Penetration testing tools with the web application stuff. So I initially ran Necto, which is an awesome utility if you haven't heard of I think I've I may have shown it off before open source web server scanner Blah blah blah you can check it out on your own if you haven't heard of it before but all I ended up really doing is just passing the URL as the host here and It will try and look through it and it immediately finds this really interesting thing The anti-click jacking x-frame options header is not present but I actually literally just read the wrong line I meant to be reading this one the uncommon header link is found with contents flag to jpeg rail equal style sheets That's interesting. That was weird. Obviously, this displays this uncommon header and admittedly. I didn't really know what to think of that or what to do with it So I was looking at it like well, okay flag to dot jpeg. That's odd and strange I see I Check out the source the web page I try to like initially I'd googled for common things like this like oh this might have been like Tutorial comment for someone just trying to find easy Config files and stuff like that and I see these images the flag one jpeg and the flag two jpeg And then I went over to the login at html page But again, there's nothing there either Same kind of content and same time bootstrap jazz, but it's just a JavaScript thing It tells us oh the passage is a flag so there's no like communication with the server here. It's just weird So I'm lurking around the IRC channel and some talking with other individuals the administrator like the admin that created this chat of this challenge Shout out to lens. I guess Had said that the flag is in the website itself So you don't have to go digging through stack overflow. You don't have to worry about any firefox specifications of like that You can find it here on the web page and even tried like I honestly tried to mirror the entire web page And like strings everything try to like Grip through everything and try to find something that is a flag But to no avail Eventually stumbled upon this thing that we ended up using firebug Which is a firefox add-on me firebug An extension for firefox to let you like interact and change html and JavaScript and css stuff Wow, you're viewing a web page so But you can also just see the traffic and stuff going out as you work through it so I Was interested in the net tab and I requested all so then I tried to load the page again and I could see all the information the URLs that are being get and posted with like the typical HTTP conversations here and Some interesting stuff that I saw Was that okay? We're getting the HTTP like page We're getting the flag dot jpeg, etc. And I was curious why a flag that jpeg was it showed up twice One down here with flag one and flag two up here. So I was observing some of these and I was going through them more in-depth And something stuck out to me was that hmm Response headers connection keep alive content like 223 was it whatever a content type text css That was weird, right? A jpeg image is not a css style sheet and that's there was that weird link header for flag to jpeg rel style sheet that Niktoe had had pointed out for us here. So I was like what and I and I right-clicked on this one and I tried to copy as curls so I could see okay I can't obviously change the request that I'm doing with through fire bug But can I see the request that it's getting and I copy it as the curl command so now I throw this in My terminal and I do this curl Command that fire bug just straight up gives us but it's the URL to the flag to jpeg however, it's accepting it as a css file and I'm just gonna run it for one thing to see if we can get the Whatever it returns for us Keep in mind my user agent right now is still Firefox Because I'm doing this through my web browser. I'm like replaying the packet get from fire bug Just this time running it through curl so it gets CSS file apparently a style sheet. However, it's supposed to be a jpeg image And there's a comment at the very end here that says how did I? Never mind. I'm pretty sure my credentials are in a text file. So boom. We've got a lead here We immediately found something and it's a good hint. So this is clearly some guidance and What sticks out to me here now is that okay, it's supposed to be a text file. I know there was some like ideas. Oh Is it flag dot text or flag flag two dot text or flag dot text and some people again in conversation in the IRC channels weren't having any success with that flag dot jpeg not Okay, and To no avail that that that did not work What I figured was hmm the content type it being CSS is weird considering it to jpeg But if it's supposed to be a plain text file according to this My credentials are in a text file. It's obviously interpreting it as something weird So let's try and only accept rather than a CSS style sheet a plain text file The mind type for that is text over score plane and I run this and We get a password reminder and there's the flag. I am very bad with computers I Suppose this hint here go tell Chrome developers to support RFC five nine eighty eight Firefox is the master race um, I guess that's that's that's why it's supposed to only work in Firefox and I'll pull this back down and I suppose me running firebug being being able to see that it passing the You are the user agents in the curl headers. It was able to find it just like that I'm curious what this RFC is I Haven't actually read through it, but oh It also defines use of such links in each of your letters of the link So interesting stuff if you're curious about how the back end works, but that's how I got the flag Crazy method admittedly I again I would not have easily figured this out on my own without bouncing ideas off of other people and talking it out so awesome challenge Had a little bit more to it than like a simple low-hanging fruit like robots.txt gig. So cool. Thank you for watching guys I hope you enjoyed this. I hope to show off a little bit more of hack-to-vote Challenges and show some write-ups for you and I hope to see you in the next video


Live from Mountain View, California, it's The Cube at OpenStack Silicon Valley, brought to you by headline sponsor, Mirantis. Here are your hosts, John Furrier and Jeff Frick. Okay, welcome back to the morning, we are live, this is The Cube Live in Silicon Valley for OpenStack SV, that's the hashtag OpenStack SV. Go to crowdchat.net slash OpenStack SV and join the Randy Bias Show, we are here. My co is Jeff Frick, our next guest, Cube alum, Randy Bias, we've known you, Randy, when the Clouderati, before the Clouderati was called the Clouderati, there was like three of us and four of us and six of us and all the crew, now it's huge, now it's OpenStack, so welcome to The Cube. Thanks, Jeff.  What are you doing? How's it all going down? So I got here a little late and the traffic wasn't great on 101, never is. That's a good sign for the economy, I guess, but the presentations before me were really good, fairly technical, I think I got on stage and kind of shook things up a little bit because I wanted to talk about the overall direction of OpenStack, I wanted to talk about how we can make OpenStack more successful and make the community a better place and I wanted to really sort of draw out what I thought was a glaring problem that need to be discussed that I think is people are sort of glossing over. So what specifically were you critical of? So OpenStack has a clear mission, there's a vision for the overarching OpenStack community and for the people in OpenStack and what they all want to accomplish. There's a mission on the OpenStack Foundation website and so on, but there's not really product leadership within OpenStack, there's sort of this big gap between the board of directors and the foundation which see themselves as responsible for the strategic business direction and the technical committee with the PTLs in it that see themselves as responsible for the six month integrated release for basically the software development lifecycle. And so the problem is that there's nobody who's really responsible, there's no ownership for what is the long-term product vision on a project by project or program by program component within OpenStack. So there's a PTL for, say, Neutron but there's not a product manager or some people that support the PTL and help them with sort of long-term prioritization goals. So talk about the importance of this issue and some of the consequences if it's not addressed from your perspective. You know, one of the things that's gotten very challenging is that when OpenStack started it was only two projects. It is now nine projects that are integrated. I think in another year we may have double that number. We'll have close to 20 projects in integration and as it gets bigger and bigger and bigger the challenges become more and more and more to make sure that we have success in each of those. So one of the things that may start happening is that it may cause a breakdown and may cause failures to get to that six month integrated release. We may have bugs where one project can't talk to the other and so on. And it also means that we will continue to have these ongoing arguments about is OpenStack the code? Is it the APIs? What kind of hypervisors do we support? What does object storage mean? What does block storage mean and so on? There's not really anybody who kind of owns creating alignment around kind of shared vision for each of these projects. So we're seeing a lot of commentary around the usual things here. I want to get your take on it. Maranth has had a presentation. There are a number one thing on what to do is to focus on the APIs as the key to adoption. I mean, it's something that's been, you've been discussing for a while going back to the API debate, the great API debate that we've broadcasted. What's your take on that? The APIs are important, but they're not the only thing that's important. The code is also important. Probably most important is that we have some kind of understanding of what each of these things is. Let me give you a concrete example which I'll kind of try to identify where problems arise. So some people would like to bring in SEF as a competing alternative to say SWIFT, which is fine. SWIFT has a view of the world about object storage. It says object storage is what they call eventually consistent, right? One of those cloud technical terms. And SEF has a vision of object storage where it's strongly consistent much more like block storage. So there's nobody there to really have a conversation with about like our SWIFT and SEF really competitive. Maybe SEF is really more in the block storage project. It's really part of the Cinder project, not our Cinder program rather than part of the SWIFT program. Because it doesn't meet certain guidelines. There's no vision about what is object storage so you can have a measuring stick against it, right? At the same time, maybe it does fit. And then there's a question of like can SWIFT and SEF coexist? And if they can coexist, how would they coexist? Is there one PTL on top of the object storage program? And then there's different product managers for SWIFT and for SEF and so on. And I think that that stuff suggests unfortunately the issues come up and we butt heads about them but we have no way to actually resolve them. So we're getting commentary from the crowd here. Tim Crawford, I agree there are many issues and not many solutions yet. Concern with that? Happy about that? Good thing? Bad thing? But I don't know how much of this is a committee versus a leader because a lot of big tech companies are very fortunate when they have a really strong willed person that can drive that vision rightly or wrongly with Larry at Oracle or with Jeff at Amazon or obviously with Jobs at Apple versus you know everyone always jokes that a camel is a horse by committee. And is that just part of the structure of the community? How do you assign or how does someone take the leadership role around some of these specific objectives? Well, I mean... Those are best practices or kind of what's your ideal state? So the important thing to recognize is that there's no single model. People have solved and resolved these kinds of problems in the past in a variety of different ways. Sometimes it's the single strong leader, sometimes it's a smaller group. The thing it never is is grassroots.  There's too many people who have kind of like widely differing opinions about what it needs to be. That will never work. It doesn't necessarily need to be the benevolent dictator. It can be something else, but it's not going to be all the developers in aggregate making decisions and you get some kind of emergent vision. That's not what you get. That's when you get the camel. Right, what we need is we actually need a smaller groups of people who are focused on tighter, more controlled missions who can actually help to drive alignment and raise problems like the one I said between Swift and Seth out to the community so that they can eventually be resolved. And do you think those will be driven by expertise, by passion, by position, by a vote of the group to assign that responsibility to get behind or what's kind of your hope or as you said what are some of the other examples that opens that can learn from to execute this? A great product leadership, and if you look at any kind of startup, a great product leadership comes from a combination of two things, ruthless prioritization and saying no. And so I think- And those are the biggest startup challenges, right? That's right. And so I think that we need to have the same. One of the greatest things that Linus ever did for Linux is he would say no when people wanted to put things in and he had, he could veto things. We don't say no much at all right now. An open stack, if you write the code and you follow the rules and you make sure it gets upstream, then it just gets upstream. And part of that's because it's clear that the PTLs don't feel that it's, to a certain degree that it's in their remit to make decisions about that kind of stuff. And a lot of the time the PTLs are working for some of these companies too. So if they did say no, they would be perceived as being biased and so on. Part of the reason for having a separate product leadership function as I proposed is that we want to make sure that that is not owned by any company. It should be owned by the foundation even though it's a little bit non-traditional kind of model for the foundation so that those people can be relatively independent. I alluded to somebody on Twitter mis-understood me. They thought I said that Linus Torvalds was a product manager. That's not what I said. I said that he does do the product management function. He does say no. He acts as that strong leader, the product leader who's got a sense and a vision of what needs to happen which is what a product manager does. And so we need that inside OpenStack in order to be more successful. And it cannot be an interest that's beholden to any corporate entity and to a certain degree the PTLs are 100% in max just making sure that the six month integrator release happens and that's going to get worse as we go from nine integrated projects to maybe as many as 20. So I got to take on obviously eucalyptus selling to HP. CloudStack is kind of taking its course. OpenStack clearly there. Do you remember the old debates? CloudStack, OpenStack, eucalyptus now kind of all kind of naturally taking its course. What's your commentary on where it's ending up? Yeah, I mean, OpenStack sucked all the oxygen out of the room for CloudStack and eucalyptus a long time ago and now we're just seeing kind of the mood to sort of the final chapter. And I'm not sure I really should make any comments there on eucalyptus or CloudStack and both were good products. They had good teams behind them. And I am in particular a big fan of Martin Miko's and I think he's going to help HP really get their proverbial stuff together. And so I think that's great. But the reality is that when we decided to bet on OpenStack in summer of 2010 we decided to do that because we saw two things. One, it was going to have a lot of momentum. And two, it was focused on community and eucalyptus and CloudStack had been open source in license only. They hadn't really focused on community. And I've been working in the valley since 1990 and I've seen the worst technology that's more broadly adopted win time and time and time and time again. Which isn't to say OpenStack is the worst technology. It's simply to say that the determination of what wins has little or nothing to do with the quality of the technology and it more frequently has more to do with does it solve a problem? Can I get it up and running? It are other people using it. And OpenStack today has so much momentum. It has so many people behind it at all levels. It's a who's who of enterprise software vendors that really there's not any room for anybody else. And that being said, I think it becomes even more critical to make sure that we've resolved the product leadership issues within OpenStack because it is not going to get better until we do that. It is not going to be able to grow and blossom into the kind of project that we want it to be until we resolve that. And that's really comes down to leadership but also some tactical execution. Some will argue that decentralization free for all actually is an innovative strategy. Well, I mean this is the thing, right?  We don't need a benevolent dictator where democratic meritocracy, democracies work and they're messy. Democracies are always messy and they work. And they still are one of the best governance models that we know of. And the reason that they work is because they're messy. People get in the room and they argue and they fight and then at some point we come to a conclusion, right? And then that conclusion gets codified in some way. So for example, in the United States, right? Women can vote, slavery is illegal. These are things that at one point in time were not true. And through the democratic process we came to a group agreement about it and then that got codified. That is the way that OpenStack is gonna work. It's gonna inherently be a slower process. It's inherently gonna be a messier process. People with a lot of emotion and angst and concerns and everybody's passionate about it. But the goal is to get to those conclusions and to then put them behind us. Right now, unfortunately, what's happening is there's a lot more spinning in circles than anything else. They get constant, you know, recreations of the same arguments on the mailing list and the meetings between the board and TC and so on because there's no resolution happening in certain key areas and we have to break that law jam in order to move to the future. Okay, so the last couple of minutes I want to just get your take on state of the customers. Right? We're always looking for the meat on the bone. Where is the meat on the bone right now at OpenStack? Obviously putting all the other commentary aside and critical eye to the organizational opportunities challenges. What's going on with the customer base? We stalled. Are we still slowly inch by inch handoff and we yard at a time? First and 10 move the chains. It's happening. I mean, it's happening. It really is happening. I think that the thing that is causing the most problems is that the community and the foundation in the first several years of operation really presented to you the potential customer base that OpenStack was a simple do-it-yourself project where you just downloaded from their website and go turn on your data center and you would magically have a private cloud. And the reality of the situation is that enterprises are going to consume OpenStack in the same way that they consume the most open source, which is through a commercial entity that has a product that's based off of OpenStack where that commercial entity is fully productized, OpenStack, and is delivering more of a turnkey solution to that enterprise. And that's just the reality. So still right now, the vast majority of early adopters are folks who can invest into DIY projects like Symantec and so on. But like I alluded to the fact that we've got a Fortune 15 company with a 20-rack deployment, that is a product-based deployment that companies very large. They want an OpenStack-based product. They don't want OpenStack raw. And they've had their own problems with OpenStack raw. And I think that what we need to do is we need to continue to educate enterprises that they're going to consume via one of the OpenStack corporate entities that is productizing it and not via the DIY open source itself. It's kind of like the whole Hadoop story, right? And the distributions around Hadoop and the commercialization around those distributions and the enterprise support of those distributions and even though the foundation is built on an open source project, really, people want to solve solutions and that's the best way to do it and really leverage the OpenStackness for innovation and growth and product development. Yeah, very similar. Randy, thanks for coming on theCUBE. Great commentary. We'll see you on Twitter. Thanks for coming on theCUBE, sharing your perspective. This is theCUBE live at OpenStack in Silicon Valley. Again, there's so much demand. They have to have great events in between Paris and the first week in November. Again, a lot of great stuff here in the OpenStack Foundation. Again, it's not about the technology, it's about the people and it's about the momentum. So, great quote. Certainly people want the technology fixed. So, let's hope stuff will be fixed. Randy, thanks for sharing. This is theCUBE. We'll be right back after this short break.