Now do you think the community what would be the reaction the community today? Do they know anything about USA? I Think they would be proud They see they don't have to know much about USA. They know moral moral And follow moral their estimation would they would make them proud Hey, I think they know about USA I think enough of them done broadcasts overseas and they know others carry down message abroad now. Let me ask you this They tell me that we shouldn't send a big road to an African country as an ambassador. Is that true? The Africans have strenuously denied it when we have confronted them with it. I Don't know whether it's true or not. I all I can say is that diplomatically they have said no Some of them have been vehement in denying it others have said this is silly I don't know exactly how they feel about it I would say that if you made a uniform practice of the signing Negroes or such Negroes as you had to African country They would resent it Oh, I don't understand. I agree with that, but we've got them in Scandinavia and we've got them in other countries Right, and what I want to do is enlarge them a little more. They don't have their 12% I'm not a percentage man But until if we can find some of the top people in this country I mean you take either the neighbors would be wonderful ambassadors some country, but top man I would like to get them up to where where they at least in the walking distance of the rest of us and I can't do it though if I've got to 20 30 at Latin American countries and 30 The African countries and they had just borrowed because somebody says so now I thought it was the Negro community in this country that was objected to it. It's it's it's a Object if it became a uniform policy, I don't believe they would object We've got one in Sweden now and Good one on my Scandinavian trip and they go now So I'm gonna try that one or two and you might get to you might get one or two of the most Outstanding ones that you know in the United States You ought to have me a list of that you better just go to work And if you want with me young or somebody get me some real Outstandingly the worst job I've performed to name one. It's failure And I don't know this field as well as you do I'm gonna rely on so you get me four five The top ones that that are like Bob Weaver or like Carl Rowan You just you do that and you talk to anybody that you want to about Carl Just say wouldn't be wonderful if he succeeded more and see what the reaction is do you get in different reaction call me collect


So I've been trying to keep up with all of Mike Lindell's shenanigans I haven't talked about it much on the channel, but I mean just seeing his cyber symposium some of the interviews that he's given I Don't really know what to say. He is He's crazy. There's there's no other word to describe him. His antics are absolutely bizarre. I think he's genuinely unwell but having said that though he is Popular enough to wear the misinformation that he's spreading is absolutely damaging now some of the individual some of the media partners in the Right-wing world who helped him propagate the spread of dangerous misinformation about the 2020 election Now they're angry at Mike Lindell because he is turning on them So if you get enough crazy people together It's only a matter of time before they start to turn on each other and begin to eat themselves And that's exactly what's happening So right-wing watch reports the right-wing conspiracy theorists at true news suddenly realized that nothing Mike Lindell says can be believed After he accused them of being an antifa front group established by media matters Now that is quite the accusation to lob against true news of all Organizations and if you're not familiar with true news and Rick Wiles I'll give you some information about them But the video that you're going to see now It's going to have Mike Lindell talk about an intelligence report that his allies Have brought to his attention that definitely confirms That true news is just an extension of media matters that were founded by media matters And they're doing the bidding of media matters I have a report from from our counterintelligence and the people that were there Um, they've given me this report and this will be ready by tonight Um, antifa Um, they on our counterintelligence antifa Uh, they were the individuals Work we're working with true news, which is a fake news site established by media matters for america We believe Zachary Patrizzo and from salon was involved We've got them all on tape colluding with mask on if his sources of information are so faulty That he accuses true news of being a media matters Puppet funded by media under meat by media matters and smuggling smuggle antifa terrorists into meetings If his information is that faulty then I can't trust anything. Mike Lindell said Mike Lindell untrustworthy No, I can't see it. He seems like a stand-up guy who would never tell a lie Um, look, I don't have the full context here. I don't necessarily know why they're turning on each other But uh, I'm going to assume that the reason why they're turning on each other isn't necessarily due to some petty squabble or Disagreement. I think that Mike Lindell probably genuinely believes that true news is something that was established by media matters It's like this left wing Antifa front I mean, I'm honestly not sure but rick wiles is not pleased and he decided to escalate After he already kind of denounced what Mike Lindell says So right-wing watch tweets rick wiles is demanding that Mike Lindell retract his accusations issue an apology and send a true news One million dollars to compensate for the damage you have done to us And this is uh, this is really entertaining. Grab your popcorn folks rick. Take it away. Mr. Lindell's wild Accusations against true news are reckless and defamatory His team is feeding him inaccurate information about us We are demanding that mr. Lindell immediately retract his accusations and apologize to true news This is our last request from Mike Lindell To do the right thing Admit he made a terrible mistake Retract his defamatory accusations and publicly apologize to true news One more thing mr. Lindell Your public apology should come with a one million dollar check a donation to true news To compensate for the damage you have done to us with your wild reckless accusations Okay, I love that he's not just demanding an apology and uh demanding that Mike Lindell issue a retraction But he's also demanding One million dollars I mean What? I mean, maybe he's like trying to Subtly suggest that if you don't give me money I might take it a court for defamation. I'm not necessarily sure but I love this. I love that. They're fighting each other I say let them fight But if you're thinking hmm after I see this exchange between these two individuals both trump sick of fans I'm gonna have to side with rick wiles because he clearly is the more sane one here Hmm hold that because my audience. I know that they know about mike lindell I don't know how much you all know about rick wiles, but if you're not familiar with rick wiles Here's a brief introductory course into the world of rick wiles So as nbc news reports a right wing florida pastor was hospitalized with coven 19 weeks after saying vaccination efforts Were part of a mass death campaign the pastor rick wiles wrote tuesday on true news dot com Where he propagates homophobic racist and other hateful conspiracy theories that he had coven 19 related pneumonia and difficulty breathing He said that he was being released from the hospital later that day But that his wife was still very fatigued He added that his daughter-in-law was in the hospital with extreme dehydration and vomiting and that at least four other family members Including his grandson had developed coven 19 related symptoms at least three true news team members were also recovering from the virus He wrote this was a full frontal hit from hell on your true news family wiles wrote because jesus christ lives in us We shall live too your prayers needed for the above family members and team Thanks to jesus christ not doctors. I survived the ccp Covid genocide on the american people he added apparently referencing the chinese communist party, of course About a month ago. Wiles said he was not going to be vaccinated. I'm going to be one of the survivors I'm going to survive the genocide. He said in an interview posted the true news I'm not going to allow the coven maniacs to convince me to be vaccinated or vaccinate me against my will So in other words, he got coven 19 his entire family got coven 19 the true news crew got coven 19 and the takeaway is um I'm still not going to get vaccinated Yeah You and mike lindell deserve each other rick wiles. That's all I'll say you deserve each other Um, I'm glad that you're fighting anything that you do to him. He deserves anything that he does to you.  You are Uh spreading misinformation, which is very harmful.  I will continue to watch it rip each other apart


Welcome back. You're still watching Plot TV News now. Let's take you to Abuja, where the Minister of the Federal Capital Territory, F.C.T. Nguyen Somweeke, has visited the First Lady, Senator Olu Rehmi Tinambo, in the presidential villa, Abuja, where he sought collaboration in the planned setting up of a directorate of women affairs in the F.C.T. Weeke, who was accompanied by the Minister of State for the F.C.T. Maria Mamoud, said the collaboration was necessary in view of the fact that there is no directorate for women affairs in the F.C.T. Weeke seeking other areas of collaboration, the Minister expressed readiness of his administration to partner with the office of the First Lady towards the drive to actualize the government's renewed hope agenda. In F.C.T., there is no department that takes care of women. I wish health that we have to collaborate. I work with you as regards women. I work through support we can give for women in the F.C.T. F.C.T. is willing to partner with you, to work with you to say that the renewed hope agenda is achieved by this We know that it is not easy, but God on our side, out of commitment and passion, we can assure you that F.C.T. will play a very great role in achieving the renewed hope agenda. Work is started and in the next eight months, which will be one year in the office, Nigerians will see that there is a difference as far as the changes are consigned.  Applauding the Minister for placing a premium on women inclusion, the First Lady said the efforts by the F.C.T. administration to also develop agriculture, one of the priority areas for the renewed hope initiative was a chair in development with a lot of prospects to be exploited. I really appreciate you for even thinking about us. F.C.T. was a capital, a territory that I thought, how do I approach them? Because I only work with the women leader if we need to do anything. And then I said they also have local government chairmen.  These are the things we want to do. But still I've not really said, okay, invite them over because I don't know how to reach them. But for what you have done today has really brought a lot of ease to our work. Whatever I'm going to do would have to be, you know, under the table and say, oh, please go and help me, you know, get the Minister and say this is what we want to do. Because, you know, we are not ignorant. We have to be respectful of all your portfolios. So I want to thank you so much for, you know, coming out and showing us that solidarity and you really, really lighten my body. You know, I want to thank you and I wish you, you know, Godspeed, good health, strength to continue to do all the changes that this administration has planned for people from the FCT. Hello. Hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


अदिलुबवैं जीन्त जाग। डुब बोईप अभफनी बवाया। यी को ड़ाब आझा इदे दाए मेंकेश। रड़ बचाद्वोख मुऽम। अधिलग धाब भवोग मुअनत वोग्वन। तो इस नीवड़ बवोग, अमतकोंगे से आंपी कि नहीं यादा मुद्तेंग, कुईसे आंफोंटाम के वो आपकार ऑवो, कुईसे श्दी।, जि्योंकों के आब आप़ी मुद्तेंग, अं than, और वगी जिल से यहाजाइखागी मुध्तेंग, यहसे जी वेटा वो चाहॉ, नहीं यों। if you want to start this language through knowing the grammatical rules, then it would be difficult for you, but if you are talking to the person that belongs to the area, which language you want to speak with them, for example, the person comes from Britain or comes from America and his or her language is English and you want to just communicate with him, then you can communicate with him, because they don't bother the grammar rules and they just want to just speak the language with you to just communicate, communicate their feelings, their thoughts, so they don't bother. when you will psychologically out of the fear that you are not making mistakes and you are only talking with the person, believe me, you will get command over the language when you would be psychologically relaxed that you are not making mistakes because we always, when we feel that we are confused and speaking any language because we are making mistakes, so that thought always confuse us and we do not speak the second language. so now when I am talking about expression here, then we can express ourselves at the same time, when we are psychologically relaxed and we know that we are speaking the right language and we are speaking in a true sense, so we can express any thought in any language, if we know that we need to just only communicate and we need to just express our thoughts, we don't bother any kind of mistakes or any kind of rules that we need to follow to speak any language, then mentally when we are relaxed and mentally we are in a comfort zone that we are talking or we are expressing, we are able to express any thought in any language, so you can get command in any language by using these rules and by using these instructions, so expressive language that you can express any thinking, any emotion, any thought in any language if you have fully command in the language and you can get command by following the instructions that I have discussed earlier and it is not difficult for anyone to get command in any language if he or she is doing practice in the language.


Combative play by Nikita Vitugo, but he had to settle for a draw against Ivan Sarich in round 8 of the Gibraltar Masters. The players join us in our studio. Nikita, energetic play, you took your chances but had to settle for a draw. Give us your thoughts on today's game. It was a very complicated game. Some mistakes from both sides. Actually, I think I played an interesting way in the opening. Then, it was why I definitely had some initiative. But in the end game I played not too precise. I definitely had some chances here. You were discussing with Ivan after your game. Did you realize the point where you might have missed anything or is it still unclear? Yeah, from my side it's definitely when I allowed to take my pawn on H5. Yeah, I should have played HG6. Black takes on G6 with some pawn and I go just Bp3. Instead of I played Bp3 immediately and it was of course a mistake. Right now there are two more games remaining. You're probably going to have one white out of the two. What is going to be your approach for the remaining rounds? I don't think the colour of PCCA is so important. So I'm just going to play and we'll try to have two good games. We look forward to them. Thank you for joining us. Thank you. Ivan, a tough game to defend but you managed to do it. You must be relieved. Yeah, I played a little bit of my opening carelessly and I quickly ended up in the worst position. He had some initiative and I couldn't really assess how my position is good or bad. And in some moment I sacrificed a pawn and I may evaluate this sacrifice a little bit too optimistically, but in the end he just made one in accuracy. He gave me a chance to return my pawn and then after that it was equal. I was a little bit lucky because it wasn't the whole game I was weaker side. Well you did find the resource when it mattered. Now going into the final two games, are you feeling positive, especially after today's game? Yeah, I'm happy with today's result. And yeah, I'm positive because so far I've been playing good with no loss the whole tournament which is normally difficult for me because I always have some bad day and still I didn't have a bad day and I hope it won't happen in the last two rounds. Alright, we wish you all the best for remaining games. Thank you for joining us. Thank you.


Think it's time to start with the next talk Which is me talking about Debbie cams that are most important announcement as we finally have a logo. I Plucked this together last year. I think what you use ago So Debbie cam is a Something I started about 12 years ago now I got into Debbie in because I studied chemistry and They were Basically no chemistry packages in Debbie and around the turn of the century I was back then a student and there was one Program called cam tool which you can use to draw chemical to these structures Which you need for for your studies And I was doing a bit of upstream work on it and I thought okay. I'll package that for Debbie For five or six years why not get into it and then just when I got about it some guy called dr Günther Bechler or something ITP did and uploaded it to Debbie and I was like damn that was my one chance to become a deviant developer and It's gone. It's the only chemistry package. I know which is open source And then a couple of months later. He actually resigned from Damian for personal reasons so I decided to take it over and at that time There was almost no Free software and about chemistry so as a as a 100-foot overview Debbie cam is the W improve pure plant blend It's officially started 2006 But I mean the the thing itself has been going on since I started packaging chemistry packages around 2000 so right now we have 30 persons with commit access, but it's mostly a couple of people actually doing a lot of work and We have now 100 source packages I'm mostly I've since been focusing on computational chemistry So that's the packages. I mostly maintain, but I've also not been actually Employed as a chemist for the last nine years. So this is only a volunteer thing for me and I guess for most other people except for Grammings who works at University of South Africa was last year's Japconf So he's actually made a deep an administrator at the chemistry department there or chemical engineering I guess and he he gets to work quite a bit on your boon to endeavor and packages for for that field so Just takes a while. So that's one of the graphs that Andreas I don't know. Did you show no? Well, this is the upload of statistics for for Debbie cam But Andreas is doing those statistics. So you can see I'm the orange person. So we're for the first couple of years I did the all by myself And around 2006 we started the the subversion Repository because other people wanted to participate and that was mostly Daniel Lydard who did a lot of work from 2008 to 2013 roughly But then in the last couple of years he kind of disappeared. So he showed up again a bit Two years ago and we actually he met what he came to Heidelberg But I actually haven't heard from him for a while So he has he has unfortunately kind of disappeared and then Philippa Rosconi. He's doing mass spectrometry Packages so but he's mostly working on his own on the camera. So he has one or two people But they're doing their stuff and I'm doing the computation chemistry stuff. So we're a bit disjoint but he's been doing a lot of work and then Nicolas Breen He's packaging grow max, which is the Molyka Dynamics Software, but he's that's basically the only package. He's maintaining but he's doing it all the time and The next one is then Waymings who has been working We started to do a lot of work this year last year. So he sees where quite active and then it's Andreas already so As you can see is there were one or two people and it's mostly me there and it's mostly Daniel for some reason last year. I did apparently a lot of Uploads or maybe that was the best tone. No, there's not possible 12. So yeah, I did a lot of uploads last year I don't remember that actually because I thought I didn't have a lot of time But maybe it's because of the source only uploads now that I tend to do more uploads these days so as I said the original mission statement for Debbie cam was Package all chemistry related free and open source software. There's not so few of them. Actually, there was only Like four or five in 2001 Camtula already mentioned mpqc, which is the massively parallel quantum chemistry That means that meant like 16 cores In parallel or something in 2000 and a few other Viewers garlic and chemical garlic a chemical was a GTK or is a GTK to based visual 3d viewer So though that was it there was these five things and we packaged it and there was not a lot There was a bit more coming on after a couple of years in 2006 We had 20 packages. I checked that and now it's 100 so it slowly got more and more and Nowadays actually the mission statement. I would say it's packaged the most useful versatile projects in each field because It turned out that there's five or six packages to to write Chemical structures and there's like 10 or 20 different ones to three-dimensionally visualized molecules And it doesn't make sense to actually package them all Because they're a huge overlap, but on the other end it's also quite difficult to figure out which ones are the ones which are useful and also actually I found out that Even more so in computation chemistry. There's a huge difference in performance. So we had one project called the QM speed test by no lab oil Who was just running? Optimizations of of molecule. I think was aspirin or something on different codes and and actually there's a factor of 50 or Something in the runtime. It's huge like one some packages are done in two minutes and another one took three hours for the same stuff so There's a huge difference between code bases, which are Fortran which have been optimized since the 70s versus some guys doing a C++ project over the summer It's the same algorithms, but the implementation is is very different So right now we try to do that for example just last week. There was another article in Journal of computation chemistry about another thing pirate is a well-done medium-sized python library for rary wins So that's another open source thing. So every there's a new one coming up every week. I have the feeling and Actually, I have another 100 packages on a list of prospective packages Which are all free software There's a few really big ones siesta for example is a very well-known code and then the periodic Or crystal community which got open source a while ago. We should package it big DFT is pretty pretty well-known and Pi SCF Couple of those are really should be packaged, but we don't get around to it that much But there's 100 at least that we know of so at least twice the size that we already have so we should really make a Point in only packaging the more important ones So what I want to do next is give a few examples of really innovative things because at the beginning There was open source in the in the let's say knots Trying to catch up like give a the same functionality as proprietary software But nowadays actually there is open source codes especially in computation chemistry which are even more advanced than the best proprietary software codes or at least They caught up to it very much. So so one of them is bagel Which is done by Toro Shiozaki in Northwestern and he basically wrote it over the last couple of three years with a couple of grad students Himself, but they're doing pretty awesome stuff. For example on the fly cast p2 to surface hopping dynamics And nobody did that actually not even So this is a paper from from a month ago or something I don't think there's even a proprietary part package that does that or just two weeks ago They published a new part of NW cam, which is a huge code base from the Northwestern laboratory and in the US pushing configuration Interaction to the limit It's as you can maybe not read they have one trillion Orbitals or whatever going on in there in their calculation So it's massive on huge clusters and then this is really kind of competitive code or another one from Zurich They they're doing CP 2k, which is a that we can package for a for a long time and they are actually simulating They have simulations with millions of atoms in one simulation and each atom is actually Actually modeled on the quantum scale. It's not just the sphere or something as you have a molecular dynamics. Those are really quantum Molecular dynamics with real quantum chemistry behind it but on the other hand these Advances in in open source got people quite a bit unhappy all these proprietary people and so for example a while ago There was this letter or this view point they say in the journal of chemistry a physical chemistry letter saying What a surprise of open source software and it was from a lot There was like 10 or 20 authors and they're all the main authors of the proprietary Software packages in the field of computation chemistry and they say yeah, you know Everybody says you should open source everything, but really we have such a complicated code base So for example Q cam has 300 papers and we have like five million or two and a half million lines of code and we have so many developers and It's really really hard work to do so we cannot just open source it and people should continue funding our proprietary model of innovation and actually what I've Saw in the last couple of years is that there is a very big change in the sense that funding agencies like the That case the German funding agency DFG are not funding Well, what they're doing is they're funding research for new Algorithms and stuff, but they won't fund proprietary software just for the maintenance of it So for example, there's this code from Stuttgart Called IMD and what they write is like IMD has now been placed under the GNU GPL as a consequence of moving the repository to get up Which that's bit stupid because that's not a requirement, but okay and the requirements of the funding agency DFG So the DFG told them okay if you want money from us you should make it open source and they did so that's quite a Huge impact, I guess that open source has there and I also heard from Privately from a colleague of mine. There is a huge code in the Fitzhaber Institute in Berlin and they also have a lot of trouble because it's proprietary to get grants these days and What they're doing now is they're open sourcing their underlying Lining linear algebra Libraries and and trying to make new projects out of them So in order to get some funding at least yeah, because they they cannot get funding for their proprietary parts So and there has been a couple of previous open sourcing and I'll be okay. I already mentioned Used to be proprietary, but they open sourced it about 10 years ago or something side three side four these are Standard packages were for students to simulate molecules and They're rewrite so psi one two used to be proprietary those are now GPL and Yes, I just mentioned and there's any CI which just got Open source a couple of months ago in a sense it was on github and then suddenly somebody put the GPL on it Well one of the office, so it's legit, but now it's now it's really open source so That's as an introduction. I want to just mention what what Debbie came does these days These are the tasks Andreas talked about it earlier, so we split it up a bit more fine-grained in these days I actually did some work on that. I think it didn't land in Jesse back then, but now it's in stretch at least so we have 12 tasks, I would say we have a crystallography and Analytical biochemistry, this is what Rosconi is mostly doing and I'm mostly working on molecule app initial Molecular dynamics molecular modeling and periodic I mean issue stuff and then they have lots of packages which produce or input output stuff There's some major packages Which I don't want to get into because I don't have a lot of time I just want to mention that yeah There's also Yeah, for visualization. For example, we have pymol. We which got mentioned earlier Very grateful that he got picked up because I didn't have the time and j-mole got also picked up by Infinity zero I guess So this was finally upgraded. So there's some some cooperation happening there So those are all the packages, but there's also a lot of interdependencies on the packages So I decided to make a graph of all the built dependencies at least for the computational chemistry packages So that's probably pretty bit difficult to read But those are the libraries and there are lots of interdependencies for example mpqc3 Has a lot of libraries and lip xc def is used in a lot of packages Same as lip int these are just the chemistry packages a lot of them Of course use the linear linear algebra packages like blast lapak or the MPI packages like open MPI and And this one is how the input output things work So we have a couple of packages like open bubble python ase arogadro and Travis and cc lip that parse the output of packages to either Compute properties or just display properties of them or to transform those outputs into other File formats and what they also can do is produce inputs because most of these packages Actually, they they still rely on text input and output. So it's a you have an input file You run the input file on some executable and then you get an output file But this is getting going even further for example, there was a recent paper for the PSI for from the PSI for developers and they This is a actually a graph from their paper, which is in the journal of chemical theory and computation and they have all these External projects which they integrate and they all open source except for MRCC I think And we haven't packed. Well, we have packaged lip int but all and cam MPS to those two are packaged But all the other ones are still not packaged. So we have quite some work to do here They can also be used by by sci-4 and in order to Make their work better Couple packages that are new and stretched I don't want to get into too much detail here But as I said Jmo got updated. That's that's great sci-4 is finally at 1.0 This is a very standard package for people to work on CP2k got updated and Grammings brought a seed atomic system simulation environment into that end Finally, I wanted to talk about it about outreach that I tried to do at least so in 2015 I gave a talk about CP2k and depicam in Zurich at the CP2k Developer meeting which was quite nice. There was also a guy from fedora there So they invited us giving a talk about how we package stuff And I also presented two posters in the summer of 2015 at the 10th European Conference on computation chemistry in folder and a few weeks later in the symposium for theoretical chemistry in Potsdam So I made this debicam poster which was also actually in in I actually also presented it in or it got printed for South Africa last year and hang up at the open day, but I made this poster of debicam all the capabilities of the computation chemistry packages and Got into some quite some interesting talks a lot of those people knew Debbie in but Not really Debbie Cam has always the same problem with the pure plants thing But that gave some some outreach I guess so finally I want to Give let's talk a little bit about what's what's left to do. So one thing I think we should really do in a bit Not happy that it's not happening upstream is that there should be more input output pausers for for the debicam packages so we have a Avogadro, which is a Graphical KDE application or Qt application which can read them and generate input But it's not doing it for all the packages we have an open bubble is is also in CC lip these are packages Which we could extend? For example CC lip is just Python. So it's rather easy So a couple of packages like CP to K Begu and aces are not really represented there So maybe there is a GSOC program Google some of code project looking there We should switch finally from subversion to get on Daniel Leiter like subversion very much so We didn't force it, but he's not really active then more and then if new people want to work on something they can just Convert stuff to get that's happened with Pymol. I think for example and some others There's just a question of whether we just use the debi directory or the full project It's easier. I guess if you do the switch to just use the debi in Directory, but we'll see that I would like to get more serious on back ports I Have been back porting one or two packages, but not as well as the neuro deviant team does they unfortunately not here But they are really doing great work on that and Then there's the other things like what to do about the MPI implementation There was quite a few problems with MP open MPI in the stretch 3d cycle and I heard from some upstreams that Open MPI is not working with us It's not it's not good if you actually have both multiple threats and multiple processes Which nowadays is the case? So you would have a cluster where you run the program on several nodes several computers on the cluster But each cluster would have 16 cores, so you don't want to run one threat on each node you want to run 16 threads and then 16 cores and For that kind of thing apparently open MPI had a lot of problems, but they are supposedly fixed So we'll see but I think one thing that it's going forward as we saw on the deviant science list I think that at least some packages like scalar pack will be compiled for both MPI CH and open MPI so you can choose your your Stack so for example for bagel I use MPI CH because it was more stable The other thing is the DH Fortran Fortran 90 module thing that's looming over us all the time It's again stuck every depth conf is going a bit forward, but it's again stuck. I guess so maybe we I or somebody should start working on that. I would also have things about more a Bit bit about optimizing packages for Production use so right now we have to go with the lowest common denominator which means MTU native or as much as not possible So it would be good if we could integrate it that you can just recompile your package And it's it's running at machine speed if that's actually useful. We should also benchmark it It's a bit difficult to to say anything about it without running proper benchmarks And then we should remove the packages which are outdated So there's quite a few ones which are 90s technology and there's been better ones in the same sins And we should look at them and actually remove them Or maybe if there's just slow if they're doing computational stuff and then other packages are way faster Just remove them, but we haven't really start doing that yet. So that's it basically for me That's some contacts. We have Debbie Camde well mailing list. There's an ISE channel, but it's not used really and The subversion and get repo and if you're interested in chemistry packaging Always happy to collaborate or to help or to just give you access. So Thanks, and is there any questions? Anyway overruns anyway, so I guess It's fine if there's no questions and we'll be continuing with the science Both in about nine minutes at half past three. Okay. Thanks


Hi, thank you very much for coming. My name is Jerv Markham. I work at Mozilla where my title is policy engineer. I also have a long term cough so if I cough a bit don't worry about that. If I actually collapse on the ground then feel free to call an ambulance, anything short of that I will recover momentarily. Today I'm going to be talking about the Mozilla root program which is our program for managing certificate authorities and a little bit about how it works, what we do, how we do what we do and then in the second half of the talk I'll go through some particular incidents that have happened in the CA world and the sort of policy responses that we have made to those incidents and possible future stuff and then hopefully we'll have some time for questions. I'm going to try and speak clearly if quite fast but if I'm going too fast for you wave at me and let me know. So as background, if you want to establish over an untrusted network a connection to a particular person on the other side, there are roughly three ways that you can do it. The first is out of band so you give them a phone call or you send them a letter or something to exchange some information that you can use to identify them when you make a connection over the untrusted network and make sure that you're actually connecting to the person you hope to connect to. The second way is called trust on first use or tofu which is normally what out of band ends up being in practice where you just connect for the first time over the untrusted network and you get through to somebody and then you hope that that's the right person and then next time you just connect you check you're connecting to the same person you connected to last time. But the third way is to have a trusted third party, somebody you trust and somebody the other side trusts who can issue kind of tokens of identity and then you check when you get the token of identity back from the person you connect to whether it was correctly issued by the person you trust and if so you assume you're making the right connection to the person you want to. And on the internet at least trusted third party is most commonly implemented using a system of digital certificates. The advantages of this system are that minimal user interaction is required. If I want to correct connect to a new website I've never connected before to and I want to connect securely I type the address into my browser with an HTTPS on the front and it connects me up and assuming my browser doesn't sort of set off warning alarms I can be pretty confident I'm connecting to the right place. Now you can argue about the various different systems and their pros and cons but I would say at the very least that fact the fact that your grandmother your grandfather someone who is not technologically savvy can make secure connections without having to know anything about computer security is the reason why this system is primarily the system used on the web and is used for secure web connections and is used in many other environments as well. Because if your grandparent of some sort had to phone up their bank and get their bank to read them the 256 fingerprint which they then had to manually verify against the key that had been used in the connection they were establishing with their bank what would happen would be that no one would ever bother to do that and lots of people's data would be stolen. But I'd say that's the main advantage of certificate systems but today is not about whether we should replace them with something else today is about how we deal with the world as we have it today. So if you are going to have trusted third parties is that helping you to establish your secure connections then you need to have a list of the third parties that you trust and that is called a root program. You can have root programs for trusting people for server to server connections you can have root programs for trusting people for signing of code so you know who wrote the code you're going to run on your computer you can have root programs for trusting the signing of documents or for email. Some root programs cover more than one thing. The Mozilla root program for example covers server to server communication and it covers email. It used to cover code signing but we found out that no one really cared so we stopped doing that. Who has one? Well all of the operating system vendors have a trusted root store built in so Microsoft has one, Apple has one, Google has one for Android, also Oracle has one for Java, Adobe has one although it's focused on document signing and Mozilla has one for Firefox because unlike Chrome which delegates these decisions to the operating system although it may make some tweaks to them Firefox uses its own built-in store of roots and so a root CA which is trusted on Firefox is trusted everywhere on every operating system so we have consistency across Firefox across the OSes and the reason there is more than one of these root programs is that it's probably not a great idea for one single world authority to determine who everybody in the world trusts. People want to make different decisions about who they think is trustworthy and who they think is not trustworthy and in fact you know what you get with your operating system or what you get with your browser is a default set to which you can add or even remove people if you feel that they are not worthy of your trust. The issues that that causes of course is that for technical and historical reasons when a website presents a certificate to anybody who connects to it normally except in special circumstances they can only present one certificate and therefore they want to present a certificate which is many people as possible who are trying to connect to them trust because otherwise some proportion of their supposed customers will get error messages and be scared away from using their website. This gives CA's certificate authorities the problem of ubiquity they would like to be in everybody's trust store they would like to be trusted by everyone and they would like that to have worked its way through the ecosystem so even old versions of Windows or old versions of Mac OS or old versions of Firefox have that trust so if you're setting up as a certificate authority unless you can find some way of bootstrapping yourself and we can come to that you have a very long lead time before your trust is ubiquitous enough among all of the different clients that people will even want to use your certificates. Why is Mozilla's route program different? We run our route program in an open and transparent manner we feel that it's very important for the internet that at least one route program is run in a way which listens to and takes account of the views of the internet community where the processes and procedures are open and people can suggest modifications and improvements to the way that we do things that when we're considering adding someone to the trust list that is an open and discussion process whether it's discussion and when we're considering taking someone off and whether that is the right reaction or not to some perceived crime or error or mistake we should have a discussion about that and so that is how our route program is different and in fact actually that influences the community of route programs to be more open than they used to be certainly. So just a little terminology to make sure we're all on the right page about certificates when I talk about them later. Certificates come in hierarchies they start with the routes at the top which are embedded in the browser or the operating system with the other trusting thing but normally you want your route certificates to be locked up in a bank vault somewhere because you really don't want them misused and so what happens is that the route sign what are called intermediate certificates of which there may be a number and those are the ones that you keep in your data center which are then themselves signing the end entity certificates which you hand out to people who own websites or who own email addresses or who want to sign code or whatever it is that you're doing. So that's routes and the intermediates and end entity certificates and if you're a new CA who wants to get into the market you might pay another CA a very large amount of money to get them to do what's called a cross certificate which is where their route signs your route and so stuff that you're issuing is trusted in older browsers which don't have your route built in because there's an alternate path up to theirs. So that's called a cross certificate. What policy tools do we have for managing our interactions with certificate authorities and managing this trusted list? Well every certificate authority for each route has what's called a CPS and a CP which are two documents of the difference between which is a bit geeky and technical but basically together they define the processes that a CA will use issuing certificates. We're going to issue them this way to this sort of person. We're going to keep our data centers like this and so on and so forth. There is also an international organization called WebTrust and another European organization called Etsy which produce standards for certificate authorities as to how they should behave. Often that is you should do what you say on your CP and CPS and we'll check that you do and a little less than we would like about the thing you say that you're going to do is actually the right thing and saying but nevertheless there are these standards. An organization called the CA Browser Forum which is an informal collection of the major CA's and the major root stores also produces a couple of standards and all of these standards are audited so every year a CA has an auditor from an audit firm come and visit and check that the things that they're doing match the requirements in all of these documents and the reason they have to do that, the reason those documents and those audits have teeth is because each root program has a policy that if you want to be in our trusted list you have to have this sort of audit and this sort of audit and this sort of audit and you need to show us the documentation that shows that you've got them and that you passed. So root program policy defines what we expect of CA's but also the audits that they have to have and therefore someone goes on to their premises and to some degree at least checks that they're doing all of the things that they're supposed to do. One could argue about how effective those checks are but these are the tools that we have. The other policy tool that we have actually is changing the user interface of our product and or its capabilities. So in Firefox at least we can eliminate older algorithms or you know deprecate them or put warnings in for them to try and encourage people to stop using them and we can do things like so when Firefox connects to a secure site there are effectively only two states it can be in. There's a state which uses difficulty called extended validation where the name the actual name of the business has been carefully checked by the CA and then we put that in the URL bar normally in green so it says this is you know B and Q or this is PayPal or this is Amazon.com Inc in the top and then there's everything else. Now CA's have other sort of gradated levels of validation that they manage to sell to people but that doesn't change the browser UI so I'm not quite sure why people pay for the extra levels but I'm not in a CA's marketing department. So those are the policy tools we have in broad brush for managing the behavior of certificate authorities for our root program. So Mozilla is keen to use our power because CA's want to be in our store so that their certificates will be trusted by Firefox so they'll be able to sell them so people will be able to connect using Firefox to their things and that power that we have allows us to drive improvements in the certificate system and in the security of the web. Some of the previous improvements we've managed to drive either by acting unilaterally or by acting with other browsers or by acting through the CA browser forum have been things like the first thing the CA browser forum did was this extended validation standard. So you can argue about the value of having information about the sort of physical location and address and so on of a company in a certificate but if that is valuable to you then you definitely want that information to be correct and it used to be the case that CA's were doing things like yes I'll accept a dodgily faxed copy of some phone bill to show that this is your address right and some CA's were trying to do better but of course because doing better costs more there was a race to the bottom problem and so the certificate the CA browser forum got together and produced a set of what we think are minimum standards for the vetting of actual real-life identity and called it extended validation. So many CA's still use lower standards but we don't trust those enough to display that information in our browser so extended validation is what we think is necessary for to actually have a real world identity written into a certificate. So those standards were defined we started those in 2007 they finished about 2009. Another thing we did was eliminate the use of 1024 bit RSA certificates. So we had to drive them out by stopping CA's issuing end entity certificates like that and then we had to get them to roll over all their intermediates and then we had to get them to stop using 1024 bit routes because we started started to become clear that a well-motivated state-level attacker with a large amount of computing power mentioning no names may be getting close to factoring 1024 bit certificates and if they could factor one 1024 bit certificate that was still in our root store they could generate as many certificates under that as they wanted and our browser would trust them. So it was definitely time to move away from that but that was a multi-year effort. Around about and we'll get to exactly when and why 2010 or 2011 the CA browser forum produced a document called the baseline requirements which are a set of things that everybody has to do for the issuance of any certificate so this was just for certificates which contain real-world identity but this is like anything that you do and so that was definitely a way of driving up the lower bound of certificate authority behavior and making sure that everyone did things that were at least vaguely sane. The the world of intermediates so we had the routes which we know about because they're not a trust store but then the CA can issue any number of intermediates and you don't necessarily always see all of those and don't know what they're doing and so we came up with a policy a few years ago where CA's had to disclose all their intermediates to us in a database so we knew about all of those or technically constrain them so that they couldn't issue for random sites on the internet. So that was a policy that we we drove. Recently there have been improvements and much more rigor in domain validation methods which are the methods of determining whether somebody owns example.com or PayPal.com or dirv.net or whatever because obviously the key thing a CA does before issuing a certificate is check that the guy they're giving the certificate to actually owns the domain names which are in the certificate. That's like the basic most important thing that they do and exactly how they were doing that was a wide variety of methods which had quite a lot of kind of slop in the definition of how they did it and so we came up with best practices for all of those styles of method documented those and those are now in the baseline requirements. We've also driven non policy improvements through the changes to Firefox primarily in the use of cryptographic algorithms. Upcoming things that we're hoping to do through this root program power that we have there's a standard called certificate authority access or CAA which is where you put in your DNS a list of the certificate authorities that you want to allow for your domain. This is a way of trying to solve the weakest link problem if there are 60 trusted CAs and one of them sucks that one can issue certificates for your domain and you can't do anything about it. So certificate authority access is an attempt to solve that problem by allowing sites to say no I only want certificates from Symantec or only Komodo and did you search or only let's encrypt. But the trouble is of course that this hasn't really taken off because CAs aren't required yet to read and abide by that information and they're not very keen to do that for various reasons but we want to make it mandatory to change this. We're trying to push that through the CAA browser forum now but if we don't manage to succeed we may well take unilateral action and require it anyway. Google has come up with a system called certificate transparency which is a way of trying to make sure that CAs disclose publicly every certificate they issue. It's not fully implemented yet so it's only used for a subset of certificates but it's already been extremely useful in finding issuances of problems that CAs have been I think bad things that CAs have been doing. Mozilla has some issues with the scalability of that system and how you can get certain guarantees that the log servers are actually going to behave properly and so we're proposing some modifications to it and that process is ongoing but we may well end up doing something like that. And for reasons which we will come to we're feeling that the audit process is not as good as it could be because what happens is of course a CAA employs an audit firm to do its audits and that audit firm would love to be employed again the following year and so is keen to make sure that gives the CAA a clean bill of health and then that relationship has various professional obligations which means that they can't really the audit firm say they can't really tell us anything about what happened apart from the fact that they passed. And we think this kind of sucks and we need more transparency so we're trying to work out how to improve those mechanisms. And recently as we'll come to we stopped accepting audits from one particular audit firm which we hope will generally galvanize audit firms to make sure they're doing a good job. So that's sort of a broad and very quick overview of the route program and what we do and what kind of things we're trying to achieve with it. And now I want to talk about some of the incidents that have happened in the past five years in the certificate authority space which have led to changes both technical and policy. In 2011 a CAA called Komodo a large CAA had what's called a registration authority or RA in Italy. An RA is basically a firm that you have normally in a particular country which knows how to check that a business is a business and knows how to do publicity and knows how to advertise. And what they do is they kind of get business for you and do some of the checking and then they hand over the information to you for you to issue the certificate. Unfortunately the security of the account that they were logging into at Komodo to issue certificates was very bad. A guy called Komodo Hacker found out the password and issued a bunch of certificates for major websites which he then boasted about. This also revealed in fact that Komodo were keeping their route certificates online. So instead of the intermediate level that we were talking about they had their route certificates in the way in the servers that were issuing the certificates and were just issuing directly off those. Komodo Hacker may or may not have been from Iran. Komodo claimed that he was but that may be just because they wanted to big up their problems as being a state level adversary. Not sure. So what did we do? The result of this was that we required that all issuances or pretty much all issuances had to be via an intermediate which then means that the CAs can keep the route certificate offline and reduce the risk of compromise of the route certificate key. And we also said that any account to the CA you can log into as an RA that can cause certificate issuance has to have two factor authentication. That was in 2011. 2011 still a very famous incident a Dutch CA called Diginotar got comprehensively pwned by somebody working for the Iranian government. The exact scope of that was unknown but it was massive. They completely failed to notify any of the route programs that they had trouble and instead tried to revoke the certificates that they found would dodging cover it up. But in fact what happened was certificates that were issued from the Diginotar routes were basically used to man in the middle people in Iran. The company which did the forensic analysis of Diginotar produced this video which was used because when you use a certificate often your browser will go back to the CA and go is the certificate still okay? Using a protocol called OCSP. And if you can look at those logs you can geolocate the IP addresses to find out where in the world people are using that certificate from. We are really quite washed out here aren't we? Can we get some of these lights off briefly? Is it up here? That's the, there we go. All right. Are you found it? Found it. Okay, that's better. The little red dots are people using the certificate. See where they all are? The others we think are probably sort of VPN or Tor exit nodes and that kind of thing. But it seemed pretty clear that the government of Iran was using these certificates to man in the middle tens or hundreds of thousands of people and we have no idea how many people's security was compromised and how many people got into serious physical trouble because of this. When I first saw this video it made me cry. What did we do? Well, we distrusted the entirety of Dijenita's organization and all of the root certificates they had control of. Eventually some of them they were managing for the Dutch government and the Dutch government did an initial investigation and said no, our stuff is fine. It's okay. It's only the other stuff.  And so we distrusted theirs as well. The baseline requirements had already been kind of going in the CAB forum but this definitely lit a fire under them and so we got them going. Because of what we just saw all of these requests were coming in, is this certificate any good? And this service was saying yeah, it's fine because it's certificate they'd never heard of. Because OCSB responders were in a sense powered by lists of bad certificates. And so they just said it's fine for anything that wasn't on their list of bad certificates. And we decided that this was completely ridiculous and that OCSB servers had to be properly database backed with a database of good certificates.  And the last thing is that the CAB forum produced some things called the network security guidelines which in hindsight were a bit of a knee jerk reaction because they did say what seemed to be vaguely good things to do with network security in 2011. In 2016 a lot of the things that you do are different but this document hasn't changed, no one really knows very much. No one in the CAB forum has the expertise to update it and so it's actually now a bit of a drag on stiff good authority network security best practice. And so we have to figure out what to do about that. But that's something that happened at the time. 2011 another company called Digisert SDNBHD not to be confused with the much bigger Digisert in the U.S. was a Malaysian subordinate CA of Entrust so Entrust had issued them an intermediate certificate which they were then using to issue to their customers. They decided it would be great to have some certificates with 512 bit keys which you can factor in about three minutes on your coffee pot. And no key usage information which means these certificates could have been used for email or servers or anything you wanted to use them for and no way of revoking them. Well done Digisert SDNBHD. We decided to distrust them completely and at around the same time we published the baseline requirements which in case it wasn't really obvious required you to put information in your certificates about how to revoke them and what they should be used for. 2012 a company called Trustwave who's an American commercial CA issued an intermediate certificate to a company called Walgreens who used it for man in the middling everyone on their corporate network. Now in one sense that's sort of okay because the people inside Walgreens network agreed to it. In another sense it's really dangerous because if that intermediate certificate leaks someone can use it for man in the middling anyone else in the world and we decided that this sort of thing was too dangerous to allow in the public PKI and because we hadn't taken a strong stance against it beforehand we didn't actually sanction Trustwave but we told all of the CAs that this has got to stop and we gave them two months to cut it out and get everyone to find some of the solution. So no more man in the middling under public roots even for people's internal networks because we can't trust you to keep the keys safe. So then in 2013 when the French government CA did exactly the same thing we constrained them to .fr and about 12 other very small top level domains which are French dependencies and it turns out actually that they decided that this incident meant that they didn't really want to be a public trusted CA at all and so they'd be moving away from this hierarchy and it's soon going to be removed entirely at least from Firefox. Then in 2014 there was an incident but it didn't apply to us it was a CA that was only in Microsoft's stores so we dodged it that year. 2015 a Chinese CA called CN Nick issued a certificate for man in the middle to a Middle Eastern company called MCS Holdings in violation of its own certificate practice statement. It didn't disclose this certificate as it was supposed to have because we had the intermediate disclosure rules in place by that point. MCS had no PK practices we had no idea what they were doing with this certificate. They could have had it just stuck on a server in their data center with no protections whatsoever. And we decided that this was so entirely ridiculous that we distrusted the entire CA. Although we did say after a year they could reapply and in fact they did reapply last October and they're going through the re-application process to be re-included. 2016 was Wosign and Startcom which I'm going to talk about a little bit more because it's a really interesting detective story and I very much enjoyed detecting it. Wosign is a Chinese CA and Startcom is a Israeli CA and this incident started when people reported from various places including some of our friends at Google that there were various problems with Wosign. And when there were sort of three or four problems on this list we decided we should make a list and we made a list and then other people reported other things and the list got really quite long. And so Wosign were kind of trying to deal with and respond to these but one particular thing on the list was particular concerning and that was Shahwan backdating. The background to this is that Shahwan is a cryptographic algorithm, a hash algorithm that has for a long time been showing its age and so there has been a industry-wide plan to eliminate its use. And one of the key dates in that plan was the first of January 2016 which was the date after which no certificate of authority was permitted to issue certificates that used the Shahwan hash algorithm as part of their cryptographic construction. The trouble is that certificates don't have an issue date in them. They have two dates. They have a not-before date which is the date you're not supposed to use the certificate before a start date in other words and a not-after date which is sort of an expiry date. But both of those bits of information are controlled by the CA and there is no requirement and there is no way you would enforce a requirement that the CA make the not-before date the date of issue. And in fact there are sometimes technical reasons why you have to vary it a little bit. So Shahwan was forbidden for certificates issued after a certain date but of course it is technically possible for a CA to back date their certificates to make it look like they were issued before the ban came into place thereby working around the code that Chrome and for a while Firefox had in that said we don't trust certificates that were issued after this date. So we thought WOSINE had been doing that. Why did we think that? Well this is a graph of WOSINE's Shahwan issuances for the three months leading up to the deadline day when they weren't supposed to do it anymore and it turned out by looking at various fields in the certificate because certificates in a sense have patterns or fingerprints sort of little features that you can tell they were issued by a particular system or in a particular way that they had two types of Shahwan issuance which are in green and orange. The green ones we think were probably issued by an automated system. They were issued on every day of the week and they were issued in quite a big volume but the orange ones we think were probably issued manually. They were only issued between Mondays and Fridays. They were issued in much smaller quantities. Well, almost completely only between Mondays and Fridays. Occasionally it seems someone came in on a Saturday and issued the odd certificate and on this particular Sunday there were 62 certificates issued. That's sort of two Sundays before the end of the year, 20th of December. And we thought that seemed a little bit surprising that they would come in on a Sunday and issue so many certificates at once. And so we had to look at those certificates in comparison to the other orange ones and we looked at the time that they were issued. Now, the orange ones you can see were issued. This is UTC. So we're issued during the day in China with a break for lunch. OK. The blue ones were issued at random times throughout this particular Sunday. So we have two options. One of which is that the employees of WOSINE perhaps because they were, you know, under some sort of pressure came in on one Sunday at midnight and worked all the way through to the next midnight issuing certificates and show our certificates before the deadline or it could be that in fact they had a template which had this back date in it and they were just using that template to issue certificates in 2016 which they were claiming were issued in 2015. We thought that was a bit more likely. So then certificate transparency provided cryptographic evidence of the backdating of six of the 62 certificates but not the rest. And so that again was a bit more evidence that they've been doing this the other thing that they did was that they bought this Israeli CA called Starcom and Mozilla has a clause in our route policy that says that if a CA changes control you have to tell us because trust is not transitive just because we trust company A doesn't mean we trust company B when they buy company A and so you have to at least tell us that that has happened and not only did they not tell us but they explicitly denied that it had happened until we went to the British, Israeli and Hong Kong company registries and traced the chain of ownership to show that to show that in fact the Israeli company was now owned by a British company which was now owned by a Hong Kong company which was owned by Wosine which was itself owned by Chinese large Chinese IT conglomerate which also has a browser called Chihu 360. But the problem was that we then found again using certificate transparency data that this kind of style of misissuance that we saw in those graphs those 62 certificates had a very specific fingerprint and we found a mis issuance done by Startcom with the same fingerprint for a Australian payments company called Tyro and they'd issued two certificates to this company again which had been backdated and so we took that as evidence that the bad practices at Wosine had imported themselves into Startcom and therefore it was reasonable to treat the whole as one and so what we did was we distrusted both CAs entirely from the 21st of October 2016. Startcom got an opportunity to be readmitted after six months if they could change their management so that they were no longer managed by Wosine but were owned directly and various other changes because they'd also moved over to Wosine's issuance systems which we had no confidence in because the code call quality was terrible. So Startcom had a bunch of work to do but could possibly apply for readmittance in April. Wosine can apply for readmittance after a year but basically has to rewrite their entire infrastructure and so on. But the other thing that we did and this may be pressing to things to come is that we determined that some of the things that Wosine had done wrong should have been spotted by their auditors. So for example they had out of date software on their issuing computers right and one of the things that's supposed to be checked is that you know you're applying security patches within a minimum of six months from the time they're issued and some of the software they were running US was five years out of date. There were other things about certificates that had been vast tranches of certificates had been issued with the wrong fields in. This wasn't a technical or a security problem but it's the sort of thing an audit could have been picked up and their auditors Ernst and Young Hong Kong had given them a clean bill of audit although I hear that this fact caused some disquiet among other auditors and among other bits of Ernst and Young but that's what happened. And so we decided that we were no longer going to accept audits from that particular branch of Ernst and Young although of course if we later find more bits of Ernst and Young causing causing audit troubles then that might get wider but that's what we did. And so we hope that this will because it's the first time that this has happened. We did not for example and maybe in hindsight we should have done but we did not stop accepting audits from Diginotar's auditors. Right despite the fact that they're you know a lot of things that they were doing were completely terrible after they were investigated but this time we did. So 2017 and this is sort of ongoing at the moment so we'll see what happens. A very large CA called Symantec has discovered some problems with an RA in Korea called Cross-Cert. So what happened was someone was looking through the certificate transparency data and they found that a bunch of certificates supposedly issued by Symantec that had like the word test in the organization field instead of the name of an actual company which again is not necessarily a security problem in itself but isn't what you're supposed to do. And they said what about these and Symantec said oh yes those are issued by Cross-Cert we'll go and talk to Cross-Cert about this and they had a little chat with Cross-Cert and it seems like the more they talked to Cross-Cert the more problems they find. So they were you know there were 12 certificates that they were concerned about and they said oh just show us the logs for these the audit logs to show that you'd properly checked that these domains were owned and Cross-Cert like audit logs. So this it seems that it's this way the story is still emerging. So and again this may also raise questions about Cross-Cert's auditor and whether Cross-Cert got a clean bill of health in their auditor and whether they should have done. So this is an emerging situation which we'll have to see but this might well be 2017's thing because and I'm still asking Symantec about this I don't think it's necessarily possible to tell when a certificate was issued via Cross-Cert and when it wasn't which means that the blast radius for this could be really quite large. So watch this space. There you go. So there's some things that happened and what we did about them as well as stuff about our route program and I'm glad we have 10 minutes left and I'm very happy to take questions. Please sir. Yes that's you in the blue. Yes. I'll tell you I'll tell you well I'm sure you know that there's a trend towards more men in the middle with the browsers because in some legislations actually ISPs are required to provide the parental control filtering.  Yeah. In certain legislations such as the United Kingdom now ISPs are required to provide parental control filtering which means that they are going for DNS filtering solutions that then title rate direct for example HTTPS connections just towards forbidden websites to their own proxies with a page that says this is blocked and whatever which doesn't work unless you can men in the middle to certificate and create a fraudulent one. And this is going to be a growing trend because more and more countries are possibly requiring this making these compulsory requirements by law. So did you ever consider this problem because unless you have a route certificate in the browser that allows I mean the men in the middle to create a valid page I mean what the users get actually is a nasty security exception ever in the browser and this is a terrible user experience for everyone. And so I mean I don't know how to solve this but I think we should have the token. So and another question is this really thinking given all these problems with the CI system that you can really be run securely or I mean if just one certification author it is correct everyone's factor so does this really work? So two very different questions. The first question was that some governments are now requiring parental controls which sort of requires man in the middle and how do you accommodate that technically? And the second question was basically that if one of the CAs is bad everybody's stuffed what do you do about that? To answer the second question things like CAA and mandatory use of CAA will hopefully go some way towards that. It means that hopefully the CAs will have systems that automatically check in a non-overrideable way and this is why we want to make it mandatory that they're allowed to issue for a particular domain and it will be automatically blocked if they don't even if some evil person is at the controls. So we hope that that will deal a little bit with the weakest link problem. Certificate transparency which Google are doing will also make it easier to spot when bad certificates are issued because they will have to be publicly logged in order to be trusted and then you can notice that they're there. So those are a couple of things that people are doing to try and avoid that one CAA is bad therefore we're all stuffed problem. In terms of man in the middle and legitimate man in the middle by say by companies or perhaps for parental control reasons I think that having the browser specifically add features to allow man in the middling is probably not the direction we want to go down. I think that you can already allow man in the middle by installing your own route and then generating certificates under that route and I think that's probably safer than your browser shipping with some kind of built-in man in the middle feature. Another question? Yes, you're getting man in the middle though if you are behind an HTTPS proxy basically you have man in the middle in an enterprise in this case. Many enterprises have this. Yeah. Okay and the question is then about the ubiquity. So now if I correctly understood in Windows if I run Chrome or I run Firefox I will get different for different websites I'll get different I can get red green, green, red so different things. So that's yeah that's the ubiquity question and then the related question is okay why separate route program instead of cross-referencing? So the first question was you get different results in Chrome and Firefox on Windows and what about that? And secondly, why is the more than one route program? Well, you get you can by default you get different results possibly in Chrome and Firefox if there's a disparity between the Windows root store and the Firefox root store but Firefox does now quite recently have an option that you can switch on which allows it to trust manually added certificates in the Windows root store which means not the ones that Microsoft add but if you've added one as a so domain administrator or as a company Firefox will find that and also trust it so it makes it easier to use Firefox in enterprise environments in those circumstances but why do we have multiple root stores? Why do we not just say okay on Windows Firefox will trust Microsoft's root store and Mac will trust Apple's root store and on Linux will trust oh hang on a minute well there's one reason right because most Linux distributions use our root store and so if we stop doing a root store then they would end up having to copy Microsoft or Apple and having either Microsoft or Apple determine the list of difficult authorities that everybody trusts in the world in a non-transparent way seems to me to be a definite step backwards for web security so you can ask the other root store programs why they have their own program and it's certainly true I think that many of them are in a sense following Mozilla's lead in terms of who they admit because for a commercial company a root program is just a cost center right? It's a necessary evil that you have to do you may want to keep it in order to exercise some forms of control but you know it's not really something you can make money at charging CAs for inclusion will give you a bit of money we don't do that but you know not really very much money it's just a hassle right? But the reason our root program exists at least is because we think at least one root program needs to exist which is run open and transparently and we think we can use it both to in a sense drive openness and transparency and other root programs also drive up the general security of the web using that power that we have yes? Thank you for the talk I'm wondering if you could elaborate a bit more about what you want to see changed in CTE and also another question can you elaborate on how AI does will maybe change the root program for Mozilla? Yes so on the matter of CTE some people who understand the technology much better than me are currently producing a paper about the changes that we'd like to see so they put an initial post on the trans mailing list which is the ITF mailing list for CTE and things like it about some of the concerns that they had and they've been asked to go away and write up the changes that they'd like to see and that's what they're doing so exactly how those changes work technically is not my bag and so you'll have to wait until they explain more about the problems that they're having the second question was about EIDAS which is an EU regulation for regulating certificate authorities and certificate authority lists I have to be slightly careful what I say about EIDAS because some of my opinions about EIDAS are probably not all that printable or wise to broadcast but I think that the people who legislated EIDAS didn't really understand the difference between the SSL certificate market and other sorts certificate market like document signing and code signing and even email and therefore the regulations are not a good fit the EIDAS people would like Mozilla to just decide that we're going to trust anybody they decide to trust and so you know if the EU trusts somebody Mozilla should obviously trust them we and other route programs to be fair push back fairly strongly against that suggestion and so we don't think that that's going to happen we think that the best way of managing it is if they want to have their own trusted lists they can have their own trusted lists and use them for whatever they want but the best way to avoid problems is just to make sure everyone in their trusted lists has been through our process and has also got into our trusted lists and then there's in practice no disparity and so there'll be no difficulty and we're very keen to make it easier and simpler for people to go through the process necessary without making the process less rigorous and we're happy to work with people from EIDAS or anywhere else on doing that but it's certainly not the case that we're going to agree to trust anybody that any other entity just says here's a list of people to trust off you go because we think that first of all that reduces our ability to drive positive change because someone can say no I don't have to do what you say, Mozilla because I can just get in their list and then you promise to trust them so up yours not very helpful so and we don't think EIDAS will have much effect in practice on our route program two questions one here and then one there okay, thank you hi well it's been a long time since I've been playing so the company that owns the route program where is it located? the company that owns the route program? well there's a route program by Mozilla yes so it's owned by a company I guess well Mozilla is a non-profit organization which is a US 501C3 so it's based in the US okay so there is where that some of the organizations issuing certificates in the United States are on the United States law and it's possible that the United States administration of the keys of this route certificate well that's true of certificate authorities in any jurisdiction so yeah if a CA is based in a particular jurisdiction it's possible that the government will come knocking with their national security letter or whatever it is and say we'd like a copy of your route keeps please that is certainly true that's not a problem that's specific to our route program or you know or to any route program because the government can always come knocking and asking you for things but the advantage of the certificate system is at least that certificate transparency might be able to help with that in some cases but also if the government does do that and starts issuing certificates of man in the middle they are handing out with every connection cryptographic evidence of what they've done which means that if the client is smart enough and making smart clients which detect this kind of thing is an ongoing area of research it can grab that cryptographic evidence submit it or publicize it and we can go okay certificate authority based in Kublaqistan you know you've clearly been issuing dodgy certificates it doesn't matter if the government made you do it we're not trusting you anymore so you know there is always cryptographic evidence when that happens the trick is capturing it and that's a better situation I think than other systems where it's much harder to prove that the government has snuck in and and stolen some keys we have seen that the power of the CAs is I think too big yeah they have they have a big potential for abuse and they did it and they will do it and why is there not a bigger drive like from Mozilla for example as an NGO and to combine CA based systems with for example trust on first contact so that they can be reduced the CAs for example to bootstrap only for example trust on but first contact with CA yeah so that would be one idea why I think it's no one is even I mean that this is idea new for me or what there's no one even it would be a whole other talk to kind of talk about the different trade-offs and user interface issues that there are with different alternatives to the CA system as it works today but I'm very briefly one of the big problems with the trust on first use system is how you deal with key change right so in a trust on first use in a CA system if a key changes nobody knows nobody cares right because the new key is signed by the same authorities the old key and it's still signed and you still trust the authority so it's fine in a trust on first use system a key compromise is indistinguishable from some guy just deciding to roll over his key right you know I think I need a new key I'm gonna get a new key you know the browser goes oh there's a new key it's like well what do I do about that well it could be that something bad has happened or it could be that something bad hasn't happened whatever right so that's a very brief answer problem and I you know it'd be great to discuss that but we really don't have time here yeah well in fact we're out of time but Joerp thank you so much


Hello friends, welcome back to another episode here on the channel. I hope you're all doing great and as always, for anyone new to the channel, my name is Lee, also known as Osiris. In today's episode, I've got a bit of a treat for you. We're just going to recap the new series 10 rules and then get into some rental teams for you. So do stick around. I'm going to touch on series 10. So it's always good to kind of refresh ourselves. We've got the new rules kicking into effect officially yesterday. As of recording this video, obviously it goes into effect on the 1st of August for anyone. A little bit confused if you're watching this a little bit out of sync with when I'm uploading this. So series 10, we can see the link town is there. Be with all the information is always will be in the description if you want to check these out for yourself. But we've got a season 21, which is kicking off into series 10. Normally, the series lasts for about three months. So we can say from August, September, October, end of October, we'll probably get a new rule set going into November. Although we may not because we know that Diamond and Pearl, their remakes are coming out in November. So it'll be interesting to see what they do in that space. But thinking about it, this is probably the last rule set that we're going to have before Diamond and Pearl come out, which is very exciting. And it runs, obviously, as you can see from the 1st of August to the 31st. This is this season 21. And then we'll go down to the doubles rule set restricted Pokemon available national put decks Pokemon. So everything is available as long as it does have the Gala mark or the battle ready mark. Pokemon limits team of four to six Pokemon from one to level 100 or Pokemon to be moved to level 50. If they're level one, they'll be moved up. If they're level 100, they'll move down. We all know this restricted Pokemon. So the restriction in this format is one of the following per team. You get the choice of either me too. Lugia Ho or Kyogra Groudon requires a Dialga Palkia, Giratina, Reshiram, Zekrom, Curam, Zernius, Ivoltele, Zygarde, Cosmog, Cosmome, Solgaleo, Lunala, Nacrosma, Zashian, Zamazenta, Aeternitus and Calyrex. So a bit of a mouthful. We get the idea. You're going to get to use one of these restricted Pokemon per team. It's a bit like series eight, but the other restriction that we've got, which everyone's singing the praises of and I think it's a really good move. It makes it refreshing to play this format without this this mechanic and that is Dynamax are not allowed. I know we've covered this on the channel before, but just refreshing you guys. I thought it would be good to jump into series 10 officially just like this. Battletimer is 20 minutes, your time seven minutes, 90 seconds team preview and 45 seconds per turn. This is the 10th ranked battle series season focused on Pokemon from the Gala, Pokedex, Alivama and the Crown Tundra and any other Pokemon obtainable in the games. It allows for you to utilize restricted Legendary Pokemon once in your team. It goes beyond what other rulesets did and banned Dynamax. So there we go. There it is in a nutshell. We've got it. We are here and we're going to be able to enjoy it for presumably the next three months. I would imagine until Diamond Pill come into effect. Now getting over to the juice of today's episode. I have got some rental teams for you all to kind of get started if you haven't been watching the content that we've been doing over the last month on the channel. We have been doing a lot of showdown content just looking at teams and seeing how things are kind of shaping up in the format so far. So to kind of help you all out and I've put together five rental teams. I would have done more. Unfortunately, we are locked and restricted by what we can put up on the switch and by our Nintendo online account. So here we go. We've got a Tonoga team, Azernius team, Zashian team, Calyrex Shadow Rider team and E-Veltel team. The last one was hard. It could have been Groudon. It could have been Eternatus, but I feel like E-Veltel's picking up a usage recently and I think it's warranted. I think this team is really good. So this is the reason why I put it in there. So first off, let's start with the Tonoga team. Pretty standard. You've got the Tornadus there, the Kyoga. It's a bulky Kyoga we featured on our showdown series. Tonadus, pretty standard. All the poker pace for all of these teams is done in the description as well so you'll be able to see all the exact details. We've got Reggio Lecchi gives a little bit of additional speed control alongside the Tornadus. Serena is what is the glue of this team. With that Queenly Majesty ability, prevents any priority attacks coming onto the team. Makes it very difficult for things like Rillaboom to operate and just negates things like fake out as well. Then we've got Incinero for obviously a Grass type as well. Works well with that Firewater Grass core with the Kyoga and Serena and it also allows us a little bit of Intimidate and fake out and then rounding the team off with a good old Landerous incarnate and I've got to give a big shout out to Bebham, big friend of the channel, big friend of mine for providing us with the Landerous in this team because I was pretty stuck for getting one so he's provided a Swiss one from Gen 5 as well. So it's a pretty cool Landerous if you do use this rental, do give him a shout out down in the comment section below and I'm sure you would appreciate that. I definitely do. So this is the Tornoga team and we'll move on to the next one which is going to be the Zernius team. Check. Zernius really good in this format.  They're open to everyone on a Friday night and Zernius the last couple of weeks has been doing extremely well in these weeklies. I do post the results so keep an eye on my Twitter line for those or Cyrus VGC and this team pretty self-explanatory, support Zernius, help it get set up and then just crush whatsoever in front of you pretty much you know very standard Zernius. Got a little bit of bulk in there. Max speed on the Zernius. I feel like that's quite important and I have done for a long time with Zernius and then you've got Volcarona another very important component to this team with the rage power.  You got the double fake out there in Rillaboom, in Incineroar and then you've got Urshifu the water type with the Mystic Water hits pretty hard and hits a lot of things in this format for really good damage you know and so making up a nice Firewater Grass call, good synergy in there supports the Zernius pretty well as well and then you've got Regi Alecki kind of tagged on to the end. You could go on Mungus in that last slot because then it gives you kind of additional redirection it gives you a trick room check as well although I don't really feel like you need it in the additional kind of Regi Alecki support that you get here is pretty useful and so this is the team for Zernius. Again poke up here to be down in the description. Okay moving on to our next team it's going to be Zashin. Zashin probably one of the more one of my more favorite restrictors in this format super powerful got that Intrepid Sword ability so whenever it enters the battlefield gets an attack boost which is just ridiculous it kind of makes Intimidate even more more important in this format got a pretty standard set on it with the substitute you take advantage of that so you negate Intimidate Shuffling if you can get that substitute up obviously any further Intimidates coming onto the field as long as the substitute is active will not go through the substituting you'll not get those attack drops so it makes life a lot easier for Zashin to kind of play around with it's a bit more of a bulky Zashin and this team as you see from the poker paste to getting down in the description below and but I feel like it performs very well and that extra bulk is really really nice just prolongs the longevity of Zashin you know again got that double fake out and you'll see a lot of the similar trends in these teams but I feel like for beginning teams for people coming onto the ladder want just to try different archetypes out I think it's best to stick with this stuff that has been very popular very successful so far in the format and it gives you a good advantage to kind of get your head around the format and jump in straight away with a few teams so this is why I've kind of stuck some of you may be thinking oh every team's got Incinero and really boom on but you know they're pretty big staples in the format at the minute so they're there on each team because they do so well they do lots of really important jobs to better than any other Pokemon so this is why they're there obviously we'll be delving into series 10 as we go through the next few months so we'll be changing up it's just a starter okay got the Regi Alecchi in there a nice Firewater Grass Court again with the Urshifu very popular at the minute and then the Landeras as well coming in there to give the team a little bit of additional support so that's the Zashian team okay next team up is the Shadow Rider Calyrex now if you've been watching the channel we had a best of three last week on the channel with a Fevzi and a big shout out to Fevzi obviously for that amazing finish in the recent players Cup 4 incredible to see we had a great best of three we both actually ended up using Shadow Rider Calyrex in that best three and so this team took a little bit of inspiration from what I was originally using and a lot of inspiration from what he was using and what seems to be pretty much a very kind of common six that we're seeing at the minute with the Shadow Rider Calyrex you've got a few issues obviously with things like Porygon 2 so you really have to prioritize those but if you go back to that best of three and you see how Fevzi kind of deals with that issue you can see how you kind of have to approach that matchup with only having Ghost type attacks on the Shadow Rider Calyrex but I do feel like this set is amazing with the substitute it does give you that little bit of extra room to kind of get it in a super nice position with that bit of protection and then start stacking those grim near boost that you can do in that building momentum sort of thing a lot of similar support here you've got the Firewater Grass Core in the Urshifu Incineroar Rillaboom you got Nyaleego here which is a great check the things like Volcarona and there aren't really too many Pokémon that are going to really threaten you off the off the straight off the bounce in the format you know you're going to have to worry about things like scarf tapulele obviously if it's got Whimsicott support and then opposing Calyrex if they do have expanding force and things like that but you do have ways to get around that Regi Alecki here again going to be a great addition for additional speed control and but the team overall I feel like this is probably one of the best builds for Calyrex at the minute with this six so this is why I've tried to kind of replicate that that we're seeing a very kind of common trend and hopefully it's something that you'll enjoy if you do want to try it out and then we wrap up with the Veltel team and this is one that I do really like I really like Solvesti Veltel thank you Veltel in the format at the minute obviously it's it's hard to say it's a great pick when Xerneas is having so much success but I do feel like it's got a place in the format it can deal with both forms of virtue food very well it deals with Rillaboom very well doesn't really care too much about Incineroar as well and with that kind of 99 speed base speed it's very kind of good at dishing out a lot of damage got to watch out for things like Nyligo of course which is another very good check for it and Nyligo Anti-Met and Pokemon can deal with the Veltel and Xerneas pretty well so that is something you need to watch out for with the Veltel but to kind of cover that you've got the Scarfed Landerous with Intimidate so we do have double Intimidate in this team helps out against disaster matchup a bunch as well as a bunch of other things and then a trick room mode as well with Stack Attacker which definitely is probably one of the best things to have against Xerneas and with the Safety Goggles you can ignore Rage Powder as well so you can get the trick room set up and always guarantee that Gyra Ball into the slot that you want it into got to watch out for Ally Switch but I don't know how much Ally Switch has been going around in this format anyway they are the teams as I say I do have the poker pastes of all of the teams as well so you can pull these up they'll all be linked down in the description below so all the details of the spreads and the move sets and all of the items like I say I would have liked to have done more teams to provide for you all but unfortunately we are locked in with these slots that we've got so we'll have these up for a couple of weeks and then we'll start cycling through some new teams and we'll be featuring new teams on the channel of these next couple of weeks so if there are a Pokemon that you would like to see featured in our new series do let me know down in the comment section below we've had suggestions like all which we will be doing crowd on I'll definitely be coming to the floor and there's some interesting Pokemon like dustman the crossmer as well that we haven't really touched on yet and Russia and things like that that we have had suggestions for so we slowly going through all of these different archetypes and featuring teams around them but to get everyone started and just put these out here as a resource that people can use to help them just jump on the ladder learn series 10 if they want if they haven't already kind of got involved with and all the thing is a lot of players are already really deep in the format so some of these teams may not be that useful but if they are then job done and we're going to keep this quite short today so hopefully you've enjoyed it friends thanks for tuning in and we'll be back very soon on the channel with some actual series 10 content on the switch which is very exciting so looking forward to that have a great day and I'll catch you all for another episode very soon so until then take care and bye bye