It would not make sense to tax the top line of the schedule C because if you have to expend the money to generate that income, then you should be taxing the net income, the bottom line of the income statement. When we think about most people that are employees, the idea there is they don't have any deductions because the employer is the one that are making the expenditures necessary in order to help them to generate the revenue. Now when we look at interest then, how does interest fit into that scenario? Well, if you had a schedule C type of business, you would think that if you had to take a loan to buy equipment, for example, that you used to help generate revenue, you have bought, you have our paying rent on the loan in the form of interest, which is similar to like paying rent on like an office building to help you do business in it and generate revenue. You have the purchasing power of the dollars upfront and therefore you're willing to pay rent on the purchasing power, which is basically interest. Therefore you would think it would be deductible in that case. However, if you buy personal things like a personal car or credit card expenditures, you would think that those things would not be deductible if you bought personal stuff with them because it's not a business expense. You didn't need to pay the rent on the loan in order to generate the revenue.


Mae'r rôl yn rhoi gweithio ar y 3-4 systemaeth global ym mwynhau ym Mwneud. Mae ym Mwneud gyda'r panon, mae'r perffwysig, mae'r ddweud, mae'r ddweud a'r ddweud, ac mae'r ffordd yn ei ddysgu ei ddechrau wedi'i gwneud. Mae'r ddweud wedi cael ei ddweud yn 96% o rôl ym mwynhau. So mae'r bwysig o'r holl ddweud. mae'r unig yn ystod yn 4% i'w ddweud. Y 96% o'r dweud y rhaid o'r ffordd yn ymweld yma yw'r ysbytydd yw'r cyflwydd. Mae nhw'n ddweud yn ei gweithio ffryd o'r ddifrif o'r cyffredinol i ffyrddig. Mae'r ddegwysig ffydellol ac mae'n cyfnod am y ddegwysig. Mae'r ddegwysig ffydellol i'r ddegwysig yw'r ddegwysig, yw ar gyflwylliannau. One of them is the membership of the systems. So in the case of the patent system it's the most complete, it's nearly 150 countries, 148. In the case of the trademark system Madrid it's around about 113 countries so it's less complete and the least mature is the Hague system for designs which is around about 50 countries. For arbitration and mediation it's open to the whole world. What are these systems telling us? Well very briefly and then you can go into the details in your questions if you like. In Safari's patents are concerned, the patent cooperation treaty, growth last year at a slightly lower rate, 1.7%. It's the sixth consecutive year of growth after the global financial crisis. Around about 220,000 international patent applications overall, exactly 218 so I'll use round figures. And the major story I suppose continues to be this continuing trend of growth from Asia. In particular in order of size Japan, China and the Republic of Korea. So Asia accounted for 43% of all international patent applications filed in 2015. So it's quite an extraordinary figure really and a growth that we have seen. 43, 43, yeah. So it's extraordinary, so if you're looking at where new technology is produced as measured by the patent indicator and it's one of the best we have, 43% of it is coming out of Asia. And in terms of the top filers, well again three of the first four come from Asia. So the top filers in order are Huawei technologies from China, Qualcomm from the United States of America, Samsung Electronics from Korea followed by Mitsubishi Electric in Japan. I'm not going to go into many more details because I'll leave it to you to ask questions but we're very happy to give you further details about all of this including for example university filings which are an interesting feature of this. In terms of trademarks then let me turn to the Madrid system. A slightly higher rate of growth, 2.9% in 2015. We're coming on to 50,000 international trademarks per year. These are using round figures, the exact figure was 49,000. 49,000. 49,000, yes. I mentioned at the outset it depends on the geographical spread. It also depends on when countries have joined the system. In the case of Madrid we know that the Asian countries have joined rather more recently this system. So it still remains a system where European countries together with the United States are the top users. I wouldn't want to extrapolate too much in terms of conclusions that one can draw from that because of the relatively recent use by Asian countries but if you think of areas where branding is important fashion, design and so forth of course European companies as well as American companies are very strong in these areas. So the top filing country is United States followed by Germany and France. Of the Asian countries China and Japan ranked 7 and 8 respectively. Of the top filing companies the top one is Novartis followed by Lidl followed by L'Oreal followed by Philips Electronics. So a good result for this I think and happy to go into further details. On the design system well this is the most recent of what's in chronologically not but it's a revision to make it a global system. It's the most recent and we're now starting to see it take off. Largerly it's consequence of the accession by the Republic of Korea, Japan and the United States of America in the course of the last two years. So the growth rate that we saw in applications here was about 40%. So this will be coming in increasingly interesting indicator of design activity around the world because we expect more big economies to be joining this system in the coming year or two. The performance of Korea is very interesting because it joined the system only 18 months ago and now Samsung Electronics has a displaced swatch as the top filer of international design applications. It filed 1132 compared to swatches 511. The top filing countries I think I gave you or I may not have are Germany followed by Switzerland and France. But we'll see an evolution of that in the coming years with respect to in particular Japan, the Republic of Korea and the United States of America. For our arbitration centre then if I move on to that we can do it later. Okay, fine. So on the first it's true that there's a relative stability in the top filers. Apart from this big historical trend of seeing the ascension of first in time Japan followed by China and the Republic of Korea. And what are we measuring here? We're measuring the output really of technological capacity. So it does reflect the differences in technological capacity around the world. But we are aware of that, we know that. Is that changing the levels, the asymmetries, if you like, that exist with respect to technological capacity? And I think it's changing but it's a slow process because to innovate of course you require a whole infrastructure or ecosystem which is very broad ranging. And it ranges from everything from the education system through to business sophistication and your capacity to be able to support innovative activity with appropriate intermediaries and capital markets, for example. Talking about in terms of technological capacity a huge ecosystem covering really the whole of the economy. So it's not surprising that there are no sharp movements in this area apart perhaps I would say from China where there has been a dramatic change in a relatively short period of time. Whether the differences are getting greater or not is I think a very major question that I would prefer not to hazard an answer on. Because I think that's a really crucial question for the world, crucial question of political economy. And I think you would need to measure that extremely carefully before you made a guess at whether the differences are getting greater or not. All we know, what we do know though, is that technology and knowledge more generally form an increasingly important component of wealth generation in the economy. And the speed at which technology is developing is accelerating. So that makes the catch up task even more difficult. On the second question I think that the I don't think the design law treaty, the proposed design law treaty will have much of an influence on filing activity in the Hague system. What the proposed design law treaty will do is make it easier for designers to obtain protection around the world for designs because they will not have to contend with such a perplexing complexity of procedural requirements in making an application. For China? No, for the Asian. For Asia? Well because I think it's a reflection of two things. First of all the economic dynamism of the Asian countries and in particular the three that I cited. And secondly the strategic focus of economic policy on innovation in those countries. Question on the table on the ranking exists early on this time? Yes, we can give it to you. We can give it that, yes. Because in the table you gave us there's no ranking for the US products. One, two, three, four. We can get that. We can get that to you. It's across the bottom. It's up on the table. Yes, sure. But we can get it easily. We can get it easily. The whole list. You can reproduce the infographic also electronically. We can get you any format you want with pleasure. I have a question about the city application by companies. I'm not sure if I'm correct but look at the Panasonic. It seems to me that two years ago they were given first last year, second and now 16th. I just missed the last page of what you said. There is an increase compared to Panasonic. I know it's an absolute increase but the decline from the second one last year to 16th is impressive. I can get the simple answer to that Panasonic but it also applies to Microsoft. What happened last year was they have changed their name. If you look at the name of this year, it's Panasonic Intellectual Property Management, where last year or the year before that it was Panasonic Corporation. So there has been a change in the name. At the moment we are just reporting what the actual name is registered in the application. There is also some application coming from Panasonic Corporation. But our guess is in the future. Everything will be combined into Panasonic Intellectual Property Management. So it's a matter of changing the name actually. It's a transition. Some application from the corporation are included in this one? It's not included in this one. This one is only Panasonic Intellectual Property Management. We have a small number of applications filed under the name of Panasonic Corporation. But at the moment we just don't know the legal status of changing the name. It's just a change of name but there's something else taking place in the company structure. That's what we think they're doing. That's what we think they're doing. Question on the top. One's technology and the other's brands. So Madrid is brands. And Patence is technology. PCT is technology. So you would expect a difference. Fashion companies are not going to be finding designs and branding. But they're not going to be much in the technology area. A quick question in the next specific country. Which is India. If you can only last two years actually. So it's difficult to use some fancies in terms of the stagnation in India's type of PCT application. So you have also cited factors that hold up technological growth. Namely lack of infrastructure, ecosystem, educational, sound education and business institutions. Are these all the factors holding up in India? What in your view are they holding up in India's stagnation in India? I wouldn't say the stagnation first of all. Let me give you some figures. So from 2010 to 2015 the average growth rate of international patent applications from India was 2.2%. So that compares favourably with most European countries over the same period. Which was an economically turbulent period. A more difficult period let's say. So I wouldn't say stagnation at all. However it's not the growth rates of China. So how do you explain that? I'm an expert on India in particular. But I think what we are seeing is investment in innovation policy in India at the moment. And that generally is a medium to long term policy. Or a policy that produces results in the medium to long term. It's not a policy that produces overnight. It's a policy that's not going to start investing in research and development. And expect to see patent applications skyrocket the very next year. It's a process. So I would say that the jury is still out. And that we should watch further on this. Masai, do you want to? No, I just want to follow up on what the director General said. One of the things we have to look at the long term trend. We have to be careful when it comes to China or other countries. For example, if you look at the R&D investment, China has invested heavily over the last 15 to 20 years. And at the moment it's the second largest country in terms of R&D expenditure after US. Where India is lagging behind. So we have to look at the investment in innovative activity over a long period of time. Use the word dramatic several times in your introductory comments about China. In the case of PCT you also said about Korea and I think designs. So I find it a bit puzzling answer that given the kind of time series stagnation that you see, I mean forget about percentage growth, see it in absolute terms as you are seeing in China. Are you trying to sort of not come clean on what exactly is happening in terms of stagnation in India? No, I would say that the use of dramatic with respect to China's filings of international partner applications or careers filing of international design applications are exceptions. They're exceptions. We don't see that elsewhere. These are extraordinary developments. Now that doesn't mean that everyone else is in the dunce category. It means you've got two exceptional performers there. And all the more exceptional when we know that innovation policy is a very complex matter which doesn't produce immediate overnight results. So I wouldn't put in my mouth the words that India is performing badly. I'm not saying that. And I don't think it is the converse of the exceptional performance of two countries. But you also said that investments in innovation in India are lagging far behind. Masaid said that investment in research and development, yes. Yes, well there's no doubt about that. I mean that's a fact. I think that investment in research and development is a very important element in innovation capacity but it's not the only factor. Well, I'd say everything from the strength of your education system because we're talking about the generation of new knowledge and of course the transmission of existing knowledge is an essential basis to the generation of new knowledge. So your educational system you can start with. The government policy framework which creates incentives for behaviour which is behaviour in this instance investment in innovation. General awareness of the importance of innovation as a competitive factor, as a means of gaining competitive advantage. The nature of your economy, what sort of things you're doing. India has a strong service sector for example. It has a very important creative industries sector with body wood and music and so on. And these are not reflected in technology, technological activities. So the extent to which you have risk capital, venture capital, the extent to which you have a range of intermediaries who are assisting. I think we measure in the global innovation index for example about 64 inputs. So it covers, that's the problem in a certain sense, it covers everything. If there was a simple way of saying okay we're going to be an innovation nation then we'd see more performance. I'm suggesting there are a lot of non-tangible factors basically say anti-deluvium beliefs or anachronistic systems that are holding up. You're suggesting that, I didn't say that. I don't think so, I think, look India is a country what, 1.3 billion people? Less than that. 1.2 billion people. Vast, differential levels of development within the country. Within the country. Pressing priorities across the country in terms of infrastructure and poverty alleviation, everything. So it's also a large democracy and I don't think you can decree, you know better than I, the change in India, it's a process. It's just for my understanding when the world is in the Madrid system, if you develop a new drug you don't get it. Look, if I may answer it this way. I think that enterprises now seek to protect their competitive advantage in whatever way they can. So if you are marketing a new drug, naturally if it's new you will be seeking patent protection and that will give you the protection of the basic technology. But you will also try to brand it so that consumers think, whatever it might be, headache aspirin and that's the function of the brand. The brand creates that reputation and image in the marketplace. So you would do that as well. You might also, although it's pretty rare on drugs, but you might also in other sectors be looking at the design of the thing that you've got. So if we take a different example, if we take that example, you have patents in it for concerning the functionality, you have design in it concerning the look of it and you have a brand that we all know. So they seek to protect their competitive advantage in as many ways as possible. We can find it out. We can find it out. What you have in the annex is the top 50, but we have lists beyond that and Novartis does appear in the list of top PCT applicants. So there's a lot of companies you'll see there, not only in the PCT, but also in trademark, Madrid also in the industrial zone. For example, Samsung is at the top of the industrial zone, but also they appear in the PCT. So you have Philip Electronics is another one where they're covering all three aspects of the IP. Please. I wonder if you can explain to me these figures related to the international applications, every number of sub-Saharan African countries, for instance, that we have, there's no applications by American, but it has given directions to the government to try more and more. You've got the same sort of thing for the suit too. Is it widely available here? Absolutely. Just explain what does... Sure. Sure, thank you. It's a very interesting question because it also applies to top countries too. So the application is the generation of new brands in that country. So the extent to which that country enterprises are developing new brands. Designation is where new brand owners, wherever they are, seek to protect their own brand, their new brands. So it's an indicator of the markets that are of interest to other countries. So in the examples you've given, we don't see any new brands in the new international brands emerging from them, but we see international brands coming from other markets seeking protection there because they're going to be selling their products there.


I think it always existed, but I think for decades, companies thought that they can get away with the change projects. Unfortunately, change projects don't touch the fundamental roots of certain ills that we try to address. Transformation means transformation, changing the organizational form of the company. Unless we don't touch this issue and the change project usually doesn't touch it, we don't get the results. And so today, probably, in our VUCA world, the simple change projects are not enough. I think there's one biggest barrier. It's the CEO's ego. I think that the true transformation can only succeed if it's based on creating an environment that allows freedom, trust and responsibility for everyone. The CEO that has an inflated ego thinks himself as being the most intelligent person in the company. And therefore, all the efforts to convince his employees or her employees that they are intelligent will fail. And the problem is ego. I have never seen a successful transformation without its CEO having transformed himself or herself first. True. Some of them didn't need that because they were humble to begin with, but most of the CEOs worked with their coaches and some, in extreme cases, were psychoanalysts. I think the key issue is how do we select the leaders in large cooperation, the business unit CEOs, who can be this type of servant leaders, who can carry this type of projects that acquire transformational leadership. That means that they don't see themselves as being in charge of running the operations in their companies, but being able to launch a transformation that will create an environment where people will take care of running the business. For the last 10 years, first I carried the research that they published in 2009 in my book that's called INC, Freedom Incorporated, several articles. And that's after maybe three, four years, caught up in a larger, larger amount of corporations and businesses. And so I was instrumental with several of my colleagues who became friends and CEOs, essentially, of the companies that launched their own transformations that we call liberations, into creating an ecosystem for helping or assisting in a certain way, mostly pro bono. These CEOs who want to do it by themselves and they feel a little bit lonely, I would say, in these radical efforts. And since the last, I would say, five years, I work on another topic that's called The Altruistic Corporation, and that's culminated also in the book, which has been published one month ago.


Bread lights on, everyone. Watch what you say. So before we, just to note, before we get started, I ask that people not take photos of me for privacy reasons. If I see a camera pointed toward me, I have an automatic response where I'll sort of flinch and duck out of the way, might hide behind the podium. Could be a little distracting for the session. So my name is Jess, and I'm better known as XJM on Drupal.org. I'm part of a team of about a dozen Drupal 8 core committers who review and commit everyone's patches to core. Within that team, I'm one of the two release managers. The two of us are the ones responsible for actually creating the releases you can install on your sites each month, as well as setting schedules, evaluating the potential disruption of changes, and so on. I've helped coordinate basically all of the security and minor releases we've had for Drupal 8 to date. And I've personally rolled most of the security releases myself. So when your Drupal site says security update required, you can kind of just think of that as me saying hi, maybe make your day a little better. I work for Acquia, and I'm part of the awesome Drupal acceleration team there. So the title of my session is Security, Drupal 9, and Navigating the Changing Web Landscape. The internet is a very different place than it was from back when Drupal 7 was released in 2011. And I'm not actually talking about headless setups or machine learning or multi-channel. I mean a fundamental shift in the way that web software is packaged, developed, and released. I'm talking about the launch of GitHub. I'm talking about the adoption of modern package managers like Composer, NPM, and Young. These shifts have affected how we developed Drupal, and they impact what we have to do to keep Drupal site secure now and in the future. So let's first take a look at what we already changed in Drupal 8. One of the most important changes we've made in Drupal 8 is that we actually schedule our releases now. And we follow semantic versioning to add new features without breaking backwards compatibility. Back in the day, Drupal was ready when it was ready with no new features shipped until an entire major version was ready to be released. Starting with Drupal 8, though, releases are scheduled and announced in advance. And we ship whatever features are ready by the date that they're supposed to be done. One of my responsibilities as a release manager is setting the schedule and making sure that nothing puts a release date at risk. Another important change with Drupal 8 is that we've adopted modern best practices and tooling. Overall, there's a lot more third party code in and around Drupal 8 compared to previous Drupal versions. You've probably heard that Drupal 8 depends on symphony and twig, for example. We manage and package Drupal 8's PHP dependencies with Composer, which is basically the industry standard at that point. At this point, we'll get right up here. Also, during the Drupal 8 development cycle, we refactored or rewrote basically everything in Drupal Core. There's code maybe in the batch API that hasn't changed in more than a decade, and the hook system is still around. But other than that, Drupal 8's APIs are pretty drastically different from previous releases. We also released Drupal 8.0.0 before the data migration path from Drupal 7 was stable, because we wanted to give new sites an opportunity to start building on Drupal 8 while we were finishing the migration path. So even though there are a lot of improvements in Drupal 8, even in Drupal 8.0, it's been a slow process for existing sites to adopt it. So with that in mind, let's take a look at what we're changing in Drupal 9. And the answer is not much. We want to keep innovating, but we do not want another difficult upgrade. So following the release of Drupal 8.0.0, we've adopted a continuous upgrade path, which is a concept we got from symphony. When we want to improve something now, instead of rewriting things wholesale, we add the new code in minor releases while leaving the old code in place. The old code is simultaneously marked deprecated with a link to the replacement. This means that, essentially, we're building Drupal 9.0 in Drupal 8.0.0. It also means that module developers don't have to wait around until Drupal 9.0 is stable to make their modules compatible with it. All they have to do is move away from deprecated code whenever it works for them. And then the same module code base will work with both Drupal 8.0 and 9.0 at the same time. Our target for the release schedule of Drupal 9.0 is for June of 2020, about seven months from now, with a fallback of December 2020. Drupal 9.0 will be exactly the same as Drupal 8.0.9, except for two things. The deprecated code that we have accumulated since 8.0.0 will be removed, and our dependencies will be updated to new major versions. Upgrading from Drupal 8.0 to 9.0 shouldn't be much more difficult than updating between minor releases so long as you keep up with deprecations. About two-thirds of sites are still running Drupal 7.0, partly because of the difficult upgrade path, and partly just because Drupal experienced its steepest growth during Drupal 7.0's active support. So it's gonna take a while to get all those sites updated. We took all this into account, and decided we needed to support Drupal 7.0 for much longer after Drupal 9.0's release. So it'll be supported until November 2021. Even if you're on Drupal 7.0 now, which I imagine a number of people probably are, the best thing that you can do to prepare your site for Drupal 9.0 is to update it to Drupal 8.0 now and to stay away from deprecations. The deprecation process and continuous upgrade path means that Drupal 7.0 to 8.0 is the last difficult update you'll have. And since Drupal 9.0 is basically just a continuation of the Drupal 8.0 series, Drupal 8.0's end of life is actually also in November of 2021, because that's when Symphony 3, the major version of Symphony currently used by Drupal 8.0 will reach its end of life. So I promised you we schedule our releases now and that releases are predictable. So in your head, fast forward to November 2021. Drupal 7.0 will have had nearly 11 years of support. Drupal 8.0 will have had six years. The end of life for Drupal 7.0 is a pragmatic decision we're making based on trends in the ecosystem. But the end of life of Drupal 8.0 is directly tied to the end of life for Symphony 3.0. And that's gonna become the new normal with our dependencies impacting our major release schedule. So when will Drupal 10.0 be released and when will Drupal 9.0 be end of life? It's a complicated puzzle to solve and it depends on our dependencies. So now we're gonna take a closer look at Drupal's dependencies, package management and dependency security and think about how those things affect both your site or application and Drupal's future. At the end of the day, the reason we have dependencies is to save work. We reduce the amount of code we have to maintain ourselves with the goal of increasing the overall code quality of Drupal as a project. People use Drupal to build powerful websites with robust data modeling. That's what we're good at. So why should we spend time maintaining software to interpret HTTP requests or run unit tests? Other open source projects have already done those things better so we should use them. That said, though, adding third party dependencies also adds new challenges to maintain Drupal and keep it secure. To explore the question of how our dependencies support and security affect us, I'll first give some very quick background information on Drupal's own security policies. Drupal practices coordinated disclosure which is described as a security model in which the vulnerability is disclosed only after a period of time that allows for the vulnerability to be patched. The goal of coordinated disclosure is to repair fixes in advance and allow sites a chance to update before giving potential attackers information that they could use to exploit the vulnerability. To facilitate coordinated disclosure, Drupal security issues are reported and handled in a private issue tracker. We release each fix with a security advisory during predefined security release windows on Wednesdays and we make the security fixes themselves as non-disruptive as possible. The goal of all this is to allow people to apply updates immediately at a predictable time without worrying that their sites are gonna break. Person in the back with a camera, please make sure that I'm not in the frame. Thank you. What was I saying? Okay, so an important part of coordinated disclosure is collaborating with other projects so that one project isn't disclosing vulnerabilities in another before there's fixes for both. So for example, back in May, there was a security vulnerability reported to the Drupal security team for a dependency library that Joomla and typo3 share with us. So we collaborated with Joomla and typo3 when releasing the fix for that and figuring out what date we should put it out. The coordination with other open source projects has actually become a significant part of the work that we do. Among all of the Drupal 8 releases we've had to date, one in three have involved our upstream dependencies. Now this doesn't mean that dependencies are any less secure than Drupal. Theoretically, all of the things being equal, we would have the same vulnerabilities if we were the ones maintaining the code. But it does have an impact on how we schedule and ship releases. When we have a vulnerability in our own code, we can review and test the fix ourselves in advance of disclosure. We can bundle multiple security fixes together in a single release so that site owners don't have to apply so many updates. When we're making a release for an upstream project though, all that goes out the window. Hopefully we'll find out in advance that a security release is gonna happen for one of our dependencies, but sometimes we don't. Sometimes we work with the upstream project to set a coordinated disclosure date that works well for us. But it depends on the project and it doesn't always work out. Sometimes we get patches ahead of time, but even then, testing a private, unreleased patch against a composer dependency is complicated. We also can't stage the core releases in advance when there's a dependency update. We have to wait for the upstream release, then test it, tag it, package it, publish it all the day of. And finally, an upstream fix is more overhead for both us and sites because we have to make more releases for fewer vulnerabilities rather than bold and blatant multiple vulnerabilities on release dates that work for us. Another challenge we face with security vulnerabilities in our dependencies is how to ensure that Drupal sites are secure when dependencies support cycles don't match our own. And I have an example to illustrate this. So we released Drupal 800 in November, 2015. And PHP 7.0 hadn't even had a stable release yet. So we've supported PHP 5.5 and 5.6 with our best effort to be PHP 7.0. We thought that we would be able to support it when it came out. Now, in July, 2016, so eight months later, PHP ended its official security coverage for PHP 5.5. However, throughout 2016 and 2017, nearly 20% of all PHP websites were still using PHP 5. And keep in mind, some Linux distributions provide their own security patches for PHP versions used by their long-term support releases. And PHP 5.5 was used by Ubuntu's trustee tar, which actually had security coverage all the way until April of 2019 this past year. A site owner using that stack might reasonably expect their applications to keep working on PHP 5. So early in 2018, we announced that we would require PHP 7, starting with Drupal 8.7.0, which came out this past spring and May. There was a risk in supporting PHP 5.5 for so long because it meant we had an increasing number of dependencies on old versions. We were weighing that against the risk of denying 20% of all Drupal sites any Drupal security updates at all, because you can't install an update if you don't meet the system requirements for it. Then in summer of 2018, months after we made our announcement about 8.7.0, we received a report of a URL rewrite and cache poisoning vulnerability that the researcher planned to disclose in August. My colleague, Wim, researched the report and found that the vulnerable code was present both in symphony and in the couples and libraries, including ZenFeed and Diaturals, which are used by Drupal Core. So we collaborated with the security teams of all three projects, as well as the researcher, to find a coordinated disclosure date that would work for us, and we came up with August 1st. So we planned to release it as SA Core 2018.05. Everything seemed okay, but then there was a problem that we discovered like the day of the release, which is always what happens, right? Very late in the process, I discovered that Zen had already dropped the HP55 support from those libraries in minor releases earlier that year. So we couldn't update Drupal to require the security versions from the release that we'd helped coordinate. Fortunately, it turned out that Drupal Core itself wasn't vulnerable because we were only exercising the symphony code, and we weren't using that part of the vulnerable Zen libraries at all. It was a near mess. What if Drupal had actually been vulnerable to using, if it had been using the Zen code and they were vulnerable through that path as well? We couldn't just drop support for PHP55 during a security window that would have caused mass chaos and panic. Would we have tried at the last minute to convince the maintainers of the upstream project to release a release contrary to their security policies, or would we fork the libraries and scramble to backport patches to an unsupported version? And then if we did that, what would that mean for updating those libraries in the future? So all this shows how important it is to keep dependencies on their latest versions, but also the complications we have for doing so. So let's take a look at Drupal 8's Composer dependencies and what managing them with Composer means. I have some illustrations. My colleague and fellow security team member, Cash Williams shared a Drupal Con Seattle. This is a diagram of Drupal 8's Composer dependencies as of our initial release back in 2015, along with their interdependencies. The purple arches at the bottom are Symphony, which like I said is our most critical dependency. Fast forward to 8.7, which was released back in May, and we have maybe a 30% increase in the number of dependencies. We've added a dependency to fix a security issue with PHP, we've added another that's useful for headless setups and so on, and those have brought their own dependencies with them. Now, of course, your typical Drupal site runs a lot more than just core, and even every contrived module is another dependency for the site and might bring its own dependencies with it. Even a simple distribution can add a lot. This is the diagram for Lightning, which I don't feel bad showing you because it's an Acquia product and I know it's well maintained. So Lightning is a starter kit for a generic Drupal site with some Acquia integration support baked in. Even the starter kit is already quite the tangle of over 100 dependencies, even without any advanced features like commerce or anything. And when you start building a site on top of this with additional modules and packages, it's easy to get to many hundreds of dependencies. Very few organizations can audit that much manually. So this brings me to some of the drawbacks of using Composer. Can I get more tea? Helpful person. Thank you. Run out of liquid. So yeah, so some of the, sorry, I'm sick and my voice is kind of going, so I'm trying to keep it lubricated here. So some of these problems here are general problems with any package manager and other are specific to Composer or to Drupal's implementation of it. Now the point of a package manager is to not have to worry about upstream dependencies or version conflicts in them. When you install a package manager, the package manager will helpfully pull in your project's dependencies and its dependencies dependencies and its dependencies dependencies dependencies and so on. So you don't necessarily know who owns or wrote the code you're installing or what it is. This can cause some of the release management challenges have already described where there's difficulty balancing stability with security, but it's also that much easier for something you didn't want in the first place to break your site or even to trick you into installing malicious code. Information about Composer dependencies also isn't surfaced anywhere in the Drupal user interface to where module information is. A related problem is that there's a disconnect between the security services Drupal provides and the security of Composer packages that contributed modules or site owners install. Something you might not have thought about is that Drupal.org is a package registry specifically for Drupal projects and it provides robust security features, rich metadata about releases, built-in security reporting, push notifications either. Where was I push notifications? Notes. Basically, Drupal.org is a package manager that does what every package manager should. It's just that it's built in-house by us. It gives you push notifications. It tells you when you need to update your site and then you also have coordinated disclosure for all the security advisories across thousands of projects and all that's facilitated by a volunteer security team. So we already actually have our own package management functionality. It's just that it's only for Drupal. And so integrating that with Composer and making it so that we get the advantages that we have from Drupal.org along with the advantages that we get from using Composer is a problem we haven't solved yet. For core, we update our Composer dependencies when they have a security vulnerability. If core itself is vulnerable, but that doesn't help you with vulnerabilities exercised by your own code or other packages you've installed. Unfortunately, Composer also lacks any form of built-in security auditing or monitoring. It lacks any concept of security advisories whatsoever. There are some third-party tools in libraries that try to fill this gap by tracking CDEs or declaring version conflicts with insecure versions of packages, but it's all often not always up to date and really no substitute for native functionality. Also, the vast majority of Composer packages are maintained on GitHub, which has no mechanism yet for private-issue reporting. This means that vulnerabilities often get discussed in public before they're fixed, preventing coordinated disclosure and increasing the possibility that an attacker can use that information to exploit some application that has the vulnerability currently. Just recently, GitHub did introduce beta features for security policies and advisories, and maybe that will influence Composer in the long term. We can hope. So I'm gonna leave this on my, when I look at my T here, I'm gonna leave that up there. So those of you in the room who are JavaScript developers, I think that it's adorable that I've just spent multiple slides talking about the perils of having a few dozen Composer dependencies. The modern JavaScript ecosystem is different in ways that terrify me and not just because my JavaScript coding skills peaked in about 2003, but I will admit that it's also a factor. Before we talk about the future of JavaScript in Drupal, let's talk about the past and present. These are Drupal 8's current JavaScript dependencies, although several of them are deprecated in 8.8 that might put little green strikes on those. Now, I can't show you any fancy illustrations of this because we actually don't use a package manager for Drupal's production JavaScript dependencies. They're just committed to core and will vendor assets directory. So 13 years ago, JQuery was committed to Drupal 5. It's this one right here. And then later that year, Carptastic was added to allow the garland themes colors to be customized. This is my Drupal old-timer test. Who remembers the garland theme? Yay! Okay, good. I don't feel old yet. Thank you for making me feel young. So then 10 years ago, JQuery UI was added to Drupal 7 to support accessible model dialogues. And all three of those libraries are still a part of Drupal 4 today. The rest of these JavaScript dependencies like Backbone, CK Editor and Match Media were new in Drupal 8. Now, 24 total packages doesn't seem so bad, right? When compared to those PHP dependencies. The trick here is that without a package manager or proper test coverage for a lot of our JavaScript, updating these libraries is both tedious and risky. And frankly, a lot of the JavaScript in these libraries is pretty legacy which adds to the maintenance burden. The list here is also a teensy bit misleading because in the list, JQuery got UI alone. Where's my evil friend up here? I put an asterisk by it for a reason. It accounts for more than, I think it's 38 separate libraries that are exposed to core. So it's not just one thing. So let's take a closer look at our history with JQuery and JQuery UI, which are the most tightly decoupled JavaScript dependencies we have. We'd really hoped to upgrade Drupal 8 to JQuery 3 before Drupal 8.0.0 back here. Is it finished not working? Let's get to the slides, that's why. There we go. But it was, JQuery 3 was still only an alpha at the time of its release. In fact, a stable version of JQuery 3 wasn't released until June of 2016, the next year. Now, by May 2017, JQuery was no longer providing minimal security coverage even for anything below JQuery 3. And there were publicly disclosed security issues with JQuery and JQuery 2 that said they would not fix. So I have called in here the JQuery 2 end of life. They never actually officially announced one, which might be tricky. Well, core itself was not vulnerable to this one particular Ajax vulnerability. At least one contrib module was. There was also some problematic documentation on Drupal.org that made it seem like that there was custom code that was vulnerable out there as well. Plus we were at least as concerned with the possibility of other vulnerabilities in the future. Public disclosure, no support from JQuery, exploits in the wild, Drupal sites hacked before we could mitigate it and so on. So given all that, we decided we needed to do a major version upgrade for JQuery as soon as possible. Overall, because of compatibility issues with JQuery and especially with JQuery UI, it was more than two years from when we first started tracking JQuery 3 at the time of its alpha until we were able to make JQuery core compatible with it. Even once complete, this update had downsides, those same compatibility issues that core had to resolve were just as likely to affect contrib in sites. So this was one of a couple things that made Drupal 8.4.0 a disruptive minor release, actually breaking people's sites and disincentivizing them from updating to a secure release. Weighing that against the very real risk of sites being hacked while we were stuck on JQuery 2 was a tough call. Ideally, we'd only do major version updates in major releases of Drupal, but other projects release schedules don't always make that possible. Overall, if we do need to break sites, we'd rather do it at least in a regularly scheduled minor release when sites can plan ahead for some disruption and test thoroughly before deploying. If we break sites with security releases, people can't plan ahead for that and it'll make it so they can't update immediately the way we need them to. So back in April, it was announced that JQuery 3.4 would be the last minor release of JQuery 3 and that JQuery 4 development is underway. No photos, please. Camera down. Put your camera down, please. No photos of me, please. If you didn't see this live at the start. So JQuery 4 development's underway and but JQuery UI, on the other hand, since that last time consuming update to be compatible with JQuery 3, it hasn't seen any development at all. And it was like things like 2017, there was a blog post about it. The last release was in 2016 and it's officially considered end of life now, which means that there's no security support for it anymore and Drupal Core is still using it. Plus, if JQuery 4 is released sometime in the next couple of years that puts us even in a trickier spot. JQuery 3 isn't guaranteed to have security coverage after JQuery 4 is released. And we know JQuery UI isn't gonna be compatible with JQuery 4, for sure. But JQuery UI is an important part of Drupal's user interface. It supports accessible modal dialogues and autocomplete fields, among other things. So what do we do? What do we replace that with?  We have one right here back in July and we agreed to start by deprecating the JQuery UI libraries core users directly and then moving them to contrib with the temporary backwards compatibility layer. So right now core exposes like 38 different things but only uses six of them. The remaining 32 things are gonna end up in contrib in Drupal 9 and people are gonna be encouraged to use that for their upgrade path if they need but find other solutions if possible since that's really dead code. So then we started to research and prototype potential replacements for the six components core does use and to see if they met our standards for quality and maintainability. Since we had to complete any deprecations by basically this week, the final step is to fork whatever was left into core so that we can patch it easily for security issues, reducing the technical debt and attack service without the 30 odd other libraries and continue to work on it in the Drupal 9 minor release cycle in the future. The goal will be to remove all of it by Drupal 10. Several of my colleagues worked on this over the past three months a lot and I have their faces up here. They managed to find a few react friendly future compatible libraries that were adding to Drupal 8.8 core so they'll be available for use in 8.8 and you can start porting your modules to them. The last big challenge though is the dialogue library which is a critical user interaction in a lot of Drupal UIs and critical point for accessibility. Replacing that will be a bigger project that we have to finish by Drupal 10. This issue is still open for discussion and we would love your help. So if you find one of these nice people or myself on sprint day, maybe you can help with that if you're a JavaScript or accessibility champion. So now let's talk about what JavaScript might look like in the future. I tease this a little bit by mentioning react friendliness in the last line. Did you notice that? It was a little subtle. In January of 2016, Drees announced that Drupal would adopt a modern JavaScript framework and the framework our JavaScript contributors fit is react. Now one of the advantages of react is that it's well maintained with a mature release process and we can be fairly sure we continue to be well maintained because it's used in fact by Facebook. Now you might have feelings about that. It's both the plus and minus columns for a reason because I'm trying to be fair here but it does give us a lot of future proofing. React also has a strict backwards compatibility policy and a deprecation process similar to our own. However, their major releases are quite frequent. Much more frequent than Drupals. Breaking changes every month or so. That said, the scope of the breaking changes actually probably isn't, like they don't break many things. So it's potentially not that much worse than we have with our other dependencies right now once you actually look at what they do. It's also surprisingly difficult to find any information about react security policies. I spent a lot of time researching this and I couldn't find anything. I had nothing about how to report a vulnerability, nothing about how securities manage. I found like one CDE for React on server that they provided security fixes for but there was no actual information. But anyone knows about this by the way, I would love it if you tell me. Not after the session because I have a meeting afterward but on sprint day find me and explain to me how it works. What I see as one of the biggest things we'll be facing for modernizing Drupals JavaScript is actually more about the modern JavaScript ecosystem itself. There's a tendency for JavaScript developers to create very small libraries and open source them independently which in some ways is great instead of installing a monolithic thing you can pull in just one teeny tiny piece that you need. And it's also really cool that there's this thriving open source community around this. Sometimes these packages can be as small as a single function which brings me to the infamous left pad. For those that don't know the story, what left pad was, it is a tiny library that adds left padding to the side of a string. Not the right side, mind you, just the left side. Back in 2016 for reasons that I won't go into because I only have a 40 minute talk, the authors of left pad chose to unpublish all of his NPM projects. And in doing so, he single handedly broke the builds of React as well as Node and Babel and thousands of other things. It was so disruptive that NPM actually took an unprecedented step of republishing the package without the author's permission. Most reactive app developers never deliberately installed this dependency and they may not have even known it existed because there was at least four or five levels upstream from that. This incident highlighted the risk and fragility from the large dependency trees that are common in the NPM ecosystem. Now there's a couple of things to keep in mind about this story. First of all, the author of left pad was not acting maliciously. And secondly, while a lot of things broke, they broke in a clean way with a fatal error on build. But any NPM package might have its own security vulnerabilities or might even contain malicious code tucked away inside something that seems useful to trick you. And when your application has hundreds or thousands of dependencies, four steps removed from the dependencies you declare, your potential attack surface increases significantly. So according to the end, this is my troll the JavaScript section to talk, just trigger warning. So according to the internet, if you use create react app to start a new react project, you'll get 1,568 dependencies right off the bat before you say hello world. Now when people say this, react developers would point out that you don't have to use create react app to build a project. And obviously it includes dev dependencies. So I couldn't figure out if this was just fun. So to understand better, I looked at a real project directly relevant to Drupal's future. The Drupal admin UI project is the proof of concept being built by the JavaScript modernization initiative for a fully decoupled Drupal admin frontend. It's built on react and uses web services to communicate with Drupal APIs. It's pretty slick. I checked and as of June, it has 1,732 production dependencies. Some 60 of those are hoisted version things. I couldn't do a flat install, but it's still 1,617 hundred. So this problem of large dependency trees is a real thing that we're going to have to handle in the future. Now there are mitigating factors from a security perspective. Unlike Composer, the popular JavaScript package managers like NPM and Yarn do include built-in functionality to audit all of your dependencies for known security vulnerabilities. And one thing that's obvious to me is that this is going to have to be a part of Drupal's workflow. Thank you Sally for patching a couple of vulnerabilities in dev dependencies, not production dependencies and a recent release of Drupal. It didn't get a security advisory because they were already declared in public and they weren't using Drupal in production and so forth. Now keep in mind, it is all not having known public security vulnerabilities. So this doesn't take into account malicious code that no one's discovered yet and vulnerability that's no one's discovered yet. It's only things people have already published. I don't know how complete the list is and I don't think there's any hope of coordinated disclosure windows or whatnot because we're talking about thousands of people. So something we're gonna have to figure out is when and how or if we'll issue security releases for our vulnerabilities in a Drupal React app, dependencies and how we'll balance stability and security with a dependency that's changing every day. So let's think about the lessons we can draw from all this. I think the most important lessons from our experiences is to be careful about external dependencies. They can add a lot of value but they can also expose you to fragility, instability and security complications outside your control, especially when you have hundreds or thousands of them. Every piece of software on your site is additional attack surface. The simplest thing you can do is limit what dependencies you add in the first place. Only add them if you need them and choose which you add carefully. Be sure to review your dependencies dependencies too because those are also going to become part of your application. Look not only at the functionality but at the code quality, package policies and release history. Another lesson here is to keep your dependencies up to date and to address deprecations and breaking changes before security coverage or lack thereof becomes an issue. That said, you should also lock the versions you're using so that you only get updated when you're specifically intended. New versions can introduce breaking changes, sometimes even in minor and patch releases. It happens all the time, I promise you. Indiscriminately updating to new releases also can put you at added risk if a package is compromised by a malicious actor. Think about which dependencies you need in production and limit the rest to your development environment. But keep in mind, development dependencies can expose you to security risks too. It's a common myth that dependencies don't need security process, they absolutely do. So keep them up to date too and consider a more secure development environment like a VM. Also remember that your dependencies mostly aren't covered by Drupal's security report. So be sure you're auditing their security. NPM and Yarn both have commands to audit packages for non-vulnerabilities. Composer, on the other hand, lacks any feature for checking security advisories. And a security checker that will audit your Composer lock files for those advisories is available from Symphony, actually. Oh, you're just trying to type. Yeah, so the folks, because I have, but there are a few work runs you can use for Composer's lack of staff. So Symphony has a security checker that'll audit your Composer lock for non-vulnerabilities. And there's also a couple of Composer packages that will declare version conflicts with insecure versions of other Composer packages, including one that Webflow Florian wrote for Drupal's security advisory specifically, which is handy. Keep in mind that these are third party tools and they won't necessarily have complete lists or be up to date because they're not maintained by the owner of the package because the owner of the package doesn't have a feature in Composer to use that for. In closing, the last general lesson I draw is that this is the new normal. Package managers in general aren't a new thing. Pair has existed since many of us could do singing impressions of our dial-up modems. But what's changed is that we have modern package managers that developers simply expect to use with large open-source ecosystems to build their applications. I don't think we can or put the genie back in the bottle. We still get a lot of advantage from using third party dependencies. And if we want to be sustainable as a project, we need to engage other communities and meet contemporary developers' expectations. So we need to adapt and iterate on our best practices so that we can stay relevant and take advantage of the new normal but then mitigate the risks they're in. Before I wrap up, let me circle back to the question I posted at the beginning of the talk. Based on all this, how long will Drupal 9 be supported? When will Drupal 10 be released? And what's Drupal's release schedule going to look like in the coming years? We want to have a major release cycle where each major release is supported for as long as possible because we know that's what site owners prefer. However, we also know site owners consider Drupal unstable if there are major version updates of dependencies in minor releases. So figure out what exactly we need to do before Drupal 9's release and how long we can support it afterward. We spent a lot of time evaluating the future of dependencies, including talking to upstream maintainers to learn their plans. We've also learned that during the Drupal 8 cycle that having external PHP dependencies adds pressure to support only the latest versions of PHP, which is not something we did before because before we were being considered of the long-term support, the long-term Linux distributions. Excuse me. We've also learned that it was very disruptive for us to drop support for PHP FUD and I imagine it was disruptive for sites as well. So it puts us in a tricky situation. Now if we time our releases right and set each major release's PHP requirement high enough, we should be able to provide at least three years of support for each major version. Unfortunately, three years is a far shorter period that Drupal site owners are used to these days. All in all, we think we should be able to support Drupal 9 until at least the end of 2023 for hopefully a three-and-a-half year lifetime. So my best guess now based on that is that we'll want to release Drupal 10 sometime in 2022. You heard it here first. No guarantees about that date, but if we're successful with the continuous upgrade path, it shouldn't matter what the exact release date is. If you want to help out with Drupal 9 preparation or composer support or educating me on how to deal with React dependency trees, you can join the contribution day on Thursday. There are Drupal 9 related sprints for first-time contributors and seasoned core contributors alike. Or you can join the Drupal 9 readiness channel in Drupal Slack. There are meetings at 800 UTC every other Monday or you could ask a question anytime. That's all I have for today. I have two minutes left, but I'm going to have to duck out and leave. So I'm going to press the red button. There we go. Because I have a meeting and I don't know if it got rescheduled. That's for the fact that this talk started 15 minutes late. So thank you all. You've been a lovely audience. I wish I could do a Q&A.


All right something a little bit different today guys is to talk about how subjective lucid dreaming can be and why it's important that you realize that loads of people Myself included at the start would Google things like how's lucid dream? They'd come up with a technique video or an article that read it step by step and then follow the steps to the letter Then what would usually happen is that I either have a lucid dream if they're one of the lucky ones Or they would just have nothing nothing would happen and They'd wonder why and then go back to the article and sort of read it again and And again, and then maybe they'd start to read another article and then try that technique and so on and The reason that most of the time it doesn't work The reason that most of the time with exceptions if you read a Tutorial for a technique step by step and follow the exact steps The chances are that it won't work for you if you're a new lucid dreamer if you're a beginner And the reason is not because the technique doesn't work and it's not because you haven't understood the technique properly It's just because it's so very very subjective and it differ it differs from person to person so much That to read a technique step by step and follow it to the letter Even if the technique is solid and it does work It's not a guaranteed lucid dream because there are so many variables at play here There's you know, what's your sleep quality like? Have you had any experience with this before do you meditate? How well if you understood the technique? Do you believe you can do it? Are you really intending to have a lucid dream?  There are so many questions I could ask you guys loads and loads of questions, but Really the most important thing to realize with any of this with any technique supplement device or method is To focus on keeping a journal write down what is working for you write down What didn't work for you and really be aware of this be really critical of what you're doing if you try a technique For a week or even for a month Write down what parts of it worked for you whether it was difficult whether it made you sleep worse When you did you wake up tired? Write down everything like this and what you'll do is you'll start to build up a database of information of what works for you And that is the most powerful lucid dreaming technique of all so as I said incredibly subjective You need to work out what works for you because if you just follow techniques and articles that you read on Reddit or whatever to the letter The chances are they're either not going to work for you or you're going to be doing something wrong I mean, yes You can learn techniques from articles and that's you know a good way of learning them But you should constantly be rewriting them in your own way and making sure that you Write down in a journal what works for you like a good example If someone says in a technique article when you do the the way back to bed that you have to do a 45-minute gap between waking up and going back to sleep that might be completely nonsense for you That might not work at all And if you're like me and you find it hard to go back to sleep after you've stayed awake for longer than five minutes That's not going to work for you at all And you're going to wonder why nothing's happening and it's just because you need to be some you need to be aware of the fact That everything is different for each person So keep a journal obviously keep a dream journal as you should be but then also keep another journal for what is working for you What techniques are working? I mean you can even use the back of your existing dream journal if that's easier But just make sure you're constantly aware of what's working for you and how you're learning new techniques done


Every year I approach Easter in the same way, hungry for the renewal it offers. This weekend, in my church with my community and song and story, I will be tangibly reminded of the power of Easter hope, and that will make all the difference. The Easter mystery is what helps me make sense of the whole year, my life, our work. If death is not the last word, then neither is war, or poverty, or oppression. God's promises are true, hope is real, and transformation is possible. Easter draws us into a conspiracy of hope, where we refuse to accept injustice and we collaborate to bring about the profound changes needed for abundant life for all. Easter compels us to practice resurrection. When I spend time with a Cairo's local group or sit in a learning circle with Indigenous peoples or visit with a global partner, hope is made visible to me. This Easter, I seek to renew and amplify that hope in the impossible story of the resurrected Christ. From all of us here at Cairo's Easter blessings, in the name of the one who makes all things possible.


It was an autumn night, the flowers bloom, and it was a normal time. A journal was next to me, dreams and whatever. It was covered in a thick leather layering, turquoise incaleration, although it had a slick feeling to it. A large computer on the table remains, it was functioning, and the internet connection was far just fine. The day was October 8th, 2015, and it felt like a new age of source, games and whatever it was, it was exploding at the time with over just a population of millions of players. The light reflecting the computer stayed long enough, albeit kind of bright. My eyes at the time were at 11.23pm EST, and it was damn well bright. I mean really bright, as my eyes were tired enough, it wanted to go to sleep. A feeling loomed over my head, it felt empty as I had no friends on roblox at the time, and it was kind of eerie. So I hopped on and joined a game, Natural Disaster Survival, one of the many games to be popular at the time, and joined it. The server at the time had many players, enough to have a glitch of its server, to which another player or I break the server limit, and join the game without these maximum restrictions. Well, I wasn't kicked at all, maybe something didn't have enough time for these implemented restrictions or server restrictions. The sky was a bit different from the other servers, and the thumbnail itself, as the sky was orange, but nobody noticed it and moved on to the games and have fun, at least to my knowledge. The players and I, just moved on to have fun with the game. The next map, Surf Central. The game started as normal, the orange sky still remained, albeit the disaster or event selected was atypical outside the normal clusters slash range of disasters randomly picked. It had its own name, Sassara. The name was atypical on its own, albeit flashing images started to appear of an 18th century Buddhist depiction of the cycle of rebirth, or the wheel of rebirth, also including the apparent Sassara, the beginningless cycle of repeated birth, mundane existence and dying again. The sky still didn't respond to the event and or the atypical nature of the situation, albeit a slight difference in coloration was detected at my knowledge, appearing as it was gray shade of orange to a much more darker shade of orange. The appearance of a catastrophic karmic failure started to appear, as the status quo of multiple super-tie foods within the game started to also appear. It was at the time, designated as in quarantine by Roblox administrators, meaning that players within the specific server cannot leave the game, and now this is extremely disastrous and catastrophic, still super-tie foods still appear, although in a bustle state as in frozen. I immediately wrote down the chronological orders of the event within the server onto my journal. The game appeared as the atypical activity had disappeared, until another catastrophic event happened within the server, as manifesting as a goat with extremely anthropomorphic traits and physiology slash morphology, also appearing with reality-bending abilities capable of bending the Roblox physics engine as a whole. It was extremely catastrophic for the server, the chat was going absolutely crazy, and players within the server were locked inside the server. The goat bent the server as a whole for a little bit of time, until the goat spawned at least 25 NPCs, appearing as the default avatar in 2015. Albeit through the developer console, revealed that the group of NPCs had backdoored the game via an unknown script, and randomly disappeared with all of the players, receiving a server-side script that appears as a GUI, and shares a wide range of other server-side scripts. The server went crazy with all the scripts, executing one of them and repeating the same process over and over, until the server executed an entity, heavily resembling the bathobot, sitting in thin air, in the cross-legged position. The bathobot had a voice or sound, similar to a soprano, albeit the bathobot is male, and this is generally considered abnormal. The server in response of the bathobot, was generally confused. The supposed goat, not including the bathobot, had also disappeared without any money noticing its disappearance. The server remained silent, no chatting, just nothing. Apparently, we were directed by the bathobot to remain silent, and after we did that, we were again told to do his work. The bathobot spawned two cauldrons, wrapped in aluminum, and once again told us to do the work, in which he was referring to the cauldrons. We also were told to dump the other players into the cauldron in which we could apparently do, and the contents of the cauldron reveals that it is acid, albeit colorless. We were forced into this work of his, no responding, and forced into dumping players into these cauldrons. We still remained silent, and also told to kill each other, albeit that statement was also forced upon us as a component of the work. We desperately raced to finishing the dumping of the players, when all of a sudden the bathobot disappeared. Some players noticed the disappearance of the bathobot, albeit it absorbed all electromagnetic light once it left, creating a supposed black hole. We also had realistic sweat draining from our character models, which is disturbing to be at least. All the servers shut down as a result of this catastrophic chronology, a chronology of disastrous events that affected the server and its players as a whole. After leaving the game, the screen of my large computer, or just computer, absorbed all electromagnetic light. An apparent and normal phenomena to be quite honest.


In today's video, I'm going to share five critical recovery tips that you need to follow for maximized performance, muscle growth and overall physical well-being. Stick around for tips number four and five for my favorite recovery strategies to avoid overtraining and keep your gains on an upward trajectory. Let's get into it. What's going on everyone? Tanner Weidman of Barbarian Body, EHP Labs athlete. Now in regards to recovery, what's the real purpose? Why not just crush your workout, go home, eat, sleep and repeat? Well, if you're fine with a degrading return on your gains, elevated level exhaustion and soreness, then by all means, neglect your recovery. However, if you want to train with intelligence, a proper recovery strategy will have you head and shoulders above everyone else in the gym. Recovery tip number one, warming up. Counterintuitive, yes, but a proper warm-up is easily one of the best strategies to ensure you recover from your workouts much more efficiently. And this is because a lot of recovery for most guys is actually dealing with a myriad of slight injuries caused from training when not properly warmed up. The extra soreness you might feel in your lower back or hamstrings after a hard leg workout might not just be from hammering the muscle groups and muscle breakdown. It's likely caused by excess tightness in and around those areas that's been progressively made worse from training for weeks or months on end without properly warming up. Ensure that you're getting proper blood flow through your soon-to-be working areas before the workout to prevent that easily avoidable hamstring pull in the whole of a heavy squat. Your initial warm-up should get your heart rate elevated and blood flowing through the body to warm up the tissues you're going to be stretching and flexing during your sets. From there, I like to use some dynamic stretching, not static cold stretching, that'll dynamically move the body parts you're about to use and get them ready to perform. If you're not going to be performing exercises in a held out, fully stretched and lengthened position with a heavy weight, why would you warm up that way? In fact, static stretching has been found to actually be counterproductive for most workouts. Dynamic stretching will prepare the muscles for the way they'll actually be used in your workouts, which is in movement. As well, using a progressing set scheme will actually help to warm you up to your working sets weight. So start a set of your first exercise with about 25 to 45 percent of your working sets weight for several repetitions. This will progressively warm up the muscles you'll be using in the exact movement pattern that you'll be using them without overloading them with the strain of your full working sets weight. Recovery tip number two, post-workout active recovery. The end of your workout will be the ideal time to attend to a proper recovery strategy. After a hard workout of, for example, your pecs and your delts, you'll be actually more inclined to have a slight internal rotation of the shoulders. As after that workout, your pecs and anterior deltoid are going to be tight from contracting the muscles and pummeling them with grueling exercises. Weeks and months of doing this type of training without the proper recovery can cause significant internal rotation that can lead to injuries down the road when you're performing pressing exercises. So a healthy way to bring back your muscle's natural position can be achieved by recruiting the antagonist muscles at the end of your workout. And by working these antagonist muscles, you'll also be stretching the tight muscles back into a more natural position. So using our example of chest and shoulders still, your recovery strategy could include a few light sets of band pull-up parts or face pulls to stimulate the rear delts, external rotational muscles in the shoulders, and upper back to prevent this internal rotation. It doesn't need to be intense, just a few minutes at the end of the workout will help significantly. Recovery tip number three, utilizing supplements, intra and post-workout to enhance your body's natural ability to recover. I like to personally sip on Beyond BCAAs plus EAAs during my workout mixed with a bottle of cold water. Beyond's formula is loaded with nine essential amino acids that'll improve pain tolerance during your workouts, offset lactic acid buildup to train longer, refuel your muscles to eliminate post-workout muscle soreness, and increase stamina. Beyond will also aid in your recovery by replacing old muscle cells with new healthy ones and rebuild glycogen, which gets depleted during training. You'll also notice an increase to your focus and enhanced mood with a supernutropic blend of Huprazine A and Tyrosine. Recovery tip number four, intelligent retraining. Avoid training the same muscle group intensely two days in a row. You want to give at least 48 hours before you go and retrain a muscle group. If you've just broken down your muscle fibers, going to retrain them before they're fully repaired is essentially pointless. In fact, retraining won't add much of an additional benefit to your muscular growth, making whatever time you spent training without proper recovery a waste of time. And in fact, it can harm your body's overall muscular growth as you're interrupting the most important process required to build muscle recovery. Remember, muscles don't grow when you're in the gym. They actually grow while they're repairing outside of the gym. So space your workouts at least 48 hours apart before you retrain a muscle group for adequate recovery. Recovery tip number five, deloading. Using a full deload week after weeks of consistent training can not only help to aid in total body recovery, but actually keep your muscular growth on an upwards trajectory. And a deload simply means you'll be significantly reducing your training volume and intensity for about a week. Now, some view this as an opportunity to just stop training altogether for a full seven day window, but instead of missing out on potential muscle growth and or fat loss, it's advisable to still train, but do so with significantly less volume and intensity. And when are you going to want to implement a deload? Well, after you begin to see a zero or negative return on your training, either the way you feel and your energy levels, you're not able to progressively overload and you're sort of at a plateau or your numbers are just not going upwards. And in fact, maybe they're going a little bit backwards when it comes to your PRs. So why do we want to use a deload? Simple to prevent overtraining in the body. Overtraining will have a net zero ROI or even negative ROI if you continue pushing through it. I like to do about 60 to 70% of my training frequency and volume for a full seven days on a deload personally. So if you're training four times in the gym, going only three times during the deload week can prove beneficial. Additionally, when it comes to the length of your workouts on a deload, if you're normally pushing one hour long workouts, it's safe to aim for about 30 to 45 minute workouts during the deload, increasing your rest during each set and not performing as many working sets for each muscle. Also focus on not pushing to failure during this time. Leave a few reps in the tank at the end of each set. And that concludes today's video. Thank you so much for watching. Make sure to go and grab yourself a tub of EHP Labs' Beyond BCAA and EAAs. They've just released a new flavor, lemon sherbet drop. So give it a try. Don't forget to like this video, comment what you want to see next, and subscribe to the EHP Labs channel so you never miss more videos like this. See you guys in the next video.