A little over a year ago, we shared the story surrounding a mysterious discovery that was once claimed to have been made deep within cave systems within Ecuador, which some believe were originally man-made. A discovery that, although now concealed from the world, was photographed, studied, and documented thanks to the array of artifacts which had been amassed by an individual known as Father Crespi, an entire seemingly alien metallic library, complete with hundreds of sheets of gold, platinum, and other precious metals, hammered out to reveal an astonishing unknown language, clearly left by a people of tremendous capabilities. The caves in which this find is claimed to have been made is known as Cueva de los Teos, and although such discovery is denied by the Ecuadorian authorities, the Ecuadorian and interestingly United Kingdom's governments funded an extensive search of the cave systems soon after the claims became public. It attracted the attention of numerous individuals who traveled into the depths of these caves, including Neil Armstrong, the first man on the moon. What we wish to focus on this video, however, is the enormous seemingly man-made caverns which are found to be within the cave systems. We feel, if these cave systems are indeed one day admitted as having been artificially hewn from the bedrock, then this would undeniably reveal tremendous flaws in academia's claims as to the geology and indeed true history of the area. The cave system is so enormous it has yet to be fully explored by modern man, yet what has been explored has revealed highly compelling features which cooperate earlier claims of an artificial origin. The Moriza portal, for example, named after Juan Moriza, the individual who claims to have originally discovered the metallic library, is clearly of an artificial nature. The question is, why go to such lengths to construct this natural-looking cave system? Was it all created merely to hide this library? And if so, how important could the information held within be? And why did such a find attract the attention of the first man on the moon? Did the astronaut know something we are yet to discover? Juan Moriza, signed affidavit, dated 8th of July 1969, in which he confessed to a meeting with the Ecuadorian president, where he received complete control over his discovery, provided he could provide photographic evidence and an independent witness cooperating the discovery. When Moriza met with Von Däniken in 1972, he took him to a secret entrance through which they entered a large artificial hall within the cave system. Apparently, Von Däniken never got to see the library itself. He wrote in his book, The Gold of the Gods, quote, The passages all form perfect right angles. Sometimes they are narrow, sometimes wide. The walls are smooth and often seem to be polished. The ceilings are flat and at times look as if they were covered with a kind of glaze. My doubts about the existence of the underground tunnels vanished as if by magic, and I felt tremendously happy. Moriza said, passages like those extended for hundreds of miles under the soils of Ecuador and Peru, end quote. We feel the question now is, who went to these unimaginable efforts so far back within history? Why create such a place deep within the earth with such an intended illusion of natural origin if you did not seek to hide something? Many still believe that the truth is still hidden deep inside its unexplored caverns, a truth that will force us to completely rewrite the history of mankind. Are the legends true surrounding Cuevo de los Teos? Did it once indeed contain an ancient metallic library, left to us by an ancient civilization? We find the evidence to suggest so, highly compelling. Hello fellow treasure hunters, welcome back. It has been a while since we sunk our respective teeth into the quest for the truth. Our journey of discovery has revealed some startling connections to our mysterious island in the waters of Nova Scotia. What I now believe, and am convinced I am pursuing, is a miraculous artifact indeed, a golden chest that has said to contain two sacred stone tablets. Inscribed with 10 particular commandments, it is of course the Ark of the Covenant, and it has to be one of the most extraordinary artifacts in history. It was said to be able to raise storms, radiate divine fire, level city walls, smash chariots and destroy entire armies. Moreover, according to legend, it could summon angels and even manifest the voice and presence of God. During my research, I have found, apart from the laws of physics, nothing to say this artifact doesn't exist. It was kept in Solomon's temple in Jerusalem until it disappeared from history in 597 BC. Biblical scholars, archaeologists and adventurers alike have spent years searching for the last resting place of the Ark. This final resting place, I have discovered, was created by the Knights Templar. If you have been watching my videos, you will know of the overwhelming Templar links to the island, and the treasure hunt thereof, in which we are dawned with our fascination. The most intriguing question I found myself asking, was how could such an object possibly exist? I however was never on the hunt for mythical relics, I never fancy myself an Indiana, I would more than likely become one of the many skeletons littering the cave systems of Earth. But rather I hunt something that is the most real of all, the truth. However, when along this journey you encounter very intelligent and powerful figures, throughout history, claiming to have pursued this item, not only that but to have found it. You begin to wonder, you wonder what exactly it is that they found. This question for me came secondary to where they hid it, as this question I never asked, I came across this legend while pursuing an entirely different treasure, which turned out to be the very same. I have been diverted away from my pursuit on the Green Isles of England, in favour of unravelling events upon the island of Oak, alas, I again cast anchor into the murky and treacherous salty waters that once enveloped me. And since the brothers have provided us with some much-needed excitement, quench the thirst for gold, I felt it worthy of my attention. Since the first auger drilling on the island during the middle of last century. A vault has indeed been the most likely candidate, and the most hunted target and depth at the money pit since its suspected discovery. These auger drillings have been surrounded by controversy, most notably the missing golden fragments brought up with the sample, that was apparently stolen. Along with a small piece of parchment, coated in liquid mercury, that still exists for study, it was part of a larger document, written in a fine ink, only one written letter is visible. When this drilling was done, it was reported that they broke through the roof of what they believe was a vault. Ever since this event, with the fragments brought up with traces of mercury, known to have been used to preserve parchment if submerged underwater, many have been convinced to treasure lay within this cavern, while others suspect it is just a natural cave system. Nevertheless this vault has been a huge target to confirm. Fast forward to present day, and we now have successful dives to this depth, with modern technologies we have done what many felt impossible. Not only that, but diver reports have confirmed a vault with smooth sides, this strongly discredits a natural formation. Add to this may be the most compounding piece of evidence this century so far, multiple positive metal detections for gold at this depth. Since these are the only dives done so far on the vault, I do not have any further information on the vault to share with you. We know from excruciating research, digs and experiments on the island, a tremendous amount of effort went into the trap, firstly the flood channels, made from stone slabs, which do indeed extend but into the sea covered in coconut fiber, the oak layers at every ten feet, and the sheer amount of digging that was done by hand. Why would you create such an elaborate structure, just to bury the treasure below the flood tunnels? Another hypothesis occurs, that there is indeed a treasure of gold laying in the money pit, corroborating the stone tablets message, yet this, if true, I believe is but a small offering compared to what the island really hides. In conversation the brothers believe they have cracked it, they believe they may have hit paid dirt in the form of national treasure, I'm yet to be convinced, but admittedly they are certainly making huge progress in revealing the money pit secrets, a pit that has taken numerous lives, and countless fortunes. I will be continuing to cover discoveries on the island and linking them to the historically known research, my research into Jolie and Graham Russell's amazing discoveries in the UK pertaining to the Templar treasures will also be released shortly. As always, thanks for watching, stay tuned for more. An upart or out of place artifact comes in many shapes and sizes, some clearly being or containing an anomalous object, which no matter how desperately some attempted discredit, the evidence is clear for all to see. This category of upart, unsurprisingly, often falls victim to theft. However, the other category actually litters the display cases of museums all over the world. These artifacts are being more easily explained away, and as such, they are often attached to a less impressive historical tale than that which was actually experienced. Stonehenge is probably the most iconic ancient site within Western Europe, an ancient site that, for many years, was to blame for many heated arguments between different individuals, all convinced of its past purpose. Now, largely accepted to be a celestial calendar and a meeting place for many ancient people who came together at solstices to hold elaborate and purportedly promiscuous festivals. However, the true age of Stonehenge, or indeed how the stones were once balanced atop of one another, or the precise knowledge of celestial activities displayed, is still unknown. Although to those who study the many other seemingly impossible ancient feats found all over Earth, Stonehenge is clearly a relic of a far more ancient civilization than any which artifactual evidence have been found for. In 1808, William Cunnington, one of Britain's earliest professional archaeologists, discovered what has become known as the crown jewels of Stonehenge. They were found within a large bronze age burial mound, today known as Bush Barrow. Within the Barrow, Cunnington found ornate jewelry, including an intricately decorated dagger. Quote, the very finest goldwork involved in the making and positioning of literally tens of thousands of tiny individually made components, each around a millimeter long and around a fifth of a millimeter wide, said David Dawson, director of the Wiltshire Museum in Devises, where the micro gold working achievements are on permanent display. The amazing process involved in creating the handle of just one dagger, included up to 140,000 tiny gold studs, each just a third of a millimeter wide. The first stage involved manufacturing extremely fine gold wire, just a little thicker than a human hair. The end of the wire flattened to create a stud head, then cut with a very sharp razor no more than a millimeter below the head. This delicate procedure was then repeated literally tens of thousands of times. An incredible ancient artifact found near one of the most enigmatic ancient sites in the world. Yet amazingly, academia continues to deny the existence of out-of-place artifacts, instead opting to explain the construction of such marvelous work by claiming it was somehow the work of children, due to their more acute site, this regardless of the clearly controversial evidence at hand. Who created such astonishing microscopic jewelry? Were these amazing artifacts once the possession of the actual builders of Stonehenge? Incredible items that are clearly amazing ancient oparts. A little over a year ago, we shared the story surrounding a mysterious discovery that was once claimed to have been made deep within cave systems within Ecuador, which some believe were originally man-made. A discovery that, although now concealed from the world, was photographed, studied, and documented, thanks to the array of artifacts which had been amassed by an individual known as Father Crespi. An entire seemingly alien metallic library, complete with hundreds of sheets of gold, platinum, and other precious metals, hammered out to reveal an astonishing unknown language, clearly left by a people of tremendous capabilities. The caves in which this find is claimed to have been made is known as Cueva de los Teos. And although such discovery is denied by the Ecuadorian authorities, the Ecuadorian and interestingly United Kingdoms governments funded an extensive search of the cave systems soon after the claims became public. It attracted the attention of numerous individuals who traveled into the depths of these caves, including Neil Armstrong, the first man on the moon. What we wish to focus on this video, however, is the enormous seemingly man-made caverns which are found to be within the cave systems. We feel, if these cave systems are indeed one day admitted, as having been artificially hewn from the bedrock, then this would undeniably reveal tremendous flaws in academia's claims, as to the geology and indeed true history of the area. The cave system is so enormous, it has yet to be fully explored by modern man. Yet what has been explored has revealed highly compelling features which cooperate earlier claims of an artificial origin. The Moritza portal, for example, named after Juan Moritza, the individual who claims to have originally discovered the metallic library, is clearly of an artificial nature. The question is, why go to such lengths to construct this natural-looking cave system? Was it all created merely to hide this library? And if so, how important could the information held within be? And why did such a find attract the attention of the first man on the moon? Did the astronaut know something we are yet to discover? Juan Moritza, signed to affidavit, dated 8th of July 1969, in which he confessed to a meeting with the Ecuadorian president, where he received complete control over his discovery, provided he could provide photographic evidence and an independent witness cooperating the discovery. When Moritza met with Von Däniken in 1972, he took them to a secret entrance, through which they entered a large artificial hall within the cave system. Apparently, Von Däniken never got to see the library itself. He wrote in his book, The Gold of the Gods. Quote, The passages all form perfect right angles. Sometimes they are narrow, sometimes wide. The walls are smooth and often seem to be polished. The ceilings are flat and at times, look as if they were covered with a kind of glaze. My doubts about the existence of the underground tunnels vanished, as if by magic, and I felt tremendously happy. Moritza said, passages like those extended for hundreds of miles under the soils of Ecuador and Peru. End quote. We feel the question now is, who went to these unimaginable efforts so far back within history? Why create such a place deep within the earth with such an intended illusion of natural origin if you did not seek to hide something? Many still believe that the truth is still hidden deep inside its unexplored caverns, a truth that will force us to completely rewrite the history of mankind. Are the legends true surrounding Cuevo de los Teos? Did it once indeed contain an ancient metallic library left to us by an ancient civilization? We find the evidence to suggest so highly compelling. It is believed to have been found on Duras, Central America. Within the deep and dark jungles of this region, large expanses have remained untouched by humans for thousands of years. Practically impenetrable, the native plants alone can grow up to 70 meters in size. Whatever it is that lay in this place, it has remained out of reach from countless astute adventurers who have ventured into these unknown forests in search of the legendary treasure, which the trees have protected for millennia. This is the first recorded by Hernán Cortes in 1526. Less than five years after vanquishing the Aztecs, he came to the colonial town of Trudillo, on the north coast of Honduras, to look for the mythical city of gold. Cortes' search for this Central American elder Arado marks the beginning of the known hunt for Sardad Blanca. In 1939, American researcher Theodore Maud claimed he found evidence of large ruins deep in the jungles. He also told of an ancient legend to him by payer guides. A story of immense temples with large stone staircases leading to their entrances and of a giant gold statue of a monkey god in the center of the city. The oral legends of the Peck Indians who inhabited the territory of Honduras 2,500 years before Christopher Columbus corroborates this report. The heart of the temple was a huge level stone platformer which was the statue of the monkey god himself. The steps of this platform were said to have been flanked by a colossal image of a frog on one side and the crocodile on the other. All accounts agree that the city was stacked full of gold, whoever they were, they were clearly a very wealthy people. The white city was also said to have been the birthplace of the Aztec god Quetzalcoatl. According to the ancestors of the indigenous Peck people whose exact genealogical origin is still a complete mystery, he built a white city of immense proportions. The city was a sacred place of great beauty and was stuffed to the brim with gold. Many have claimed to have found it in the past, yet they have all lack proof of their discovery. Many began to believe it was just a myth. However, for a very long time, visitors to the jungle who have become lost, those lucky enough to escape its clutches have reported stumbling across this large city lost deep within the dense jungle. And along the Platano River, many mysterious ancient petroglyphs have been discovered carved into the rocks by an as yet unknown ancient jungle civilization. These are now suspected to be marker stones leading to the city. These reports led a team of explorers into these deep forests in search of this amazing place. And they have actually managed to locate prehistoric foundations and ancient mounds, which are indeed linked to the fabled city of Asadad Blanka. Using lidar technology, they were able to locate a complex of mounds, ancient ruins, canals, roads, and terraces all leading into an impenetrable section of jungle, all suddenly becoming visible from laser reflections off the tree canopies in the Moskvisha region of the Honduras rainforests. With plant life 70 meters in height and with foliage many centuries old, the team has barely scratched the surface of this immense place and have not yet been able to penetrate the forest sufficiently to enter the central city ruins. What amazing treasures could be laying in this place?  All stories attributed to this mystical place have so far been confirmed as true, so there is no reason to doubt the other information, meaning that there is a very high possibility of a mountain of ancient gold cast by an as yet unknown civilization resting in the central American jungle, just waiting to be found. An upart or out of place artifact comes in many shapes and sizes, some clearly being or containing an anomalous object, which no matter how desperately some attempted discredit, the evidence is clear for all to see. This category of upart, unsurprisingly, often falls victim to theft. However, the other category actually litters the display cases of museums all over the world. These artifacts are being more easily explained away and as such, they are often attached to a less impressive historical tale than that which was actually experienced. Stonehenge is probably the most iconic ancient site within Western Europe, an ancient site that for many years was to blame for many heated arguments between different individuals, all convinced of its past purpose. Now, largely accepted to be a celestial calendar and a meeting place for many ancient people who came together at solstices to hold elaborate and purportedly promiscuous festivals. However, the true age of Stonehenge, or indeed how the stones were once balanced atop of one another, or the precise knowledge of celestial activities displayed, is still unknown. Although to those who study the many other seemingly impossible ancient feats found all over Earth, Stonehenge is clearly a relic of a far more ancient civilization than any which artifactual evidence have been found for. In 1808, William Cunnington, one of Britain's earliest professional archeologists, discovered what has become known as the crown jewels of Stonehenge. They were found within a large Bronze Age burial mound, today known as Bush Barrow. Within the Barrow, Cunnington found ornate jewelry, including an intricately decorated dagger. Quote, the very finest goldwork involved in the making and positioning of literally tens of thousands of tiny individually made components, each around a millimeter long and around a fifth of a millimeter wide, said David Dawson, director of the Wiltshire Museum in Devises, where the micro gold working achievements are on permanent display. The amazing process involved in creating the handle of just one dagger, included up to 140,000 tiny gold studs, each just a third of a millimeter wide. The first stage involved manufacturing extremely fine gold wire, just a little thicker than a human hair. The end of the wire flattened to create a stud head, then cut with a very sharp razor, no more than a millimeter below the head. This delicate procedure was then repeated literally tens of thousands of times. An incredible ancient artifact, found near one of the most enigmatic ancient sites in the world. Yet amazingly, academia continues to deny the existence of out of place artifacts, instead opting to explain the construction of such marvelous work, by claiming it was somehow the work of children, due to their more acute site, this regardless of the clearly controversial evidence at hand. Who created such astonishing microscopic jewelry? Were these amazing artifacts once the possession of the actual builders of Stonehenge? Incredible items that are clearly amazing ancient oparts.


So hello everyone good afternoon. I hope all of you are having a great time at the Red Hat Dev Nations Day and also getting a lot of knowledge and insights. All of you enjoyed the Gulab Jamun at the lunch. In the moment happy to know I know Gulab Jamun was not served today. Cool. So you are all awake and reshaged I believe. So I am Ramya Raghvira. I am a specialist solution architect with the Red Hat Partner Ecosystem. I specialize in DevSecOps, developer productivity and application modernization on Red Hat OpenShift and today in this talk me and my colleague Ramki will take you through how you can actually secure your app using DevSecOps. Security is the number one priority of all our enterprises and we all need to know how can we secure our enterprise software. But then why is it of really utmost importance to our organizations? So throughout the day you would have heard how open source software has literally eaten the world. Two out of the organizations currently are using open source software to augment internal development of new applications. 600 is the estimated number of open source software, open source components which are there in any given software. And around 90% of search code bases have open source components which not have been had any maintenance or further development in the last two years. 31% of search code base have open source components which don't have any custom or any license for that matter. So with the introduction of the open source software we are seeing new vulnerabilities and new threats which are coming into picture every day. This is even increasing the surface area for the threats. For example, we all know how easily a malware can be injected using chat GPT. Hence with the arrival of the open source it has become the need of our that we have security as a fundamental and ongoing aspect of our SDLC. We have the secure supply chain for our organizations software supply chain and make sure that we build secure applications. But why do we really need to build secure applications? These numbers are itself the answer. In the last three years there has been a 742% annual increase in the software supply chain attacks. And one out of these five data breaches are due to a compromise software supply chain. Average cost of a data breach has increased to 4.45 million and the ransom paid is actually a mere fraction to the overall downtime and recovery cost of the data breach. The companies have to go through prolonged lawsuits and also provide recovery settlements to their users because their user and financial data has been compromised and exploited. DevSecOps mindset is a solution to all these problems. 78% of executives have taken initiatives to increase collaboration between DevOps and security teams to ensure that security is moved left. 92% of IT leaders say enterprise open source solutions are important as their businesses are accelerating faster and moving to the open hybrid cloud. Now switching gears from software to automobile. When we buy a car we expect each and every part coming along with it to be genuine. Higher the price of the car more is the expectation on the genuineness of the parts. Raise your hand if any one of you would be okay to buy a car where the seller says I'm responsible for only 75% of the parts and 25% you have to take care of yourself. Anyone? Definitely. Search a car will not have any takers. So we need the genuineness because it proves that the car is durable and safe to drive not just in the short period but even in the long run. But if we really come back to our software industry can we really have the same expectation that we know that each and every part component of the software is genuine. For that in the first place are we all really aware what are the components which are there in our software. Many of us are not aware what are the different application dependencies or libraries which come as a part of our software and this results in security breaches which has led to huge losses to company and even affecting their brand value and reputation. All of us would have heard about the infamous solar wind attacks around where basically so many companies were affected and even the customer data was compromised. So we need to know about each and every part of our software and even make sure it is secure. But is it really feasible to achieve this? The answer is yes. So, okay, sorry, my bad, it went back. So how do we really achieve or make sure that our supply chain is secure? The answer is we need to make sure that each and every phase of the SDLC is secured. From the code phase, we need to make sure that malicious code is identified and prevented. When a new piece of code is being inserted, we need to take care that there are no vulnerabilities which are introduced or if any bad code is inserted. Then when we move to the build phase, that is where our application pipelines come into picture. We need to safeguard the build systems early with DevSecOps in our CI CD pipelines. Other thing comes to the monitoring. Continuously, we need to monitor for security at runtime. Observability is the key. So when we spoke about it, let me tell you how we at Red Hat can help you with this. So all throughout the day, you would have been hearing how we at Red Hat work on hardening the open source software to make sure it is enterprise ready for our customers. Red Hat has around 30 plus years of proven experience of providing enterprise open source software to their customers. We provide secure services and platforms which enable you to automate, test and build secure applications using DevSecOps. We provide strong distribution mechanisms with signed packages. All of you would have known or maybe whoever has heard or worked on RHEL would have known about RPMs. The Red Hat package managers, which is a secure distribution mechanism which we offer as a part of our super secure OS. Sorry. So we at the Red Hat Summit had in May had announced a set of services which comprised the trusted software supply chain. I believe you would have all heard about this from Amita in the keynote. So this talk, we are going to go in more detail about the Red Hat trusted software supply chain. So Red Hat's trusted software supply chain is a set of services delivered with integrated security guardrails at every phase of the software development life cycle. With the Red Hat trusted software supply chain, we make sure that both the developer and the platform perspectives are covered. And we make sure and we know that the software development experience for every organization is unique. Hence, we take the application context and provide a experience which not only enriches the developer experience but also make sure that your software supply chain and the platform is secured. Now moving to the four phases or basically the four critical phases of the software development code, build, deploy and monitor. In code, we provide a set of tools which provides which helps in identifying the vulnerabilities, runtime vulnerability tactics or even scanning your code statically. Then when we move to the build phase, it actually provides you the production ready application pipelines which have provenance attestation and SLSA level three. So talking about SLSA, SLSA is a framework which helps to make sure that your artifact is improved throughout the SDLC life cycle and higher the level of SLSA it ensures or it gives the trust to the customer that what we are saying that is what we are delivering. SLSA level three ensures or affirms that the software artifacts which we are delivering are authentic and trustworthy. Going to the deploy phase. In deploy phase basically we provide you open immutable leisure where you can store your software artifacts and it's made sure that they are not tampered with. Moving to the monitor phase where we have our product called ACS, the Advanced Cluster Security which provides continuous runtime security monitoring and continuous assessment observability and catching the runtime threats and it even takes care of the non-compliance. Okay so the idea is to secure your open source code and dependencies early. We need to catch the vulnerabilities in the very starting of the software development life cycle. So there's the emphasis to move the culture such that security is moved left and is not seen as a after process or afterthought once the software is built and we should give emphasis to the solution and not just a technology implementation because the maximum value can be born out of a solution when the change is acknowledged or accepted by the people and become part of process and it is not just a technology implementation. So shift lift is a cultural and technical shift where we make sure that security is introduced in the way from the very starting that is in the coding phase and take and taken care in every part of SDLC till the code goes to production and with shift lift it is ensured that the collaboration increases between the security operations and the development team. So DevSecOps is basically a part of shift lift where it is made sure that security is there in every phase of SDLC starting from the planning to the coding, building, development, testing and release and we have real-time feedback and insights. Shift lift is about shifting all the way to lift to where the source code resides. The production code is used by the end users but shift lift is about moving from the end users to the router, production, staging, networking, QA, development and the development code and seeing what is actually the reason or the root cause for the risk which we found and as you would have all known as developers every given code has some transitive dependencies. For example if you are Node.js developer you would have written a package.json defining your dependencies. In case of Java you would have used a pom.xml and even if you are just writing a containerized application you would have a docker file. So the people who write these dependencies or use these dependencies are actually responsible for bringing these dependencies to the application but just imagine what would happen if a malware is injected to one search dependency. Luckily we have the open source software to our rescue. So this is our opinionated approach. All this set of tools together build the Red Hat trusted software supply chain. We are working on an on-prem solution which comprises of all these tools and we at Red Hat have contributed to all these open source projects and are working on integrating them together to make sure that we provide a secure stable and strong platform for you guys for the trusted software supply chain. Starting with the SEM we can use github, gitty, bitbucket, gitlab to get your code or pull your code. Then we have teched on the in-house or basically Kubernetes native CI CD pipeline. With teched on it basically provides a containerized build such that it is isolated and provides you security and also it doesn't need any agent it can be used without any agent and every run is isolated to a container and is not attached to any central server. Then we have the teched on chains. Teched on chains actually provide the attestation and the provenance for the execution of these pipelines. The teched on chains actually provides a manifest files affirming that the execution of the pipeline has happened. Then we have another popular open source tool that is Cosign which is used to sign and verify the S-bombs. So S-bombs is the software bill of materials. So you would have all seen like when we buy a food product you will have a list of food labels or ingredients what are there in the food product. Similarly with the S-bombs it gives you a list of all the dependencies which are there as a part for software. So just like we see that the ingredients and decide we should consume the food product or not, S-bombs plays the same rule. In case of the food products some of us might be allergic to nuts and when we are as developers some of us might be allergic to struts and then we have Red Hat Quay which is our global secure registry where you can store your images. Then we have Clare which can be used to scan your images for any publicly available CVEs that is the common vulnerabilities and exposures. We have another popular open source tool OPA which can be used to write rules and policies for Kubernetes. When it comes to deployment we use the GitOps approach and Argo CD is our tool for GitOps. Now going a level deeper to understand each and every face. So let's start with the code face and see how the Red Hat Trusted Software Supply Chain helps you to prevent and identify the malicious code. So with Red Hat Trusted Software Supply Chain we have Red Hat Trusted Content which helps you to secure your code face. This is a product which we have which is currently in the tech preview phase. With Red Hat Trusted Content we provide you automated software composition analysis which helps you to recognize the open source dependencies and intercept the vulnerabilities before providing you the recommendations to how to mitigate the vulnerabilities and the risk. Also we have dependency analytics which comes or which can be installed as a plug-in or extension to all your popular IDs like VS code or IntelliJ which helps you to identify vulnerabilities and also provides your recommendations on how can you remediate them. As part of Red Hat Trusted Content we provide you transitive dependency analysis and CVE discovery which is done very much at the point of entry. Now moving to the build phase how we can safeguard our build systems. So when it comes to the build phase we have the production ready Tecton Application Pipelines. The Tecton Application Pipelines provide ready to use customizable pipeline definitions for hermetic builds. The Tecton Pipelines have network isolated builds which provides package container managers with and auto-generated software bill of materials. When it is pushed to the code base it provides you an automated pipeline as code.  So we also have Tecton Chains which actually provides you the attestations which are verified by the enterprise contracts. The enterprise contracts are the rules which define the policies to check the conformity that a given pipeline is following or is othering to the SLSA framework. When we promote a pipeline from build to say a production stage we have to verify that the attestation and provenance checks are there eithering to the SLSA framework and this is done through the enterprise contracts which has a set of around 43 rules which act as gates to make sure that there is no suspicious activity which is passed. The Tecton Pipelines also provide continuous image vulnerability scanning. So the idea is to build with security focused CICD workflows such that we can meet the industry compliance while increasing the productivity and the efficiency. Fine. So now talking about the deploy phase. In the deploy phase we have a very powerful tool which is again in the tech preview phase that is the trusted artifact signer which empowers the software developers and the users alike to sign and verify their software artifacts. For example S-bombs the images, the source code, the playbooks and it helps to enhance the software supply chain security. So the 6-store ecosystem inside looks like this. It has flucio, cosine and record. So when a developer actually request for a certificate it actually it actually has a client which request for a certificate to flucio. Flucio prompts the developer to go to an open OID identity provider which provides an identity token and with the identity token it provides a certificate using which the artifact is signed and once the artifact is signed it is pushed to enterprise registry like we are basically pushed to enterprise container registry and once it is pushed the certificate is provided with the key pair but for the security reasons the private key is destroyed and we don't even need the private key because public key can be easily used to decrypt and verify the signature. So once the artifact is signed and stored in the registry then at that point that event is registered in the record transparency log. Record is the log where it actually records all search events by having a timestamp against every signature event and all the clients actually push search events to a publicly auditable logs. So as artifact owners they are responsible to check record to see that there are no unidentifiable signing events which are there in the log. So when we need to actually verify the signature the timestamp object is matched against the transparency log record transparency log and if there is a match it means the certificate is validated and the signature is valid. Six store is actually a free open to use software which can be easily installed on any Kubernetes cluster or platform basically by using scaffold helm shards which is available in the six store GitHub. Now we have spoken about how we can actually secure our code build and deploy phase. So once we have secured our code build and deploy phase now we need to continuously monitor security at runtime and make sure that there are no threats and compliance issues. So when it comes to the monitoring phase we have an advanced cluster security which is the tool which is provided for the security phase. Advanced cluster security is a service which visualizes security and compliance across distributed teams of hundreds of audit controls from a common dashboard. ACS allows you to monitor multiple clusters together. It helps you to easily monitor and respond to misconfigurations, non-compliance and runtime threats. The idea in the monitor phase is to observe the software artifact and detect and respond to the suspicious activity. It provides runtime vulnerability scanning and management. In case if an incident occurs we can expedite the incident response to reduce the down times. Advanced cluster security also views compliance against the industry standards like HIPAA, PCI DSS and CIS. So ACS actually provides monitors and identifies runtime incidents and it helps to reduce noise and alert fatigue to make sure that we have a shorter time to respond. Now I'll be giving control to my Kali Gram Ki. This is how the thing looks like. Like we mentioned earlier we have various popular open-source projects in every phase of this. The code phase, build phase, deploy and monitor phase. So we'll just take a look at how it is. So the way we are doing this, this is our opinionated way of how secure supply chains can be done with very minimal effort is we create a template like as usual. We create a template and we put this template across this is an example of a e-commerce store. So suppose you need to work within a certain component within your whole software components. So it is going to show what are the like say for example you can see all the APIs, how it's interacting with each other and say you onboard a developer onto the project who's supposed to work on certain API components. So within this they can change which resource they want to work into and we have an sample app HR2. I can share this template so you can load it onto your OpenShift component. So suppose you want to work on this project. Like we mentioned earlier the technical documentation, the code base, everything comes out and from there on you can start looking at so the basic thing is the developers require three things, the code repository, the access to the build pipeline. So here what you can do is since from the developer hub template itself you're getting the code repository loaded on to the system, you're just downloading it and then there you can go ahead and make your changes. Here we're only changing, we're only changing the code base, we're not changing anything from the security or the pipeline perspective. So what you're doing is as soon as you push what is going to happen in the back end is, so you see a git clone happening. So what's happening is the developer is only focusing on the code base, he's not focusing on the build pipeline. So all of these things can be put as an artifact. So the main audience of this talk is the DevOps people in the cloud or also the security operations people in the cloud where you can put your company's enterprise contract in the pipeline and what happens is in the same way you can create a whole supply chain attacks. So how many of your organizations had a supply chain attack recently? Over the last three years like what Ramiya was mentioning there's a 732% increase in a supply chain attack and these attacks are happening most probably in the build phase itself. Like say your open source project is pulling let me stop over here for a second. Your open source project is pulling dependencies from upstream projects. One of the most common error is typosquatting errors. How many know the water typosquatting error is? So think of this. If I want to give an analogy in the real world how many of you have drank packaged water by this brand called Bislery? How many varieties of Bislery are there? Bilsery, Bislery, BCCR. So you see right it looks like packaged water it looks like Bislery but it's not Bislery. So there is there are small changes. So these things happen to many open source projects where malware can be put in your dependencies of your project and it will be a similar sounding name right and you're going to pull that package like for example it will be Django but the spelling could be D-A-J-O-N-G-O or some other popular thing. So what happens with that is all the your code base so like I was mentioning earlier software is always a liability so your package, your software, what your writing might be like say 1 lakh lines of code but the dependencies you're pulling into the project of which you are not the author of so many open source project is it could be at least four or five lakhs of projects depending on how complex your enterprise software project is. So what happens with that thing is it's a responsibility of the developer or the operations team to keep these dependencies also updated onto the projects. So most of the security vulnerabilities happen where popular open source projects or popular projects are consumed within their production code bases and these dependencies are not updated right and as developers you would also like to move very fast. Another bad practice which has become like a norm in many organizations is just because there's a open source package they want to put it into their software project. Sometimes you need to validate why is the package in my component do something in that package. So usually the rule of thumb which I suggest is if it is not improving your code base maximum 10% you don't need to introduce that package within your software use it and code that bit right because you'll have more control on your code base reduce the number of dependencies your software projects have as much as possible. But in the case where you need to keep these projects up only select the projects where there's an active community around that just because there's a rockstar developer in one project it doesn't necessarily have to be put into your code bases right. So evaluate what and all you're putting in your code bases because errors like these are very common and they're going to become more and more common because like say if you're generating code and not writing the code by yourself it is going to pull older packages right like if I go to a chat repeat generator token for something in Golang or Rust or Ruby it is going to generate but it is going to generate from the knowledge what it had from two years back or something like that and by introducing that thing the present packages might have a lot of vulnerabilities which have been fixed in the previous thing. So the other common mistake is how many of you have heard the term forking a project? So you go to GitHub fork a project and then you use that project within your code base. So what happens when the fourth project the mainstream of a project the master of the original project keeps moving in a different timeline. And most of the popular open source projects try to have some kind of a security cadence where it is fixed especially projects which consume JavaScript lots of security vulnerabilities. All that gives you a lot of flexibility and features can be rolled out very fast. The number of security vulnerabilities in JavaScript projects are phenomenal. So these are few of the things which you need to keep from a healthy perspective but not all organizations can afford dedicated security and security ops teams. It is critical but the thing is it's everybody's responsibility it's the responsibility of the developers to see what kind of code bases they are putting is the responsibility of the operations in the data teams to say where depend which dependencies you need to take which for artefactories you need to include within your pipeline. And the third thing is also the security teams perspective that the projects which have already been deployed continuously monitor for vulnerabilities on those code bases. Like for example the SolarWinds sorry the log4j attack like most of you might know the vulnerability was always there in the systems it only got exposed much later because the exploit came much later right. So all the code bases what you ship right now will have some kind of a vulnerability. You'll never have a place where you know there is all the code bases are always going to be security proof and all that is just a myth or if somebody is trying to sell you that he is basically the person is basically selling you a snake. The thing is you can only mitigate the security list so you're always working under constraints the constraints could be you need to deliver against a certain perspective or certain deadline or a certain compliance structure needs to come in. So what happens with that is your underlying code bases even popular services like GitHub and all have started analyzing your code bases and started throwing out vulnerabilities because this is something security can't be an afterthought it is there in every phase. So the code build and deploy phase also is there. So even if after you deploy what's going to happen is the next vulnerability is going to come then again you need to go through the whole processes right. So these are a few of the things which takes which this application takes care of. So in this case what's happening is this project already has a defined security criteria for a particular organization.


Yeah, good morning. Wonderful sight here. Thanks for getting me here. And thanks for the brilliant introduction, which really makes things a bit easier for me. First of all, I should mention, I did not make this semantic distinction between replicability, replicability, replicability, replicability, and all that. I think to make a wrap up now, none of them we have. So whatever I've been talking about fits perfectly to all three of them. Unfortunately I wasn't able to take part in the previous discussion, so maybe I blurb something which already has been discussed, please give me some feedback, let me know, stop me from saying too many redundant things. I also should point out your enemy protein I did not simulate yet, so too complicated. Okay, so just a few scattered thoughts to spur the discussion. Actually, I went into that kind of discussion many years ago with a mathematician. They tried to help us with our simulations. I encountered that several times. As soon as you give them a real problem, they don't come back. But this mathematician, quite clever guy, Peter Deufelhardt, in Berlin, he pointed out that we cannot do the simulations in the first place at all. It doesn't make sense at all. And the reason is, of course, the chaoticity of the system and the mode. This is the right word, chaoticity. Which all of you know, and also alluded to that already in your introduction. So if you start any reasonable molecular dynamics system with more than two atoms, there's really a small difference in the last digit, even double precision. And you just let them run, you will find out they will diverge in phase space after a few people seconds, quite quickly. I'm not saying they are quite decorrelated, but they are quite distant in terms of RSD or so in phase space. That happens more or less immediately.  And that was kind of a surprise to me, because I never had thought about that this way. The reason was that I kind of implicitly knew, and that's what I also told him, of course, that also nature doesn't do that as accurately. So if nature doesn't do it, I don't have to do it either. And that was my main argument. This argument, that was a strange experience. I never got across to this mathematician. So he always insisted I would make errors, and that will destroy my trajectory after a few people seconds. It doesn't make sense at all to talk about any trajectory. Don't do it. Yeah, that was sent a probe to Mars. That is a not chaotic system, but don't do the simulations. He doesn't know still, but... Okay, so that was my kind of... Yes, please. Does statistics help in his view? What's the problem exactly? I get to that. In my view, statistics is the key to everything here, of course. But that is also something I didn't get across. But I'll get back to that exactly. So essentially, that brought me to think a little bit more about what to do. Yeah, we had the same question before. What do we mean by reproducibility? Certainly we don't mean to reproduce, I think, the same identical project. You all know we can do that, of course, but we need the same seed for the same random number generator. We need the same CPU. We must not do it on a parallel computer because otherwise we don't reproduce. So all these things make it simply impractical to reproduce a simulation. So what do we want to reproduce? And what I learned from the mathematician, if you can't really get forward, just define it. So the definition I came up with at that time was simply... I called it relevant observables, you may also call it essential or stable observables. All those, which despite the fact that the individual trajectory may differ, turn out within a certain error rate to be the same. Only those can be interesting in a certain sense of observables. And typically that would be averages, like RLSFs, average distances, average structure, some spectra, transition rates, average transition rates, or mean test passage times. Of course free energy is hopefully an experimental observable. Anything which you calculate and can be measured, reliable, or personally also should be reproducible. So any variable which does not show this chaotic behavior because it's averaged out, I guess those are the observables which we should strive for. And that is very exactly what you may need. But of course we are afraid because we all know that estimating errors can be very, very hard in simulations. By the way, I kindly disagree with... You should not spend too much time to learn how to calculate errors because there's a black box which does it for you. No, I strongly disagree.  There's nothing worse than errors estimating too small. We know it from the free energy business. All the errors we calculate are typically too small because we rely on black boxes which have some mathematical theorem, but forget the assumptions on the line. Okay, at the very end of the day of course we want to get to functional mechanism and also those should be of course reproducible and stable in the sense which I have mentioned. One example that I would like to show is simply this is a case of an observable which we calculated a long time ago. And that's the rupture force which you need to rupture a non-covalent bond of ligand as a receptor which can be done by experiments, AFM experiments. And what I would like to share here would be what I think we should really, and when it comes to quality, we should really aim at. Can we predict something which can be measured? Ideally before it is measured and ideally by another group. Can we predict that we give a certain error margin and within our errors which we give within an experimental error? I guess that is the gold standard what we all should aim for. That's an example here. So this is how fast you pull the ligand receptor apart and that is the force which you need for that and the blue is experimental data by Simon Schroding and co-workers and green here that is simulation data and obviously we're limited to short timescale that's why we have to pull fast. But you can see that now we start to overlap here and within the error points which just come from 20 repetitions of each pre-production of each and only right here we can get quite nice agreement. I guess that's really the ultimate test and also ideally it should be against an observable force here which has never been used by anybody to calibrate the force field which we are using here. So that means that the general is our approach to that. I guess then we can start to put some trust into the simulations. That means that many things go wrong but that is what we should aim for I think. So I mentioned already is nature reproducible anyway but it's not and there are several reasons in fact. First of course that this thing in mechanics proteins are not in vacuum but they are in an environment. Other proteins are around, water is around, molecules bumping on the surface of the protein, solid molecules, etc. So already in a classical world which our simulations are in at least as the nucleic motion is concerned already there nature is by no means reproducible so why should we be in a strong sense and the second is of course Gordon and the top of that is quantum mechanics which even if the protein were in vacuum and everything still it would not always follow the same trajectory because the trajectory is not the defined quantum mechanics. So from that also follows from an evolutionary perspective if I want to achieve a certain function as a protein I better be robust against these perturbations. If I am not then probably that's not a reliable function in a protein and that makes our life a little easier. We just have to be as inaccurate as nature is. We can't afford a certain level of inaccuracy and actually that is where we all rely on. Okay so much for that. Another piece of thought I'd like to just bring up is then what you might call reproducibility and that of course links to what I've said user-friendly numbers. If you don't start with the same random number for a e-bar then you don't get the same trajectory. It depends on what precision you are using. It depends on the sequence of the operations. If you add a large number to a small number and then you add another small number that gives a different result typically than if you add the two small numbers in the first place and only then to the large number. You can kill you and party through and you have to take care of those and that specifically means that as soon as you go to a parallel machine where the sequences of operation are not always determined uniquely then already from that fact you get different results which are not reproducible. And of course if you go to a different GPU of course there is an iterative standard on floating points but it leaves a few options open when it comes to two roundly up or down and so that means if you go to a different GPU or even a GPU you may get different results that may be in bugs in the GPU as we have seen in the CPUs. On top of that come and we discussed that this breakfast approximations we are using and I think that is probably where we might want to spend most of our thoughts when it comes to like transferring the simulation package that we give as a complete box if you want because we all use a number of approximations and that is a little different from maybe quantum chemistry where things are a little more easier I'm not saying they are really easy but I think they are easier compared to what we are doing here because the methods they are using are really very very well defined and that's not so much the case for example electrostatics calculations we all use PME or something other times we use cut-offs we may use for multiple methods there are different approximations schemes and they give different kinds of errors but all may be accurate with it and say 10 to the minus 6 in the forces but still the errors are of different kind and some errors may be malicious others may be benevolent and even help us not enough to just specify accuracy I'm afraid for example if you use a cut-off you can have a pretty accurate force but because it's systematically always wrong in the same direction it can accumulate to large artifacts whereas if PME things tend to average out a little bit more beneficially and so even with the same accuracy numerically you get probably quite different accuracy in your relevant observables then at the end of the day modern time-stepping is another approximation besides you name it I think our field because it's so computationally demanding and so dealing with so complex systems also this methodologically really really complex we have to get this under control yeah it was national quantum chemistry and I think it does help to look at our fields which are in that respect in terms of standardization more advanced than we are and I think that's not our fault it's just that our job is much harder I mentioned quantum chemistry may also help to look into solid state physics for example where also there are standards for electronic level calculations pretty high on the side but also it helps us go to the electron bolt rather than kilo truth the arrow is much much smaller so we with our kilo truth it's really they come up and say point to electron board you are super accurate yeah I was surprised on that with their standards are not as high as ours it's really true in our field a fraction of a KT can make a big difference actually that is what very often happens in proteins actually it can be a fraction of a KT and antibiotics we have studied binds in the tunnel of the ribosome of bacteria because there is just one H-bond more than in our ribosome so what the difference between life and death both for bacteria and us is just one H-bond a few kilo truth or something that sounds really frightening and that is for a system which has about two million atoms which means for each atom this accuracy has to be really tremendous and that makes our life really really hard and I think it's really much harder than in quantum chemistry than in physics okay and finally I just listed here what you may call practically reproduced we will never get to this you see beauty if you run a simulation for a year or something on a huge machine you just not get anybody to repeat your simulation it's about a similar problem as we have in elementary and particle physics right if you build a huge accelerator basically like that nobody will build a second one just to represent the state that will not happen and it's a bit like that also in our field here and we have just to be aware of it I'm not saying there is something really fundamentally wrong with that it's just perfect and I didn't list that here but because it was also mentioned I think in our field what is really crucially important is error calculations and how do we deal with add statistics it was pointed out that it is really hard to come up with good statistics in our field we are happy if we see a conformational transition which is functional maybe once or maybe twice it's by the way not exceptional that it takes a year to get the paper actually written not talking about getting it published so to deal with a small number of events I think in our field is very critical so one additional term I would like to throw in there is a very good statistics or probability theory we need and in my field there is only one this is base theory we need to really look more closely to base because base is the only correct way to calculate errors I would collect this is a bit controversial but this is a discussion here so there is only one way to add up to numbers three and four and always seven and if you deal with probabilities there is a life you only only one way to do it right and this is by base and therefore I think our field should also learn just the correct way and this I miss very much in our field so that just came to my mind when we were talking about error bars and so no I don't want black boxes for error bars okay I guess that's about it just one brief thought where all what I was talking about and what's discussed here also becomes I think very important I think the field is kind of mature to one more step from just looking at individual systems and finding out how these systems actually work and so we're doing that all the time it's highly exciting but I think we are in a position where we can also look at many systems at once and try to conclude from a whole bunch of situations and we are of course not the first to do that but never a field was mature enough to collect a lot of data for example in physics people discovered I think it was Headsprung in Brussels that certain stars have certain colors and that relates somehow to their brightness and to the absolute brightness and only from that serving a whole large number of stars they were able to conclude how stars evolve that was a big achievement only possible by looking what was done before those guys individual stars try to make something up from there and of course in sequence alignment the same thing happens so looking at many sequences taught us a lot of things looking at many structures same thing again taught us that for example structures evolve much more slowly than sequences underneath which is a bit puzzling but that's exactly what we learned from looking at many structures same thing in molecular dynamics and trying to see how this dynamic space actually looks like how proteins distribute in this dynamic space and also there it's of course absolutely crucial to understand now if you do several simulations with several force fields and other approximations how do the protein in dynamic space how do the dynamic fingerprint actually depend on those approximations and what is real differences between proteins so I just say we should fill the link in a more systematic way than just looking at individual proteins and then a brief preview is what we term the dinosomes rather than just simulating one protein as I said we went to something like a few hundred and try to answer the question if we have now two proteins of different structure is their dynamics and you're completely crazy question because of course the dynamic is different you can't even compare the dynamics if you have different structure right and I'm saying yes you can you can just need just to come up with the right matrix to do that dynamics may be very similar despite the fact that the underlying structure is very different and if you explore that you can actually in some abstract dynamic space with the lack of time I don't throw here it's just kind of a graph theoretical connection of these hundred proteins each dot would be one protein and they are just laid out here projected down to two dimensions in this graph according to their similarities so if they are connected their dynamics is very similar and if they are far apart here their dynamics is very dissimilar and what we have done here we have plotted on those for example signaling proteins here transcription proteins proteinases they are not uniformly distributed over the whole dinosaur space as we call it but they cluster in certain regions of that space and that makes it possible to predict function just from looking at the dynamics not in that sense so if you give me a new protein I do a simulation I try to place the new protein up here I would predict it's a signaling protein if it ends up here I would probably predict it's a glycosidase and if you do that I don't have the slide but if you do that then you can ramp up the success rate for predictions from 30% to 50% or something structure based predictions of function 30% 50% if you include dynamics so that actually helps and that is something to see in such a graph how much for the protein move just due to numerical inaccuracies just due to the choice of force just by repeating the same simulation with a different seed so what is the error range of this position in that strange space so that is also something which we address and I think it can only be done by repeating many simulations and see actually how much it can I think by time is we are running it's not right here very very interesting your comments about LHC where they don't run it twice the LHC experiment was actually designed to completely separate teams and actually I think we should learn from that to be honest when we want to run a simulation to predict it's observable you should take two separate teams and I think we should actually be refereeing if I want to run one simulation we should say no don't do that so one simulation is not useful so the LHC will give out places in one month and the physics community said that they have a significant frequency process between them actually there's no pre-study six months of simulation on the shade because it's completely worthless then how does that work well you can leave it for this session I also just want to make I think I'm not suggesting just a paper


Hi, I'm Connor O'Day. I work for Gitcoin or I'm a member of the Gitcoin DAO and we're going to be talking about a nifty thing called quadratic funding. So first off, I just want to take a quick poll. Who here has heard of quadratic funding? Okay. See a lot of hands. That's good. That's good. Who actually understands it? Okay. Okay. Maybe half as much. I'll take it. I also, you know, I'm still learning. So who has actually funded a project in a quadratic funding program? A lot of hands. That's good. And who only did it because you thought you'd get an airdrop in the future? I see one, two, three. Okay. I like the honesty. I like the honesty. So the two long didn't watch for the people that are heading out to happy hour right now. Quadratic funding has proven to be a powerful tool, but primarily in niche communities like web three and with few new invent advancements over the past few years, which is basically QF is good. As adoption has grown, problems are becoming more apparent. Scale is hard. And things like decentralized identity, community curation tools will boost scalability and then tweaks to the mechanism design can help drive adoption as communities tailor QF to fit their specific needs. And we're going to call that innovation and experimentation equals transcendence. So that's kind of the high level overview. If you need to go, you can go, but I think it'll be pretty interesting diving into the details here. So first WTF is QF spoiler alert for the whole presentation. That is QF. Basically what it means is funding for any given project is calculated by taking the square root of each donation, adding these values together and then taking the square of that result. We'll get into that a little bit further on the technical side, but basically the widely accepted definition of quadratic funding is it is the mathematically optimal way to fund public goods in a democratic community. There's always kind of been this emphasis on public goods and democratic communities, which covers many of the use cases, but perhaps not all, which I'll get into later. And QF was kind of first proposed by Zoe Hitzig, Vitalik Buterin and Glenn Whale and the paper you see on the screen right now. And what it really does is it let us harness the collective intelligence of a community helps ecosystem signal and fund their shared needs. And what it looks like in practice is your donations are multiplied on this logarithmic curve. And I really like this about a lot of implementations is you can actually see the impact of your donation as you do it. And you can kind of see how a small donation can get a large match, a bigger donation can get a bigger match, but it really tapers off because the higher value is in the number of unique contributors rather than the total amount contributed by any one person. So quadratic funding came from this idea of quadratic voting, which basically allows you to signal preferences, but most importantly, the strength of those preferences. Quadratic voting as a concept is existed before crypto, but was popularized by Glenn Whale, which is also kind of independent of crypto, but kind of at the same time the ecosystem was maturing. But compared to, you know, $1, one vote or one person, one vote systems, it really, it really allows you to signal preference in a much better way. And so QF and public goods, this is kind of the common theme you hear everything here is about funding public goods, everything quadratic funding is usually in relation to public goods. And so what even is a public good? It is a non rival, non rival risk, non excludable good. For example, you know, clean air or open source software, which is one that we focused on a lot. These are often discussed as a pair, but I don't think that will always be the case. We're kind of starting to stray from this public goods pigeonhole where the types of goods is more of a gradient that people are understanding. And there are things like network goods, community goods, plural goods, even private goods that could benefit from QF. And it doesn't mean we are funding public bads, but it means we just have to kind of rethink the framing that we're using for, for, you know, what we're funding with this mechanism. So where are we today? Get coin in our history since we started in 2017 has funded $69 million worth of open source software and public goods, which is a pretty nice number to round out for this presentation. That just kind of worked out nicely. And this includes grants, bounties, hackathons, tips, a bunch of different things that can happen on the get coin platform, not specifically just grants. And for the get coin grants program, we've seen kind of round over round growth now for over three years. We started in 2019 with the first round had a $25,000 matching pool. I think it got like $13,000 of community contributions and 200 contributions total. So not a whole lot. Fast forward to grants around 14 in June, 600,000 contributions and over $5 million raised for these projects, these public goods, these open source software projects, which is really cool to see. And these visualization graphs you see are kind of the network 3D visualized of all these donations and all of these connections between users and projects. And the most recent round grants around 15 just ran in December or September, sorry. And what I really want to call out here is that this wouldn't be possible without the matching pool funders. So these are, you know, DAOs, organizations, you know, private companies, individuals that want to donate large amounts to the matching pool in order to incentivize the community to also donate to public goods. And that last round had over 450,000 contributions, over $4 million raised and almost 40,000 unique donors. But yeah, so this wouldn't be possible without all these logos you see up there right now. And so just want to give them a quick shout out because it's super important to what we're doing. And so we're, you know, experimenting with all different kind of types of quadratic funding rounds. We kind of started with one main pool. We broke it into categories and now we're doing what we call ecosystem rounds. So we've done, I think, 20 plus unique ecosystem rounds in the last year or so and over 40 total, a lot of those are recurring. And some of them are kind of crowdfunded and more focused on a theme like the open gaming round or the ZK Tech Round versus many others are kind of a single funder trying to grow their own community, their own protocol. For example, you know, ENS polygon, and some of the others you see up there. And the way I view it is this could eventually be part of the DAO tooling stack, where it's better than like a yes-no governance vote, it's faster and more democratic than traditional grant programs. So, you know, you can imagine a DAO that needs to decide what work streams, what hubs, whatever they call their projects within their DAO, what they need to fund. They could use a QF tool or QV tool. And with quadratic funding, it has the added benefit of raising additional funds for those projects. And then cause rounds, I think are what are really interesting as well, where we're kind of trying to break out of this Web3 bubble and, you know, make an impact in meat space in the real world. And we've done rounds for climate, diversity, crypto advocacy, Deci, longevity, we did a round for Ukraine. And there's still a lot of overlap between the Web3 communities and these communities. You know, for example, in climate, like a lot of the climate projects we see are kind of crypto focused climate initiatives, which isn't a bad thing. But what we're trying to do is really onboard, you know, non-cryptonatives to the blockchain, the Web3 ecosystem, which is difficult for everyone. But I think we've been making good progress there. And here's some examples just from the climate round. I think these are really interesting because it really has like a global widespread impact. And it's very cool to see in this case, we are kind of onboarding new users to Web3, which, you know, comes with a lot of manual handholding and onboarding, but it's really cool to see the progress that's been made in these areas. And the last one I want to mention is these kind of geographic QF rounds, so the regional and local rounds. I want to call out specifically the DEVCON Latin America focused CLR fund round. So that's happening now. Gitcoin is not involved, but you know, we work with CLR fund, we like them a lot. And everyone should go check it out because they're also utilizing some of the mechanisms that I'll mention later in this presentation. But yeah, so that's that's happening now. And as Gitcoin, we've done a few rounds like we did an Oakland youth charity focused round. We did a China crypto ecosystem focused round. And the downtown stimulus one was actually during COVID and it was focused on Boulder, Colorado, and reviving the local businesses there. And I think what I want to say on this is just like, we're all experts at what's right in front of us in our communities, you know, it can be difficult to fund projects that are across the world from you. But this mechanism can really help in kind of, you know, shared shared public goods or localized public goods that maybe don't have an impact around the world but have an impact in your neighborhood or your town. So growing pains. civil attacks are the single greatest threat to quadratic funding. If you haven't heard a civil attack is basically one human making, you know, many accounts with quadratic funding, you can imagine if I can make a grant, I can donate it to my donate to myself from 100 different accounts that totally skews the mechanism steals funds. And it's not good. And so it's a constant kind of battle between, you know, mitigating civil attacks, but also, you know, trying to respect, you know, personal privacy and identity systems. And it's this game of kind of red team versus blue team that's constantly evolving. So we've seen civil attacks really increase as of late. I'm not sure if it's like more awareness, you know, the bigger matching pools or just the bear market, people are running out of things to do to make money. So they decide they're going to civil attack grants. But it's an issue. And we see, you know, we see the self donors who are trying to cheat by donating to themselves, we see airdrop farmers, which, you know, are typically not, they're not trying to do bad necessarily, they're just trying to get as many accounts as they can, you know, eligible for possible airdrops, which is also not good because it skews the mechanism. And I think that's partly in due to a lot of the airdrops we've seen that have went to public goods funders in the past. So we're working on mitigating that. And then just general collusion between different real humans, it's really hard to tell what's collusion between legitimate people when you don't know their full identity, or, you know, what is actually a civil attack, but in both cases, we're trying to mitigate that. And then we see fraudulent grants. So, you know, impersonations grant emulations, which is what we call making up a project and making it look like it's real, but you know, the GitHub is empty, the Twitter has five followers, but they really write it up to make it look real. So we're dealing with a lot of that. And the solution to all of this is identity. So how can we channel this airdrop farmer energy into raising more funds for good causes while not compromising the mechanisms integrity? It's inevitable that people are going to donate to things because they think they'll get something out of it eventually. And as long as we can kind of channel that energy, you know, in such a way that it doesn't, you know, hurt the mechanism and other grants, then I think we're kind of secretly converting these these D gens into regions without them even knowing it. So get going grants right now the one the platform that most of you know, or some of you may know, it's still fairly centralized, but but that's okay. You know, we can't go to governance for every single grant decision. So governance helps direct the eligibility requirements. And then we have a centralized team that must be trusted to act on those decisions. But you know, this is a high bandwidth task for our team. Humans are prone to error, it's centralized. And you know, at the end of the day, it's not what we want to be doing with with our time. And so as we kind of move towards a path to decentralization, which I'll get to more later, we're thinking about launching this permissionless protocol. We have resilient identity systems in the works, community curation and really self serve product features so people can kind of choose how they run their own rounds. And one of the one of the primitives I'm most excited about is around decentralized identity. And that is Gitcoin passport. So this is an open source DAPP preserves your privacy. It's fully decentralized. The data is on ceramic network. Gitcoin uses it as, you know, to print symbols and provide trust bonuses to donors. And it's all open source and anyone can integrate it with their own DAPP. So we already have actually 60,000 passports created on on Gitcoin, which is really exciting. And some of the integrations that we've seen are East Staker, Bankless Academy, Rabbit Hole, Snapshot, Guild, are already using passport, you know, mainly for civil protection or quadratic voting or similar use cases like that. And once we kind of nail this civil resistance with passport or you know, through many combined means, it unlocks this spectrum of possibilities of quadratic funding, quadratic voting, fair launches, universal basic income, one person, one vote dows, data collectives and plural funding. And then the other the other mechanism that I'm getting more excited about is, you know, different, different ways to incentivize community curation. So, you know, curation is creation. And we're experimenting with things like grant and identity staking, where, you know, you actually put value on your grant or on your identity. And personally, I think that the revival of token curated registries is going to happen. So if you're not familiar, super bullish on this, but TCRs were kind of popularized, you know, a long, long time ago in crypto land in 2017. But it's an incentivized voting game that helps create trusted lists that are maintained by the very people that use them. So essentially, using the wisdom of the crowd principles, people collectively vote on what submissions are valid, what should be removed, and they're rewarded in tokens for doing so. This is this is during the 2017-2018 cycle, there is a lot of hype around this. And I think it kind of died out. But I'm slowly starting to see it kind of come back into the main Web3 discussion. So even if it's not TCRs themselves, some type of community community curation is absolutely needed for, you know, a decentralized grants program. Alright, so we're going to go into some of the new flavors of quadratic funding. Lots of people are doing really dope stuff with public goods funding, quadratic funding, and we're excited to work with all of them to do so. You'll see some of the logos there on that unnamed bag of candy. But you know, these new flavors, we're really going to try to taste the rainbow here. So I first want to establish that almost all QF implementations kind of stray from the math. When proposing, you know, adjustments or new experiments, like we often get the reply like, Oh, well, that's not real QF. Hence, kind of the meme I dropped in there. But it took me a while to kind of fully grasp like what the image you see on the side there means. Basically, the green is donations, the yellow is matching. And as we said before, the matching is calculated by taking the square root of each contribution. So those those blue lines you see there, adding it up and then taking that square, which is the full, the full square of yellow and green that you see there. And so that would be like pure QF, right? And that would happen if we also so it doesn't happen in this case, because what get coin does is we have a fixed matching pool and a fixed time limit, which means matches will scale up or down based on the saturation. So if a round is oversaturated or under saturated, that means all the matching is allocated or all the matching is not allocated, then you don't have this perfect square that you see here. And most of our rounds end up getting saturated. And what you see after that point is it's kind of a zero sum game, which means, you know, there's no additional matching to provide. But as more donations come in, it just shuffles around where that matching goes. So, you know, some people have argued that it should kind of end after it's saturated. And that would make that would be what's kind of like a fixed pool only where as soon as the round is fully saturated, it's over, which I don't think would be a good user experience, because people want to know how long they have to donate and when it's going to end. But it's one thing we could experiment with. The other thing is that there's a fixed time limit, but a variable pool. You could run it that way, but you essentially need infinite money to make sure that you're not going to run out. And that's not really feasible either. So we kind of have this middle ground here. And then there's other things to the trust verification bonuses. We have matching caps on certain rounds where there's a certain percentage of the total pool that you can take. Paralyze bounding, which we'll talk about in a second. And many other mechanisms that kind of take the initial QF, you know, math formula and then add some tweaks to it to kind of help the experience. So Paralyze bounding I'll talk about first. This is a mechanism designed to practically prevent collusion, muting the impact of groups of contributors who contributed the same grants as each other. So if you look at the image behind me here, you see those big clusters. Those are all donors that are donating to similar grants and that are, you know, have connections on their network path. And so those donations are going to be going to earn less of a match because of that kind of assumed collusion. So less correlated pool of donors is more matching, more correlated is less matching. And then we could also experiment with like plural pairwise QF, which would, you know, with new identity systems like VCs, DIDs, SBTs, we can sort of better figure out how close or far a single individual is to your network and kind of take the pairwise bounding a step further. Macy is another really popular mechanism. This one's actually used by CLR fund. And it's all about privacy. So you know, privacy is a public good privacy is a human right. And Macy voting or funding is private helping to avoid collusion and vote buying. So in quadratic funding users could not cryptographically prove to others how much they've donated or who they've donated to some of the caveats there I think is that it relies heavily on civil resistance assumptions as everything kind of does. You can only make donations on one chain. You can only contribute once to around. And you know, if there are trusted parties, you know each other in person, like they could still potentially include. But in any case, I think, you know, privacy is really important. And this is a good thing that we'll be trying to experiment with soon. Retroactive public goods funding is another concept that's not necessarily QF. It's more quadratic voting. But the core idea is that it's easier to agree on what was useful than what will be useful. So optimism is not trying to be a grants program. They don't want to fund what they want to see built in the future, they want to reward what was already built. So it's more export expert driven and proportional to kind of the past value generated from a project. In their iteration, they've kind of went for a whitelisting approach, which reduces civil attacks and fraud but is less inclusive as a whole. And the benefit of this is it can kind of incentivize the initial seed funding of a project. So, you know, right now it's very hard to get initial seed funding for an open source project or a public good. But if retro PDF kind of gains traction, and, you know, part of that retroactive funding goes to the initial funders, then you might see, you know, private investors investing in open source with the idea that there's going to be an exit eventually. So it kind of working backwards, it could sort of help fund the initial stage of many open source projects. And I want to call out we were working on something very exciting with optimism for retro PDF using the new grants protocol that I think I think we've sort of announced but you'll be here more about that soon. Super exciting. And the other thing I kind of wanted to mention is just that like, when I donate to normal quadratic funding rounds, I'm often donating to projects that I think have done really good work. Like I'm also donating the projects that I want to do good work, but I certainly think you have in general, it's a good mix between retro funding and, you know, future funding, but it's a lot easier to donate to a project that you know the name, you know, they're doing good work versus someone who's brand new. So all funding is sort of retro in some capacity. But you know, that's kind of a personal preference thing that we haven't fully explored. Okay, running low on time, but dominance assurance contracts are another mechanism that we could potentially use. It's a product of game theory meant to incentivize everybody in the community to contribute to funding the public good and avoid the free rider problem, which essentially offers a refund to your donation if a threshold is not met, whether that's the amount raised or the number of donors. And with dominance, the dominance part of it, the person offering the public good could actually would actually have to pay you some bonus on top of that. So it kind of turns into a win-win for donors. You know, your public good either gets funded and everyone's happy. It's what they wanted. Or you earn a profit and it doesn't get funded. And ideally, in game theory, that might be the dominant strategy for free riders that don't want to fund public goods. And then back to quadratic voting. So, you know, do we really need the F and QF? There's plenty of great quadratic voting experiments happening. And it might better serve the needs of some communities. You really need strong civil protections or, you know, a whitelist system. And I find it kind of more useful for single-choice decisions like A versus B versus deciding, you know, on what scale to fund something. And of course, it lacks the benefit of raising additional funds via user contributions. So what is next? So, Gitcoin, as it kind of alluded to, we're launching a new grants protocol that's going to be fully decentralized. And we're kind of at a crossroads, because we want to, you know, decentralize QF using the latest and greatest Web3 tooling. But we also want to drive adoption of QF in new areas in the real world, which means making Web3 more accessible to the average non-crypto-native person.  So, you know, anyone can use it. And we're kind of balancing the scales here. It's a bit difficult to do both at one time. And this is a problem for, you know, the entire Web3 ecosystem is usability and user experience. But I think we'll be doing some experiments both on the new protocol and, you know, in maybe a non-blockchain, you know, QF-based system. So that's actually with the Downtown Stimulus project that I mentioned for the local round section. That was totally done in Fiat in the Boulder local community. And we might do more of those, more social network QF experiments. But finally, what we wanted to get to is the Gitcoin grants protocol. So this consists of a suite of overlapping products, passport, round manager, grant hub. It's going to be permissionless, modular, and decentralized. So anyone can try to, anyone can try different public goods funding mechanisms to kind of find what fits best for their community. And this really differs from our centralized programming platform now because we have to manually kind of help run people's programs. It's not self-serve. You can't just spin one up by yourself. And a lot of the work is kind of, you know, based on our centralized team doing this manual grinding to get it done. And so this is going to be open to anyone. And what we envision here is that, you know, project owners will use the grants hub to kickstart their project, use it as a vehicle for growth. And then, you know, at a point far in the future, there could be hundreds or thousands of programs running at any time, all kind of designed and operated in a self-sovereign way, specifically to serve their communities. All right. And this is the last slide, I promise. So Gitcoin Grants 1.0 was a monolith. It's on this centralized stack. Super outdated. We're excited to move on. The grants protocol is really going to take the power of Gitcoin Grants and quadratic funding and make it available for any EVM-based chain and community. So this is going to be permissionless, open, decentralized. You can take any of those mechanisms that I mentioned earlier or new mechanisms that haven't been thought of and implement those into your program. You can kind of self-serve and choose your own adventure. So we're really excited to launch this. We have a few test rounds that are going to be going live in the next few months. And I think in Q1 of 2023, we'll be moving the entire Gitcoin Grants program over to this new protocol, which, again, will be modular, decentralized, and hopefully civil-resistant. So that's, I think, the talk. That's the talk.


By formation, I am an endocrinologist, a specialty that studies hormones and since medical school I was fascinated by the effects of hormones on the whole body and the interaction with other organs. Here we do studies on obesity and metabolic syndrome, which is diabetes, hypertension, dyslipidemia but mostly we study the effects of a specific hormone called leptin on the regulation of food intake, energy metabolism, immunity and brain function. In the lab we have some experiments going on. We are studying leptin deficient mice, which are mice that don't have the hormone leptin. So they are very obese, they are diabetic and we are doing at post-tissue transplantations in this mice. So we are reversing the leptin deficient state with the transplantations. So we are doing those experiments and assessing the effects of transplantation on body weight, behavior, glucose metabolism. We have short-term goals and long-term goals. Short-term goals are to further develop our studies on at post-tissue transplantation and stem cell transplantation into the leptin deficient mice. So we can treat those mice with stem cells. In the long-term we want to translate that treatment to our leptin deficient humans. These patients are being treated with an injection every day. The drug is given free of charge by a company in the United States. They cannot guarantee permanent supplies. So we want to develop a permanent treatment for these patients with stem cells therapy. So if everything works out well, we will be transplanting stem cells into these humans. The stem cells will become normal at post-tissue. That will produce normal leptin and then they will no longer require leptin for surviving.


when let's say the time will be normal and this COVID go away, we can have the presence, participation, but to keep this online winter college, but for a short time, for very short time, two, three days, like now, in addition to the presence. This is my opinion. The other thing that I want to say is to Henry, Henry was speaking there and telling something important about Ianofer. Here, there is in our unit a group working in this topic. They are our colleagues and they have a very strong collaboration with developing countries. I can put you in contact with them. They are even my friends and they are doing great in this regard and they are specifically in this topic. Yes, thank you very much. This topic was a kind of a parenthesis because now I got involved in the university and restarting the research. I have a lot of data from 2010 to 2016 from greater measurements that can be worked together with optics and let's see how much understanding of the polymers of your thesis can be done from aftertaste, but I appreciate so much. Send me an email. I will put you in contact with them and they will be very happy and Peru is a very nice place for their research. I think they will support you. Yes, thank you. Okay, that's great. There you go. This is the kind of networking that happens even online. That's great. Thanks for pointing that out. I think we should wrap it up because it's like an hour over. I just want to thank everybody again, everybody that participated and through this and especially our lecturers. Joe, you're still here. I see. I think Randy just had the go. But anyway, thanks so much because it was really informative. I want to know more about those fish. Anyway, thanks to everybody. Thanks for showing up. We'll keep in touch and we'll find out what's going to happen next year. Really, right now, nobody knows anything. I think the way the world is going is more like what Humberto was saying. It's going to be hybrid from now until forever. But there are some advantages. It doesn't mean you do one or the other. Maybe we can keep some online component for a short course that's online because I think a long one online doesn't make any sense. We can pick a very specialized topic. We've been talking about that with John Howell, actually, yesterday's speaker. So he got kind of inspired by that possibility. So anyway, thanks, everybody. I won't tell you to travel safe because I think everybody is just back where you're home, right? Thanks, Anna. Thanks for you. Thank you, Joe. Thanks, Freddie. Thanks, Humberto. Joshua.


By the Board of Trustees of the People's Democratic Party, PDP has ratified the party's deputy national chairman, Salz, Yemi Akiwami, as the acting national chairman of the party in line with the party's constitution. Chairman of the BOT, Senator Walidj Gibran, announced this decision after an emergency meeting of the board in Abuja. He said Akiwami affirmations as acting chairman is in line with the constitution of the party that the BOT and the caucus will meet tomorrow Friday and the NEC will hold on Saturday.