So welcome everyone to the 14th meeting of the sensitive data community of practice. This community of practice is co-coordinated by the ARDC, the Australian Data Archive and Arnett and today, well, we'll start, hang on, yes, by acknowledging and celebrating the first Australians on whose traditional lands we meet and paying our respects to their elders past and present. For me, that is the Nga Wajap people. And I just like to let you know that we'll be taking notes today in the community document. I've put a link to that in the chat. If you've come in after that link went in, I'll put it in again in a second. But you should all be able to edit that. It just gives us an opportunity to pop in notes and into that gray box. And I'll also take notes of any questions and answers that show up in the chat. I'd like to pop those into the community notes as well so we have a record. So today, we're going to be talking about external IT support for research teams. So I think we're all aware, researchers and researchers working with sensitive data finding more and more that their research projects involve the involvement of external IT teams. And I think that's can be an interesting relationship to navigate to make sure that everyone's getting the most out of the project. So today, we're hearing from three people who have worked in various external IT support roles who are going to talk to us about how to get the most out of that relationship. So I think I will switch over. So that's Helen, Andrew and Luca. Helen, were you starting us off? Yeah, for sure. We didn't formally discuss this. Are you happy with that? Sure, yeah. All right, cool beans. All right, I will share my screen. Okay, awesome. Thank you, Nicola, for the introduction. Yeah, so the external IT support professional network is a really interesting one with really sort of varied skill sets and approaches, I think, to collaboration with research teams. But it's quite infrequently talked about. And I found at least chatting with various research groups that there's a fair bit of mystery around the process of engaging with external IT support, what to expect from that process and what sort of what you can ask for and how engaged that IT support would be. So the three of us today have quite different, I suppose, professional roles. And so hopefully you hear sort of some different perspectives on that interaction. So this is me. I'm Helen. I'm a manager at Notitia, which is an analytics consulting firm. You can have a Gander at our website if you like. I've got a lab science background, so genetics and biochemistry, wet lab research, and I started doing more and more coding. And nowadays my day-to-day work is full-time software development and analytics. So in terms of where I would sit on a project, it would be somewhere between the sort of IT infrastructure and software development side of things with some sort of database management as well. So I'm also one of the co-organizers of our latest Adelaide, although we haven't had a meet-up since pre-COVID. But if you'd like to be involved in like a programming group sort of relevant to lots of research data transformations and please do get in touch. What I've got down here is kind of a sample of some of the clients that we usually have at Notitia as a consulting firm. So you can see here that we're pretty healthcare focused, although we certainly have different sort of clients as well. But we've got sort of publicly funded research groups, privately funded research groups, government groups, and also just private businesses that operate in a really similar way to a research group in that they're effectively doing internal research projects. So something that all of these groups have in common is that they've got patient identifiable data. So it's very sensitive and the content of the sensitive data fields varies between the organization. But generally it'll be sort of row by row patient identifiable information and each organization or research group will have different members who will sort of have ethical permissions to access different components of that data. So what I've got here is the sort of difficult transformation journey, data transformation journey that we go through as an organization, as external IT support. And in the interest of time today what I've done is pulled out a few key points here to talk through that I think are particularly relevant to research groups that are handling sensitive data and want external IT support in order to be able to achieve that. So what we've got up the top here in the sort of grainy tail part is the sort of core data management process. So ideally a research group would come to us when they've got sort of an idea for a project but they haven't done a whole heap of planning or and haven't sort of already bought any kind of tools for starting the process. So then we'd be able to go through and plan everything really thoroughly and make sure that everything's configured really well for for what they need security wise. However, what actually happens 99.5% of the time is that a research group will have something set up already and they'll hit some sort of a wall where they realize they need assistance and then they'll get in contact. So at that point in time and the first thing I've got here is being realistic about money. So especially for research groups you've got very specific funding kind of boundaries and it's really important to have that discussion up front particularly because there'll be some security solutions that are really only plausible if you have a consistent amount of funding over the period of time that that data is available to use and often that's not actually the case for a research group. So more often for a research group there'll be sort of more funding available at the start and then funding will get a bit sort of fuzzy towards the end of a project and keeping that in mind at the very start means that we can make sort of a security setup that can manage that process that doesn't need consistent or increasing payments. So something I'd say to keep an eye out for is if you want to use a certain software tool in order to be able to provide certain secure access to your data to either your own clients or other researchers or something like that it's worth before committing to something like that it's worth getting external IT support to be able to talk through what that actually means because oftentimes something that seems good doesn't actually serve all your requirements but it can take up a lot of the budget. So the second point I've got here is developing a joint data security understanding. So this is kind of leading on from that first point being transparent in terms of who you've got involved in the project, what they need access to and sort of what you're trying to do with the project. So oftentimes security-wise there'll only be a couple of people who truly need access to the entire data set. So if what you want is to make sure that you're sort of following your ethics agreements by ensuring that only the people in your team who absolutely need every part of the data have access to it and all of the other people have a much more limited type of access you still want to make sure that the limited access is appropriate for those members and isn't going to cause them sort of unnecessary problems. So there's a million different ways to get people access to various types of data and it's all very doable and sort of time blockable so long as you plan sort of early on and talk through each step of the process. So I know it's tempting to sort of to only consider maybe the first year of your project in terms of setting up IT support but actually if you give the IT support a really broad understanding of your project they're going to be able to meet your needs a lot more easily. So really walking through each step of the of the research project is super helpful there. So the next point I have is to agree on a visual output type for a communication focus. So in terms of maintaining a relationship that might go for say three to five years for a research sort of funding block you want to make sure that you're communicating regularly and positively and it's really easy for that to not happen. So if you've got external IT support it is external and I suppose they're handling a what can be quite a siloed part of the research project but as soon as something goes wrong or needs to be changed you need to be on the same page and so it's important to have some kind of focus for both the research team and the IT team so that you can both communicate effectively. So something I really like to use is a a really kind of clean and simple map of the infrastructure of the project so it might show the service that you have or the databases that you have what sort of fields are in each and then what that's used for. So say you're reporting or your website or your papers whatever that happens to be and then which of your team members has access to what maybe with some indicators of vulnerabilities around ethics agreements that way you can all like literally have a printout or share your screen and be pointing to those parts as you're talking through whatever you're thinking about that makes it a lot easier to communicate any issues or questions about ethics agreements or updates that you do have between an external IT team and your research team. Something else you can use if you're interacting more regularly with your IT team and they're doing some analytics for you it can be really good to have some kind of shared internal website or dashboarding page or something like that where you've got a joint view of say like a series of charts or something something simple that you all understand the meaning of that you can go back to to communicate some basics so if someone's confused about where data is coming from or how it's being used or what you can see you've got sort of a visual cue for that that you can all look at at the same time. The final thing I would say is expectation management and goal communication so in terms of security it's easy for people to get quite frustrated and often that's where actual security breaches happen so if they don't understand why they need to update their password and then they end up writing it down on a post-it note and sticking it to their screen or something like that that is the easiest way for people to make big security breaches. So there might be a series of processes that your external IT support team have asked for you to follow but that's not actually going to be useful over like a five year project unless everyone appreciates why that's happening and feels free to complain if they really hate the solution. So setting up that type of communication where both the research team and the IT team understand why the security protocols are in place really helps especially over a longer time period to to make sure that the security systems stay solid and don't get kind of messed with as part of the process. Yeah so that's that's my kind of summary of a typical engagement process for me so I'll hand over to you Luca. Sure just to follow the schedule we have Andrew I was wondering if you would like to go otherwise I'm happy to go now as well. You can go that's fine. Sure I'll share my screen thank you Andrew. Okay I believe everybody can see that I do notice the black box sorry I'm actually projecting from a Linux machine I think it does have issues sometimes we assume. Hello everybody thank you for having me today I'm Luca Dykes I'm a researcher and systems architect here at Samaritan's Australian Health Medical Research Institute I also have academic status down at Flinders University and I do some work with the Commission on Excellence Innovation and Health. I'm talking a little bit today about one of the projects we've recently been funded for with an NHMRC partnership grant and the process that we've had to go through in terms of allowing us to work with sensitive clinical data in an essay government computer network and so we've recently been awarded the $1.2 million to run the RapidX AI project which is a real-time project looking at artificially intelligence predicted risk of myocardial infarction in 12 emergency departments in South Australia really with the goal that this is a real-time clinical decision support system so patients will arrive in the ED we'll collect some information about them by interfacing with a range of health data systems and then providing a real-time risk assessment and provide this back to the clinician at the point of care. So you can imagine that this is quite sensitive to work with because we need to be able to interface with quite a number of data systems and then actually be able to have that computational infrastructure work with sensitive data be able to interface be able to work with clinicians in a very sensitive setting. So I was really keen to talk a little bit more today around the process that we had to go through with Digital Health Essay which are the governing and administering body of IT support and digital systems here in South Australia inside Essay Health. So I've just got a basic rubric here that's part of the business request just one of the initial things we had to go through and we engaged with Digital Health Essay. It's fairly general it talks about business value and clinical value and risk assessment and those kind of things. I was quite keen to talk a little bit more today about the process map and the actual engagement we had to go through with that but unfortunately a lot of the documents and a lot of the communication I have surrounding that are actually classified as sensitive and office use only or actually classified as sensitive and I just kind of wanted to raise that something that I feel really personally about and I'm sure the ARDC Alliance of this is the transparency of these processes. So a lot of the documents that we have had to follow in terms of the security assessments we've had to go through are not readily available and it's something I'm trying to have communication with Digital Health Essay about making a lot of these documents much more publicly accessible so that when external parties or in this case an academic party comes to work with the health system or work with the government there's a very clear line of process around what we have to go through. But very generally what we have to do in terms of meeting security is there's a mapping from SA Health Security Requirements to ISO 27001. It's not a complete compliance to ISO 27001 but it's a fairly significant subset of what we have to do in terms of computational infrastructure. So I thought today I'll talk a little bit more around the actual computational infrastructure we've had to set up in order for us to deploy these systems that work with clinical data. So we've set up this project called the Hard AI Project which is an overview of our systems architecture and really a system implementation that we've hosted on a publicly available website. So I've just linked the website up above there. And following on from some of Helen's comments we have a whole range of our system architecture, some de-identified network architecture, some project timelines, some project governance and a whole range of information that we want to make publicly available and share that information. So please feel welcome to go have a look at the Hard AI website where we do have a range of information about our systems and the projects we work with. So we've been really quite lucky that we've had approval to deploy a Microsoft Azure deployment on the South Australian Government computer network SA.gov.au. So as of this Monday actually just this Monday this week we have deployed to Microsoft Azure. We've had a subscription set up that's part of the SA Health Enterprise Agreement with Microsoft and it sits on the SA Health Active Directory Tendency. So we did a lot of work working with Digital Health SA and senior stakeholders to have approval to have a 24-sider range network address allocated to us from StateNet and we have now deployed to that network address range. At the moment we do host that on a StateNet network address range but we don't have a physical connection to StateNet at the moment. What we've been asked to do is to set up our environment on StateNet and then have a third party security assessment and once we pass our security assessment we will create an interface to StateNet. The way that this will work is we'll actually connect to StateNet through a hub model, a hub spoke network topology where SA Health and SA Government will manage a hardened network edge VWAN interface that we'll actually connect to via network peering. So that gives us a really consistent way of actually interfacing with StateNet and that allows a lot of that management of that actual edge network infrastructure be managed by SA Health and SA Government directly. A few of the security promise that we have had to do in order for us to work with clinical data are really a couple of key things. One of those is no exposure to public internet. So we do that through two mechanisms. One of those is with the PAZ services that we use on Microsoft Azure. So with our databases and with our sensitive data source and our event buses, they're all Microsoft PAZ services and we connect to those directly using Microsoft Azure Private Link. That enables us to connect with those PAZ services over the Microsoft backbone network so we never actually leave the Microsoft network. The other aspect is that we don't expose any endpoints or any public IP addresses to the public internet. To actually access any of our data services, you have to go either internal to our network or you have to go through StateNet directly. Really with the mechanism being that anybody that wants to access these data systems should do so through StateNet. They should seek credentialing inside StateNet as an SA Health credentialed entity. So for example, we've had ID or an Active Directory account and through that mechanism they'll be able to access our service endpoints. So it gives us a very clear delineation of where our responsibility is in terms of managing infrastructure and where the management of governance and liability and the legal aspects of what we're doing. So from that perspective, that is being managed by SA Health and SA Government. So all data that we manage is encrypted both at risk and in transit. So it's encrypted everywhere and basically we set out to implement a zero trust network. So I'll just go over very briefly some of the technology that we're using. Probably one of the key components of our technology is that we're using Microsoft Azure Red Hat OpenShift. This is a converged best practice solution for systems orchestration. It's effectively a Kubernetes abstraction. It's a higher level implementation of Kubernetes and it has a lot of additional constraints around security in particular. For the purposes of this meeting, I have talked a little bit in this slide about how Red Hat OpenShift complies with the Stride model, really around spoofing, tampering, repudiation, information disclosure, and denial of service. I think there's one artifact that I left off this slide. But for example, some of the things that Helen had mentioned is that we do operate with the least privileged model in terms of how we allocate permissions. We do implement an integrated identity and access management system. We use encryption for all systems components. We do logging for all interaction with our system and we provide that logging back to SA Health. SA Health manages a central Splunk repository for Logstore and we forward our logs into Splunk. Essentially, in this system, no sensitive data is stored directly and all sensitive data is injected into the system. In terms of security from an availability point of view, we maintain effectively a distributed service mesh. We have ability that our system self-heals if we have any actual physical infrastructure or logical infrastructure go down. It will have an automatic failover in the sense of it being like an active-active distributed system. Those systems will essentially always have some mechanism of being redundant and that says a massive catastrophic failure in multiple data centers. In addition, we do things like real-time monitoring and loading as well. We've really tried to align with what we've seen best practice in other areas like banking and insurance. Areas that use Microsoft Red Hat OpenShift are similar areas in government. In South Australia Department of Premier and Cabinet use Microsoft Azure Red Hat OpenShift. I believe Victorian DPC also uses a similar implementation as well as New South Wales and Queensland Health. Any additional information around these kind of implementations I'm really keen to hear about. I'll just go over a little bit just in terms of what our testing class looks like. This is what Red Hat OpenShift looks like with its central dashboard. You can see we've got a range of real-time monitoring and just an overview of the kind of applications and services that we deploy. For example, here's a range of pods and just looking over to the right you can see for each individual service component we have real-time monitoring of memory, CPU usage as well as a range of logging that we saw for who interacts with those services. Here's just a lower level view of the service information that's been used for one particular pod and you can see it actually is down to almost a second that we do recording of our system usage. And here's again that same pod just showing the log output from this one particular pod. So all of this information is stored, it's backed up on Microsoft Log Analytics and that gives us a really good way of having an audit history of all the work that we do. Just a couple more slides to talk about how we interface with these systems. So in this slide on the left I show the SA.gov.au domain. I'm really looking at the SA Health DNS. So that's really when somebody is on the SA Health domain or on state net, this is how they interact with us. They do recursive DNS from the SA Health DNS and then they would be able to find our DNS at the heart AI DNS. So really showing how that interface works on state nets. This is all essentially overlay networks on state net as subnetworks. And really probably the key thing here is the fact that we're doing a service proxy, reverse proxy paradigm that allows us to have a hardened edge networking implementation and then a service proxy, a service reverse proxy that we can scale up to have high availability. Also shown here is how we're doing identity and access management. So we're using an OpenID Connect and OAuth2 stack using Red Hat Single Sign-On. This approach allows us to do identity federation with SA Health HAD active directory accounts. So with our systems we also support users coming to access our systems but logging in with their SA.gov.au identity. We can actually federate with that. We're also looking in the future to provide federation to the Australian Access Federation such that the institutions can also access these systems by federating with us over state net by exposing that network. So more details to come about that. In relation to what users have to do to access data at one of our service endpoints, they really are required to pass in one of these OAuth2 access tokens. So these will be validated at a service endpoint. We'll be able to then log who that person was, validate that they have the right level of permissions to access at endpoint, provide a range of security assessment, security constraints around that. And we do that for all of our service endpoints over encryption as well, such that any mechanism or any interfacing that is done at that service level is recorded and monitored. So that's what we're working with. This is really my last slide. But at the moment we've had approval to store quite a lot of data. At the moment we have about 300 million records from a range of different data systems. These are administrative records, emergency records, pathology records, pharmacy records. We have a huge amount of clinical data that we're using for research and making sure that with the support we've had to go to cloud, making sure we're doing the right thing with this. We've been very fortunate to have an opportunity to go to cloud. And I think we're one of the first groups in South Australia in the health system to go to cloud. So we're taking this very seriously. We're working very closely with Digital Health SA and our stakeholders to do that. Actually just this Friday, I believe Andrew and I have a meeting here at Samry to talk about the relationship between the institutions as well, because we'd love to make these resources available more generally. So that's a very high level overview of the work we're doing. But yeah, thank you for joining us and thank you for your time. Thanks Luca. I'll just take over screen sharing. So I'm just going to talk on five main topics. Just going to introduce myself and give you a bit of background of who I am. I'm going to talk about when the best time to engage ICT is in some of these projects. What kinds of questions we ask when we're doing those engagements? Some of the solution options that we look to implement and then I want to talk about cloud versus on-prem which ties in quite nicely to what Luca's just talking about. So I'm the applications team leader at Samry. I run a team of software developers, business analysts, project managers and application specialists. Previously I was the lead software developer at Samry before I started in my current role. So I was really doing a lot of coding on basically one project but now I'm a lot broader. Prior to Samry, I worked as a senior technical consultant at Enterprise Content Management software company and before that I worked in defense for a few years. So I guess the common thread throughout all my engagement so far has been dealing with sensitive data has really been front and center. So when should I engage ICT? I guess the short answer is early and often. So earlier is always better and there's probably a few key time points that I suggest. So one is like when you're brainstorming and thinking about an idea for a grant. The next is when you're actually starting to write that grant. When you get the tick and you get funding approval, that's a good time to engage us as well. When you want to kick off the project and then wrapping up the project as well is really important but it's probably overlooked a little bit. And actually doing the design for your project or your grant, ICT can help you estimate costs in the technology space. We can help you identify any roadblocks or any high-risk items that you're thinking about doing, things that we might need to like investigate a bit more. And it can also help us to start thinking about technical solutions to your project. So if you bring in a grant and you're not going to find out about six, nine, 12 months or whatever, we can start planning around our own capacity just if we think that there might be enough demand to do something new in our space. So when I engage with projects around this kind of stuff, there's really two main categories they'll look at. One is data, one is access. So by data I'm really interested in like what kinds of data you're looking to store. So if it's just, you know, server responses in text or as an image or as lots of images, video, how sensitive is the data? So, you know, is it identifiable? Is it just anonymous? Something that you've collected through SurveyMonkey or something like that? How much is it going to be? So if you're pulling data off an instrument, it might be like terabytes per day or it could be very small. So we've got to understand that. How are you going to receive it? So is someone going to rock up with a USB flash drive and give it to you or are you going to pull the data off an instrument or whatever? We have to understand that. Then during the course of the project, are you going to give the data to someone else, either like throughout the project or right at the end? If you're going to do that, we need to kind of come up with the best way to do that transfer. So, and that will be informed by the sensitivity and the size of the data. And lastly, you know, how long do you want to keep the data for? So in your ethics agreement, you might say something like we're going to keep the data for 10 years after the study closes or you might say you want to destruct it right at the end or you might want to keep it forever. So we need to understand that straight up so that when we can plan around, you know, backups and all kind of stuff. When it comes to access, I guess we're really interested in the categories of people that are going to be participating in your projects. So if it's all just internal staff, then that makes it a little bit easier because we can try and authenticate people against, you know, our own corporate directory. So normally active directory in most places. If you've got external people, we kind of need to understand their relationship to us. So if they're just people that are part of institutes or part of institutions, then that makes it easier because you could do something like the Australian Access Federation to authenticate everyone in to the same bit. But if they're overseas or commercial entities, then that makes it a little bit tricky. So we've got to understand that. Most of these details or these questions that we would want to talk to you about are way more complicated or low level than what you put in ethics applications. So just because you have an application or grant ready to go, we need to understand the next couple of levels down so then we can give you better costings and better estimates around time frames and resources.  When it comes to solutioning, which is kind of my favorite part of this process, there's really like three broad categories of solutions that you'll be looking at. So one is you go and pay someone to run the thing for you. So SACS Institute has sure, which you might be aware of, that we should basically like a self-contained managed environment where you can do secure data analysis. We might pull a few off-the-shelf components into a coherent solution for your project. So one example that we've done in the past is you can have your survey or data capture stuff in RedCat and then do an exploit out of that into a stats program like SAS or R or SATA and then you can do your analysis there. Lastly, we might end up creating a custom solution for the ground up. So you might hire some software developers and get some shiny new servers and build some software that does exactly what you need. So when it comes to choose, I guess the answer is it really depends. So how much time you got? How many resources are you going to have to do it, both personnel and I guess funding as well? The initial ongoing cost structure, so how much money are you going to have in the first year versus the future years, which is I think what Helen talked about in her presentation. I guess also OPEX versus CAPEX is probably something as well because not all grants allow for both or there might be purely a CAPEX grant or purely an OPEX grant. How novel are the requirements? So if you've got some pretty special stuff you want to do, then that might take that managed server stuff off the table straight away. It might also take that integration of off-the-shelf components off the table as well, in which case you kind of look left with that custom solution, which has its own risks but also its own rewards and data sovereignty is another thing. So if you are looking at a managed service for example, you have to be really careful about where that data is being stored from both from on-premises cloud stuff, but also which countries are being stored in. And the ICT people that you're engaging with can obviously guide you in all this and they're going to be really key people to consult with. Last slide I want to talk about is cloud versus on-prem. So Luke has given a really good example of what you can do in the cloud now, but historically I think sensitive data is often had a requirement to store data on-prem. It's not necessarily something that you should just be by default copy-pasting into your ethics application. I think you really need to consider it really critically about whether you want to box yourself into that kind of stuff because a properly configured cloud instance is if not equal to or better than an equivalent on-prem service. So you've got a whole different set of risks obviously, but you can bolt it down. Luke is just a really good example of that. To be, I can't say that anyone would have a real problem with the story in the cloud. And there are added benefits. So you can get a better cost outcome often, particularly if you've got development environments or test environments that you don't need to have up all the time, but if you're hosting it on-prem and you bought a server, that server's there and it's going to be sitting there, but if you've got test environments in the cloud, you can turn them on when you need them and turn them off when you don't necessarily have to get charged when that's off. Availability, obviously you can do a lot of stuff around geographic redundancy and speed of deployment is great. So you can have an idea and set it up and get it done on the same day. You don't have to go out and procure a server and wait weeks or months for it to get racked up. And a lot of those environments are already certified to protected status already and they've got a little table there from protected security about that means, but it is, you know, like you can store reasonably critical data in those environments already without doing much extra classification or yet work. It's my last slide.  Yes. Thanks. Thanks all. So we have some time now for questions and discussion. I'm just going to check the chat and see if we've had any questions so far, but if anyone would like to ask questions from our presenters, we can pop them into the chat. I had one to start us off because, Andrew, you mentioned that at the level of involving, at the point of involving external IT support, you really need to have that sort of lower level understanding of what's going on beyond what might be in an application. And I was curious from your experience, maybe from all of your experience, how often it is that you find that research teams maybe aren't at that level of thinking yet and how you negotiate that. That's a great question. I ask it as a former researcher, so I'm really, you know, making fun of myself. Sure. I think in a lot of cases people have thought about it, but they might not have put it down on paper. So what I would typically do external to a grant application is actually write up after I've engaged. This really drives the cost discussion or the cost estimate discussion and the resourcing discussion. So what I would typically do is go to that next level down and actually start documenting what I think the solution would look like and all of the caveats and risks and opportunities that would be there and put that back to the researchers before they submit their grant. Then we have got a shared understanding of what we think that next level down is. And then when we come to the next part of that engagement, whether it's going from brainstorming to submitting or from submitting to approved or whatever, we can revisit that document and then flesh out that next level so we can get a better understanding of what it is. And even just putting stuff on paper does start to tease out some of those questions. So I don't think anyone intentionally just goes out and doesn't think about that next level down. But I think it's helpful to start documenting that stuff because then you can kind of have a shared understanding between the researchers and ICT about what you're going to actually deliver if you're successful. Yeah, 100%. I agree. I think it doesn't, I suppose we'd ideally like the researchers to come and have a chat at that early stage before you 100% know everything. But at the same time, yeah, exactly. Writing, drawing out a diagram of what you're thinking sometimes really clarifies some vulnerabilities or sort of missing parts that haven't been thought through yet because the whole process, I mean, often doesn't even need to be fully thought through in order for the grant to be written and accepted. So you can very easily get quite far down a research project without actually having planned all of those steps and going back to sort of budget and communication. If the whole process hasn't been sort of clearly talked through together and mapped out, it's really easy to sort of fall into communication pit holes where there'll be the assumption that this sort of end point can be reached. But without the intermediate steps, which might require either time or funding or something like that. So yeah, so I mean, yeah, my personal preference is for diagrams for the either on a like a whiteboard or sent to each other over email of what that process looks like so that everyone can make sure they're on the same page. And then yeah, following up with a sort of document to go through each point really break it down. And then that can be sort of sent around by the research group as well to their collaborators to make communication easier. We've had a few requests Helen for would love to see examples of diagrams that you've used please Helen and then someone would be good to see the level of detail required and visual projects and system representation. I mean, I'm sure that maybe specific diagrams are specific to projects that themselves are sensitive. Yeah, I had a look so I've got one that I've just like quickly de identifying. So it's a, I mean, I suppose each diagram is really specific to who you're talking to and what this setup is what you're talking through what the project is, but also yeah, I think Andrew is talking about and Luther is well about roles and responsibilities. So it's going to look different if you want the external IT support to be effectively guaranteeing that you're meeting ethics requirements, then you're sort of handing over in entirely conceptually the sort of sensitive data management process to them. And so it's really important that you're both the research group and the external IT support both constantly on the same page and really communicating well and frequently about that. Whereas if the research group wants to just hand off sort of a silo of the project to an external IT group, then it's going to be on the research group to be doing a lot of that documentation. I personally would, even in that situation, still recommend that you go through the whole process with the IT team. And in that situation, if you just want to hand over a tiny part, your diagram will look sort of much smaller or much more specific. But also then that does mean that the research team has to be on top of all of the other components and how it maps to everything. So it does mean that you probably need some pretty strong internal IT capacity if you're going to do that. So in general, I wouldn't recommend it. But yeah, I'll show my screen and just show you this example one. So it is very specific to this project, but hopefully it'll give you an idea. So what I've got just as an overview here, you won't be able to really see much yet. It's just like this particular group has three different servers that they're working between. And we came in at that stage of the project where they already had a setup that had been sort of provided in a mishmash of internal and external collaborations. So the first thing we did was to map those out. And part of the purpose of this diagram was to indicate that the setup was a bit more complex than the research team realized it was and that the vulnerabilities were actually sort of scattered throughout the IT infrastructure. So I'll zoom in a bit so you can see. So this is the sort of their basic development process. So because the development process is so much part of the, I suppose, the security limitations and requirements of an IT-based project. In this particular case, I included the sort of development steps that they have so that everyone from their team was on the same page about what their internal members were doing IT-wise, which helped us then to be able to be like, look, if what you're wanting is for this particular section to be updated, what that involves as an external team is for me to do these three steps, which are reliant on a particular member of their team to approve before that can happen at all. So that was really helpful in that case because often the person who's funding the external IT support is not the same person who's doing any sort of local data work. Usually it'll be like the lab head or someone's senior in the group and often they'll not be the same ones doing the kind of data analysis within their team. So that communication between the person, I suppose, funding the external team and their team members was important for this part. So what we've got here is, yeah, a couple of different environments. Again, this is really focused on these kind of like flow steps and what they currently have set up. So what we've got is these are all sort of, in this case, automatic steps that are happening behind the scenes and sort of times in that process where we can intervene and do various things, steps that are required that are manual versus automatic, flagging anything that was not as they expected it was and off using this diagram as a discussion point, we then wrote down like a vulnerabilities list together and sort of a to-do list for next steps to improve that environment to do what they actually wanted it to do. For the other diagram, I can send around this document which had that transformation one. So I'll send that to you, Nicola. Fantastic. Thanks Helen. So I have a couple more questions. What can researchers do if their IT support, external or otherwise, isn't as nice as you three or become blockers? Any advice? Well, Andrew, you may be the best at this one, but I can maybe speak a little bit from experience. So we had a bit of certainly a lot of challenge with getting our systems set up, particularly on the SA government network. And what we found was I think one part of it was actually building the relationship with IT. So trying to understand what their requirements were and what their needs were. So when the discussion was about security, really what were they looking for? How could we actually come to them and have the discussion about what was appropriate for them? I think another part was also the kind of backing to use a word. So we did end up building a lot of relationships with clinicians and stakeholders and administrators to really start talking about what the value was in this case of going to cloud, really raising the discussion of why were we going to cloud? What was actually the reason for it? And then how were those reasons mapping to the IT requirements? So I think we're able to actually have that conversation from both an IT and technology perspective, but also from a business value and a research perspective. So initially, it was blockers for quite a while. It was actually really difficult for us to engage. SA Health is a huge entity of 50,000 employees. But after enough time and after really figuring out what were we asking for and why were we asking it, we were actually able to then have that conversation and it's going much, much better. And I think the people that we thought were blockers were actually really lovely people. So yeah, I think that was just a story that we went through. But maybe Andrew or Helen's also got some stories as well. Yeah, I guess an approach you can take potentially is so if you come along with a fully designed system that you want IT to implement, they might look at it and go like, well, we can't do this or this or this or this because we're not just set up to do it. So you might have to just take a step back and try and think about what you're actually trying to achieve from a like a requirements, almost like a first, first level requirements step, and then let them, I work with them to guide you through what they can do, what the art of the possible is, because often, you know, someone might be saying, oh, coming to you and being like, we want to do something in Docker and Kubernetes and blah, blah, blah. And your infrastructure or your IT team might be like, we can't do any of that because we don't have any of that set up. So you need to go back to the drawing board. So if you're in a bit of a constrained environment, you might want to think about not getting going so far down the path that you've got a technical solution for us, you really want to bring it back to what we're actually trying to achieve from the business perspective and be led by the ICT team around how you actually achieve that at the technical level. That would be my suggestion. Yeah, absolutely. I think a lot of the difficult relationships happen because there's so much stress, really. Also, IT professionals can't necessarily do, you know, like they'll have a set of skills, but they won't necessarily have done everything that you might like to use. So just having an honest conversation about what their limitations are in terms of, it might be timing or it might be skill set or it might be infrastructure limitations. I think that sometimes people are surprised to say if they want to store data that that would cost money. That often does surprise people, but it's a sort of a practical situation. You need somewhere to put it and either you're paying for someone's time to set that up or you're paying for the sort of physical place that that is stored. And that might be more of an ongoing cost if it's more of around the sort of physical storage, or it might be more of a short term cost if you're paying for the person. But all of that type of stuff. Yeah, exactly. If you come to IT with a request for a sort of a complete idea where you want to be really specific about how the actual IT part of it works, there might be limitations around that that make that setup almost impossible with your combination of sort of funding and sensitivity restrictions and things like that. So it's something that we will hear a fair bit is I heard in this conference that this dashboarding solution was really secure and I want that. So that's what we're going to go with. But they're not aware that the pricing that they've seen on the internet is just for like a single user license and that to then share it with other researchers or to do anything interactive for all the things that they want to do that require quite a high level of security and control, they have to pay a lot more money. So yeah, so not coming in with a really fixed idea. It's great to say I saw this thing at a conference. I really like it. Is there something like that we can do that's much more manageable for an IT team? But if they're being grumpy, you could actually just ask why. Like is this too strict? Like is sometimes the IT people you're asking are for the building and they're not necessarily supposed to be for like research projects in which case you might be asking them to go like really above and beyond and work a lot of overtime for something and you don't realize that that's not actually their job. So having a frank discussion about like I want this to be a good relationship. This is what I want out of this project. Is that actually something you can do? I think that would be a really good discussion to have. So thanks. Any advice on how non-technical researchers can find vendors or IT specialists that are used to working in the research space? To the uninitiated, a lot of commercial IT or data vendors on the market seem very business focused as this matter. Have opinions on this one. Unvised opinions? Like completely unbiased. You are first? No, and I go for it. All right.  Talking to other people in your building and your institute or around the traps based on like other people that are involved in this forum, for example, can help.   What I would strongly recommend people do is ask for referenceable customers from them and sit down and you know, if you're trying to do a data research project and they give you customers at a bank and that's what they think is their best referenced customer for you, then that's perhaps not a good fit. But if they can give you someone else that they've worked with in the past and you can talk to them and explain what you're trying to do and they can explain what they did and they give you a glowing recommendation, then that's a pretty good, you know, probably going to be a pretty good fit. But if you just talking to the vendor and you don't get a second opinion on that same vendor and then if they can't provide you with any referenceable customer that are in that same space as you, then that would be a warning sign for me. Yeah, totally. And I also think, I think sometimes people expect to be confused by the conversation with someone external from IT and that some people can be predatory and use that to their advantage. So if you're, I suppose, treated the same way as you would any contract that you were considering, if they, they should be trying to make you feel comfortable and they, you should be able to understand all the parts of the process and you should feel comfortable saying that you don't understand or that you are uncomfortable with part of the process or you don't think that sounds good. And they should work with you and be positive about it. And if they're not doing those things and they're just saying we'll fix it for you, that's a, that's a bad, I think, I think a lot of people get into trouble because they expect it to be confusing. So they just accept a confusing explanation. And then they can't pick up any warning signs. So the person should be, it doesn't matter how complex the solution is, the person should definitely be able to be like, this is, like this, if this is your ethics application, this is how we're handling this part. You know, the reason that that works is this and this and this and you should come out of that feeling really confident. And if you don't, then they're not the right person to be working with. Yeah. So in any kind of engagement when there's like a technical asymmetry in the relationship, like you take your card or a mechanic, if the mechanic can't explain to you why they need to change your doodad, whatever, I'm not a carpenter. But if they can't explain it in terms that you can actually understand, then I'd go somewhere else. Yeah, exactly. Brilliant. And thanks. One last question just quickly. We've got a couple more minutes. Do you see initiating engagement between IT and researchers as only the responsibility of the researchers? Yeah. Sorry. There's a lot of researchers at Samrine and I'm one person, but I'm trying to build as many relationships as I can with everyone that I meet. And if people know you, then we'll likely to think, oh, I need to just reach out to Andrew right now because I think we're at the point now when we need to have a chat because this is what we're thinking about doing. I think that, yeah, so, you know, IT can't, I think it's unrealistic to expect them to reach, be constantly checking in with every single researcher or every single research group, but at the same time, we have to build those relationships so that then people feel comfortable coming to us, not like they're going to come to us so we can say no to them because that's not the intent. It's never going to be the intent, right? Yeah, that would be my take on them. Yeah, I've got a thought of that as well. I actually also, I try to really approach researchers here. My background is in bioinformatics, and I do see a lot of the research also at Samrie where it could benefit from some IT support, from automation, from scaling up, from some more high performance approaches. So I think IT can look into what's happening at the research space and think, what can be done there to innovate? How can we support that and actually bring that discussion to them as well? I found that to work really well with a few of the people that I work with, and I think very often the researchers also don't know what's possible, and you can really bring some innovative ideas by having that discussion. So I do see the potential for a two-way relationship.


Good morning, everybody. My name's Jeff. Can everybody hear me okay in the back? Should I talk like that? This one this one closer. All right Gotcha. Okay. Um, like I said, my name is Jeff We're gonna be talking about Gutenberg blocks kind of what's underneath behind the scenes Stuff that you don't usually see when you're dragging and dropping blocks and playing with Gutenberg I work at automatic. So I've been there for about eight years and I work on Calypso which is the front end of wordpress.com. So I'm working and react most of the time with connections to the back end and So, you know, it's I've been learning Gutenberg just like the rest of you so thought I'd share some things that I've learned and Feel free to stop me if you have questions, especially when we get to the code stuff if there's anything you don't recognize Just let me know So by now you've all seen the block editor, you know You come in to the the wordpress editor and you can put in a Twitter block You can put in any sort of block and you know, it's what you see is what you get it drag it around and it's a nice little package It's a block. It's something it's a piece of content and you know, we're all pretty familiar with that by now It's it's only been there for I don't know a year How long is Gutenberg without not very long, but we're all pretty familiar with it by now and I'm sure we've all seen this thing pop up a bunch welcome to the wonderful world of blocks and There's the promise of Gutenberg bringing full-site customization The next round of the focus for wordpress is to bring all of these blocks together for basically revamping the customizer But I'm gonna talk a little bit about what's behind the scenes today So if you look at the the Gutenberg repository, there's a quote that's been there for a while That says Gutenberg is more than an editor While it's currently focused on building that block editor It doesn't end there So there's groundwork for a new model for wordpress core that will ultimately impact the entire publishing experience of the platform I don't usually like to read quotes in a talk, but I feel like this is pretty important So Gutenberg, it's more than just this block editor. It's a modern web framework for wordpress And it's something that you can use in your sites and things that are beyond websites I invite you to install the Gutenberg plugin if you haven't I know Gutenberg is Installed with wordpress core as is but install the plugin you'll get the latest and greatest and there's this cool demo if you haven't seen it so if you install the plugin you've got in the sidebar menu Gutenberg demo and You can just play with some of the stuff that you've seen kind of at the keynotes You can move stuff around see what the images do it gives you kind of a good overview of what's there And if you think about it, there's a lot going on with this screen right here there's a lot that's behind the scenes for making this possible and it's kind of cool that instead of keeping it all in Gutenberg and and Not opening it up to you to all of you and all and everybody else in the world These things are being published as packages and you can use them As you see fit so let's talk a little bit about that What's this talk about what are Gutenberg packages? What are some packages? What do they do? How can you use them in your own project? What are some of the other tools that came with Gutenberg that are now in wordpress core? And then how can you contribute to back you package development? How can you take something that you've learned or something that you see that maybe doesn't suit your needs or you think would be Other people would find useful. How can you give that back? What's it not about? It's not about how to create a Gutenberg block. It's not about how to Build a site composed of blocks It's not about the voyages of the Starship Enterprise if you want to learn about how to create a block Julian had a pretty good Workshop yesterday, so I invite you to watch that video if you didn't see it It's not taped Workshops aren't taped. Well see you the next time there's a workshop on how to build a block or go out and then check out the Handbook for building a block But this is kind of about how to do things outside the box in your own project if you have an existing Site or it's something that you want to use some of this and that's newly in wordpress So what's in the box now because of Gutenberg?  It's in wordpress. You can just use it load ash similarly There is something called underscore that is in wordpress already, but now you can use load ash It's the newer version and there's packages which is what we're really going to talk about these wordpress packages or Gutenberg packages How are they built? How can you use them? So what are Gutenberg packages? It's modular code. It's reusable. It's it's a package just like any other package system You can take it and use it the source is in the Gutenberg code base under the packages directory You might have heard the term mono repo and they've kind of taken this approach with Gutenberg to kind of have everything that they might use in This vein in this sort of framework and have it in the Gutenberg repository and then package those up And then they can use them in other other places like wordpress core or like your own your own software they're managed by a tool called lerna and Learn it can get pretty complex, but it's just a way of taking these things and spitting them out in a format that can go into npm or other sort of package management systems and When there's a Gutenberg release Everything gets built and then they get pushed to npm if you're familiar with JavaScript development at all I'm sure you've used npm to install a package and that's where these live Then wordpress then includes these built copies of these packages Inside the WP includes JS disk directory and You can use them. So what sort of packages are there? There's all sorts of packages. There's data fetching state management presentation view layer ports of back-end PHP stuff that you'd expect In 2019 to be in the front end. They're there, too There's a lot of dev tools and etc. Etc. If you look at npm under the wordpress Organization, there's oodles and oodles of packages there for the using and Indeed if you look at the source of wordpress, this is the package JSON Which talk a little bit about in a little bit you can see that all of those packages at wordpress Blah blah blah. They're all being imported into wordpress itself. So The source lives in Gutenberg and wordpress imports them and you can do the same thing Here's the block editor handbook for one of these packages. It's called element and it's Interesting to note that elements kind of an abstraction layer on top of a react element And you can read all about it there. I just kind of wanted to show the handbook and what a package looks like there There are reasons if you read the page why they chose to create an abstraction layer on top of react But for the purposes of this talk, you don't really need to know that The block library itself is an npm you can install the block library and then register the core blocks and basically a non-wordpress context and There are software out there that have used the Gutenberg editor That are not wordpress. So I think that's pretty cool How can you get started using wordpress packages? First I suggest that you install wordpress locally and it's um, you know, it's kind of a matter of choice how you like to do that A lot of people like local by flywheel I Actually use the jetpack docker environment. It's pretty handy for for my day-to-day VVV is short for varying vagrant vagrants I think and a lot of people use that Gutenberg itself has a Docker environment that you can spin up You don't have to have anything installed on your system except for Docker and if you follow the instructions here It can help you get a local environment, but like I said, it's really kind of What you like to do with the kind of projects that you like to work on as to what your local environment might be it might be You actually install wordpress itself and that's you can do that if you want to Something else that you're going to need is node. It's anybody not familiar with node. It's It's a Way to run JavaScript locally and run scripts and do all sorts of stuff. It's kind of a Swiss army knife and It's kind of one of the first things I do want to set up a new computer is get my node environment I use a piece of software called in VM to manage that because different things that I contribute to required different versions of node and again, that's something that people have different different opinions and different Different pieces of software to manage their node versions and Then you can just use npm npm is a piece of software that comes with node typically that lets you install packages npm Used to be short for node package manager and you can think about it that way So like I said these scripts or these packages are in npm. You can just install them npm install at wordpress scripts It's kind of the basis of the demos. I'm going to be showing in a little bit that installs a Tool to help you run These tasks to build your files and that sort of thing and it's pretty useful ES Lent plug-in is another one that I wanted to call out because it It helps you to to do things WordPress style way a lot easier if you have an ES Lent plug-in in your Editor it can show you where things are not to the WordPress coding standards and you can even use tools to automatically Make them to WordPress coding standards. It just saves a lot of time. I'll show that often a little bit and npm install word at WordPress dot dot dot all of those packages. That's pretty much how you install them Is there any questions about anything so far? Cool This goes to the scripts that I was talking about at WordPress scripts if you go to Might not be able to see that list if we can zoom in developer wordpress.org block editor packages package scripts set up or you can just Google for WordPress block editor handbook scripts or at WordPress slash scripts This shows you how to use Some helpers to help you do things like build and do some lending the main one that we want to talk about is build and start There so I would suggest you at least have those two Because after you have that in place in your package.json file, you can just run npm run start and it's pretty handy And it will keep rebuilding your files Cool. Okay, so I'm going to show off some code on how you can actually do this sort of thing Please feel free to stop me if anything doesn't look familiar if you don't understand the syntax That sort of thing if you want to follow along You can go to the github repo JBLZ slash WCAVL 2019 And here's the repo that I just Told the link to First file we're going to look at is just your basic entry point for your plugin This can look like any plugin in WordPress. This just had to be something in place for me to do a demo And what I'm doing here is for these demos. I'm just looking for a particular post ID and then For the repo it was github.com slash JBLZ W or slash WCAVL 2019 Yes, thank you. Cool There's the repo cool, so What I'm gonna do for the first demo is I'm gonna look for this particular post ID and run this demo one And if you look at demo one, I'm in queuing some styles and scripts and running this function here for registering a bunch of these These packages scripts that exist in The WP includes JS disk directory like I mentioned before and this is on the reposts I don't feel like you need to copy any of it down And then I'm just in queuing a JavaScript file just like you would probably be used to is anybody not familiar with WP and Q script and WP and Q style Those are if you are It's just a way to take a script or a style Which is which is just a file and then send them to the browser at an appropriate time Rather than just taking your JavaScript and writing it directly into PHP So this is a way to get a JavaScript file or a CSS file into the browser and It's noteworthy to to mention that this is not a Built JavaScript file. It's just plain. I'll show it in a minute and It has some dependencies and if you look at the dependencies for it We're including something called WP polyfill That is one of the packages that's available to you that that lets you have broader browser support It's not kind of a silver bullet But if someone is coming in with an old version of Internet Explorer something like that It'll probably still work if you have this or another polyfill to Bring it up to modern JavaScript standards There's a package called nux which stands for new user experience It's a way to focus attention and show guided tours and that sort of thing There's auto P Which is a port from the PHP side of WordPress That takes whenever it sees a block of text and has a new line in it. It will add paragraph tags around it Date there's a date script, which is another port from PHP Element is the element. I showed you before Which is the abstraction on top of react I 18 n is short for internationalization It's a way to localize your UI for various audiences word count is self-explanatory And escape HTML is a way to prevent troublesome characters from getting into your browser and causing trouble with cross-site scripting and that sort of thing so now we can take a look at the JavaScript file that is loading and Before I show off the demo. Let's take a look at that Let's look at it in an editor. That's a little nicer All right, so this is just straight JavaScript. It's not compiled and It's wrapped in a function that wraps around this global WP object and You're probably familiar if you've done any front-end JavaScript with WordPress this Global WP object houses most things that are WordPress specific that you can use and then up at the top I'm destructuring out these scripts so we can just use them locally And those kind of relate one-to-one with the packages that I showed you before auto P date element escape HTML I'll show them show you how we're going to use them I've got a block of text that's maybe from an API. I'm looking for an element at a particular place and Doing some stuff. I'm doing a word count on it adding an event listener wrapping in internationalization functions and the rest I'll come back to you after I do the demo First off the plug-in is not activated. So you can see it's just an empty page if we go and look at The editor for it. There's nothing special going on. It's just a regular page type post There's nothing in the content. There's just a title and As you see there's nothing there, but if I activate the plug-in That JavaScript file is going to kick in it's going to look for that element there It's going to take that block of text Wrapping it in WP auto P to get the paragraph tags You can see it adds paragraphs around where there were spaces here That is the the NUX Tor I can't remember what you call this particular widget, but it attaches this sort of element to Another element on the page and I added a little Little delay so you can watch it's not there until you scroll down Up there it is and it's styled pretty horribly, but at least it's style, right? New user experience so The welcome to the wonderful world of blocks pop-up thing that I showed you at the beginning is I think it's part of that And the button handler works and it's doing a date format and we look back at the code Yeah, there there are properties for that. It's not implemented here, but you can You can keep track of the state of that Yeah, that's really annoying, but it will come back because I haven't implemented that part And So a couple things to kind of point out is this is how you call the auto P. It's a little weird because You import it as auto P and then you have to call auto P auto P And then it's in kind of the same thing with escape HTML escape HTML That's kind of a gotcha there That's lowercase and that's uppercase and they all have different functions and then that you can use But the escape HTML is making sure that sneaky scripts don't get into your stuff from an API or something like that This is your internationalization localization function to wrap a string for translation so if we had If we were trying to target multiple markets or something like that multiple locales We could have translations for engage that were local to wherever we are On the back end and we could load those and it would show and all of that stuff Let's see is there anything else? Nope. I think that's pretty much it for demo one. Oh the word count So you can see it's counting it and then just saying Appending to this string it has that number of words and if we look back at the page Move this out of the way. There are 215 words in that ridiculous Star Trek Ipsum that I found on the web Cool so that is Kind of an example of something that I would probably only do kind of as a last resort if you have an existing Script that you don't really want to convert to like a built JavaScript file If you don't have a built environment if you have other constraints and you're loading from Ascidian that you can't affect you can then go in and do this sort of thing without having this big build environment but the Kind of the beauty of that at WordPress scripts Thing that I showed you before with the build and the start is it gets you a lot of stuff for free that Otherwise would have taken a lot of setup Webpack environment a webpack is a way to build your JavaScript it gets Everything this WP scripts binary can do for you So it's kind of cool. I'll show you that and In your terminal You can just run Yes, thank you That better You can just run npm run start and you see it's going out. It's looking for It's looking for some configurations. I'm using the default webpack configuration. I've not customized anything It's just what's built-in to WP scripts And it's looking for files in a particular place So as long as you put the files in a particular place for your JavaScript entry It kind of does everything else for you and you can go in and let's see. I'll page down a little bit so you can see I'll go in and edit demo 2 Which is just the hello world for using Using this from a build script so set a one Exclamation point will do three and if you look back here, it's going to pick up automatically that I've Edited that file and build your whole app again just the parts that need to be built. You see it only built that source demo to index It's pretty smart about knowing if something has a dependency on another module. It needs to rebuild that So it's kind of cool So it helps with that feedback loop. It kind of makes it more like you're just Loading a JavaScript file and you're just editing that so you don't have to go out and run the compile script again so the entry for our built demos is in See how am I on time as an index.js just inside source and It's nice to separate out your dependencies like this So if you look at the WordPress source and the Gutenberg source I'm you're going to have things like external dependencies which are not part of WordPress proper They're things that we've imported Internal dependencies. These are particular to the demo that I'm giving today and if you look other places let's look at for You'll have WordPress dependencies, which these are the packages. These are things that you're importing from npm or Scraping off the WP global or that sort of thing. So it's nice to have those in place So you can kind of see what's going on Let's just talk about demo to for now I'm just importing it from a directory that's relative to the current one and This is just a little bit of an illustration to show that you know Your app can be dynamic and you can switch based on a number of things and I'm passing Demo to from the PHP script For the built demo Just letting it know this is demo number two for this particular page And if you look back here, if it's demo number two, it's going to render a demo two If you're not familiar with this syntax here This is called JSX it is a way to make writing JavaScript components and particularly react components a lot more like writing HTML it helps with composition You can do things like adding foo equals R and That'll automatically get sent to this component as a prop or a property So it will know that whatever wants to display a demo to also wants foos to be bar if that makes any sense probably doesn't While I'm live editing to show you something cool I added a a new line added some spaces and You're probably familiar with WordPress coding standards that that wouldn't fly so when I hit save watch what it does Puts it right back and this is part of the ES lint Package that I showed before I've also got a piece of software in my editor called prettier Which takes those ES lint standards and then applies them on save and that's all customizable per your editor So I invite you to look at ES lint. It makes that sort of thing so much easier. You can just paste stuff in Do all sorts of stuff? I Can even do like oh, I forgot that this doesn't need to have a demo to closing and it will get rid of that and Just make it a self-closing element and as you can see it looks a lot like html and it's meant to And all the time I'm doing this it's rebuilding my app in the background So let's look at the demo to on the front end just for the hello world and This was it with the The plug-in disabled when I reload it's just gonna say hello world because that's all that we've told it to do here This is a react component. It's a functional component that takes no properties and just spits out a div that says hello world That's pretty simple If anybody doesn't understand this syntax This is just a function short function syntax that takes this one takes no arguments, but if it took arguments We could put arguments in either arguments or We could destructure them with arg1 arg2 But this one doesn't use them. So there's no sense and in the background you can see it's been building all of this stuff and if you take a look at What actually gets sent it's build JavaScript Let's take a look at demo 3. There's only one more after this. So I have a couple of minutes for questions same thing demo 3 is just switching on a particular page number post post ID for a page minimal Dependencies load ash like I mentioned before it's it's a functional programming Kind of helper utility library that's another Swiss Army knife. It's really good if I invite you to take a look at the docks for load Ash, it's really useful on the front end get is a way to Get deep properties of an object without worrying about Errors if you've ever tried to do like X dot y dot z and you get a weird error this helps you get around that and you can specify a default value so in this demo, we're gonna do some fetching so we're importing the API fetch package and You've already seen the escape HTML. We've already seen the Internationalization functions I've got a post ID that I'm gonna try to fetch and Here's the fetcher function to do it and All I'm doing is calling the rest API for pages and this post ID and After the rest ID our rest API comes back then I take the post do some massaging of it and Use the get function from load ash to get deep into that post object that comes back from the rest API and get what I really want is this title rendered for a title and link for link and Content rendered for content if you look at the shape of the rest API, that's how it comes back and then I'm taking and looking for Looking for particular elements and then just plopping the results in and this is not the best way to do it And that's what demo 4 is for to show you the best way to do it or the better way to do it and There's a button and when I click it it's going to fetch the thing and it's gonna put the stuff in these It's any of that unclear. I kind of went pretty quickly through it right here. Yeah. Yeah so Okay, right here This is just a string if it's probably hard to see on there But this is a a newer kind of string and JavaScript that uses a back back tick instead of a single quote Yeah, so if you take a look at this self-closing syntax if we take out that slash and we can put Stuff in here and then close h3. It'll keep it But that's just it's a shorter way and there's less code to store If there's no stuff in there, it'll get rid of it and just do the self-closing syntax I don't think that's valid HTML by the way to have an h3 that's self-closing I think it'll probably work, but it's not really valid Anyhow On to the demo. Let's see if this works Clicking and it's getting this post over here there It's a regular post. It's getting the title and the the content over the REST API and just plopping plopping in into this div that's there and If we go over here and change Change that there's coffee in this nebula to Art Tuvix And we reload this actually we didn't even need to reload could just click it again It's gonna go out and get the new title and the link that's there and same content and That's all happening over the REST API So any questions about that? There's really no data flow or anything there the package part of it is the API fetch and Internationalization around the button and escaping the HTML and escaping this attribute and link Again, this is not really how you do it. I just wanted to show off some of those functions All right one more demo and it's kind of the same same sort of thing it's going to reach out to The if I can type it's going to reach out to the REST API and get a post and Instead of just kind of taking the response and plopping it in We're going to do some things the data flow way if you're familiar with redux package it's a way to Take something as far as data flow and break it down into Discrete actions that have a particular action type and then sometimes data attached to those actions and Typically those actions are just a regular JavaScript object if you've heard of Programming model called event sourcing It's kind of the same thing. So you send an event which is an action Something is listening to that action to when it comes in and saying am I interested in this action? Yes, okay. Well, then I need to update my data that I know about from the data that you sent me And I'll show you that part in a minute but This is kind of the meat of that and What it's really doing is loading this door file And if anybody doesn't know about what I just did I just did it reflexively and visual studio code and a couple other editors you can hold down the command button whoops and Hover over things like the packages variables and go to them so I just held down command and clicked on store and Helps me get to this other file that I'm talking about really quickly without having to find it So this one the only dependency we're using is get from lodash and then WordPress dependencies We're combining reducers and registering store This is a data store and WordPress is kind of opinionated on how it's doing this I mean, it's it goes into detail in the handbook that it's not just redux. There are some decisions that they've made for WordPress itself for How to make it appropriate and how to make it less likely to break And a little bit better of a developer experience than just raw redux So these are the actions. I was talking about There's one called fetch post which tells the store that I'm fetching a post It tells it what the post ID is and so it can store that And if the post comes back as an error, I can tell it. Oh, that was an error So that the store knows that I got an error And if we get data back that is valid then I can say that I received it and send that post data through to the store These are reducer functions and you can think about a reducer function as Something that takes an initial state whenever your application loads So for this one the error whenever your application loads that error is going to be null. It's not going to have any value it's going to be null and Whenever one of those actions comes in It doesn't matter what kind of action it is if it sees any action It's going to process this function. So it's saying okay. What type of action is it if it's one of these three then it's interested in that action It's going to take some sort of action. Otherwise. It's just going to return the original state And so I'm showing here how you can have kind of Discreet nodes of data for your state and reducers. So there's the error there's the fetching state whether or not you're fetching from the API and what the data actually are whenever you get them back and Whenever we register the store We can combine the reducers into one So we're going to be able to say okay error is That result from the error reducer fetching is the result from the fetching reducer likewise and then there's a Concept called selectors which is a way to reach into that state Get that particular piece of state As a function and I'll show you how to use that on the react side on the element side So this is just getting the error that's getting the fetching state and that's getting the post data And you could get as particular as you wanted in here you could say oh, I just want the ID You could add a selector just for that here. It's kind of a lot to go through for a demo But let's look at the code And there are these helper functions in this package called WordPress data That's one of the medius parts of of Gutenberg if you look at the source there's a lot going on here with with function composition with Using these sorts of data flow pieces So it's a lot to learn There's a function composed to so When we return our React component because that's what we're Returning here is a demo for react component. We are composing with select and With dispatch and then calling all of those on this react component And what with select does is it takes it's a function that takes select and then returns the value of those selectors in this object as properties for the wrapped object and it's It's kind of a lot to wrap your head around. There's something called a higher order component which Is composed of lower order components And I'll show you how that works in a second But basically the content is going to be in your properties title link the error state and the is fetching state are going to be in Your properties and with dispatch is how you piece into the actions. So We're calling fetch post it's going to dispatch that fetch post action and then when we receive data we're going to Dispatch the receive post and if we get an error we're going to dispatch receive post error and This is the actual react component that is wrapped with all of those things and There's a button and when it is clicked. It's going to do this fetch John Belias And guess what I'm going to return Which does those things and that gets pieced to the properties of this react component and There's an error. It's going to tell you there's an error if there's not then it's going to tell you if it's fetching or not and If there's a title it's going to print out the title if there's content It's going to dangerously set the inner HTML for the content So this is kind of important You have to be able to trust where you're getting your data if you're going to just pop things into react otherwise Sanitize them run them through escape, but if we ran this through escape it wouldn't work. I'll show you why So that's demo 3 Demo 4 did you see it for a second fetching fetching and when it comes back? It gets that results and We got John Belias Let's change it so it gets an error so it's rebuilding in the background. I can just go ahead and reload That should not have worked. Is it still building? Live demo Maybe I did it too quickly or maybe it's cached. We'll stop this and start it again. See if that works yeah, so it got an error back and it's just Jason stringifying the error that we got back. He could probably do something a little bit more elegant than that in your actual app See if it will library build again cool. All right So anybody have any questions about this and I don't believe you if you say no because I Do I have questions You don't have to get as deep into Selectors and dispatchers, but it's I think it's a concept that you're gonna see a lot more going forward I think that the developer experience is probably gonna get better around it There are already some helpers that kind of help you do some of the stuff without piecing it together in your components But they use generator functions, and I didn't want to bother with those Back to demo 3 I wanted to show off that you could do other things other than just images of course And do demo videos. This is just a embedded YouTube and in a Gutenberg block someone put this song over the discovery I Think that's pretty much it for the demo. Does anybody have any code questions before I talk about Contributing cool, so all of this is still pretty new I gave a talk like I said two years ago, and none of this was in WordPress, but now it is and it's still getting better And you can help make it better. So if you see something that doesn't work quite right or if that Developer experience doesn't work for you think you can make it better. Please help make it better This is it's a very active project you can see it's a lot of JavaScript. There's 3% PHP in Gutenberg So fresh and new it's exciting This is the past month. There have been 226 merge pull requests and if you take a look at the activity graph I think that is probably The lead up to the merge into core So if you see something say something there's if you go to WordPress slash Gutenberg on GitHub You can go to new issue and there's these helpful templates to help you file a bug report or help request or feature request please do and That's it. Any questions if not, I'll be at the happiness bar


Ring in the New Year with amazing savings from Appalachian Wireless. Get the Galaxy S7 for just $49.99 when you sign a renew a two-year service agreement. Better service, bigger savings. That's today's Appalachian Wireless. I have a dream that one day my four little children will one day live in a nation where they will not be judged by the color of their skin, but by the content of their character. I have a dream today. This morning, Big Sandy Community and Technical College, along with the city of Pikeville, held a unity march which ended with a series of speakers in the city park celebrating the life and legacy of Dr. Martin Luther King Jr. And there's a synthesis of all of what he felt God was compelling the new for humanity and that was God give us all the strength to love. A diverse group of people from local businesses, schools and churches gathered to hear the music and the messages of solidarity from several speakers. God created man, humanity in his image and that means all of us are made in the image of God and let's not forget that but let's remember it as we deal with each other and as we go on life through life. The keynote address was given by the Reverend Herbert T. Owens following a powerful rendition of Dr. Martin Luther King Jr.'s iconic I Have a Dream speech. And he says while major strides have been made in the decades since that speech was made, we still have a long way to go. I would like to say that everybody loves everybody else but that is not the case. But as I said in my remarks, we have a book, we have a manual called the Holy Bible says this is my new commandment that you love everybody as I love you.  Reporting in Pikeville for EKB News, I'm Shannon Deskins.