Hello everyone Today we're going to talk about phantom attack evading system called monitor. My name is Rex nice junior so Imagine an attacker compromise your Linux infrastructure So the attacker first Compromise a web app through a web app Remocal execution and then it launches a reverse shell Then it discovered a vulnerability on the system. He can activate privileges using the pseudo vulnerability CV 2021 3156 then he's looking for Secrets on the system. So he read the Etsy shadow file and then he discovered additional Later movement opportunities by reading the SSH process environmental variable Then he let her move to the second machine using SSH hijack as he is celebrating this moment He discovered that his reverse shell connection is gone and it doesn't take him for too long to discover that He his IP is completely blocked now Let's take a look at the other side of the story while all this is happening our security engineer Has received a bunch of slack messages For the alerts generated by his latest cloud workflow protection software and The reason that the software can discover all these activities precisely is because it monitors The system calls and other process related data. So for example When the attacker launches the reverse shell, there will be a connect system call and there may be additional system calls depends on the reverse shell that he uses this is similar for the other activities and Through this talk, we are going to use open as system call as an example So let's take a look at how one can use system calls and other process information to detect a attacker Reads Etsy shadow So here's an example rule The rule is trying to detect untrusted programs Reads the Etsy shadow Let me explain what the rule means It detect that there's a open at or open system call with the reprimission and the file name is equal to Etsy shadow and Also, the program is not in the allow list That allows to read the Etsy shadow So from this rule it should be very obvious that the ability to precisely monitor system calls and How their system call related data is critical for the detection for the this attack The agenda of this talk is we will talk about system call monitoring in more detail and Then we'll talk about the two open source system call monitoring project that we analyze and then we'll talk about the first model ability the Talk to issue which we use Benton v1 attack to exploit and then we'll talk about the second vulnerability a semantic confusion Issue which will use Benton v2 attack to exploit and finally we'll conclude the talk with takeaways With that I will hand over to Junyuan to talk about the system call monitor Yeah, so as Rex mentioned system call monitoring is very important to detect threats So what is this call monitoring? We can define it as a technique to verify whether the application application system call Conferred to the rule that's based by the program behaviors at runtime Here is a graph showing how system call monitoring works When application system call is invoked System call code pass is executed if there are any hooks in a code pass The attached program will be called to collect system call data For example, since call arguments the data are sent to use space monitoring agent The monitor agent will check if application system calls Confer to the user defined rules If not the case it may generate errors So typically at least two steps should be include for system call monitoring One step is call system call interception Which is to get notified if target system call are invoked In order to intercept system call, you can use trace point or raw trace point Both of them are static hook place in a kernel code Raw trace point are EBPF alternatives to standard trace point It's faster because it provides slow access to the arguments without processing For this call interception the kernel provides two raw trace points 6 enter and 6 exit This raw trace point can be called this function trace 6 enter and trace 6 exit respectively The first arguments of this function are PT register structure saving user registers in user kernel mode switching In it includes system call arguments The second parameters is syscall number If any progress attached to this raw trace point It will be executed with the same arguments as functions Trace point has low overhead but it only provides static interception Different from trace point, kpro or kretempro provides dynamic hook in the kernel Using it, we can register the progress on kernel instructions For example on system call co-pass When the instructions are executed, it will trigger register programs Kpro can be inserted on almost any instructions in the kernel However, kretempro can only be inserted in function entry and exit Kpro provides dynamic hook but is slow compared to trace point And you need to know exactly how data is placed on a stack or registers in order to read system call data You can also use ld preload trick to intercept system call But it's not working in all cases For example, application is statically compiled Key trace system call provides another way to intercept system call However, the overhead is high The second step of system call monitoring is called syscall data collection Which is to collect system call data For example, system call arguments FBR notified by system call events The program used to collect system call data is called tracing program For example, you can use the tracing program to collect system call arguments As we mentioned before, tracing programs can attach to different hooks Like trace point, raw trace point, kpro or kretempro When the hooks fire, tracing programs are called to collect data There are different ways to implement tracing programs to collect system call data You can use Linux native mechanisms like ftrace or perf events You can also implement the trace programs in kernel module Or evpf programs Which allow the execution of user code in a kernel The open source project, farco and tracie both use the similar techniques to monitor syscall Farco is originally created by sysdick It's one of the two security and compliance projects And the only endpoint security monitoring project in CNCF, in cubatings projects It has two 3.9k github stars It actually consumed kernel events and enriched them with information from cloud native stack Like linux, containers and so on Farco supports both evpf and kernel module implementation for the tracing program Tracie, on the other hand, is originally created by aqua security It has 1.1k github stars It's basically a runtime security and forensics tool based on evpf So unfortunately, the open source projects or other projects using the similar techniques Are vulnerable to be attacked during syscall monitoring The first vulnerability is time of check, time of use During time of check, tracing programs collect syscall data During time of use, syscall data used by the kernel is different from what tracing program check Let's take open syscall for example The second parameter is called file name, which is the pointer pointing to user space buffer Between time of check and time of use This pointer is vulnerable to be modified from user space So we will introduce phantom b1 attack that can exploit the topical issue The second vulnerability is semantic confusion It means kernel interprets data differently from tracing programs For example, symbolic link is interpreted differently by the kernel and tracing programs We will also introduce phantom v2 attack that can exploit semantic confusion We will also demonstrate phalco is vulnerable to both phantom v1 and v2 attack While trace is only vulnerable to phantom v1 In order to understand tactile, we used open-app syscall for example We used kernel version 5.4.0, but regardless of the kernel version If the monitoring software used trace point in this way The tactile vulnerability will exist To simplify, we only show the code that is related to the attack When open-app syscall is invoked in applications syscall handler will execute trace6 enter function with two arguments As we mentioned before, if any tracing program attached to sysenter tracepoint, the program will be executed After that, syscall handler look up syscall table and jump to open syscall to open the file Before returning to applications, the handler will call trace6 access with exactly the same arguments as trace6 enter So similarly, if there are any tracing programs attached to sys exit tracepoint The program will be executed As we mentioned before, the second argument of open-app syscall is fine-name pointer Pointing to the user space memory The fine-name is passed to do this open function And kernel populates it to kernel buffer temp using get-name function After that, kernel use the kernel buffer to call internal function to file open to open the file This is time of use for syscall arguments by the kernel If we divide the open-app syscall co-pass into two parts based on the get-name function We get two sub-co-pass cp1 co-pass1 and cp2 co-pass2 In cp1, the fine-name pointer hasn't been copied to the kernel buffer In this case, no matter where we place the host in cp1 The attached tracing program will have to read user space buffer in order to get the fine-name This is vulnerable to be changed in user space attacker For example, if we attach tracing program to sys enter tracepoint Or to do sys open using kpro During time of check, the tracing program will have to read the user space buffer to get the fine-name In cp2, user space memory has been copied to the kernel buffer Making it not vulnerable to be changed from user space For example, if we attach tracing program to the entry of do file open function using kpro The tracing program can read the kernel buffer tab to get the fine-name That kernel buffer is not vulnerable to be changed for tactile attack However, if the hook are placed improperly in cp2, tactile is still possible For example, if tracing programs attach to sys access tracepoint It will read the user space buffer to get the fine-name If, as we mentioned before, we use kernel version 5.4.0 But regardless of the kernel version, if the monitoring software use the tracepoint in this way This vulnerability will exist FACO is vulnerable to tactile And the vulnerability is tracked by CVE 2021 <IP_ADDRESS>.5 means the scores 7.3 In particular, the vulnerability Exists for FACO with the version older than 0.29.0 or open source sys stick It also affects some commercial versions based on the open source agent This was confirmed by the open source maintainer Please contact the vendor for the versions The reason why FACO is vulnerable to tactile Vulnerability is that they use sys enter and sys access tracepoint to intercept system calls In that case, user space pointers are read directly by FACO trace program In both kernel module and eBPF programs implementations In order to demonstrate the generality of FACO We evaluate the sys calls in FACO rules Please note that we only consider system calls That includes user pointers as arguments like open sys call And we found that FACO is vulnerable to monitor most of sys calls that we evaluate Accept exact v-system call because FACO doesn't read user pointer for exact v-system call arguments directly Instead it reads the data from kernel data structure So we evaluate trace 0.4.0 and we found that it's vulnerable to many system calls like Connect sys call One thing I need to mention is There's no CVE given because the trace C also is mentioned The tactile attacks on sys calls wrappers Or tracer is a well known issue and trace C is no exception And also agrees on the fact that there's no CVE or normal findings and therefore we could talk about it publicly I will let the audience to interpret So I will hand over to Rex to explain and demo the V1 attack All right, so The high level idea To exploit the top two issue Is fairly simple So first of all, we want to trigger the target system call with malicious arguments And we'll let the kernel to read the malicious argument and perform the intended malicious action for us After the kernel reads it We will override the data structure pointed by the user space argument pointer with benign data And at sys exit The tracing program reads the data structure pointed by the user space pointer And checks the benign data against the rule and therefore you will not fire Although the high level Plans are simple. There's a few technical challenges that we need to overcome first one is When does the kernel threat reads it? And how can we synchronize the override with the kernel threat read? Are the recent windows big enough for the system calls that we're going to attack And how do we ensure the tracing program gets the overwritten copy all the time? So before I dive into the step-by-step exploitation There are a few primitives that we use in the exploit which I want to talk about First one is user for fd system call The system card is designed in a way that the user a user threat Can handle page fault But page fault is traditionally handled by the kernel So what's the initial design intention for this This was designed for memory externalization In in in the case where you're running a distributed program You can run compute node and memory nodes When the compute node Needs a particular memory that doesn't exist in the compute node The kernel triggers the page fault and the user space For handler it's going to reach out to the memory node to get the desirable memory On the other hand if the compute node Has memory pressure it will send those memory pages back to the memory node One very important fact about user for fd is that once the kernel thread triggers The page fault the kernel thread is completely paused and wait for the user space program to respond As some of you may already Be aware of this has been used Quite a bit in exploiting kernel risk condition bugs The other two primitive I want to talk about one is interrupt And the other one is scheduling So an interrupt notifies the processor with an event that requires immediate attention It will diverge the program control flow to an interrupt handler Let's uh look at the picture On the right side So we have two cores and we have two tasks Running on each core corresponding it On core zero task a issues a system called a And then the control flow transferred with kernel thread to handle the system call While it's running the user thread On the core one triggers an interrupt And the way it triggers the interrupt is uh Indirect interrupt using system call Once the interrupt is triggered it's Uh core zero will execute the interrupt handler And after the interrupt is handled It will return back to the system call routine which handles the system call So there are different ways to indirectly trigger system call indirectly trigger interrupt using system call Um one way to do is to trigger a hardware interrupt So this can happen when Uh a program issues a connect system call the cpu that is dedicated to handle networking interrupt Will get interrupted Another way to trigger this interrupt is called inter processor interrupt This can be done by issuing n protect system call so um once The n protect system call is issue the memory page Is permission is changed and therefore all the cpu's that are Caching those memory permissions need to be updated With the right memory permission The scheduling primitive that we use one is sex Uh scheduler This will change the scheduling priority Of a particular task This is optional in the exploit Because for system calls with longer top top windows such as networking system calls we Find that it's not needed to reliably exploit the top two issue but with system calls related to files The top two windows typically smaller and With the capability we can 100% reliably exploit the top two issue And then the second primitive we use is set affinity which will pin a task to a particular CPU Okay, so let me talk about the step-by-step exploitation in detail um Initially we need to do some setup. So we set up three thread a main thread A user for fd thread The user for fd thread um Can run on any cpu and also an override thread So the main thread will pin to cpu 3 The choice of three here is because we Uh run our experiment one of our experiment on a four core system and cpu 3 is used to handle The networking interrupt But if you are using IPI interrupt it can be any cpu um And then the main thread will map a memory page a Uh the page is not allocated And uh, it will register the user for fd thread to handle the page file generated for this page on the uh override thread site We pin it to a different cpu because we want to reduce the interference between the override thread and the uh main thread um And then the override thread will just block on conditional new text Once it started after the setup The main thread will trigger A system call in this case open at And it was specified a file name argument to point to page a Now keep in mind that page a at this point is not allocated And uh, so the kernel thread Will trigger a page fault Once the page fault is triggered The user for fd thread Will write page a with the malicious file name And then it will release the conditional new text And then it will issue out a system call to return execution back to the kernel Now once the conditional new text is released the override thread will start running And uh, it will first write the behind file name In the last stage of the attack Once the execution Return back to the kernel The kernel will use copy from user And you will get the malicious path name This is a time of check and uh It keeps executing until As this exit the trees program will read the register and de-reference The file name value again. This is the time of check So this is the talk to window we have And uh, let's see how we can Use the override thread to make this override successful so the After it writes a benign name We issue a memory consistency update using cpu instructions and uh As the memory consistency update takes place We want to increase the talk to window Such that we have enough time to update the value for all the cpu's So what we do is that it will issue a Interact using system calls And this will increase the risk the talk to window size And then the memory consistency update applies So The file name now points to be the benign file name And then the tracing program will read out the benign file name and track it against the rule Which will not fire anything Now let's take a look at the demo Okay, so in our first demo we're going to attack cystic um For using connect system call as a as an example So what we'll do is we will run cystic And ask it to monitor connect system call and just filter the data on our tag program And then on another window where we use tcp dump to monitor all traffic going to 48 and then we'll run our attack program The attack program It will Connect to <IP_ADDRESS> But then it will override this uh, ip address With a ip address from linking.com Okay, so we can see that the tcp dump report traffic actually going to <IP_ADDRESS> This is what happens on the wire But cystic will report that okay this program attack connect Is actually connecting to 13.107 42.14 which is the ip address on by linking.com and therefore We showed that we can write this Uh with arbitrary value Okay, so uh now we'll show a second demo In this demo we'll show an attack on cystic on the open add system call Now our demo setup, uh is slightly different So for open add The top-to-window is small so If we don't use uh capsis nice Sometimes the attack will fail but If we assign capsis nice we can achieve 100 reliable exploitation um Keep in mind that because The override thread has the highest scheduling priority. So sometimes you can write the uh file name faster Then the kernel reads So When that happens The system call will get the benign file name And the Cystic will also get the benign file name. So there's no harm being done and no other being fired as well And therefore we run the experiment 15 times using our script And each time we check What is uh, what is a syscall rate? And what does uh cystic read? And that will compute the result based on each observation So what we'll do is we'll print out the number of success attack the number of Attack that has no harm and also the success rate Okay, so as you can see here There in the 15 experiment we succeed three times No failure And 12 times there's no harm And therefore the success rate is 100 percent Okay, so lastly we'll show a demo on 3c as well And here we'll attack connect call In 3c the attack setup is very similar to what we have for the cystic again 3c will monitor the connect system call and we'll just filter the data on our attack program reported by 3c And then we have tcp done monitoring on port 80 and then we run the attack as you can see that The actual traffic going on the wire is going to <IP_ADDRESS> But 3c reported that the traffic going It's going to 13.107 42.14 which is overwritten by us okay, so This is I just want to reiterate that the capsis nice is optional. It depends on the system call that you're attacking and For networking system calls typically this is non-needed and for file base Typically, this is needed to achieve a hundred percent reliable exploitation And then I'll talk about the second attack the semantic confusion The idea of the attack is fairly simple The kernel and the tracing program can interpret data differently so We use file link as an example When the kernel reads a link it will try to resolve the link and read the actual file But when the tracing program read a link it will just take the link as the argument And use that to track in the root So file call is vulnerable to this semantic confusion attack Because it didn't resolve the link In the system call There's no cve given because they mentioned that same link and same link add link and link add are all monitored by file call but practically Detection team need to track all these same link add Or link link add to all these file base rules if the attacker is using those And tricy is not vulnerable to this attack because they use a mitigation in rsm hook Which junior will talk more in a later slide So I just want to quickly show the example of phantom v2 attack insisting remember this rule that we talked about at the very beginning and See that the file name actually we check that whether the file name. It's a atc shadow, okay So in order to exploit this We can create a file link temp shadow pointing to atc shadow And then the tracing program will read the same link atc shadow And then the system call open add Seize the temp shadow and track against the rule. It doesn't match atc shadow and therefore the rule is bypass Okay, so with that I will hand over back to junyuan to talk about mitigations Yeah, so um for mitigations. There are two basically two approach for the Bennett attacks. So one is to detect the potential exploit is happening This was a proposed and partially implemented by its faculty It has include in faculty release in version zero point 29.0 Basically is trying to detect the foreign behaviors used by the exploits for example It detects the arm privileges use of user for fd season core this was implemented And detect the user registers memory address range and also detect a user copying Continuous memory trunk into a user of d register range and so on The second way to mitigate fan attacks is to read the data that actually used by the system call or the kernel In order to do that, you can hook lsm functions to get those system call data that is actually used lsm hooks function is a list of checkpoints That are placed in a kernel before operations happens on the kernel objects So here is the table showing a list of the lsm hooks used by tracee version 4 and the second column shows the system call that was that is protected by the lsm hooks from Fender attacks You can also read those data that's used by the kernel from kernel data structure for example In order to read the arguments of exactly tracing programs can read it from the FM structure from the kernel I will hand over back to Rex to conclude Okay, so basically In this talk, we show that phantom attack is generic And it exploit the fact that kernel and tracing program Can read data at different times. This is exploited by phantom v1 and we also show that the phantom attack can Exploit it the fact that kernel and tracing program can interpret data differently. This is exploited by phantom v2 We demonstrated that kernel raw trace point on system call are not ideal for secure tracing and For other tracing implementations such as kpro it could also be vulnerable if it is now implemented properly for mitigation One can use detection for abnormal usages on for user pho fd Or to ensure that the kernel and the secure tracing program reads The same data and interpret the data in the same way If you're interested in discuss further feel free to contact me on twitter and We'll share the github link at twitter as well. So Before we conclude we also want to thank all these people During our research chris and joe for the discussion on the ebpf and kernel tracing and top toe also you on top toe and Lastly, we really appreciate the falco open source team They are very professional handling the issue. We have really good discussions On there Thank you


If you have any additional messages, you can give feedback to the speakers via this form. The last slash is important. If you like the talk, otherwise it's blocked. So ignore that for non-good reviews. By me. I need to see the results and then I'll tell you whether you can press the submit button or not. Okay, the next speaker is Steven, who works as a developer evangelist with OpenShift. Thanks. Hi, everybody. This is me. I am not Steen Thorgensen, but I leave this up here because if you know, how many of you know Key Cloak or have seen Key Cloak or have seen the page? Just two people. So, good. I am Steen. No. I'm not Steen. One is the lead architect and the lead developer on Key Cloak and I gave this talk with him at Java 1. So I can talk at the high level for the developer experience. How many of you do authentication stuff for your day job? And like, yeah. So you people are not allowed to ask me the deep probing questions because I'll never be able to answer them. So I'm just level setting that for the deep probing, like how does all this ticket stuff go on and are you using this really whatever protocol you're using for your tickets? I'll say talk to Steen. Okay? So I gave that talk with him. I can talk through some of it, but not very deep. This is the slides or Google slides. So if you want to come back to them later, this is the URL for the slides. And I'll have that URL at the end so you can just copy it at the end. You think, oh, now it's kind of worth it. Okay? And this is where you can find me. It's at my Twitter handle, but the Steve Zero because I'm lead like that. That's where I'm everywhere. So the goal is pretty simple. Talk a little bit about microservices. How many of you have heard of microservices? How many of you are actually, keep those hands up because that means those are people who have actually might, you've heard of them. How many of people are actually using them? Keep your hand up if you're still using them. You've written an application that's in a microservices format. That was a quick hands up. Are you not sure that you're really using it or not? Okay, so then it seems like that's a pretty good percentage of the audience. You have permissions, if you get bored during my microservices piece, to check email. Not YouTube, because there's limited bandwidth, but you can check your email. I give you permission. Then we're going to talk a little bit about centralized authentication and then we're going to see it all in action. Okay? Sounds pretty reasonable for 40 minutes. That's more than 10 minutes of goal. So these are microservices. Everybody get the joke, microsushi, microserve. So if you thought that's a bad joke, you should probably leave now. Because it only gets worse from here. The reason I bring, does everybody know what this is? Does anybody want to explain what this is? Yes. That's even more specific than I needed. It's a battle map. A historical recreation of a battle map. You ready? This is where you're, oh, almost. And the reason why I bring this up is because I think a lot of us think microservices is something new. But really, it's really something new only in what we do with computers and how we've architected applications. If you think about what we do in our most normal life, almost everything is microservices like. So in the military, each of these symbols, the different looking symbols, is a different type of military unit. And if you think of football, the real version of football, do we make everybody have the exact same position? No, strikers do not have the same skills as goalies. But for some reason, in the evolution of programming, we have thought that everything has to be linked together and moved together and everybody has the same priority. So basically what ends up happening is, could you imagine if you were playing football, and the goalie, and the striker, and the defenders were all in the same position moving around in the field as a big group. And you couldn't move forward as a group unless the goalie could keep up. That would be foolishness, or you get beat all the time. And it's the same thing in military. So this is not a new concept, it's just actually new to what we do with computer programming. So has anybody seen this image before? This is from Martin Fowler's page. Martin Fowler, the Fowler. Wasn't he one of the GOF, the Gang of Four? I thought he was, maybe not. Anyway, doesn't matter, he's still got a page and he's got this picture up of microservices. For all those that didn't raise their hands for this is what I'm doing, you're not doing microservices now, this is what you're doing now. A monolithic application. And so you'll have all your, how many of you are Java developers? You don't have to be ashamed, this is supposed to be everybody. And it's a red hat, primarily a red hat show and we kind of have a whole middle, and this is the middleware track. Raise them proud. Okay, how many of you are Ruby developers? Yeah, whatever. Okay, and then how many of you are actually Python developers? Okay, my second favorite people. And then Pearl, how many of you are managers? I feel like there's like no hands going up here. So what are the rest of you do? Anyway. So... Bakery? Nice, good. I build Linux boxes, I make RPMs all the time. So this is the monolith, right? And so these are each, let's say we're doing an e-commerce application, because that's what everybody loves to talk about. And each one of these different symbols is a different part of your e-commerce application. So, checkout, shopping cart, browse, I don't remember, other pieces, oh, social media piece of it, right? And in a typical Java enterprise application specifically, and that's what Fowler usually dealt with, these would all be in one large ear or war file, right? And for those of you who are not doing microservices, these would usually ship how many times a year? Two, who said two? Who said one? Who said two? But that's a good guess, because that's actually usually what most big ears, because they're so big and there's so many teams that you're trying to integrate at once, that's how many are actually, that's how often you release, right? And if you miss one of those releases, you've been working on this feature for six months, but you can't get quite finished by the release date. How long do you have to wait until you can actually get your feature in? Another six months, right? So it's incredibly frustrating for people. The other thing is, what's the technology being used in this? What is it? Is it all the same or is it different? Same. And so how much fun is it getting different development teams to agree on a programming language? It's like making everybody use the same IDE, right?  So the same thing is happening in this monolith here. What happens with microservices is you take that application and you break each service into its own functional part. And it's running in, it can be its own server, it can be wherever you actually run it, but the key part is that it's not bundled up with the entire monolith, right? So this team, I'm going to make it up again. This is a social networking team, right? So the social networks come up all the time, they do integration with it. What do you think their release cadence is going to be? Fast. Good. Someone's picking up that I'm giving softballs here. So they're going to have a really, that's an American idiom, isn't it? What would that be in football if you're just giving little easy kicks? What's that called? Pass. No. Forget it. That probably doesn't translate. Forget it. I'm giving easy questions. No analogies. So these guys have a very fast cycle and they're probably using what language? Because they're integration with social media. Who, come on, node, right? The hipsters, or maybe Rust. Who's using Rust? Nobody's using Rust?  Forget it. You guys are behind the times. All right. So this is Rust and it's releasing once every two weeks. This is the actual financial check out. Does the money transaction? What language do you think they're using? Cobalt. Who said cobalt? No. No. What's it going to be? Java. Java, right? And how often do you think they're going to change that? What's their release cycle going to be? Yeah, at best. Because once you get money working, you don't touch that stuff again, right? Like this works and you're not going to touch it. So what happens with microservices is these guys can pick the technology they want and they can have different release cycles. So when I talk to companies about why they're adopting microservices, there's all sorts of advantages, but one of the biggest ones I've heard from some of our customers is autonomy. That teams become responsible for everything about what they're doing. These people are also on call for the beepers. So when it goes down, you can't just point at the ops people and say it worked on our laptop. Then a future problem now. When this goes down, this team gets called. And so they get to choose the technology. They get to choose how their release cycles look, how they're doing everything. And all that happens between teams is you have contracts. This is the API and this is the payload I'm going to give you back. So my therapist taught me this one saying it is clear boundaries, infinite possibilities. So usually when humans fight, it's because they're unclear about whose responsibility it is for this thing. And with this, you have clear boundaries. This team is responsible for everything that happens with social media service. This team doesn't have to concern themselves with that at all. They can be quiet. And what they can do though is the clear boundary is that API contract. And so it gives the teams the freedom. And there's other cost-saving reasons and other things. But here's some of the key points of it. It's distributed services rather than a monolith. The best practice seems to be one functional area per service. So in the beginning of microservices, there was a lot of discussion. Do you guys know the REST API? You know that pattern. And have you ever heard of RESTafarians? So these are people who would be like, if you said, oh, I have a REST API. And they say, well, I studied Fielding's paper. And this is not following this exact protocol. And you're not doing REST. Those are RESTafarians. And so there were some microservice afarians when microservices first started who would say a microservice is one function call. That is a microservice.  Because there's no way I'm going to decompose everything into one functional call. So usually what seems to have been settled out is it's one functional area. This is a big one. There's no sneaky backdoors. Everything goes through APIs and messaging services. Because that maintains that clear boundary. Nobody gets to say, oh, let's just open a Corbett. We're both Java teams. Open a Corbett interface for me so I can make some remote RMI calls behind the scenes. No. Everybody goes through the same API. And then this is another really big message. There's no specific technology required with microservices. So you'll see talks that are like, you have to be doing Node.js in Mongo if you're doing microservices.  That's not true. That's somebody trying to sell you something and make you feel bad about yourself and it's not true. It's an architectural pattern, not a specific technology. So I have friends who've written microservices in Perl. They use Dancer. There was a couple of Perl hands. Is Dancer like a Perl framework for doing web applications? Thank you for giving a one-word answer. That is awesome. So they use Dancer and then they made microservices and then it was all in Perl and that's fine. So some other architectural patterns. So to show you some patterns. Oops, too far. This is a very basic microservice. So there's three different services. They're each talking to their own database and then they're going through some load balancer to talk to some client. And this is actually particularly a pattern that's used a lot in mobile applications because this connection is actually very expensive in terms of time. So you'll actually make... No, this is not used in mobile. Sorry. The load balancer is just shifting things around between the different services. This is more of a web application. And so sometimes they say you have to have your own DB per service and that's not true either. It's usually the pattern that's used but it's not required. Is this what most people are seeing with their own microservices? That sometimes you have your own DB and sometimes you don't? Okay, half of you raised your hands. At least one person, there's another scarf ready for being thrown, should say yes or no. Is that the pattern you're seeing? Yes. You get a scarf. Thank you. One word.  You didn't even have to talk to me at the booth. Okay. So this is a very simplistic microservice pattern. But it can get to be something like this. Where you have the same service, some as being proxied through one service and another place where you come in directly to the service. Do you understand how that's happening? They took away my big stick. So I can't point. Jorge, come down here. You're very tall. I'd like you to point for me. So the idea is you can mix and match these services, whatever makes sense for your application. Microservices doesn't mean all the services are exposed to the front end. Sometimes you'll have different services calling in with different patterns. Make sense? Okay. I think we're getting close to the end of the microservice part. The fun's not ending yet. So what you used to do is a monolith, especially for Java developers, where would you do all your authentication? What would handle all your authentication? We're going to sit here and wait until someone answers. You guys just didn't write code. You never wrote web apps. That's it? Yeah, that's what it was. Come on. Jorge, where would people do all their authentication in a web app in Java EE? In the application server. Is that so hard? You know, Jorge, I'll give you another here. There you go. So it's in the app server. So if I go back to this picture, which each one of these is an app server? Because they have to be able to be scaled up and down independently. So where am I going to do the authentication now? I can't use the same pattern that I had before. So for those of you who... Okay, if I could say it in check, I promise I would. But for those of you who actually are doing microservices now, is authentication one of the things that you hit up against right away? Like how do you handle authentication? Yes, thank you. It is one of these tricky things that most people don't talk about at the beginning of microservices that comes up and bites you. So I was writing a microservices app just so that I could talk somewhat intelligently about it, and this is why I discovered KeyClook, and this is why I'm going to give the developer experience talk. And then you're probably also using a distributed cache to handle session state. The new way you do it is you have an authentication service just like every other service in your microservice architecture. So just like you have a shopping cart service and just like you have a payment service and a browsing service, you have an authentication service, and it's independent of any other service that's there so you can scale it, everybody can talk to it, and it's shared. It should be distributed and fault-tolerant in the same way that in a microservices architecture you usually don't spin up one endpoint. It usually has multiple in case things fail in the cloud. You do the same thing with your service. It should be able to scale independently, I just said that again, and it should have a standard way to interact because the problem is if that team is writing in Node and another team is writing in Java, you can't use Java authentication with the Node server. You need some open standard that everybody agrees about. So how do I get my hands on this hotness? Have any of you heard of Stormpath? So Stormpath is a centralized authentication server. Another example is Auth0. Have you guys heard of Auth0? Stormpath and PingIdentity are the same, basically. Stormpath and PingIdentity are authentication servers as a service. You sign up, you make an account, and then they have an Auth service running off in the cloud somewhere and you just use it. Auth0, I think you install yourself, if I remember correctly, is that right? Steam is the one who said to use it. And then today what I'm going to show is an installable free and open source project from Red Hat called KeyClok, and it will be running on OpenShift, but OpenShift v2. Any questions so far? As you can tell, I kind of like when people ask me questions, and I promise to be nice. So if you have a question, A, I'm speaking in English, which is probably not your native language for most of you, so I'm assuming I'm going too fast. So if I talk too fast, please stop me, okay? Wait, what do you mean? Where do you live? Are you from Czech? Okay, you need a scarf. It's cold here. Okay, go ahead, give it to someone that you know. Go ahead. So the question was, can I put this authentication in the integration, like on an ESB, like in the integration layer? Is that what you mean?  API management at that layer? I think that's kind of the, so you're saying something, like you have a whole bunch of APIs that have some product that manages authentication against the APIs? You can, and I think that's basically what we're going to do today, but the problem is how do you then get the user to authenticate against that on the webpage? Does your product handle the authentication on the webpage or in the client front end? If it does, then that's exactly what we're going to show today. Okay? Any other questions? No? Okay, so Key Cloak.  No? Okay.  These services register with the Key Cloak server, and what that means is they get a secrets file from the Key Cloak server. So there's a shared secret between the service and the Key Cloak server, right? And then what happens from there is, the user offs against the auth server, they get back a token, which they can then use against each of these services. That token can then be passed all the way along with any service that's registered with the Key Cloak server, and the roles and everything comes through it. So that's the basic idea about how this works. Everybody get that one? That makes sense? You didn't get it. What part? No, so you can say within Key Cloak, you have this concept of realms and realms are different applications. So everything within a realm can share a token, and then within there you can have a lot of different roles, and people can belong to multiple roles. So you would have to do it that way. You would give a person multiple roles or not have them have multiple roles when they authenticate in. Does that make sense? Yeah?   It's like beware of Americans bearing scarves. Okay, any, oops, sorry. Any other questions? Yeah, go. Yeah, yeah, yeah, yeah. Very simplified view. You're one of those authentication guys. Shhh. Shhh. If I was Stean, then you could ask Stean all those questions. How many, most of you are developers in here, right? Yes. So I'm talking to my peeps. Let me sing you the song of my people. I don't want to know about tokens. Right? Yeah. Yes. Agreed. But actually all users can't, Key Cloak gives you the pieces to manage users both on the Key Cloak server, I'll talk about this in a bit, or on other authentication servers. Like you can manage them in a database, you can manage them in an active directory server, but it's a whole other area in and of itself. Yeah. But we can handle the authentication. Yeah. Because Key Kerberos is a much more, from a developer's perspective, what I would say is Kerberos is more complicated to use than this would be to use because there's client ends, this is using the OpenID authentication protocol. So it's very easy for you, you can find any OpenID connect provider and use that in your application. No. Next. Yeah. Talk to him afterwards because, but from an application developer's perspective, this is much easier than using Kerberos, especially if you're not into like low level pearl and you don't want to think about all that other stuff that does all that fancy math. That's what I would say. It is true. It is true. I've looked at using Kerberos and it made my head hurt and I ran away in two minutes and this was incredibly simple to me. So from a developer's perspective, this is much easier. So authentication, Key Cloak deals with authentication. It can actually safely store the passwords inside if you want to. It can actually also do two factor authentication out of the box. Do you know what I mean by two factor authentication? Half of you, not every, if you don't shake your heads, then I'm going to talk more. So nobody, not many people shook their heads. What it means is I can check a box and have any of you done that with your phone where you take a picture of a barcode and it starts generating a random number that you have to use. You check a box and Key Cloak and all your users will automatically get a barcode that they have to take a picture of and generate a random number. So I would recommend if you're going to actually handle off, yeah, just like that. If you're going to handle authentication on your machine where you want to store user names and passwords, I would highly recommend that you turn on two factor off. It has saved my Instagram, Facebook, and many other accounts multiple times. Yeah. So when I gave this talk in the fall with Stan, he said they did not support hardware tokens yet. So that's what you're asking, right? Like a hard, yeah, yeah. Last I heard they do not. Yeah. You can do both. I only know the part that is users authenticating and then that being propagated throughout your system. I can't talk much to the other part. Sorry. Any other question? Oh, that's two scarves. They said I could get rid of a lot of these, so I'm going to. Because I like to reward people for interacting.  Not you. You have an accent like I do. All right. A New York one. So you can also customize the flow of when people log in. Like you know how sometimes when you log into one site, they show you terms and conditions, and then they make you refill out all your information again, and then you're actually a user. You can customize those flows and it's single sign on. So it's one place the user can go in there and manage all their stuff. Protocols, it supports OpenID Connect, which is probably what most of you are going to use, except for some of the Java people, and you're using capital W web services and you have my sympathy, and then you're going to be using SAML. So SAML is for the capital W web services, and it can be a Kerberos SSO bridge. So if you like that kind of pain, have at it. So here, let me throw this to you. And the question was, can I actually... Well, I'm assuming most don't, because I didn't, and I'm not that smart. So I'll talk to people like me. There's a difference between OpenID and OAuth. All... And you can correct me if I get this wrong. So you're my kind of pseudostean. Can you pretend to be Norwegian or Swedish? Can you be Swedish for a bit? Thank you. Good. So Open... OAuth just says, yes, I am this...  It's just I am... They're authenticated. OpenID actually says yes, they're authenticated, but can also pass in information actually about that user that can be passed around. Like, this is their first name. This is their email. This is the roles that they're supposed to have. OpenID... No, OAuth can't do that, right? And so the question was, can you just provide an OpenID provider and then move on to OAuth? Later. I'll show you. Like, turn on Google or Twitter for authentic... This is exactly... So... I need to give you another scarf for that. Do you have... Wait, I know, but do you have a significant other? Do you have a significant other? Like a partner? Do you have children? How about a dog? All right. So the reason I actually... What? I don't know. But back to... This is exactly why I started using key cloak. So you'll see this in a second when I demo, if I... I'm going to probably stop taking questions for a bit, but I wanted to turn on Twitter, Google, and Facebook authentication for my application, and I started looking at how to put all three of those on one page, and I started crying. And so what I... I saw the demo on key cloak, and I'll show you how easy it is to turn that stuff on in your application without having to write any front-end code. Okay? Clustering, it clusters. Screenshots of... Screenshots of the console. I'll show them in real life. So client adapters. So it actually ships with some libraries right out of the box if you want to adapt it. Java EE, Spring, JavaScript, Node.js, and mobile, native mobile, Android and iPhone. So these are the adapters you put into your application or that it knows how to talk to the server. It does all the nice work for you. Again, because it's OpenID Connect, you can actually find any OpenID Connect client library and use it against the server. And everybody here is using Linux, except for the people with the silver boxes. But you're running Fedora on those. Do we have a code of conduct policy here? Just kidding. I'm not going to pick on you. Most of my team uses Max. Most of my team does now. All right, more to come, so there's going to be more to problem. But again, you can use any resource provider that's out of the box. So this is the other really interesting thing about key cloak is the key cloak aimed to be the 80-20 solution out of the box. So 80% of the use cases should just be met by installing it and go. But when we gave this talk at Java One, someone said, I want to do eyeball recognition. I want to do an iris scan, and I want to key cloak handle iris recognition. And the answer is no.  So a lot of the places in key cloak are pluggable. And so what that means is your authentication is pluggable. So this one person could write an iris scanner, plug that mechanism into here, and whatever that information that's usually passed in from an eye scan can get processed against here, and then the person has been authenticated. So if you want to change any of these pieces and many more, you can actually just write your own interface to that, plug it in and go. Okay? And there's a community of them if you need others. You can theme it, and you'll see this in the demo. And this is the part that you asked about, about open identity brokering, and I'll show this in the demo as well. But it can also do user federation. So this active directory, notice what's interesting about that arrow. It goes both ways, exactly. So most solutions are, I'm going to take this and dump it into here. But I'm never going to go back this way. So if you're administrators, or you're an administrator running the Klee Coke server and you want to be able to do bi-directional work with active directory, you can. Some people will think that is heresy, but if you like that idea, you can. It also can be LDAP, or like Postgres, or any other RDMS. But you can actually send users back, and that whole... Yeah, it's like treating it like an LDAP server. Yeah, yes. I think it's... So, Dian doesn't like to talk about this, just for Java developers, which it's not, but it's written in Java. I don't know if you can write them in any JVM language. You might be able to write them in Jython or JRuby, but I don't know for sure. Any other questions? Because I want to get to the demo. Or do you like hearing me show slides so much that I should just keep going? So demo time. So I'm going to take a microservice with some different patterns, show how easily we add a key cloak, and then the whole microservice. It's very complicated. And it uses everybody's favorite game. I've got 10 minutes. Crap. What's everybody's famous game when you roll dice? No.  Dungeons and Dragons. Thank you. Dungeons and Dragons. So this is a... Do you know what Dungeons and Dragons is? Is this like an American thing? I think not. I think all nerds know Dungeons and Dragons. We all sat around in our junior high, being sad, playing Dungeons and Dragons with our friends. They were awesome. Anyway. So there's a player interface. There's an admin interface. They're both in HTML. You cannot log into this until you authenticate against the key cloak server. And then that actually... When you press a button here, it generates a Dungeons and Dragons character. For those people who did like Dungeons and Dragons, this is not following all the official rules, please. So if your wisdom is less than four, you can still be a cleric. And then that actually... Once that's generated, it actually pushes it into a Mongo database. And then the administrator can come in and look in that Mongo database and actually look at all the ones that have signed up. So that's our... So this page authenticates this service and this service do not ever talk to the user. They're just using tokens that are passed along. So go. Make a character. I think... Is it a server or is it a... That's one of the ones where Stean would know. But I didn't think Shibboleth was a server, is it? Okay, so the answer for those on the video, which I think is right there, key cloak is awesome. Shibboleth is tiny and puny. Is that good? Basically, Shibboleth is just for SAML. Thank you, sir. And key cloak has a lot more protocols and it's a lot more robust in what it handles. Is everybody going there to the page? How's it working for you? Can you sign in? I did that for you, Grant. Okay, let's go to the administrator console. So, here's the administrator console. Okay, fine. So I'm in. I'm going to go to key cloak and we're in the dra... Actually, can I make the smaller... Who's my age in the back with bad eyes? You, sir. You're pretty close to my age. Right there. Can you see that? Okay, keep telling me. Can you see it? We're good. Okay. So, this is the administrator console which is actually very easy for me to understand as a developer. We're in the realm of Dragon. So Dragon is just for these suite of applications. And here's the name. It's enabled so it's turned on. Oh, but can users register? No. So sad. Okay, not everybody at once because I need some people to save for like the Google authentication and the Twitter authentication. Okay, so did anybody signed up? Go back to the URL. Now you got excited and now you want to try it? You didn't trust me at first?  You knew it was a setup. Okay, good. So are some people in now? Yeah. And can you generate a character? Nice. The rest of you can go home. No, so I don't... Thank you for not signing in. So, one of the key things was turning on that kind of authentication. Right? So here we go to identity providers. People on the video, please don't copy down these numbers. Here's the... How many have Twitter? How many of you have a Twitter account? How many of you have tweeted that this is the best talk that the Steve Zero has ever given? Thanks, Jorge. I'm not turning it on then. How many of you are Google users? That's about the same. That's a little bit more. So I'm going to turn on the Google one. So I say here, edit. We put in our client ID, our client secret that you get from the Google when you're defining an app. And I just say enabled. Five minutes. That's sad. It's a conspiracy. Save. It's saved. Go ahead and refresh that page and watch what happens on the right side. It should look something like... Where'd it go? There's now a Google provider. That's how easy it is for a developer to enable Google off. So what I would actually do in my application is I would turn this... I would turn any new user registration off except for this and Twitter. Because I don't want to handle people's passwords.  So that's how easy it is to turn on another service.  Right? So who is... Who's Fly Bubic? I don't like you. You are no longer in my application. So that's how easy it is to get rid of somebody in there. The thing that happens with that, though, so he's not in there, if you delete a user, he can just reload the page and reauthentic make a new account again if he wants to. The smarter thing to do is... Now, I'm not going to... I'll have to have something good in my other hand. Who's Good Meric? Who's Good Meric? Is that really your name? Who's A-S-D-F-D-A-F-D? Who is that? Of course it is. Paranoid Security Guy. Okay, so what we can do with him is we can edit and we can say off. And once I save that, he's no longer enabled. So when he tries to come in, that account will be disabled. You have no longer... You can get your characters back. So that's how easy it is for me as a developer to manage users, which I find incredibly easy. There's other features that I could show, but I'm probably down to like two minutes, is that right? Or one minute, or I'm over? Is there a session after this one, or is there a break? That's it? Yeah, okay. Yeah, unfortunately. It is. There's a bunch of users in there. Here's the Federation. So if you wanted to add another provider, you can add LDAP or Kerberos here if you wanted to. This actually screwed my demos once because he added a half-broken LDAP provider and nobody could get in at all. Here's all the sessions. So I can... Here, there's 23 of you who actually have active sessions right now. Right? And who's Harry Potter? The boy who killed... Everybody's scared to tell me now. I shouldn't have done that. Who's Derpy? That's no good. Okay, show more. I need someone to come forward, please. Who's Pepe? This will give me great pleasure. So I can go to your session. Where's your sessions? I can actually... Oh, here's your sessions. Log you out. Right? So there's a bunch of other stuff in here that you could question we get a lot. And I don't know how to answer it all. You're going to have to help me answer part of this. But the part of the way this work is when you authenticate, and this is the last thing I'm going to end on, is back to this diagram. Right? If I go back to this one, the question I usually get a lot is every time I'm actually hitting one of these services, does it actually go back to the Key Cloak server? Right? Is this super, super duper chatty? Because that's what me and my developer had. I'm like, oh, well, I have a token. I have to keep making sure that token's good.  And then you get another token that's a renewal token. And so what that means is you have a token that's good for a certain amount of time. You can keep going. Suddenly, your token is no good anymore. And so what happens is it says, oh, I need a renewal. And then it'll go back to the Key Cloak server, get another token which is good for that amount of time, and you can keep using it. So this is a way, usually, you set your renewal token you set your renewal time to be short so that if somebody's doing something malicious you can kick them, when they go to renew again you can kick them out. But then you set the time that they're allowed to have their entire session open to be long. Right? Like a day or two days or whatever you want to send it to be. So I didn't get to show a lot of other, like there's email integration and all that other stuff and I'm out of time. So any, can I get one more question? One more? You're so nice. Do you need a scarf? New question, sorry. You got scarves. New question. Sorry? So the question, the statement was so I like Kerberos because it's a very similar idea. Yeah, the idea is the same. In my simplistic developer head, it's we're getting tokens and we're passing them around and we're doing stuff with tokens, which was originally built out in Kerberos. I think what's changed over time is this makes it a much easier to use, that pattern that was harder before to make nice libraries for you. Is that a good summary of that? Pretty much. Good enough for a developer. Out of time. Thank you everybody. Oh, and remember to show me your evaluations before you submit them. Just kidding. Are you next? Excellent. I don't have to read the room. You're doing the Archillian one with microservices, right? Good. What? Yeah, I'm still on. Hold on. Hi, hold on one second. You're the guy who offered to give the talk with me. Is that who? No? Okay, hold on. Ladies and gentlemen, please mute your mobile phones. Don't forget to give feedback. And the next presentation is by Aslak who is the


Let us continue our discussion on various aspects of interviewing. As participants speak to us, it is important to make them feel heard. By doing this, we acknowledge the importance of what is being shared with us through spoken or silent expressions. We may nod or make affirmative sounds such as hmm or yes. Occasionally, we can try paraphrasing and repeating back to them what they have told us. This may assure the participants that they are not being misinterpreted. And it helps us to be clearer about our interpretations. Every now and then, we may respond by sharing with them our own experiences and ideas. As we have discussed previously, sharing and responding helps build a more equal and interesting conversation. At the same time, it is important that we do not take over the conversation. We need to find an optimal balance between listening and speaking. How do we do this? In order to create a balanced discussion, we have to pay attention to the pace of the conversation. How fast or slow the participant prefers to speak? At what points and how often do they pause? What do their pauses indicate? If we attend closely to their speaking and their silences, we can sense the pace at which the participant is comfortable. They often indicate when they want us to respond to something they have said or when they want us to ask the next question. Some participants do this by pausing. A lull or a short gap in the conversation indicates that they want us to speak or maybe they want to add something. Others may be more forthright and ask us what we think or if we have had experiences similar to theirs. As we converse, we learn to read these subtle patterns. And it is these that guide us on when to listen, when to speak and when to express what we have understood. And how can we ensure that we are not leading the participants' opinions when we share our own? As we speak, we need to be careful of not imposing our opinions over theirs. Instead of being assertive in presenting our ideas, we can assume the position of someone who is looking for the others' critique and comment. Like saying, this is my opinion. Or in my experience, and what do you think about this? We must remember that in speaking, our objective is to share and to build upon each other's knowledge and experiences. In an interview, speaking is a way of working with our participants to make sense of their experiences. We have spoken about the meandering and fluid nature of ethnographic interviews. Sometimes though, the participant may digress way of our topic. When this happens, we have to try and bring the conversation back to the original topic or move it on to the next one. And we have to do this without awkwardly cutting off or offending or embarrassing the participant. A simple way is to wait for a gap or a pause and use that window to divert or redirect the conversation. For example, we could say something like this, yes, I remember you talking about that. What I also wanted to learn was, and so we can reintroduce the topic we would like to discuss. There are some interviews where we need to be particularly efficient with time. Like when we interview someone at their workplace, or when we interview someone for a less reflexive and more fact-based understanding of a phenomenon. In such cases, it is best to move the conversation at a brisk pace, shortening the gaps between the discussions and moving to the next topic. Whether we have been discussing a complex and difficult subject or a simple straightforward one, transitioning across topics requires a fine balance. Often the cues for a new topic to be discussed are to be found in what the participant is telling us. Even listening and short gaps between topics make it easier to recognize such clues. In introducing a new topic that is unrelated to our present discussion, we should avoid abrupt switches. We can also ask the participant if they want to add something else to the topic being discussed. This ensures that we are not cutting them short. A pause here may be a good idea. We can take a moment to quickly scan through our notes to check for any follow-up questions or see if there are any loose strands we may want to tie up. Or maybe the participant wants to add something here. When we are certain that it is okay to close this topic, we can start on the next one. As we near the end of the interview, we move away from more complex subjects towards simpler ones. This is where the intensity of the interview peters off gradually. At the end, they should feel empowered, happy to have shared aspects of their lives with someone who was keen to listen and learn. They should not feel like they had a lot more to say but were not able to say it or were not asked about it. Nor should they feel like something has been taken away from them. As we end the interview, we need to acknowledge and express our appreciation for what they have shared with us and for the time and energy they invested in the conversation. It is a good idea to ask them if they have any questions for us. Often participants want to know how the things they shared will contribute to the research. And before we leave them, we can ask again if there are parts of the interview that they want to keep private or anonymous. Even though we have taken permissions beforehand, interviews tend to go in unexpected directions and we should be doubly sure of respecting their comfort and safety. Let us pause for a moment here and revise some of our learnings. On the screen, you see different aspects of interviewing. Handling between topics, handling digression, closing the interview. For each of these aspects, list one key learning. Do post your answer in the discussion forum. We will discuss your answers there. And in our next section, we will conclude our discussion on ethnographic interviews.


Nice of you to show up. I'm very glad to be here. I'm Lambda Totoro, and I can't see you anymore. Very good. I'm usually findable at the Acme Labs assembly. And I have come to you to talk about gender. I know. Interesting topic, right? So a couple of things about me. I am many things, among them, non-binary, a master of science in intelligent systems currently. So my background is in computer science. Currently a PhD at the University of Erlangen. And I also do science labs. And basically, this is just another one of those for me. And I've been doing this for roughly, well, I've been pondering this topic for roughly 10 years. That doesn't make me necessarily an expert, but at least it makes me an expert so that I think I can stand up here and tell you some things. OK. What is this talk? This talk is about this exact thing. This is a form that a good friend of mine who wanted to partake in a scientific study had to fill out. And it's in German. I'll translate. It's a question on a scientific survey that asks you for your gender. And it gives four options, male, female, other, and no answer. And while that is not technically the worst thing you can do, it was the motivation for asking myself of how can we do better in this type of situation. So this is a talk about our responsibilities as software craftspeople, what we can do to reflect these things, and what responsibilities we have, and how the tech itself, by itself, just by the virtue of being tech is not neutral. There's some content notes I want to hit on first. This talk will deal with descriptions of transmisia, so hatred against trans people, intermisia, and involuntary surgery. If that's not something you want to deal with, there will be a recording, if you want to see this, at a better time for you. And otherwise, I want to follow roughly this split. I want to do one-part education, one-part form design advice, and one-part fun. Because even though it is the year 2019, and you really think that by now the basics would be down, you still sometimes get forms on the internet like these. I must say at this point, none of these screen grabs that I will show you are made up. I have done exactly zero of them. They were all found somewhere on the internet. OK, a few things this talk is not. This talk is not an invitation to debate the human rights of people, especially trans people, or people in a different culture.  All right. So why are forms important? Why is it important that we deal with this at all? Well, if you do sloppy work, it hurts a lot of people. First of all, your data. If your input form for anything, but in this talk, we'll use gender as an example. But if your input form doesn't let people input the correct form or the correct answer to a given question, then that hurts your data. Because you will get incorrect data. It hurts your users. And I can tell you from first, second, and third hand experience that it is really, really, really frustrating if you're supposed to tell somebody something about yourself. And the correct answer is not an option. And it also hurts yourself, because somewhere down the line, these people will complain to you or not use your service when they otherwise would have. So nobody likes this extra frustration. Let's see how we can do better. That brings me to my conclusion slide, which I like to put in front. The central points are as follows. Make the model fit the user. You are modeling your user, if you know it or not. And it's important that you make your model fit the actual users in the world. And don't chuck any model out there and say that the user has to confirm to that. The next one is humans are moving targets. Humans change. Their names change. Their genders sometimes changes. It's really, really, really difficult to just get everything right the first time. And so we change. And your model should reflect that. Of course, the easiest thing to do is just not ask a certain question, because with that you make the fewest mistakes. But sometimes if you do ask something, be at least very precise and upfront about what you're using the data for. Just so people know which is the correct answer to give you. All right. Now that we've got the boring stuff out of the way, we can talk about the fun stuff. The talk is titled, Hello, I'm your edge case. And that is based upon mine and some of my friends' experiences at university. Whenever we wanted to sign up for something like a sports club or a student union or something, whenever there was a little field that says, oh, well, please select your gender male or female, then we would not be able to give the correct answer. And we would have to go talk to an actual person. And the introduction usually went something along the lines of, hello, I'm the person that doesn't fit your system. Or, hello, I'm your edge case. And the format this rest of the talk will take is that we will go through some of the maybe incorrect or maybe a bit biased or maybe a bit, well, let's say updateable functions or preconceptions you might have and then talk a bit about the facts and about the problem and see what we can learn from that. The first one is maybe the most popular one. There's only two genders. Well, some people don't even manage that. And again, these are not made up. Some people apparently still believe that, well, there's just one and it's male, so you're all the same. I mean, while I appreciate generally that the impetus into the direction of everyone being equal, I don't appreciate just everybody being called male instead. But no seriously, there's a lot of non-binary people that are neither male nor female. Non-binary people have been part of almost every culture for almost as long as we have records going back. This is not a new phenomenon. This is not just a trend. And it's gotten so far to the point that even some countries, you can see here, have started adding legal recognition to non-binary genders as well, including Germany. In some sense, we'll get to that a bit later on. But the list is there. It's not very short and it's only ever getting longer. So maybe don't store gender in a boolean anymore. I beg of you, please don't. It is just not enough. It can only hold two things when there's clearly more than two things. OK, now that we've done that, the next step that somebody might take is, OK, OK, OK, OK, I get it. Not two. It's three, right? Three. That's what you said. It's like male, female, and all of the others, or the other. So I'll just do three instead, that I can do. And of course, first of all, I would like to ask of you, if you're designing a computer system and you want to give a third option in gender, please, please make sure it's actually a gender. This thing was given there where you have female, male, and LGBT. LGBT, of course, stands for lesbian, gay, bisexual, and trans. And none of those are genders. Your trans, if your gender doesn't match the gender you were assigned at birth, otherwise you're cis. But it's not a gender in itself. It's not the third option. Please, please never do male, female trans.  OK, but if you don't do that, even some corporations have caught on to that there might be more than just those or just three options of male, female, and other. Tinder has 37 by now. And of course, 37 is a lot, but the thing is, is that now the exact number? And of course, it isn't. Whenever you get to a finite number, there will be somebody on Earth and probably somebody within your user base that doesn't fit into any of those boxes you've laid out. I mean, just from the 37 here, we also have gender fluid. And I think this is gender queer, sorry, gender queer, and gender fluid, and agender, and neutra. And we have bi-gender, tri-gender. We have poly-gender, and pan-gender, and a range of other non-binary identities. And the idea is just whenever you get to a certain finite point, it is always somebody who is also beyond that. Don't just put out a limited number of boxes and say everybody fit into that. OK. And the next step, of course, would be, OK, you said 37 and then you said some others. I'll just build all of those. And here's the interactive part of the talk. I don't know if we can get the room lights a bit up. If not, that's also not probably. Whoever here has heard of something called a demi-boy. That's a gender identity? Who has?  And there's at least 100 people here. So that's a perfect illustration of why you would need a text box, because you don't know all of the possible answers that you can give. And for that, this slide gives a reasonable approximation and is also a little bit of a humorous take on something extremely serious. Humans still change. Humans are still a moving target. Even if you know about all the genders that exist today, you might want to add another one tomorrow because you get a new user that has that gender. And for that, it would be ideal if you can have a text box where people can just add their own gender. It's not a statistical outlier if enough people do it. It's, of course, a little bit of a funny take, but it's also an invitation.  Because if more people do it, it will create more visibility. All right. So from that, we've seen that maybe don't store gender in an enum, either. OK, next up. This is also a bit of a contentious subject, but a lot of people come to me and say, well, I learned in school that there's only two biological sexes, right? Well, you might have learned that in school. I won't dispute that. But I can tell you from my side of things that I once learned in school that there's no gravity in space. Well, that is obviously wrong, even though it's a simplification, something that my younger self was or needed to be told so I couldn't understand or have my understanding move forward a bit so I can then later understand the more complexities that, of course, there's gravity in space, but it behaves differently than the one you know. And it in same things goes with biological configurations and as that relates to gender. There's something called intersex people, and that is if you are born with any configuration of your biology that might be your gonads, that might be your chromosomes, that might be a lot of things, your hormone levels a bunch. And any of these can fluctuate so that you don't fit into the two classical categories. And if you are, if you are born such, then you might find yourself into the label intersex. And intersex people don't necessarily become non-binary automatically. They are not non-binary automatically, but some of them might claim that label. It's up to them, of course. Gender is something you know best what you are, so please just let people talk for themselves. While I'm on the topic, also there's a very serious thing that I want to mention where a lot of intersex people when they were born and people notice that maybe their genitals don't conform to one of the two classical categories, then people are still being subjected to unnecessary surgeries. Like there's no medical need for them, but just to make it easier for the person, a functioning set of testes is removed or the clitoris is reduced. And that is still happening today in Germany too and in the US and in a lot of other places. And if you're maybe social justice adjacent and looking for a good cause to spend some time in, maybe read up on this and learn about that and see how you can affect that. That's definitely something extremely troubling to me. Okay, so biology, maybe bimodal, that is a distribution that maybe has two peaks with the most common outcomes, but it's definitely not binary either. Okay, also you probably don't need to know. Unless you're a doctor and making some input form for very specific medical procedures, then you probably don't need to know. If you're just a social media site or something, you do not need to know your user's biology. Yeah, well, this I also hear a lot. There's so many options now. You said there's at least 37 or might be more. That sounds like work and sure, but I don't buy that. There's a, here's a form from the German military interest union or something. And they give you two options for gender and they give you 71 options for academic title. I could read them all to you, but I literally do not have enough time left in the talk. And with that, I just don't believe you that it's too much work if you do something like this. So if you don't want to deal with the whole thing, please be advised that not asking is always an option. You can always just not ask about it. The information is either needed or not, act accordingly. If it's needed, get the right one. If it's not needed, maybe just don't ask. Some people also say, oh, well, I'll just ask for preferred salutation and infer gender from that. Yeah, spoiler alert, guessing gender doesn't work. Not from name, not from face, not from their tweets. From, there's nothing that you can guess gender from except a field where the user can input their gender. And so you will get this wrong. Even if there's some online services who tell you that they can, they only give you a best guess. And that's usually not enough. If you want to do salutations, sure, more power to you, but at least include like a neutral option. This is one from Lobby Control, I like that a very lot. They have two options and they have a third one that just says hello in German. And the English language also has mix for not mister, not miss is not miss, but mix that's gender neutral is in the dictionary. But whatever language you're using, hello just works everywhere. Okay, quick case study in the case and you're working in Germany in particular, we have four gender markers in our passports. We have numerous options in biology and we have countless options in gender. And I wanted to see, okay, political parties, how do they do this? Who of them shapes up the best? And well, to nobody's surprise, the social democrats do it the worst. They just ask for binary gender, nothing to do about it. And since Germany has a third entry, I'm pretty sure that's illegal or at least legally questionable by now. So next up, also to nobody's surprise, the two conservative parties just ask for binary salutation. That's not very good. We have the free democrats that ask for male, female or diverse. At least they didn't mention all of them. The green party has male, female, inter or diverse or no answer, which is basically okay. And the left party, the socialists, they don't ask at all, which I think is really the best way. The empty model makes the fewest mistakes. Yes, thank you. Okay, my time is running to an end, but you kind of also came for this next slide. No, seriously, how do you ask people for their gender? So here's my best take. Before asking, make sure you need the information. Make sure this is the information you need and you're not really asking something else. Make sure it's mutable in your model. Make sure you can change it. And then just ask. Either tell them, definitely tell them what you need the answer for and definitely tell them that they can just enter a free form answer in a text field, but then you can give either no options and have everybody use the text field or give as many as reasonable possible, that's more than two, and then also have some text field for the ones that are not in the boxes listed above. This is very popular with the target demographic. I also would very much like that, more seen, even there's no text field. Of course, this applies to other questions too. I don't know if you could be Danish, but apparently you can. But generally, this is not just gender, it's not just sexual orientation, it's also names, addresses, all of these things. Not everybody has one, even if you think they do, and it can be really, really complicated once you get down to it. My conclusion slide is this again, if you wanted to talk to me again, you can come up after or meet me at the Acme Labs assembly. Here's some recommendations if you want to read more. That's all I have. Thank you for your attention. Applause, applause, applause, applause. And on the left and on the right are the usual microphones. If there are any questions from the audience, it's now the time or perhaps from the internet. So, somebody is running, it's a good sign. Yes? Hi, is there, you said that in the beginning, there were booleans to store gender, which is not recommended. Do you have any data on whether there was a preference to give the true and the false to male or female or vice versa? Well, the thing is both are false. To Jay. I don't know what you are. The thing is there's not enough answers in two. Both are false. It was just idle curiosity as to whether there is some preference in the data as to in which direction they got it wrong more. The preference is to not give the wrong answer. Good. Okay, a second question or anyone from the internet. No questions, it means thanks a lot. Another applause for Lambda Totoro.


San Francisco voters approve taxes on CEOs and big businesses. That's the headline, but that's not the truth. It's much more nefarious than that. In an effort to address economic disparity laid bare by the corona pandemic, San Francisco voters overwhelmingly approved several tax measures targeting property owners and big businesses with CEOs paid far higher than the average workers. Under the new law, any company whose top executive earns 100 times more than the average worker will pay an extra 0.1 surcharge on the annual business tax payment. If a CEO makes 200 times more than the average employee, the surcharge will increase to 0.2. Voters also agreed to sweeping business tax changes that will lead to a higher tax rate for many tech companies and a higher transfer tax on property sales between 10 million 25 million. In quotes, we're not going to shed any tears of penthouse dwellers have to cough up. The results show that San Franciscans are concerned about the growing economic inequality. City Supervisor Matt Hannie, the author of the measure titled Overpaid Executive Tax said Wednesday, the very wealthy are gaining more and more. They're gonna much richer during the pandemic while everyone else has remained stagnant.  The hypocrisy is obscene. San Francisco or California in general has become, it's not becoming, it is a fucking, it's just slum, it's shit, man. We continue. In quotes, we need the wealth that has been generated in the city to be shared more broadly with the workers.  Crazy. Since March COVID restrictions have shut down the critical elements of San Francisco vibrant economy, tourist scarce legions of workers and tech in the city's main business and financial districts have left yadda yadda.  I said this at the beginning of COVID. As soon as they started doing lockdowns, I said the first thing they're gonna do and the easiest thing, and if you study history and you look at what politicians and governments have done, the first thing they do is tax property. Income tax is difficult because depending on where you are, and that's more kind of like the honor system depending on what you claim, but property tax, they know the blue book value of your property.  Even here, Ontario, the Ontario party, the conservative party is talking about increasing property tax. So what this happens is you have a hollowing, hollowing out of the city. Anybody that has two brain cells left is leaving San Francisco or has left San Francisco outside of California. Joe Rogan left, he's gone, a lot of other famous people have left, and you get to understand the people that have the means, which I mean by means is finances, to move around, they will leave. What this does is hurts the regular person, and it's not just for the rich. They say this, but it's not. Anybody that has a property, if you have a regular property and you sell it, let's say it's just blue book value, regular house, you're getting taxed more. So basically, they're trying to just steal more money from you, and it's the hypocrisies app scene. Politicians telling you, ah, the people are hurting, we need to share more. Says the one who's making $150,000 a year plus full benefits from the government with 100% immunity. Look at this. Rents in San Francisco have fallen as much as 31%. Rents continue to drop in some of America's most expensive cities. With more people working from home for the foreseeable future, many renters are seeking to live in more affordable areas that can offer them extra space. This especially impacted San Fran, which led the nation rental prices decline in September. According to a report from Realtor.com, the medium rent for a studio apartment fell to 22.85 a month down 31% a year ago. The report showed the medium rents for one bedroom apartments dropped 24% to 2,873 a month and two bedrooms fell from 3900 down 21. In quotations, renters now have the upper hand over landlords in many of the nation's most expensive cities. In addition to San Francisco, many of California's high cost counties have seen significant drops in rent as well. One bedroom in San Mateo County is down 13% from last year and 12% in Santa Clara County. In September, rent for one bedroom was down in 36 out of the 100 largest US counties. So this is what's happening. It's a hallowing out. People are leaving.  Many, many big tech corporations aren't coming back to San Fran. They're moving to more friendly jurisdictions, whether that is Florida, whether that is Texas, whether that is Delaware, whether that is Nevada, or in fact, they just leave United States altogether and their legal jurisdiction for the most part is Ireland, Northern Ireland or somewhere else around the world like the Maltese or whatever. But these politicians thinking, imposing these more tax taxation laws is going to help the regular person.  If you are living in California and you haven't considered moving, I would consider moving. I would really ask yourself, what benefit do I have living here? Yeah, the weather is great. Weather is great in Texas. Weather is great in many other southern states. It's not just California.  We got winter and then we got construction season. Those are the two seasons we have. Spring and fall kind of, it just bypasses quickly. So basically we're a two season country for the most part. So we don't have the luxury of moving anywhere that's kind of warmer. We have the luxury of moving out. Do I want to have a minus one or do I want to have minus 10? Oh, the decisions I need. But this is the writings on the wall and it's going to get worse. Watch in April next year when the real economy starts getting hit, where mortgages are completely deferred and defunct, where the economy catches up to reality, where over the last now 10 months or even a year, all the major small businesses, gyms, restaurants, bars, clubs, the real economy, the cash economy has crumbled, the domino effect. We will see a massive hollowing, a massive exodus of people leaving California and in general leaving any major polythene city, even here in Toronto, people are leaving. I have a piece of property north of Toronto a couple of hours and the realtor I was talking up there has said the property sales have been through the roof. He's lived there for 20 years. He's never seen this much interest for people wanting to leave the city because people now can work from home and they can live pretty much anywhere they want for one tenth of the cost, the cost living in the city for like a little piece of shit, one bedroom apartment.  That's it. This is pure theft. But the craziest thing, they're trying to steal from people that have the means to, I want to say escapist, but they just say no. If you're a big multi-corporation and you have property in California, you have smart accountants, you have smart people that can figure out ways to whether to sell it, liquidate it, get out of there and completely move any trace elements of your physical and legal presence in San Fran. And what's San Fran? San Fran is going to become Detroit. That's exactly what San Fran is going to become. It's going to become Detroit overrun with social Democrats who think they know better, who are pretty much communists in the skies.  Peace out, guys.


Problem three, a closed piston-cylinder device filled with 10 kilograms of air undergoes a series of quasi-equilibrium processes shown here. Determine the specific boundary work in kilojoules per kilogram occurring between states 1 and 4. So, let's think about what's actually happening here. We have a gigantic apparently piston-cylinder device. I said it so it's now canon. I guess it would have to be pretty large in order to fit 10 10 kilograms of air, so that makes sense. Awesome. I have a large piston-cylinder device containing air and between states 1 and 4 here it is undergoing three processes. From 1 to 2, the specific volume is constant, the pressure is increasing. From 2 to 3, the specific volume and pressure are both increasing, and then from 3 to 4, the specific volume is increasing, but not the pressure. So, because the mass is constant, I know that because it says a closed piston-cylinder device, because the mass is constant, this specific volume increasing means that the actual volume is going to be increasing as well. So, between 1 and 2, the piston doesn't move. Between 2 and 3, the piston goes up quite a bit, and then from 3 to 4 it goes up a bit more. And I'm asked to calculate the specific boundary work. Let's step back to what boundary work actually means. We defined boundary work, which is that work associated with a moving boundary. In this case, the moving boundary is the raising piston. The total boundary work would be the integral of pressure with respect to volume. And what I want is actually the specific boundary work. So that would be the total boundary work divided by mass, which would be 1 over mass times the integral of pressure with respect to volume. And I could bring that mass inside the integral, and I could divide the differential of volume with mass, and end up with the differential of specific volume. So I could have the integral of pressure with respect to specific volume. And what I'm looking for is the specific boundary work between states 1 and 4. So this would be the integral of pressure with respect to specific volume from specific volume 1 to specific volume 4. And I could make this a little bit easier by recognizing that I could break that integral apart. So the specific boundary work from 1 to 4 would be the same as adding together the specific boundary works from 1 to 2 and then 2 to 3 and then 3 to 4. Which would be the integral of pressure with respect to specific volume from v1 to v2 plus the integral of pressure with respect to specific volume from v2 to v3 and then again from 3 to 4. I know that doesn't look like a P, but I swear it is. So at this point, I look back at how my pressure actually varies across the processes. Pressure is only constant from 3 to 4. So I could bring the P outside of the integral from 3 to 4 here and actually just take the pressure times the differential of specific volume. Pressure times delta specific volume. So pressure of 500 kilopascals times 0.2 meters cube per kilogram. However, from 1 to 2 and 2 to 3, this gets a little bit more complicated. Because I would have to actually calculate or determine the equation of this line, I have to know how pressure varies with specific volume in order to actually evaluate this integral. Except for one thing. I could take a shortcut by recognizing that the specific, the integral of pressure with respect to specific volume is just going to be the area under this curve because I'm given a graph of pressure and specific volume. I could actually just geometrically determine this area here and that would give me my answer. And I can do that by splitting it apart into some simpler geometric shapes. Add them together. That would give me my answer. So let's see. Let's do the area of this rectangle plus the area of this triangle plus the area of this rectangle. So the first rectangle would be 200 kilopascals times 0.4 cubic meters per kilogram. So I guess let's write that out. 200 kilopascals times 0.5 minus 0.1 cubic meters per kilogram. Plus the area of this triangle, which would be one half base times height. So that would be one half. The base is going to be 0.5 minus 0.1 cubic meters per kilogram. And then the height is 500 kilopascals minus 200 kilopascals. And plus the area of this rectangle over here. So this would be just to be consistent. Let's take 500 kilopascals times 0.7 minus 0.5 cubic meters per kilogram. So 500 kilopascals times 0.7 minus 0.5 cubic meters per kilogram. So I calculate these numbers and add them together. I'll get my total specific boundary work, if that makes any sense. So wake up calculator. We have work to do. 200 times 0.4 is 80. 0.5 times 0.4 times 300 is 60 and 500 times 0.2 is 100. So 80 plus 60 plus 100 would give me 240.  So let's do 80 plus 60 plus 100. That's 240. Awesome. Score one for mental math. Although I guess I did do mental math over here too. It's probably fine. Let's just ignore the problem and it'll go away surely. So I have 240. 240. Now the question becomes, what are the units on that? Well, I know that I have kilopascals times cubic meters per kilogram. So when I add all of these up, this is actually 240 kilopascals 240 kilopascals meters cubed per kilogram. Now let's think about what that means. A kilopascal is a thousand pascals and a pascal is defined as being a Newton per square meter. Then I know that I'm looking for an answer in kilojoules per kilogram. So I want to get this numerator into kilojoules. I'm going to end up with kilograms on the bottom here. This meter squared is going to cancel this cubed. So I'm left with Newton meters per kilogram. Well, that's convenient because I know that a joule is defined as being a Newton meter. So in order to get an answer in kilojoules per kilogram, I'm going to have to take this answer that I came up with, multiply it by a thousand and then divide it by a thousand again. Because there's a thousand joules in a kilojoule. So my answer of 240 is actually already in kilojoules per kilogram. So you'll notice that at no point in this geometric solution did I use the 10 kilograms? Or remember that we were supposed to or we were supposed to quote unquote have calculated this answer by figuring out the equations of these lines. So the equation of the line from one to two wouldn't have been a function of specific volume, it would have been a function of something else. This fails the vertical line test because one input could yield multiple outputs. So this integral here would just become zero. Then I could come up with the equation of the line from two to three and that would have given me let's see y plus mx plus or y equals mx plus b, in this case y is pressure and x is cubic meters per kilogram. I could extrapolate this line to come up with a y-intercept, that'd be b, m would be the slope which is rise of a run, which I could calculate, I could come up with this equation as well. And then three to four, this would be an easier integral because pressure would come out. But at no point in that solution either would I have used 10 kilograms. That means this 10 kilograms was more information than I needed, it was a red herring. It would have been useful if I were asked for the total boundary work, that just kilojoules occurring between one and four. But because I'm asked for kilojoules per kilogram, the kilograms, the number of kilograms, the mass doesn't actually matter. But that gives me my answer to question number three.