One of the greatest joys of doing this project at the Theorosa Center has been our stakeholders group, and we have a number of stakeholders, the State Historical Society of North Dakota, the North Dakota Code by Hall of Fame, where we'll be having our wrap-up reception later this afternoon. The Theorosa Midora Foundation, which is the 501C3 foundation that runs this community, the tourist aspects of Midora, the new hotel this building, and many other facilities here in the Midora musical, but our greatest joy is having Valerie Naylor as our stakeholder partner. She's not only been a terrific supporter of everything that we're doing, but she's the one who took the initiative to get the Centennial Challenge Grant from the National Park Service that's enabling us to digitize the holdings in the National Park Service that are Roosevelt-related. She and I have met to Sycamore Hill, and our friends from Sycamore Hill are here today. She's just been a wonderful friendship and partnership with Valerie. We just so completely appreciate all that you do. So I want to have Valerie as the superintendent of Theorosa National Park, and she's going to have a few statements about the park and the National Park's history and so on, and then we'll move into how Roosevelt got on the Mount Rushmore. Across this country, from Alaska to the Virgin Islands, from Maine to Hawaii to Guam to American Samoa, there are 392 national park units. Now, 58 of those actually have the title of National Park, but those of us who work for the National Park Service call them all parks. We don't differentiate too much among national parks, national monuments, national historic sites and such. So there are 392 park areas and 58 that actually have the title of National Park. Now, of those 58 parks, there is only one that bears the name of a person, Theodore Roosevelt National Park. When you're standing, just a stone's throw away from it right now, sitting. So this is a very significant park from that standpoint. And most of the 392 national park areas are not named for people. There are a number of national historic sites and such that are. There's the Lincoln Memorial and George Washington Carver National Historic Site, Martin Luther King National Historic Site and such. So there are a number of them that are named for people, but most of them are more like Fort Union Trading Post, or Fort Laramie, or Knife River Indian villages, or they commemorate an event or a place, but not necessarily a person. Nevertheless, Theodore Roosevelt actually has six of those 392 park areas that memorialize him in some way, and that's extremely significant. There's only one other person that has six parks that are really memorials, and that is Abraham Lincoln. So that is really pretty amazing that both of those men have that many national park areas dedicated to them. Now, for Theodore Roosevelt, we have Theodore Roosevelt National Park right here. There's also Sagamore Hill National Historic Site, which we've talked about, on Long Island, which was Roosevelt's family home, where he and his second wife Edith raised their six children. There's also Theodore Roosevelt Birthplace National Historic Site on East 20th Street in Manhattan, which is the reconstructed home where Theodore Roosevelt was born in 1858. And there is Theodore Roosevelt inaugural National Historic Site in Buffalo, New York, which is the site where Roosevelt took the oath of office on September 14, 1901, when after McKinley, President McKinley died. So those four sites are very specifically dedicated to Theodore Roosevelt, and there is a lot of connection between Roosevelt and those sites. Now, there is also Theodore Roosevelt Island, which is an 88-acre island in the Potomac in Washington, D.C. We don't believe Roosevelt was ever there. But if you're going to make a monument to Theodore Roosevelt in Washington, D.C., it's nice to do it in a natural area. He loved nature. So it's an 88-acre natural island where you can hike, and there's a big monument to Roosevelt there. So again, it's a site that's very specifically dedicated to Theodore Roosevelt. But Mount Rushmore is the sixth one, and that one's a little different, because it is in fact a memorial to four presidents, not just to Roosevelt, but he's one of them. And so I thought we should talk today a little bit about Mount Rushmore, how it came to be a memorial to the presidents, and how Roosevelt got his face as one of the four faces on Mount Rushmore. Go for it. Do you have anything you want to say about that? I look forward to hearing you. Okay, great. Mount Rushmore was conceived by a man named Don Robinson, and he was a state historian in South Dakota. And in 1924, he was thinking that South Dakota really needed a great attraction. The Black Hills had wonderful scenery. It was a beautiful place, and the tourists were already coming, but there was no one attraction in. And this is what Don Robinson wrote. He said, tourists soon get fed up on scenery, unless it has something of special interest connected with it to make it impressive. And so he was trying to figure out what that should be, and he was doing some reading about Stone Mountain in Georgia, which was carved by a sculptor, Detson Gorgon. And he was reading about that, and he thought, hey, we could do something like this in the Black Hills. And that was his first idea. And so his initial thought was that they should carve the needles in the Black Hills. Now, how many of you have been down the Needles Highway in Custer State Park? And most of you have. Many of you have. It's beautiful. And his first thought was that they should carve some Western figures onto the needles, like your friends, Lewis and Clark, and Sakaka Williams, and maybe Jim Bridger, and maybe George Arningstrom Custer, and folks like that. And they could carve these pinnacles, and that was his first idea. But, yeah. The Needles, oh, it's a beautiful area. Part of it is in Custer State Park, and it's a little bit on Forest Service Land in the Black Hills, and it's a fantastic place of these spires, granite spires. Very impressive. And so when Don Rockinson suggested carving that area, there were some conservationists who didn't think that was a very good idea, and they were really quite critical of that idea. And the Needles are remnants from the granite remnants where the softer materials run and they're eroded away, so they're like huge pillars, and they're scattered. And so if they had followed through with Don Robinson's idea, Annie Oakley would be here at three miles away, would be Custer, and eight miles away would be Jim Bridger, would be just sort of weird kind of puppet heads and granite all over the Black Hills itself. What if that idea did not get done? No, fortunately, again, because the spires and the needle spires and the needles are a natural wonder of the Black Hills. And so people in those days even said that a statuary among the needles would be as ridiculous as keeping a cow in a capital rotunda. I would say even more ridiculous than that. Somebody said, why desecrate a noble work of nature with a puny work of man? And then there was a chance, leave the hills alone. And I'm sure I would have been among those folks in 1924, if I had lived there then. So Don Robinson, he still kind of thought that was a good idea, but he was looking for a sculptor, first of all, to come out and carve something. He didn't even really know what, and he wasn't sure where, but he wanted someone to carve something. And so Gunson Borglum, the one that had carved Stone Mountain that he'd read about, was actually not his first choice. He later said that he was, but in reality he asked two other sculptors first, a gentleman named Taft who was a well known sculptor at the time, but who was in poor health and didn't want to do it. And then the one who had carved the, or had designed sculpted the Lincoln Memorial, the sitting figure of Lincoln in the memorial. And both of them turned him down. So then he telegraphed Borglum, and Borglum was a little more desperate, I guess. And he jumped right on it and said, yes, I'd love to do it. That would be great. I know what to do. I've been doing this in Georgia. And he came out to the Black Hills in August of 1924 to check it out and to talk to Robinson and see what he could do. And it wasn't until he actually met Robinson in person that he told him, well, you know, I really don't want to carve these Western figures at all. Borglum said, no, we're not going to do that. And I think he knew from the very beginning he wasn't going to do that. But he just basically told the guy that had asked him to do it that he wasn't going to do it, that he wanted to do, was to carve a great American memorial and that the Western figures were too local. And that he did something much more grand, something that spoke to America, something that was nationwide insignificant. And so, in fact, he suggested he took out a piece of scrap paper and he drew a figure of a Washington car. And he said, if something like this is what we need. Thoughts on that, Clay? Well, just to... I mean, it's the accidental nature of Mount Rushmore because Don Robinson was the historian of South Dakota and he wanted to create a tourist facility in the Black Hills to increase visitation. And Borglum was not interested in this concept at all. But what I find so interesting about this, and I want you to reflect on it a little, is how little deliberation there was about the eventual form. I mean, this was not a national conversation. There wasn't a big debate of a committee and there wasn't a series of historical memos written about this. Borglum had already done a Lincoln that was in Washington and that Lincoln was actually taken by the Roosevelt and placed in the White House for a time and Roosevelt knew Borglum and Borglum was involved in the 1912 campaign to a certain extent. So he already had a Lincoln, Washington was the first thing he sketched, but there's no paper trail of a long, deliberative process. No, there really was no deliberative process and I like to say that Mount Rushmore involved rather than was decided, but in reality, I don't even think it involved. It muddled their way into it. It was just something that sort of came about. I mentioned that Borglum had written that or drawn that picture of Washington on a piece of scrap paper and said this is what it should be and they talked about it a little bit. He went back home to Connecticut and a couple of months later, he sent a note to Don Robinson and had said, yes, I'm ready to carve this sculpture of Washington, Lincoln, and theater Roosevelt and Robinson really didn't respond. He was like, okay, whatever. So it was really initially Borglum's idea, just two months after he had visited the Black Hills, that Roosevelt should be part of Mount Rushmore. Nobody really debated it or talked about it at all. It was an interesting thing. So they spent about a year sort of trying to find funding and get things together and to get a lot of support and they needed the support of a number of people, the carps of them, the Black Hills. They wanted the Rapid City Mayor, John Boland, congressional representative, the governor-elect and then of course Peter Norbeck, who was senator of North Dakota, or in South Dakota and was the most powerful man in the state. So they had a lot of support too. So in late 1924 and 1925, they were trying to get that support and then about a year later in 1925, Borglum came back to the Black Hills and they threw a luncheon for him and he got up to talk and in the course of that, he said, I'm going to carve a great sculpture of George Washington, Thomas Jefferson, Abraham Lincoln, and theater Roosevelt and the whole world will speak of South Dakota. And he just said that at a luncheon and that was really the first time that Jefferson was officially announced. And I don't know that he and Norbeck or he and doing Robinson had much discussion of that at all. He just announced it and Borglum was great at just announcing things. He announced also that the people in South Dakota would not have to pay anything for Mount Rushmore. They wouldn't have to pay a cent and he said a lot of things and turned out not to be true. But he just proclaimed it and so it's kind of interesting. Now later, Peter Norbeck, who was a senator and he did discuss a little bit about theater Roosevelt, later on Borglum said that it was really Norbeck's idea to put theater Roosevelt on Mount Rushmore and Norbeck said that it was Borglum's idea to put theater Roosevelt there and we think that maybe Besson Borglum was trying to distance himself from a little bit from Roosevelt because Roosevelt was always a little controversial up on the mountain. But interestingly, there was no real discussion of that and as Clay mentioned, both of them had been involved in the Progressive Party, the Bull Moose Campaign. Borglum had been the Stamford, Connecticut chair of Roosevelt's campaign in 1912 and he had gone all over Connecticut campaigning for Roosevelt and Peter Norbeck was partially responsible for Roosevelt actually carrying the state of South Dakota during the 1912 election. To say something, why that's such an unusual choice that Lincoln was inevitable. He had already done a lot of work on Lincoln. Lincoln was celebrated in so many different ways but of all the four from Borglum's point of view Lincoln was the most obvious but Roosevelt was the least obvious for one thing, he was only dead for five years and that's very recent and as you know, we have cultural anxiety about memorializing people recently dead when Washington National Airport's name was changed to Reagan there was a lot of consternation about that because the jury is in a certain sense still out on a recently finished president and so that was part of it but also because of Roosevelt's apostasy in 1912 when he bolted the Republican Party and formed the Progressive Bull Moose Campaign so people had never forgiven him for that and then in 1916, between 1914 and 1918 he was unbearably hard on Woodrow Wilson and really mean to Woodrow Wilson publicly and his editorials and his essays and the outlook in other places and it finally led H. L. Menken, the great sarcast to say, apropos of Roosevelt but the best thing we could do a former president was take them out and shoot them that would just be better for them and better for the country because Roosevelt had become a nuisance and there were many people who had never forgiven his post-presidential behavior and so for a person with that kind of baggage suddenly five years later to be memorialized forever and that kind of gigantism on Mount Rushmore was a controversial choice but they were friends of all the four Roosevelt was the one with the most bonafide western heritage but if he actually did ranch out here he did spend time in South Dakota he great wind cave national park he actually had the I think the strongest western bonafides of the four but he was so completely recent and controversial Yeah, he really was and I think the recency is a big part of it and all of the things that Clay mentioned really but also as they were more or less thinking about this memorial they had to think of a theme for it now going back to Don Robinson remember he was really just looking for a tourist attraction and Rex Allen Smith in his book The Carving of Mount Rushmore says that Don Robinson probably would have been happy with Santa Claus and his elves as long as it was a good tourist attraction who was really, we have borne them to thank for the fact that it was a great American memorial with presidents instead of something that was a little less important nationally but eventually they came up with a theme for Mount Rushmore and that theme was that it was to be in commemoration of the foundation preservation and continental expansion of the United States or as I've heard it said other times Washington founded the nation Jefferson expanded it Lincoln preserved it and Roosevelt revitalized it I've heard that said but they were trying to get Roosevelt to fit after they sort of more or less decided or muddled into the idea of Roosevelt being there and Norbeck like that and get some working like that they were trying to figure out how to fit Roosevelt into this theme of Mount Rushmore the preservation of the United States and its expansion and he was the least obvious from that standpoint but then they thought about the Panama Canal and they thought well because he was responsible for the Panama Canal that's a lot like expansion of the nation because it expanded our ability to expand the nation so they decided that because of that that he was just as important as Jefferson in expanding the nation and that would fit and so they decided that that's how they would justify Roosevelt being on Mount Rushmore and of course the cases made that they're all westerners of a certain sort, George Washington believed in the West he went in deep into the Ohio Valley he did some exploration as a surveyor of the West and he was one of the founding proponents of the canal, the Potomac Canal that would extend into the interior he and Jefferson worked tirelessly to get a Potomac Canal as the portal into the Ohio Valley rather than eventually the Erie Canal which turned out to be the nation's portal so that gives George Washington a place as a westerner in addition to his obvious place as the father of the Republic Jefferson, Louisiana Purchase, Lewis and Clark he's the last choice of Portland but it turns out that it makes sense from this point of view Lincoln, the Homestead Act Transcontinental Railroads a western president a long cap and president that had the savior of the nation and Roosevelt as somebody who actually built his character in the American West and went on to become a conservationist president so from your point of view from a national parks point of view Roosevelt is a great choice because of the legacy his conservation legacy the 230 million acres that he set aside and the national parks and monuments that he created while he was president so it's great from that standpoint and gives a whole other realm of things that can be discussed as they relate to the theater of Roosevelt on that mountain so we have these slides these are from you I'll rush more to talk with them when they're digitizing their collections in fact you can maybe make an announcement about that here in a minute but we asked them to send us a few images so these are images of TR being carved these are just marvelous this is recently he wouldn't like that that would trouble him mightily but here he's been revealed he didn't have to be Mr. Jefferson for a moment he's not next to Jefferson here's more of the construction the glasses the glasses aren't interesting because Borglin didn't really carve the glasses he just carved a nose piece and then just a hint of a ridge underneath but when you look at Rushmore you see all the glasses it's an illusion but it's wonderful this is what I want you to talk about this look at this model well that has Jefferson on the left yeah, Jefferson on the left Washington 2nd, then what Jefferson again Lincoln is the foreplay link I think one of them is Billy Nelson look at this that's Jefferson unless that's TR no I think that's Washington's longer here well that's Washington I don't know it's a preliminary sketch give him a break who are they? I just bring up an interesting point because when he started he didn't really know what he had as far as carvable rock and how he could carve the various figures up there in fact it might be interesting to note a little bit how Mount Rushmore was selected for this project should we talk about that or do you want to finish this slide Mount Rushmore was already named and Mount Rushmore when it was selected as a place to carve and when Borglum came back out in 1925 he was looking for a mountain to carve because he pronounced at this lunch and that he was not going to desecrate the needles after all and that they were going to find another mountain that would be suitable for the memorial and so he went out looking and they were out on horseback and there was a state geologist or a state forester named Theodore Shoemaker who knew where the best granite was and that there were three possible mountains old Baldi, Mount Rushmore and Sugarloaf Mountain and so they went and looked at all of those and Borglum wasn't too impressed with Sugarloaf, Old Baldi had some possibilities to it but when he saw Rushmore he said this is really the one because it was about 500 feet wide and 400 feet tall and he pictured this granite thing but then he announced publicly carving Mount Rushmore but he announced that before he really knew whether it was even carvable granite so again he just announced it but fortunately it was nevertheless he didn't need to go and test it and there were some things along the way that didn't go quite as they planned and he had to change them as they went along they were going to do full length portraits initially fuller length portraits than what they are now so we should have a contest to decide who these are for example will be on Mount Rushmore here he is this is Stone Mountain he was actually part of that project he was fired from that project there were huge controversies there here's an aerial view of the carving of TR touching up Jefferson's weight you could spend hours talking about the cultural aftermath of all of this and the ways in which Mount Rushmore has been used by artists of different sorts this is a Gothic one that I discovered pretty amazing in its own protestness this is about recent presidents they've been proposed to put Ronald Reagan on Mount Rushmore they've been proposed to put other presidents this is a cartoon about the legacy of George W. Bush I think he wrote it outside it's a great deal here there's a zombie version I saw the other day I'm not sure what that signifies this is a very well known image there's a lot of controversy about the Black Hills and whether parts of or all of them should be returned to the Lakota of Cheyenne and there are right down here if you've ever seen it there are people who believe that there's a face of an Indian that is sort of not carved by humans but somehow has emerged on the face of the mountain but these are regarded by Native Americans as better heroes to be carved in the heart of Indian country but you see this recreated literally all over the place the backside of Mount Rushmore it's a postcard that's sold for many years at Mount Rushmore I'll take it back to a more appropriate image here if I may or just, I don't think I've ever sold that on my path but you're in Keystone, certainly Thank you Does anyone have a question for Valerie on this subject or a comment? Or a question for Calais Yes ma'am The question is did the sculptor have a lot of trouble with Lincoln's nose and is that why he moved over and I don't know that specifically but I expect that's true they moved things quite a bit as they discovered issues with the rock and as it turned out with Roosevelt they had to put him almost recessed because they kept going back and back and back and if they had gone any farther they would have broken through to the other side so that was lucky that they found the carcable rock at that point so there were a lot of changes that went along, it started in 1927 with the dedication by President Koolidge and it wasn't really finished until 1941 so there was a lot of time in there when they had to group and regroup but yes Ted How was it eventually paid for? State funds, federal funds and privacy? The way to fund Mount Rushmore was another issue of course and those times things were pretty tough and Barlow had told South Dakota that they wouldn't have to pay anything but then he later changed his mind and asked for some money from South Dakota the project didn't get off the ground because they were looking for the first $5,000 and it took a while to get that there was a federal bill that authorized Mount Rushmore at one point there was state funding, they raised funding for it it was a combination of funding sources but Barlow gave the cost initially at something like 1.2 million and then when they said oh no we're never going to be able to get that much then he said okay how about $800,000 and then when they said no he said how about $600,000 I mean he just kept adjusting it until they said yes and then he sort of like scarred it so he adjusted his fee all the time he adjusted his estimates all the time and it wasn't really until the Park Service took over in 1939 that we started asking him for a budget and you know the Park Service is like that we want to know okay when are you going to be finished and how much is it going to cost and could you please give us a budget and he had never really had to do that before there's another question back here the question is that when there was discussion about carving the needles there was a lot of uproar from people that didn't want the hills to be carved and the question is whether there was a big uproar when they talked about Rushmore do you have some thoughts on that play I don't think there was too much there was probably some, I mean there's some people always that are going to be opposed to that kind of thing but not as much as the needles Rushmore was a fairly unknown mountain and it was off the beaten track there wasn't really a road close to it and so people weren't as aware of it would be my guess and I didn't like the idea including some of the Native American folks who many people that still don't like the idea of it the question is did they do fundraising among the school children and yes I have read that they did just a little bit at a time raise what they can for the great American Memorial the Shrine of Democracy her comment I don't know if you didn't hear it was interesting that the timing of the carving of Mount Rushmore was between the two world wars here we were doing something that was a great shrine to the country in between World War I and World War II and then the carving ended really right at the time when World War II started for a number of reasons the country had to devote its attention finances and such to other issues at that time yes ma'am the question is who owned Mount Rushmore at that time my guess is it was Forest Service yes Forest Service they had to get permission from the state they had to get permission from the federal government to do it and so there were a lot of stakeholders at that time I don't want to take a break we're going to ask Amy and David and Julie and Barry I apologize for calling you by your first names to come on up and join us at this table and if you need to get up and get coffee or to take a break go ahead with Valerie before you go I want to ask you number one Don Robinson the historian said this will be great it turned out he was right 3 million people per annum go to Mount Rushmore yeah it's a heavily visited national park for one that's in a state with a small population there are a lot of people that go there from all over the world and a very popular place and international visitors are often as inspired or more inspired than the US visitors so it has done its job to get people to the Black Hills there's no doubt about that that it is one of the major attractions but probably the major attraction in the Black Hills I think you have something to say about the digitization of their collection well sure we want to digitize the collections of all of those six national parks some of our collections are really special and some of them just have to do with the administrative history of the national parks but Theodore Roosevelt Island we're working on it at Theodore Roosevelt and Noggerl Sagamore Hill has recently started this project and has been on board since the beginning and now we're going to start at Mount Rushmore here in October it looks like Joe Camisa who works for us in the summer last winter he worked for Dickinson State working on our collection here at Theodore Roosevelt National Park and if everything works out we hope to send him down to Mount Rushmore here in a month or so and have him finish theirs and have a really large collection relating to Roosevelt so we can get that park done and that would be exciting just one last question for you Valerie there's so many things that we take for granted today that probably couldn't get authorized or built today I'm guessing that Mount Rushmore would have a much harder time getting started in the 21st century than in the 1920s save the hills I think it would be very hard to get something like that going now anywhere Thank you very much


Hi everyone, my name is Alexander. I'm going to talk about uninitialized memory a bit, so Sorry, this this guest probably Yeah Nice So let's start with what uninitialized memory release It's memory. That's actually uninitialized. So if we create a variable a local variable or a heap allocation And it's used before we assign any value to it then we consider it uninitialized It's initialized as well if we're using it after it has been freed So according to C standards starting from C 89 This is considered undefined behavior, which means we can pilot may do whatever it wants Optimize the code away change it So some kapal is really do so and different even if they don't the result is still undeterminable This means that attackers may use such bugs to By by controlling this memory to provoke crashes information leaks our seas and so on So right now I'm working on kernel memory sanitizer, which is a tool I can pile a base tool that detects uses of uninitialized memory in the Linux kernel. It tracks every bit Every bit of kernel memory Writing telling whether it's initialized or not and the compile instrumentation propagates this state and checks whether uninitialized memory is used in conditions appointed the referencing or Whether your values are copied to user space or data. Oh, sorry or hardware Right now. I've this code leaves on github. I've sent some rfc patches upstream, but it will take some time to Actually lend them So within we've integrated KMSAN with Ceasebot a Fuzzing infrastructure developed at Google Within two years it has found more than 240 bugs in a very modest setup, so we've been using like 10 machines for that and for example case and use uses 10 times more machines So 200 bucks out of those are real There still are false positives and one of non reproducible errors, but we don't report them to upstream developers Out of those 200 bucks 119 have been fixed already There was one 21 info leak 5 KVM bugs and Almost a hundred networking bugs Sorry. Yeah, almost a hundred networking bugs. Most of those bugs I will never report it upstream because the networking people at Google just fix them right away 58 bugs are still open and 61 is a stuck in pre-moderation queue most of them are Use after freeze which have been already reported by KSN Some of them just don't have reproduces or are not reproducible anymore Three bugs have pending fixes, which means The fix is landed already, but Ceasebot is waiting for for it to reach all the track trees Most of the bugs that we found are fixed within One week Some of them however take 10 months or more to fix Here are the bugs that have been reported this year. So on average KM7 reports like seven bugs a month So we don't have much data about the bug lifetime But based on 53 fixes tags, we can see that the lifetimes of bugs Almost uniformly distributed within one year and 14 years The top anti-patterns are below so a Lot of places in the kernel copy parts of struck Struck socket address from the user space, but they treat it as a whole struck Also a lot of people allocate a structure, but forget to initialize some of its fields or Forget to initialize the padding which is also critical and then the structure gets copied to the user space Some pointers may leak Also USB code Initializing USB devices Often doesn't check That the read from the device exceeds and it actually read more than zero bytes So most certainly there is a lot of bugs That are still there in the kernel Right now Ceasebot covers Only 12% of the kernel kernel code on x86 and Most of the attractive attack vectors are still uncovered. So we We have only basic support for networking for IPv4 and IPv6. We don't really generate packets that do anything complex like Initiate a head shake for example Sorry There is very limited support for USB for KVM and there is almost no support for wireless networking stacks, which probably contain a lot of bugs For example information leaks that don't require physical access to the machine. I Also expect like 200 bugs to be present in the remaining networking code. It's unending Sorry, it's unlikely that the uninitialized bugs May disappear anytime soon. So Mateusz Uczuk from the Google project zero says that Bugs related to Sorry But the bugs related to information leaks are deeply rooted in the C programming language and I actually believe that all bugs related to uninitialized memory are deeply rooted in C So what shall we do to never have to deal with uninitialized memory again? The answer is simple We must initialize all the memory There are several reasons to do so First if we initialize all the memory there won't be any information leaks second if we have code that Has branches that depend on uninitialized memory then it will execute deterministically and third if we Initialize memory that has been freed then it complicates use after free exploitation By the way, Microsoft already does this for PODs on the stack since November last year So, yeah, we're a little we need to catch up Let's start with this technicalization case cook has put a number of a Number of kernel configs under an umbrella There is a number of GCC plugins that initialize parts of the local variables. So there are structures Marked as user space as has been copied to user space. There are structures that are passed by references And finally we can zero initialize anything passed by reference There is also a flag called unit stack all which initializes everything on the stack With an infinite screen pattern. This is only supported by clang, which is something that we may want to change in the nearest future Clang can also zero initialize locals, but this is this mode is protected by a really lengthy Flag because clang developers don't want to introduce a new C++ dialect So our goal is to converge to a situation where all the supported compilers can zero initialize all the locals on this stack in order to do so we must Introduce a similar option to GCC by the way any GCC contributors here and make make clang Community support is a zero initialization option as a first-class citizen There's been also a proposal from the clang community to introduce yet another C standard mode for the compiler which will Be just a collection of such options so we've measured some measured the performance of the locals initialization and the numbers look pretty good So in most cases It's almost free. The problem is that we It's it's really hard to benchmark such changes because if if a benchmark like a net birth spends most of the time in the Kernel, it's not really representative if we have an end-to-end benchmark like for example Android benchmarks Which use both the kernel code and the user space code then Their variance is really big and it's really hard to tell whether anything slows down or not So ideas are welcome. If anyone knows how to benchmark Kernel slowdown the size impact of this instrumentation is pretty low, but Certain hot functions still need an extra cache line or two. So the question is can we do better? First of all, we must use zero initialization for that because The code is more compact. It's faster Second right now clang is bad at that star elimination There is a lot of opportunities to do cross-basic block DC in both the mid-to-land and the back-end and Also FDO and LTO can So there the full program analysis can help remove redundant stores that come from inline functions and Maybe GCC is actually doing a better job. So we must just switch to GCC For certain cases in which the compiler's cannot do their job Well, there is attribute uninitialized which just prevents initialization of certain hot functions So let's now move on to the heap Linux 5.3 has two good parameters called any tonalic and the need on free Which initialize heap and page unlock memory the first option is more cash-friendly because it's initializing The memory chunks that are likely to be accessed soon The second one is a bit slower, but it minimizes the lifetime of this sensitive data And it on free works somewhat similar to Pax memory sanitize, which is unfortunately downstream But well Pax memory sanitize has an advantage of disabling initialization for certain caches, which we haven't done yet just because we haven't measured the Security and speed impact of those changes So initializing the heap is substantially slower than initializing the stack Although it's possible to reduce the costs by not initializing some some places I just need to better understanding of How this works in terms of security whether we can trade speed for security in these cases so yeah It's it's a big deal to not initialize Certain buffers that get for example initialized later are one of the approaches to do so is introducing a Special gfp flag for that This will only work for allocations because we don't pass gfp flags to free functions We've checked that this can this is an easy way to Improve certain benchmarks by just fixing one or two call sites one or two allocation sites, but such gfp flags are really easy to abuse because There is a lot of allocation sites in the kernel and they go easily out of control on the other hand there is a nice nice opportunity for optimizing this even further by emitting and non-initialized came a lack plus memset and The MM set can build it later removed by this to elimination pass in the compiler Another option is to introduce a slab flag that disables initialization altogether for a certain cache Which will work for both in it on alloc and in it on free This is easier to set up and control for example we can create a list of uninitialized slabs at boot time. This is what packs memory sanitize does So Linus also thinks that opt-outs are inevitable We just need to figure out which places Need to be fixed and document them. Well yeah, so Memory initialization is also related to the new arm Instruction set extension, which is called the memory tagging extension or MTE It has been announced last year, but doesn't exist in hardware yet the best of my knowledge The core idea is to assign a full-bit tag to every aligned 16 bytes of memory as well as to every pointer in in the girl so a load and store instructions check that pointers and The the corresponding memory chunks have matching tags if they don't The hardware exception is thrown It's one can think of this as a hardware a sun Implementation, which is really fast and can be used in production So we hope that people will actually use this in order for MTE to work will need to Set tags for every stack and heap allocation Which is suddenly what we need for initializing them and MTE provides Special instructions that perform both initialization and tagging of memory Which means we'll probably have a cheap way to both detect heap corruptions in production and kill uninitialized bugs all together So yeah, make sure out of slides at this point. So If anyone has any questions, I'm welcome For the stack Initialization, did you also look at the increase in stack frame size for the functions? So the question is Did we look at at the increase of stack frames, right? Well, it doesn't affect This tech frame size that just because we Do do do do do do only mean the initialization not for example, I'm empty so let me explain if we initialize a local variables then we don't introduce any additional locals Yeah, but the compiler tries to reuse stack slots between different so we'll use the same stack slots for different variables In different places in the function and actually when we did the GCC plug-in We found out that actually the Stack frame size is affected It could be like a pathology of the plug-in or it could be a GCC problem But I was wondering if you had any numbers for clang on how the stack frame size is affected. I Would suppose that for a GCC plug-in that doesn't initialize all the locals It it could be so that the the local variables cannot be reused but In the case of LLVM, which Initializes just everything. It's still possible to reuse the stack slots and this is done at the intermediate representation level So it's optimized pretty heavily. I Myself have actually never seen a case where the This cost any stack load, but it probably could be possible. Yeah, thanks for a talk. Is it possible to turn memory sanitizer into runtime mitigation not just debugging technique Well, I don't think so just because it's really costly It's requires twice Twice as much memory Just just to store all the metadata. So twice as much memory altogether plus it inserts a really a Really heavy instrumentation that Effects every arithmetic operation every loading store in the in the kernel So it's a lot cheaper and easier to just initialize everything And yeah, on the other hand, you can use memory sanitizer for different things that that require tracking of certain values from from They are During their lifetime for example for taint analysis Thanks More questions. Thank you for the talk. Do we have time for two questions? So the first question is you've shown some statistics on how long does it take to Fix the bug. Do you have any thoughts of why some bugs are fixed earlier than others? Is it about the type of the bug or the availability of the proof-of-concept or is it something else? so I Don't think this Has anything to do with the type of bug by the way types of bugs don't don't really say anything because he's bought Just bails out after the first report and it could be so that There is an innocent-looking bug Which is immediately followed by a remote code execution. We just don't see it and we report only the first bug I think this depends heavily on the Availability of maintainers for the certain subsystem for example the Networking people are really responsive and they've fixed most of the bugs within one or two days and Yeah, maybe maybe for some people the burden is bigger and they just don't have time for that I see. Thank you. The the other question is about the code coverage. So it's also really interesting the statistic Based on your experience with these tools, would you say that once we get the code covered? Let's say we have these drivers five percent What would be the level of certainty that the code is bug-free at this point like once we get it covered Is it like executed millions of times thousands of times? I'm just trying to get a feel for that well this metric As far as I understand this metric actually means that there exists at least once is color program that Executes a certain basic block. Of course in most cases. This is not enough to trigger a bug for example if if a bug requires two two tasks to be immediate to be running at the same time then You'll need some Some better metrics some threading coverage for example Yeah, thank you very much More questions, if not, let's thank the speaker. Thank you


I'm Eric Shupps, SharePoint Server MVP, President of BinaryWave. I've been doing SharePoint development since the dark days of the Tahoe project before it was called SharePoint. So I've been around a while through the early 2000 revs into 2007 and all the way now into 2016 in the Office 365. Well, I started working with it in the early beta bits last year. I worked with it through GA and working with some of the various pre-release things that come out. So I've had some fairly good hands-on time with it so far. Well, I like where they're going with it. If the team can execute on their vision of bringing a client-side extensibility model to where we stand in Office 365 and hopefully SharePoint on-premises today, they can bring those pieces together, which is a big ask considering the breadth and width of the server-side APIs and where we've been with the add-in model and whatnot. But if they can really bring these things together, I think we've got something really powerful that will give us capabilities that we've never had in the cloud and quite frankly that other cloud platforms don't have and then translate that down to on-premise. You get a pretty powerful story. My impression of the roadmap is they've set a pretty ambitious agenda. I think they were smart to go with web parts out of the box as a basic extensibility concept. It's something that was sorely lacking in the add-in model that they focus their attention on, which is good. I think when we see the new publishing experiences, people are really going to like those and of course those are built on top of the framework. So they're using their own tool set to deliver a new set of capabilities. I'm really excited to see where that goes. And if they can further extend that to give us some of the capabilities in the cloud that we had on-premise in terms of overall extensibility, I think that's a really good direction for them to go. I know it's a lot of work to pull off if they can make it happen, but I think they're going in the right direction. I like that the framework brings extensibility without all the overhead of working on the server. You don't have to have a fully installed dev environment. You don't have to be running all the heavyweight server stuff. It's something you can spin up. You and I work on our MacBooks. We can deploy code from our MacBooks. Folks can work on Linux or whatever flavor they want to have that. Or if they want to stick with their traditional Windows environment, they can do that as well. But there's no server-side install. It's directly to the client. It's all done in client-side technologies. I think that opens up the platform to a lot of people who weren't prepared for the very steep learning curve for traditional SharePoint development. Well, it's interesting you should ask that, because the one thing that's missing from the tool set is integration with the idea of choice for most SharePoint developers, and that would be Visual Studio. I love the new tool chain. I like the VS code and everything being done with modern web technologies. That's great. The target base for SharePoint development is and always will be within the enterprise. So I would ask people to stay tuned. We're working on a community project that hopefully will address those concerns for folks and bridge that gap between the enterprise and the pure web development community. Change would assume that we have the ability to go in a different direction. And I'm not really sure that we do. I think it's too early, in other words, to say what will we change or what will we do differently about what we have. They've taken a direction for a lot of different reasons to go with this modern web stack in terms of development. That's going to be very confusing for a lot of people, but they didn't really have an option in that. So we can say, oh, we'd like to see that change. We'd like to see it go back to a traditional server-side model, but that's not possible, nor do I think it's actually the right thing to do at this point. I think there's, in order to get this stuff out to not have the traditional we got to wait three years for a new platform to come along and for them to tool it and support it and all that. We're beyond that now. So I think people just need to be patient and let the process mature. For those who are having struggle adapting to it, yeah, that can be a steep curve if you're a traditional server-side.net developer. But I would encourage people to focus less on the tool set and more on what you can get out of the product, especially as it matures more and we get more capabilities. The biggest challenge is definitely the tool chain. For most folks, that's a very hard bridge to cross from where they were in ASP.net, NBC, server-side type of development over to sort of this wild, wild west of JavaScript frameworks and things that change so rapidly. And tool sets that seem to come and go with the setting sun. That is a challenge. There are certainly some frameworks that are gaining adoption. I'm not sure that the tooling is the way we have it now is following the trends there about where most people are going in the web development community. But they've also made a choice not to block people out of using other frameworks, whereas in the past it was .net or nothing. And now we have, I think, more options available to folks. So that's a good thing. I think people are going to struggle. There's no question about it. But when we look back, people struggled with building web parts in 2007. People forget that there was a day where we didn't have any tooling, where we were running Make Cab and making our own Diamond Directive files to build these WSP things. There was no tooling. Now it's easy because it's all baked individual studio, but it wasn't back then. And we're kind of in that same boat again, although I would argue that the tool chains, although they may be unfamiliar, actually fairly robust within the web development community. So there's going to be a period of transition that may be a little rough. But on the other side of that, I think people will like what that gives them in terms of overall capabilities. In terms of future of the framework, I think that the near-term future is pretty clear. They've identified a roadmap where they want to go with this thing. They've already started building their own modern experiences, which are betting on heavily with this tool set. I think that secures the near-term future pretty well, 12, 18 months out. If they can execute, as I mentioned earlier, on their vision for this, I think we have a pretty long runway for this framework. If people adopt, now the community may not adopt. They may decide it's not for them. We have to be honest with ourselves that this is the fourth development model that we're working on. Some people have lost interest. For some, it's just too much change, especially enterprise developers who are used to a very consistent tool set and ALM story. We'll have to see, but if they can deliver us even a portion of the capabilities we had for customization at the server-side APIs, if they can do that in the cloud, with all the other capabilities that Office 365 brings to the table, I think they've got some runway in this. Do you have anything else you want to riff on? Why don't you call that? I would encourage people who are looking at it now and wondering if they should or shouldn't jump into it and work on it to just go ahead and take the leap. You're only going to learn new things. Outside of our traditional bubble for SharePoint development, we've kind of been insulated for a lot of stuff, usually running behind the game. We've been telling people for years, get on the JavaScript bandwagon, learn this disconnected remote API model, even if you're writing .NET and CSOM, learn to break out of that server-side chain. I think this furthers that opportunity. Find a framework or no framework if you want. Just write raw JavaScript and jQuery, if that's what you like to do. But get out of the comfort zone of the way we've traditionally built SharePoint stuff and look for new opportunities to learn the tool sets because maybe you decide not to do SharePoint in a couple of years. You'll be ahead of the game a little bit in catching up where the rest of the development community is at or be able to transition to other parts of the stack that you may. Maybe you want to do teams development or you want to do something inside of one of the other product areas of Office 365. So learning it now, getting ahead of the game, I think will pay dividends in the long run.