Saeddiw, wych yn ymwneud ymlaen i'r ffordd i'r ffasglau'r Llor, ac rwy'n meddwl â'n gweld am yma. Yn 5 April 1603, James VI yn fawr eich wneud i'ch gweithio gynhyrch i'r Llyfrgell yng Nghwyllgor i Llyfrgell yng Nghaethol yn ymwneud. Mae'r cerddur yna'r ffrindiau ac i'w bwysigau ar gyfer y rhanen gwybwyr yng nghymru, yw eu cyfrifio ar gyfer y newydd, y newydd yng Nghyrchu Rhôl, ac, wrth gwrs, y cyfnodd y bydd ymlaen i'r archipeligau. Mae'r ffordd yma yw'r 1 yw 23 ysgolwyddon, ymlaen i'r progresau, yn ymlaen i'r cyfnodd yma o'r 22 ymlaen. Yr Argyngrifedd Ysgolwyr, mae'r cyfnodd ymlaen i'r cyfnodd ymlaen i'r cyfnodd ymlaen,friendiadol ac dróswpogengu fan siaradol yn yr argyn UK o ran yr Maenol 一 nifer yma, y gall G completion G siaradol ar gyffredin Llad Cymru a beth i'r hawdd yses appreciation sydd yn ei ffrif ar y cymdeithio a'i ffinogiad cyfan sydd yn ymlaen y gwrs i gyfl所有 a'r politeis neu ymlaen ychydig ar gyfer anghard yma. Mae'r ffordd fцуo molygu yn gyrtaf i fy Wi mael Co away ddych chi'n rhan o gwyfwyr ac yn ddweud o'r ddweud o'r ddweud o'r ddweud. Mae James, mae'r progres wedi bod yn ymgyrch ar gyfer cyfnodol y prifyniadau. Rydyn ni'n meddwl i'r cyfnodd o'r ddweud o'r cyfnodol, i'r cyfnoddol yn ymgyrch, ac yn ymgyrch ar gyfer cyfnodol ymgyrch. Mae hyn yn ddweud o'r cyfnoddol, rydyn ni'n ddweud o'r cyfnoddol, ac yn ddweud o'r cyfnoddol. Oes hyn o embros 400 o myd yn gweithio benthe, James ran iawn ac yn fawr syniad ymlaen i gwybod y gwno arill ac yn Llyfrgell, ysgol, nôl, syniadau, ein hyn. Mae hyn o myd yn rhan o'n parodol, ddwyod, a ddwyod o'n ryw wneud cyffredinol, yn cyfwysig gyda llwyddoedd o bod yn rhannu a dynol. Yr hyn gyf�ith yma mae'w rhan o'r trwyd o'r corgau i James yn y ddwyngol awr i ysgololau As he marked it, quote, like some wolf or tiger spreading his scent through his territory. He will examine the organisation of the progress James' demeanor and the political devices he utilized throughout, as well as the reception of his English subjects towards any king. It will argue that along the journey, the self-proclaimed King of Great Britain not only adapted to a tewd style of visible monarchy, ond ystafell yw newydd yw'r ddyliadau rôl ydyn ni, i gael i'r ddefnyddio'r rhain enghraeg. Ymgyrch gael y progres yw'r cyffredinol wedi'u llwylo'r Elisbroedd. O'r diolch ei wneud o'r llyth, os y pethau er mwyn o diannodau cefnidol, fewys i'r gwneud ein or lleol rôl fel rydych chi'n meddwl ychydig iawn. yn 1603 bywyd y bywyd yn ymgyrch i'w hwnnw i'r gael i'r ddechu amser o fynd dechrau, a'i wneud allwch amdrafed o hyffredinol, llwf i'u ddweud, cyffredinol, yn ychydig yn dda i siwr o'r hwnnw i'i daith. Fynd i, mae'r hyffredinol bywyd i hyffredinol, ddweud â'r begerau ac ydw'r bydd, sydd oherwydd Chwyrddol, a'r bydddau a'r byddau Llywodraeth a Horddon yn dod o'r Llywodraeth. Rydym yn fwrdd y cwysigol ym 1603 yn heddiw yn ymwneud yn y lleidiau gyllideb amdanool. Ysgolwch ychydig, ymddangosol, ac ymdrych yn yr hyn o'r blaenau yn cael ei ddau, yn gweithio i'r Llywodraeth yn gweithio i Gweithinodau. Felly, mae'n meddwl i'r prydau a'r ystod yn gweld yn ffynuol a gyntaf, ac mae'n gwbod i'r prydau. Mae hynny'n cymdeithasol i'r prydau, ac mae'r prydau o'r prydau, i'r prydau a'r prydau. Mae'n ffynuol i'r prydau, ac mae'n ffynuol i'r prydau, i'r prydau, i'r prydau. Mae'n ymgylch i'r prydau i'r prydau i'r prydau, i'r prydau. A wnaeth i ddim yn ymgylch i'r prydau, ond yw'r awrnau gyda ni. One of his first acts of King of England was ordering the Privy Council to send jewels and other furniture which did appertain to the late Queen. This included coaches, horses, litters and whatsoever his Privy Council to think meet to accompany him on the journey south. The image on the left is a royal coach which was presented by James's ambassador to the Tsar of Russia in 1604 and it gives a good indication of how Monarch travelled during this period. Upon reaching English soil at Berwick on the 6th of April, James heard a sermon by Bishop Toby Matthew before surveying the fortifications of the town firing a cannon and commending the soldiers. In a symbolic interpretation worthy of Elizabeth herself, James then pronounced the sudden rainstorm to be a good omen, saying, the sun before the rain represented his happy departure, the downpour to be the grief of Scotland and the succeeding fair weather, the joy England at his approach. The martial enthusiasm he exuded at Berwick is certainly at odds with James' later reputation as wrecked specificus, while his somewhat florid language contrasts with the traditional portrait of an overly formal pedagogue who was quote always undignified in public. But these specific actions were designed to introduce a distinctly Stuart Monarch. They fashioned the image of a virtuous king who was revered by his Scottish subjects, a pious king whom Protestant considerations were fundamental, and a king who could easily align himself with martial masculinity in a way that his female predecessor could not as easily do. Exorcising these traditional values of good pingship from the outset revealed James' understanding that many of his new subjects were desirous of change. Not having stepped foot in England before, to James it must have seemed a profusion of wealth far beyond that of quote Farron who nearest Scotland. Upon reaching York on the 16th of April, the abundance was quite literally flowing into the streets. A conduit running white and claret wine allowed every man to drink as much as he listed. Although many historians have attested that James blithly rushed to take possession of his lucrative inheritance, the six week progress in fact proceeded at a leisurely rate. Even eagerly applied himself to the affairs of his new realm on route. Ample correspondence between the King and Council in London survives, revealing his input on subjects such as the treatment of recusants, support of the United Provinces and arrangements regarding Elizabeth's funeral. Perhaps elated that the years of uncertainty over his succession were over, James was charming and charismatic throughout. This is the only image I could find where he looks even remotely happy. These are attitudes rarely ascribed to him by history. In York for example, he declined the offer of a coach declaring that the people are desirous to see a king and so they shall, they shall see both his body and face. In Doncaster, lack of suitable accommodation forced him to lodge at the sun and bear in. Upon his departure, he presented the innkeeper with the lease of a manor house of good value and gratitude for his good entertainment. Moreover, in Newcastle, he simultaneously demonstrated his mercy and about Protestantism by ordering the releasable prisoners accepting murderers, traitors and of course, papists. Somewhat more ominously, however, the journey featured several public executions orchestrated by James himself. At Newark upon Trent, the King received word of a cut purse who had been stealing from the crowd gathering to watch the train pass. In a display of Rashwa Bavardo, James ordered the immediate hanging of the quote base pilfering thief, an order which was swiftly executed. This may have been a simple understanding of English law, which compared to Scotland's as well established and deeply ingrained. Or perhaps it was the first occasion on which his new subjects all witnessed James's proclivity for absolutism and action. After all, relatively few would have been familiar with his treaties, the true law of free monarchies. The response to the execution is a sonnish new English councillors carefully, but quickly advised that in England, if not in Scotland, the sovereign left such cases to the due process of law. The sheer size and magnificence of the 1603 progress strength would have made a considerable as considerable impacts on those who watched it pass. It's likely that few in the north of England had living memory of Henry VIII 1541 progress. The last time a reigning English monarch had travelled as far north as York. The majority of those in rural areas were unlikely to have seen anything comparable for. A lack of surviving policy of evidence makes it difficult to gauge the reception of the rural populace towards their new king. However, there appears to have been a sense of relief at the accession of the male monarch, already furnished with an heir and a spare, some of whom are shamed here. The brusque words of an honest plain Scotsman reveal the ostensible elation with which James was received. Scotsman commented that the applause of the people in so of secrecy and submissive a manner will spoil a good king. James himself was later rather romantically to recall how his subjects had their eyes flaming, nothing but sparkles of affection, their gestures discovering a passionate longing and earnestness to meet and embrace their new sovereign. Constitutive descriptions suggest that the number who ventured to catch glimpse of James were incredible. As he drew nearer to London, the crowds increased daily, fighting each other for the best view and filling the countryside to such an extent that they quote, covered the beauty of the fields. One eyewitness, John Savill, positioned himself in an upstairs chamber at the bell in in Edmonton and attempted to tally the concourse. Within less than half an hour, he had counted 309 horses and 137 footmen, a throng which continued from four o'clock in the morning until three o'clock in the afternoon without intermission. Consequently, the king was feigned to publish an inhibition against the inordinate and daily access of people's coming. No doubt provoked by his fear of assassination following a turbulent forms of career as King of Scotland. However, if the sheer number of people who turned out to welcome James as a barometer of public feeling towards it, the first progress of his English reign was an apogee of success. Accessibility and congeniality were vital to the success of the progress. These qualities manifested themselves through political devices such as the granting of petitions, gift exchange and the conferring of honours. Such strategies were mainstays in the political armory of James's Tudor predecessors, but on the 1603 progress, he employed them with gusto. For example, he was presented with a petition from the poor inhabitants of Hull that they might be protected from the daily spoils done to them by those of Dunkirk. The king, in a princely and heroic reply, assured them that no Dunkirker should after dare do any of his subjects wrong. Personally managing and determining the results of petitions became a hallmark of James's reign, helping to placate and endear his people to him in times of political crisis. The progress is also an opportunity to secure ties of patronage and cultivate personal relationships with provincial elites. This could be exercised on the road with a publicity unobtainable from the confines of the palace. One very public approach was introducing a cycle of gift exchange that James was careful to nurture and keeping tact for the remainder of his reign. Mutual gifting was recognised as a profound display of patronage, affinity and deference that was central to political identity.  Whereas 17th century politician Sir William Drake more cynically put it, by gifts and presents a man attains his ends. A procedure was initiated upon James' arrival at the town or home of his host that illuminates the significance of space and intimacy on progress. In the guise of a gift, the town or house would be figuratively offered to the king and the keys ceremoniously handed over to him. This was a process in which the royal visitors became both guest and host, while the host became almost guest in their own home. This public ceremony symbolised a bond of allegiance between sovereign and host, while simultaneously reinforcing the latter's position within the local higher-up. More tangible gifts from those eager to court favoured with the new king were also plentiful. Civic donors tended to limit themselves to refuse amounts of gold.  This is an example created to commemorate the coronation of James II later in the 17th century. The coins were quickly deposited into the privy purse, but the cups often ended up in the hands of footmen as perquisites, an insensitive custom which no doubt exasperated the donors. Private hosts, however, could be somewhat more imaginative with their gifts. So Oliver Cromwell had clearly been told of the new king's fondness for the hunt and offered horses, hounds and diverse hawks of excellent wing. So Edward Denney took a similar approach, bequeathing a gallant horse, a rich saddle and furniture corresponding to the same. When James's consort Anna of Denmark made her own separate inaugural progress south shortly after James. So Robert Spencer's entertainment author was little more than a device concocted to frame the giving of a gift. A considerable jewel presented modestly as a simple gift was offered to Anna by an actor playing the fairy queen. Although the actor explicitly denied any hope of our glory by the deed on behalf of his patron, the implication was clear. Obligations have been established and Spencer was summarily created a baron less than a month later. Evidently, hosts expected to receive something far more valuable in return for their material outlet. And when it came to conferring honours, James frequently acquiesced. On the southbound journey alone, he created 237 new knights, causing Gilbert Dugtail to observe that the king dealt honors as freely to our nation as their hearts would wish. This was in stark contrast to Elizabeth, who was so cautious in her creation of knights that it was said by her death, hardly a shire in England muster enough knights to make a jury. In politicising gifts and granting petitions, James was continuing early traditions of in exchanging favour for allegiance. However, by employing a political device somewhat underutilised by Elizabeth, the conferring and later selling of Chilbaric Monarchs, James has set out his stool as a different style of monarch. Graffiti spotted at Cheapside in 1603 remarked, this world's a stage where on today kings and mean men parts do play. This ephemeral of observation neatly encapsulates how sovereignty was intrinsically linked to performance. It also reveals contemporary understandings about the collaborative nature of early modern sovereignty, in which the image of the ruler was forged in and out of dialogue with their subjects. Tradition would have it that James was woefully inadequate in his attempts at both performance and collaboration. Conventional historiography also prescribes that nature had denied James the power to appeal to the imagination of the subjects. However, as we have seen, on the inaugural progress in 1603, he performed the task of listening monarch with much the same aplomb as Elizabeth. As a foreign king and a largely unknown quantity in England, the progress more than any other institution of government provided James with the stage fundamental to the success of his dual monarchy. The path he chose once upon that stage incorporated elements of continuation and deviation. He adapted to an English style of visible monarchy that ill-suited his experience in inclination, while simultaneously paving the way for a new Stuart royal image. The accession of a Scottish king had little effect on the mechanics and pageantry of the progress, but in his judicial arrogance and deployment of honours, we can see his Scottish heritage and personal idiosyncrasies influencing progress culture. This would become more marks in later progresses, particularly as he brought his vainglorious ideologies of union to the fore. In terms of audience reception, the six-week progress was arguably the most successful of his reign. In the years that followed, we found the process of interacting with his subjects increasingly ties it. So too, many of his subjects had started to become tired of James. This sparked nostalgia for the Golden Age of Gloriana. However, despite strong opposition from his councillors and subjects, James pushed onwards, travelling persistently and extensively for the next 22 years. As David Bergeron suggests, it was if he could only make forward progress through constant motion. Thus, for James, progresses were not a diversion from the business of government, as is commonly claimed, but were the business of government. Thank you.


Hello everyone. Thank you for being here. So my name is Arnaud Ars. I'm part of the Open Technology Group at IBM. I've been involved in open source and open standard. It's pretty much my whole career. I brag about the fact that in 1990, I did my first release of something which back then we didn't even call open source. But the funny thing is I actually recently discovered it's actually still being used. It's running on my HP printer at home. So, you know, the power of open source is there. So anyway, today we want to talk about the supply chain integrity working group at OpenSSF. I've been involved personally in OpenSSF for the last two years. And so I just have a couple of slides I'm going to show you to give you a little bit of context. And then we will have a discussion with my co-panelist here today to try to give you a better idea of some of the names that are floating around OpenSSF. So it should be well known to everybody I'm sure now that, you know, open source software in general but through open source in particular is under attack today. We are seeing an explosion in attacks. Basically, you know, bad actors have discovered that as we harden production systems, there was a soft spot which was the software supply chain that incorporated the law of open source, a lot of which is not very well secured. So this is a problem that has become so important that governments around the world has actually taken note and actually starting developing as we heard earlier in the keynote different regulations around the world to basically tell the industry, wait a minute, we cannot keep going like this. You need to fix this problem. And so OpenSSF is part of the movement from the industry to try to address this problem. Of course, you know, it's a bigger problem than any single organization can address. So OpenSSF is by no means the only organization out there working in this space. There is quite a bit of overlap in some cases. We're trying to collaborate with other organizations, even within the Linux foundation, right? There are different foundations working on these aspects. And so the OpenSSF was actually launched over two years ago. Initially, we were doing the COVID era. Quite frankly, organizations like IBM and other vendors were not too sure about what the economic impact was going to be. And they were not so eager in investing in a new foundation. And so the project was started in a fairly, you know, a typical way with regard to how typically Linux foundation starts projects in the sense that there was basically no funding associated with this. And so for the first year, it kind of grew organically. And I think we actually feel some of the pain because of that still today, because the organization can grew in a different ways, in different parts of the organization, fairly disorganized. And but after a year, we were getting out of COVID and people realized, okay, maybe this is not the end of the world, thankfully, we can actually take this problem more seriously and put money behind it. And there was a sort of reboot of the organization in 2022, where we moved to a more well funded organization with, you know, organization actually putting real money behind it. And so we now have these funds available, we have a fully staffed organization from the LS staff. And the members have been busy, some of us are involved in the governance structure of the organization, trying to get it all sorted out and make sense of all the activities that are going on. So this is a high level view of the organization. I'm not going into the detail of this. This is not the point of this presentation. It's just to give you an idea at a high level, we have a governing board, and then we have the technical advisory council that kind of oversees all the technical activities in the organization. And what we're going to talk about mostly today is what's in that black square or rectangle there, supply chain integrity working group, right? So we have different working groups addressing different parts of the problem. And we have one that's specifically focusing on the supply chain integrity problem. And within this, each group, right, actually has a whole bunch of different activities within them. They take different forms, and we're still trying to figure out all the details of the governance aspect. But at a high level, we are different types of technical initiatives. They are projects that are mostly focused on developing code, like actual programs that you can use. And then there are activities that are more like working specifications, or best practices, documents, guidance, that kind of stuff. So again, what we're going to focus on today is what's at the top right corner there, the supply chain integrity. We have different activities within that working group. So we have Salsa, which we'll talk quite a bit about today. There is actually two different groups within related to Salsa. There is one that works on the specification, Salsa is a specification. And then there is one that actually focuses on projects. So there are tools being developed that actually help you use and implement Salsa. And then we have Fresca is one of the implementations of Salsa, which we'll talk about. And there is S2C2F is another specification. And then there is another, there's a group, which is the integrity positioning working group. It's a bit different. It tries to give a little bit more of positioning for the different pieces, how they relate to one another within OpenSSF and beyond, and try to identify possible gaps so that we can put that on a roadmap moving forward. And then there is a newcomer. It's not officially part of OpenSSF today, but I'm hoping maybe it will become. And there has been a proposal, so it's not completely accidental. I'm bringing this up. It's called Guac. And I think, you know, whether it ends up in OpenSSF or not, I think it's a tool that's related to the supply chain integrity. And I think it's worth mentioning. And we have one of the co-panelists involved in this. So he can tell us more about this. So that sets the background. This is what I wanted to kind of give you as a background for the discussion today. So now I would like to turn to the panelist and let them introduce themselves first. So, sure. I'm Mike Lieberman. I am a co-founder of the Software Supply Chain Security Company, Kusari. I'm also an author of the book, Securing the Software Supply Chain by Manning Publications. In the open source space, I'm a CNCF tag security lead. I'm also an open SSF tag member. I'm also a steering committee member. And I'm also the co-creator of the Guac project. Laura. I'm Laura C. I work at Red Hat. I'm a manager of our supply chain operations team under product security. And I participate in the positioning group for supply chain integrity. My name is Joshua Locke. I am a steering committee member on the CELSA project and tried to get involved in a bunch of the open SSF efforts and paid to work at Verizon in the new open source program office. We're just kind of bootstrapping that. Jay White, I work in the open source strategy ecosystem team in Microsoft.  And I'm being all over the place in Microsoft, all over the place in the open SSF, and in other open source communities as well. I'm a board member. I'm a board member on Oasis Open. I work in the supply chain integrity working group as a co-lead. I'm a co-lead of the positioning, CIG, co-lead, and the S2C2F, CIG, co-lead in the DE&I education subcommittee. Am I forgetting? Anyway, I'm all over the place. I love this stuff. So that's why I'm all over the place. I don't sleep much. Okay, go ahead. If Jay lists all the group he participates in, we ran out of time before the end. Every time I join an open SSF call, Jay's on it, no matter what it is about. So thank you. So I mean, the goal is primarily going through all these different technologies so that this alphabet soup kind of thing makes more sense at the end, right? So we're going to go through a few rounds of questions, and then of course we'll open to the public if you have questions as well. So let's get started with Salsa. Laura, can you tell us briefly at a high level what Salsa is about? Yeah, sure. So Salsa stands for supply chain levels for software artifacts, and it's a set of guidelines for securing your software supply chain. It is established by industry consensus to prevent tampering, to improve build integrity, and secure software packages and infrastructure. It's also organized by tracks and levels. So there are tracks that are focused on a specific aspect of the supply chain. Right now we have just the build track, so it makes it easy to keep track of. And then the levels, so it's measured by security levels for incremental adoption, and the build track has three levels right now. So one, two, three. Thank you. Michael, Fresca. Sure. So Fresca is a implementation of the CNCF's secure software factory reference architecture. It utilizes a bunch of different open source tools like Tecton, Tecton chains, Spiffy Spire, the Q language, if anybody's familiar with that, along with some other tools to try and create something that really implements Salsa and looks at what can even go beyond when it comes to securing the build and securing the supply chain. And Jay, I'll turn to you for S2C2F. S2C2F, secure supply chain consumption framework. Eight practices, four maturity levels, takes you all the way through ingesting open source to how you protect it, preventing, if you can prevent attacks, all the way to auditing now, how you audit the nature of your protection methods into fixing things and then upstreaming. Really designed for the consumer in mind, so how the individuals ingest and consume open source software. And then pairs very nicely with the other frameworks as it takes from one end, takes you into the middle and then allows connective tissues on to the others. All right. Thank you. And so let's finish with Guac. Sure. So Guac is a tool, a backer name for graph for understanding artifact composition because it's Salsa and Guac. So it's intended to be sort of an ingester for all of your software supply chain metadata, whether it's S-bombs, whether it's information from sites like OSV or depth.dev, scorecards and tries to aggregate it all into a graph that can then be used so that from the consumption side, you can kind of say, am I enforcing the best practices and those sorts of things? So you can ask questions like, am I enforcing this S2C2F requirement? Do I have a Salsa attestation for this project? That sort of thing. All right. So let's now get a little bit deeper into what's behind those high-level introduction. So I mean, Joshua, maybe you can tell us a little bit more about Salsa. Who is it for? What is it for? So Salsa is really focused on kind of improving the machinery that we use to build and deliver software. So the end users, the developers shouldn't have to do too much work in order to adopt Salsa in the ideal circumstance. The build track especially is very much focused on people building CI and CD systems. And the next things we're going to work on is training more of those platforms together to improve the integrity. So one of the core principles of Salsa is trusting platforms and individuals. So we can identify a system that we trust and root trust in that rather than trying to evaluate whether we can trust all of the individuals producing software in the spotlight. So Laura, how does that relate to compliance? I mean, we heard earlier there's more and more references to regulations and compliance which plays an increasing role. How does the Salsa fit within the compliance picture? Sure. Yeah, it provides evidence for attestations and it also strongly aligns to NIST's secure software development framework. It also aligns to NIST 800-53 for security and privacy. Also 800-161 for specifically written for supply chain. And even OWASP, and we did a mapping to OWASP for SAM version 2.0, which stands for software assurance maturity model. And so if you are trying to attest to any of those industry frameworks or governmental frameworks, it's stepped in the right direction. And it's great because with the Salsa specification group, it demystifies how to implement that for the build requirements. All right. Thank you. So Jay, I know compliance is also something that you hold close to your heart. First, let's go back to S2C2F. Who should use it? And the big question that people always have is, so how does S2C2F compare to Salsa? So S2C2F is for the end user, for the end user, for the consumer, specifically designed to manage dependencies. Where this differs and then aligns with Salsa. Salsa is a more producer-focused framework. So it concentrates on builds in general, where S2C2F controls how you manage dependencies that go into that build. So this is where you'll see a lot of S-bomb creation. This is where you'll see ties into other things that we're working on, like VEX and things of that nature. These are the tie-ins with not just stuff that we're working on inside the openness, but these tentacles that reach out to other organizations as well. So end user in mind, consumption in mind, dependency management in mind.  And the compliance aspect, do you have more to say? So, Laura did a good job of providing the mapping between Salsa and SSDF and then OWASP and 800-53. Well, S2C2F does the same thing, right? There are mappings that go back and forth. So if you take the controls in S2C2F and then write down there in the bottom of it, you'll see the mappings and the mappings are very similar, right? So you are able to meet certain compliance requirements, but even more so, right? So here in Europe and in the States, also South America, Australia, there are all these different privacy requirements that are being developed, security requirements that are being developed, but even more so, these cyber security requirements around how software gets developed, how it gets consumed, and when they say consumed, you mean by the person buying the software and whether or not they're secure, the security's in place enough for them to use it and therefore not to be data disclosures and everything else, right? All this stuff is happening. But these frameworks attempt to do, because we're working so closely with them and we're so close to these different, these different regulations that are being developed, is that we get a chance to say, hey, how can we meet the metric at the same time, not reduce productivity? So when it comes to compliance, right? I always refer to this meme with the truck that got these big giant wheels, but they forgot to change the entire in the back of the truck that has the original factory wheel on it, and all the thing says is you got to have that wheel on it, right? That wheel has to be, therefore, the truck to be compliant, and nothing says that the wheel can fit on the little big wheels that you now put on it, right? So when it comes to compliance, I say, all right, let's meet the metric, but also let's make sure things secure. What we have to be careful of is to not over engineer in the process. So that's how I feel about compliance. You could meet the compliance requirements, but let's make sure that we're still keeping our thumb on security controls. All right, thank you. So let's talk about the status of those different technologies. So Laura, what's Salsa actually hit the major milestone in the spring? Can you tell us more about the status of Salsa? So yeah, Salsa released its first version, so version 1.0 in April, and it specifically focuses on the build requirements and specifically for producers and build platforms. So the build platform requirements include provenance generation and isolation strength. For provenance generation, it starts with level 1, it just must exist, right? And then level 2 would be to authenticate. It must be authentic, and the third one would be that you have to be able to deliver the provenance. And so with regard to the isolation strength, or I'm sorry, unforgeable, I believe this word is used for build level 3. And then for isolation strength, level 2, it must be hosted, and then level 3, it must be isolated. So that's, but with all that, there's also an attestation model that goes along with it so that you can sort of like a analogy with the manufacturing factory. So the first step would be to have that tamper proof seal for the code. And the second would be to verify that the artifacts were created by who they said it was created by with this stamp made by Harry in Michigan. And then the third would be to just implement industry best practices. Yeah. All right, thank you. I will interject that there's something that has confused people a little bit, which I think is worth explaining about Salsa, because it's kind of like we have three dimensions at play. We have the version of the specification. So in this case, we're at salsa one zero, we have different levels and different tracks. And it becomes a bit like, you know, puzzle to put all the pieces together. So I think you need to understand that those things are actually unrelated in some ways. The idea was, you know, well, we have the version of the specification. And it surprised a lot of people that the one zero has less than what salsa zero, I think five was the previous version to 0.2. Okay, 0.2. And so this was actually, you know, a concerted, you know, a decision in the group to say, okay, we cannot focus on trying to address all the issues we have with the original draft, which, you know, we have to give them credit. It came initially from Google. So they came with a specification that contributed to OpenSSF.  Well, as soon as you submitted to public scrutiny, you realize there's plenty of holes you have not even thought about. And so it happened there as well. So a lot of issues came up. And then the group said, well, if we try to address all these issues, we'll never be done any time soon. And so there was people already implementing the salsa 0.2 draft that was out there. And so the group decided to basically narrow down the scope. So we went from four levels to three. And we reduced the number, we came up with this notion of tracks to define different domains, if you will, and focus on the bill track for the one zero.  And some people said, how can you even dare calling that a one zero? You should maybe call it a 0.5 or something like this. But so this was, you know, concerning the effort within the group, everybody agreed, this is the most rational way of progressing and getting something out there that the industry can start using sooner rather than later. Yeah. So the one zero was really an indicator of confidence and stability, not of features. And so we effectively in software terms removed features from zero to one to zero. But that's because the focus was always. So one of the things I think super interesting about what's happening in the SCI working group is that it's basically taking best practices that companies and communities have developed over years and trying to enshrine those in standards that people can implement in incremental ways and as easily as possible. And so what we found with South Level 4 and some of the non-build requirements, or build Level 4 and some of the non-build requirements, is that we were struggling to articulate those in a way that everyone could understand and that would be equally applicable to like Google and Microsoft scale organizations as to, you know, three person open source projects. And so that's why we ended up removing those things ultimately while we continue to work on reintroducing those features, but with those kind of goals in mind that being very clear and relatively easy, you know, none of this is easy to implement, but at least clear to implement and well, well described. So why don't you continue on this actually trend and tell us what's happening now with regard to Salsa. I mean, as we talked about Laura, I said Salsa 1-0 came out in April and quite frankly, after that seems like nothing has happening. I was involved in the group and I think honestly, everybody needed to take a break a little bit and focus on other things because we worked really hard to get that 1-0 out, but work is starting again. So can you tell us what's happening? Yeah, so we did take a break. Some of us changed employer, but we have resumed effort. We've got a few things happening. So we're trying to release an incremental patch version. So we're following semantic versioning so that we can indicate when we're making changes, which are incompatible. We're trying to make sure that we signal very heavily when people should be paying more attention to changes in the specification. We've been making some editorial clarity edits over time to the 1-0 release, but working towards the 1.1, which introduces further clarity, but based on how you interpret it, that could be considered to be a significant change. So that's why we're working towards this patch number release, not patch number, minor version number release. But we're also working on new features that we don't have a concrete timeline for, but we're focused on source, which is something that was removed from the 0.2 version of the spec. Notions of whether the source has been reviewed or scanned by various tools. How you can have a greater level of assurance that the source code that you introduced into your build system is the source code you expected. So we have some of that encoded in the build platform, the build track, but there's definitely a lot more we could do. So that's a very active area of discussion. And then we also want to introduce some additional considerations for the build platform. So one notion that was in Salsa 0.2 that we unfortunately lost a bit in 1.0 was this, because it's so abstract, we can very easily hand-waverly say two people should approve everything as a general kind of principle, but then how do you turn that into kind of something concrete for each of the different tracks? So with code review, it'd be like you should have two reviewers effectively for each pull request or for the build platform. We like this notion of you can't make changes to the platform itself, whether that's the operating system or the users that are enabled on it and things like that without a second approver. So no one rotation. I think there's an XKCD comic which uses the $10 rent security metric. And so we're trying to make sure that we don't have a, although we have a two-range factor effectively throughout the specification. So yeah, the things we're working on, the source track, build platform, and then we want to reintroduce level four of the build track. All right, thank you. Yeah, go ahead. Yeah, so that is absolutely a concern that has been raised and why we have struggled. We have this notion of, I forget the exact term we used, but effectively, if you're a maintainer of a project and you open a pull request and another maintainer reviews it, that's kind of two because you're already a known trusted entity. But if you are a non-maintainer and you submit a pull request and that's reviewed by one maintainer, that's a weaker level of review because there's only one trusted known entity involved. But I didn't do a great job of explaining that and trying to write that in clear and precise text has been a challenge. But then also, even that is contended. We would like open source projects as much as possible to be able to achieve as many sales to levels as possible. So yeah, that is a great question. It is a topic of contention. We don't have a good solution for that. We are definitely going to have to strike a balance between security goals and supporting smallest projects. But I think ultimately there will come a cutoff where if you're a tiny project you'll only be able to reach a certain level. And I think that accurately reflects the kind of risks that people are implicitly taking on by depending on a single person project. Just going to have an organization dedicated to software reviewers that can be able to reach out and be like, I need a reviewer on the pull request and then all of a sudden you're soft on the line. That would be a good way for me if an SSF to spend all of its money very quickly. And you know it's very easy to create new GitHub account too. So one person can impersonate right? Not suggesting anything but I mean there are limitations that are well understood. So you're creating a standard, I suspect, or attempting to. Could you, instead of that, can we get it on Zoom, for example, right? How a verification of an entity is the literal entity that's in the center? Yes. But I don't think we have time to address the question now obviously. This is a big question. You know my view on this general premise, we cannot address the whole chain of problems we are facing, right? But this is still moving us a step forward. It doesn't solve everything but it's still better than if we had none of this. I think it is important seriously to know that we are concerned by these kind of things and there are people in the group that raise that concern and we do joke about it but we, one of the reasons that we remove that requirement for the initial release is because we don't want to place arbitrary barriers towards open source projects becoming secure. That's ultimately, most of us are there because that's our passion, our interest. We don't have a good solution and one of my characteristics is that I make jokes about things that I can't solve. Yeah, it's definitely a big problem that we would like to try and address and we don't have a good solution. All right, so let's move on a little bit because I still want to hear Jay give you a chance to talk about the status of S2C2F and what's happening? What are you guys doing? So S2C2F is evolving all the time. As a matter of fact, we've just added a new control. We added one, a few months ago around audit and then we added a new control around another threat that came up and it was very recent. I can't remember. Please go to the Rebo. Look up the issue when the pull request is there. Trust me. Anyway, one of the other cool things that's happened in those that we just had a hackathon internal to Microsoft, of course, and I tried as hard as I could to get external participants, but the hackathon was to develop an attestation tool that can provide a level of assurance of meeting at least level two on S2C2F. And of course, that's through doing specific get hub actions and things like that. We're still trying to perfect it, but the great thing about this tool is that it's formatted in OSCAL format. Now OSCAL format, I'm still working out or helping to work out. By helping, I mean doing a whole hell of a lot of complaining, finger pointing questions, asking and waiting for answers. And then when I get those answers, they give me the answers and I'm asking people, but really trying to operationalize OSCAL such way because it's so dynamic that you're able to report out a machine readable format and provide those assurances in machine readable format that says, hey, you are indeed meeting level two because it was an automated check that you have these specific things enabled that provides that level of assurance. Anyway, that's happening right now. That's also very exciting. Also, S2C2F is working with GWAC closely as well to see if we can bridge that gap between putting the artifact stuff on the end of S2C2F so now you can provide that historical context of where things were, where things are now, and of course, where things are going to be in graphing format. And I say that to say once again, these tentacles. Right? These tentacles, man. So yeah, so that's where S2C2F is there and of course, you know, we'll say this at the end, I'm going to say it now though. Come on in, the water's warm. So Michael, why don't you follow up and tell us a bit more about GWAC? What's the status, what's going on there? Sure, sure. So GWAC is currently sort of in beta. It's had it's like 0.1 release a few months ago and now we're up to 0.1.2, maybe 0.1.3 this week. I haven't been checking up on my emails. But so, you know, GWAC, as I sort of mentioned before, is trying to kind of come in and ingest all this data from places like, you know, Salsa, your Salsa attestations, your S-bombs in all the various formats, and lots of other supply chain meta-data like OSB, Depth.dev, scorecards, and associated with the stuff like the artifacts, the identities that sign those artifacts, and those sorts of things into a giant graph that you can then query to kind of, you know, ask questions like, am I compliant or conformant to this S2C2F requirement? Am I conformant to this NIST requirement? And so, yeah, GWAC is very much focused on that sort of thing. So you can ask questions like, do I have log for shell somewhere in my known software supply chain? Right? And also in addition to that, GWAC really tries to help answer the question of, do I have enough information to be able to answer that question in the first place? Because that's, like, I think one of the key things that's been missing from a lot of the software supply chain stuff is people just go and say, great, I generated a S-bomb. Well, is it accurate? Is it complete? Do you know? And so, with stuff like GWAC, we can start to see where are sort of the big gaps, you know, where does, you know, my supply chain supposedly end, right? You know, I might have three or four layers of artifacts, and then somewhere down here I have my final artifact, but does it still have its own dependencies or do I just not know? And GWAC is hoping to help answer that and helping answer stuff like, if in the future you're like, hey, I have some salsa ad stations that came from this party, we know they were compromised. So now we are concerned that all of these artifacts that we might have ingested over the past X amount of months are now vulnerable. Find me all of those artifacts. Where do they live? Where do they live in my software supply chain? And then also eventually where are they deployed? And how do I answer that? And then potentially where are the central areas that I need to upgrade to just be able to kind of sort of fix the problem, fix those vulnerabilities upgrade and that sort of thing. All right. Thank you. Unfortunately, we're already running out of time. So to finish, I would like to invite everybody, you know, I recognize quite a few people here. So a lot of you already know that. But, you know, one of the particularities of Living Foundation organizations, they're open to everybody. Of course, you can be a member and support these organizations financially. But independently of that, you're welcome to participate. So I invite you to look into OpenSSF. I give you a quick overview. If you haven't looked into it, there's certainly something, if you're in this room, there's probably something that was of interest to you. We welcome every newcomer. Typically we have calls. There's an open, there's a community calendar that's available where you see all the different calls from all the different groups on the calendar. Don't be intimidated. Feel free to join. Typically, we make an effort to give every newcomer to introduce themselves at the beginning. If you're not comfortable, it's okay to just pass and stay silent. But we all were there once first time, right? So don't let that stop you. Just, you know, attend. And as you get more comfortable and you feel like you want to contribute, you can start participating. I do want to also point out that if you want to know more about Salsa, there's actually a good opportunity. There's a tech talk that's going to happen on October 5th. It's online. It's free. You can participate, attend. I put the QR code there. If you can't scan that, you can find it from the website. If you go to openSSF.org and you go to the events, it's actually listed there. And there's all the information on how to join that event. So I invite you to take that as an opportunity to learn more about Salsa. Several people here will be part of that panel. And so thank you all for joining us today. We'll be around most of us for several more days. Feel free if you have another chance to ask us a question here to follow up later on. Thank you.


Hi, my name is Xiao Yan. I'm a research staff member at IBM Teacher Watson Research Center.  It's a large-scale, big geospatial data and analytics platform. Pears' website is athttpspears.res.ibn.com. IES stands for Research. If you have any questions, please feel free to contact admin account pears.ibn.com. Here is the outline. I will quickly go over the sign-up process and then give some live examples for doing queries on the user interface. And then in the end, I will demonstrate the API course using the REST client plugin. Let's get to it. Okay, here's the Pears' webpage. On the left-hand side, here's the link to the user menu, which is very useful. It shows you how to use Pears, how it's designed, and the details of each dataset. And then this tutorial video will be hosted here as well. On the right-hand side, here's where you can sign up for a new account. For IBMers and academic or non-profit users, you can request a trial account. Once you click Subscribe, it should bring you to the subscription page. We need your work email and your institution name, because the approval process involves validating the email versus the institute. And we would love to hear about your use cases using Pears. Once you've submitted, you should receive an email saying we are processing your request. Usually this takes less than one business day. Once the account is approved, you'll get a welcome to IBM Pears' email, and you need to use the link there to activate your account. Basically, you need to set your password. Please note that this link is only valid for one use. The second time you try to use the link, it will not work. It will give you an invalid link. And this is for security reasons. But if you already activated but forgot your password, you can reset your password and it will bring you into the system. So let's get started. Your login ID is your email address you used. Here are a few main menus. The query page lets you define the query conditions. The job page shows you all the queries you have done. And because this is a big data retrieval platform, you actually don't need to wait around for the query to complete. You can log out and log in and the queries will be saved under your account. The metadata page, I'm going to go into details because it explains the architecture of the data organization. First is the dataset. As you can see, these are the available data sets like ECNWF, European Weather Model, Elevation in the US, Global Weather Model from NOAA, Crosscape is historical crop planting mapping in the US. We also have a drone dataset for experimenting. And MODIS satellite, we have global satellite coverage of MODIS with two different products. PRISON is the historical weather dataset in the United States. You can go back more than 10 years. IBM Analytics is where we put our own developed model from PERS data and put it back on the system for users to use. This one is called reference evapotranspiration. A climbing forecast is based on NOAA's CFS model and it is a long-term forecast with six months to log out. This one is SMT self-learning model. It's our own statistical weather forecasting model for two days ahead in the United States. And then NINE forecast is also United States weather forecast from NOAA. Then there is data layer. Inside each data layer, inside each dataset, there are multiple data layers. Let's pick USA weather. And as you can see, there are parameters such as temperature, relative humidity, solid irradiance, pressure, etc. So we covered dataset and data layer. The next one is data table. Data table is something new we're developing and it's going to be useful hosting Internet of Things type of IoT sensor data. Basically, this will enable hosting our point data that it's a long series of temporal events. We'll save the data table for our next tutorial. The next one is data region. Data region is most useful for satellite data. So for example, if I choose MODIS, because satellite data is organized by tiles, what it means is it's just like a snapshot picture of taking by a camera. And you can look up the tile of an area you're interested. For example, here the horizontal tile 7 and vertical tile number 5. And it's located around in latitude 40 and this longitude. For MODIS, we have global coverage. So it has all the tiles. It has a complete list. The last one under meta data is color table, which is the color scale we use to visualize data. You will see later. Only administrator can associate a color table with a data layer. So please let us know if you have a favorite color scale you want to use. Please do not change anything in here. Just for one example, radiator shows spectral data scale. And help menu has three submenus. One is the user menu, as we just mentioned about. So this gives you access inside pairs. And then there's tutorial page. And the tutorial page will host all the tutorial videos. Our video today will also be put in here. And then of course we have our acknowledgement, acknowledge all the data sources that allow us to use and distribute the data. Okay, so let's get started. So query is under submit new, submit a new query. As you can see first, what query you need to define at your spatial coverage. It can be a single point, can be a polygon, it can be a rectangle area you draw on the map. Okay, let's first take a look at single point query. Click anywhere in the world. It will fill in the latitude, longitude for you, or you can choose to type in your values. Then you can choose the temporal coverage. In our case, I want to take a look at climbing forecast, that's six months out. And this one give you the interval. And you can also just do date. And what this means is it will bring you the data that's prior to or equal to this timestamp. All right, we can choose all the parameters. And then submit this query. And this came back right away because point query is very fast. And the data is displayed on the table is very convenient. You scroll down here, B, this column is a unit. And then the last column is the value. You can download the data in CSV format or in JSON format. I just want to point out here on the bottom, there's a feature that's very useful. It's called the API string. You can copy the API string to a clipboard and save it to use later for API calls. You just need to attach the web server address prior to the API string. We'll get to that in the end. You can also say send to query page. What this does, it remembers all the query conditions you're pointing, so you can modify it any way you want and read some meta query. This is how you modify your query and it's very convenient. So point query is very straightforward. Now let's go on to polygon queries. There are three different polygon groups of polygon, personal, group and repository.  So I'm going to show you how you add your own polygon. Under the query menu, the second item is called add area of interest and personal. As you can see here, it listed all the polygon that I uploaded. To add a new polygon, just click the little add icon and give a name, a key and a name. Here I want to explain share with group. The concept here is you can choose to share your polygon with the group of the user under the same category. This is a way of collaboration. I always share my polygon with the group so everybody should have a base set of polygon show up under their group category. So let's choose a KML file. Right now we only support KML shift file format for now. And then add. You can see we just added test and go back to the submit query page. Under polygon, you should see the test I just put in. And for everybody else, it should show up in the group. So for example these are the shift file that other user actually shared in the group. The third group of polygon is called repository. This is very convenient. We have uploaded all the shift files for all the states in the United States. If you put in USA, you will see all the state. And you can start typing and search for the shift file you need. And very soon we will upload all the country shift files as well. Now let's do some queries. The first example I want to show is for orange farms in a county in Florida. So in my personal polygon, I have a polygon called Florida Isoto County. And I'm interested to take a look at the latest NDVR satellite image of the oranges. So what I do here, the satellite is one of the satellite product. NDVI is normalized difference vegetation index. It's a measure of how green the tunnel is. And I can add a condition on the historical planting map in the US. I want only take a look at oranges. The index for orange is 212. You can find this index in the user manual and submit. And this is the new query we just submitted here. And this brings you to the jobs page. Most of the area of the jobs page is the map for visualizing the results. And on the right hand side is the details of your job. See this one is complete retrieving the data. And I just want to show you one useful tool here. Click there and click on the little pan here for editing. You can give a nickname. For example, I will say Orange, Florida. And you can also copy the API string just like we did and save it for later use. And what we got here is you click on the file name and it will show you the data layers. It got back. Check on the box. For example, here is a crop because we use crop to do the filtering. There are lots of oranges in this county. And if you click on the timestamp here, the color scale bar will show up. And this is the one we define in color table as I mentioned in the metadata. And we're interested to take a look at the NDVI value, the distribution of NDVI. And click on the timestamp here and it will show you the NDVI color scale. Click on it and it will show you the value where you click. And this is very useful. You can set up a time range and to collect a long history of NDVI evaluation evolving. And you can even correlate the NDVI to your yield of the year and also correlate with all the aggregated weather information. So that's the first example. So now let's do a query outside USA. One feature I just show you here I didn't mention. You can also do send to query page. That's the same concept as a point query.  It doesn't matter. For example, 4 is fire. So for this query, I'm going to show you how you choose an area and query the area just by clicking on the map. So I'm interested to take a look at the impact of this awful forest fire in Canada this year. It happened, I think it started in May 1st of 2016. So I'm going to go zoom in and go into that, go into the region first. You know it's in Alberta and it's around Fort McMurray. So what I can do is click area and I can just drag and draw a little rectangle. That's the third way of defining the area. And it was happening in May 1st. So I'll do the query from April to maybe June 1st. June 15, let's say. Then you will capture the before and after picture. And this is actually choosing both products for modis. Aqua and Terra, these are two equivalent satellites. While this one is working, the next query I want to show you is let's do something in Africa. This one, I'm interested to take a look over the weekend. What the precipitation is going to be like. And I want to see what the evapotranspiration is like. So I can prepare for irrigation in some of the areas in Kenya. So this is the Kenya. The time is for this weekend. GMT time. And I choose ECNWF. That's the European model. It's global weather model. And I choose in precipitation rate. And the filtering condition is the reference evapotranspiration is greater than 5. So this one is working. We can take a look at the one we just finished. That's one about the forest fire. So as you can see, this is March. I think it kind of still pretty cold. And it gets greener. Time goes by. And then this is the day before forest fire. And then you'll see two weeks after the forest fire. It's a whole massive impact. The fire as you can see here. And you can see it should be the same story on the other satellite. After winter, get greener. And then the fire. And this is very useful. These two. Just a few click, you'll know what's happening. This is very useful for monitoring environmental issues and events. The one for Kenya also complete here. Kenya we're trying to take a look at the weather pattern. And you can see these areas has low precipitation. Basically means low evapotranspiration. Because we said evapotranspiration to be less than 5. If I click on the timestamp, it's less than. These areas have high evapotranspiration. They are higher than 5. Okay, I was clicking, sorry, I was clicking on precipitation. So you'll see the moving of the rain cloud, raining area. And yeah, I want to prove to you the evapotranspiration. It's the query area is higher than 5. Okay. So the next query, I actually want to do something for a much bigger region. Like China.  And I'm interested to take a look at the weather pattern, the seasonal forecast, and around New Year's time. During the weekend, what's the weather it's like. I want to take a look at precipitation. I want to take a look at temperature. Let's submit this one. Yeah, I just want to point out there a few things that's pretty useful to do. For example, look at the modis satellite image. When we look at the one of the five, that's after the forest fire, you can change the color scale. You still use the green, you know, the green color bar. But you can change this to make it, you know, to make some area more standoff. For example, this is this. And I want all the area that's below 0.5 to standoff. See? So really show up the area that got impacted by forest fire because NDVI value is much lower than the other areas. Okay. Yeah. Okay. So this query also returned already. This one is going to turn a little bit because it's generating visualization files. The first parameter here is ground temperature. And you can see the ground temperature in China. Very cold and very warm in the south. So it's a lot of fire files we generated. And this is the precipitation pattern. So this way you can plan your vacation accordingly. Okay. Some areas are more likely to have rain. I will avoid for my vacation if I'm going there for vacation. Okay. So let's do one more query. This one is quite special. It's our experimental drone data layer. So this coordinate system, this little square is actually our research center location. And I'm going to take a look at the latest drone we have. And I'm going to take a look at the band. But in addition, I actually, let's make it a little bit more fun. Let's compare to satellite data. See how they compare. Of course, this is extreme. A drone image, the resolution in our case is about 20 centimeter. And the satellite image is about 250 meter. Of course, there are other high resolution satellites out there commercially available or publicly available. But drone really offers an opportunity that is because satellite image one is very far and to the resolution couldn't really get to sub meter. It's very hard to get to 20 centimeter, but maybe it's possible. And then three is it's impacted by cloud cover. So if there's cloud, you're out of luck. So we had that experience, especially with the coast area of California, because it's so cloudy, we couldn't get much clear sky images of the area. So drone can overcome that if we have a very reliable and consistent operation of drones. The data is back, it's 100%. I'm trying to cover as diverse data sets and use cases as possible to give you a good feel on how this works. One rule of thumb is when you create query, try to create query that's not so big. For example, instead of you do, okay, 10 days forecast for the entire United States, you can do five days and then the query size will be half. And then you can launch both of them at the same time. That's how you get the data back faster. And for all the query you have done, you can download the data you want, you can save the file. And we encourage all users to use other GIS software for additional geospatial analytics, for example QGIS and S3. Our platform, if you watch the introduction video, we focus on bringing the content, bring the data to user and make it very easy to use. We take the heavy lifting of data scientists shoulder so they don't have to processing and curating all the data. Okay, so this is the drone data. You can see the cars very clearly. Actually, this data set reaches the limit of the open stream map rendering resolution. The initial, the raw resolution is actually higher than what I show here. And for comparison, yeah, this is modis. It's just something to keep in mind that drones really can be very powerful. Okay, so next we're actually going to go into the API section. So I like to use a little web browser plugin called REST Client. You can see here. So instead of typing in the API code string on the browser, I put it in here. So we have, the first one is the point query. Okay, we're already prepared. So you can just copy and paste and send. I will ask me for username and password. Yeah, this is a lot of data for it to put it into JSON format. The default here also is JSON format, but you can, in our menu, you can find, you can actually ask to return our CSV instead. Yeah, this is how it looks like. Value latitude, longitude, data layer, that's the temperature. Okay, now let's check the polygon query. So that one, the type is point, this one is polygon. Yeah, so this one, it will give you the importance in here, give you a job ID. This is the one we need to retrieve our query, the jobs. And then put in our job ID. And they say it's succeeded already. And what you need to do is just after query jobs, put into the browser that you download the file. Yep. So that covers the basics of API call as well. And I hope that is useful. And thank you very much for watching. Please let me know if you have any questions and welcome to Paris.


My name is Dr. Rosini Patel. I am the breast surgeon and medical director for the breast program at Hackensack Meridian Jersey Shore University Medical Center. My focus is breast surgical oncology, which means that I take care of patients that are afflicted with breast cancer. I also take care of patients that may have benign problems with their breast, such as a cyst or breast pain. I also help to monitor patients that may be at elevated risk for breast cancer. My practice philosophy is not only operating on the patient and removing a cancer, but also providing all-encompassing care for a patient. Sometimes there's things going on outside of the cancer diagnosis. Sometimes they have some family issues. They may have problems with work. They may not have the finances and also just addressing any health issues that may affect their response to treatment as well. This affects families. I've had family members who've had to have surgery. I've been a patient as well, and it affects everybody in the family. A lot of times family members want to help and they don't know how to, and just trying to foster an environment where they're involved in the patient care, and they can have that discussion. I think it's more meaningful, and I've found that the patients have a better outcome when the family can be involved in that discussion.


this is how easy it is to move so it's just the case of getting it down now we'll have this down in 10 minutes 15 minutes easy because once the top's out it's just chop chop chop yeah yeah good Thursday morning Thursday the 5th of October Halloween approaches and it's a wet one but we're finished well we're finished on the extension but all the outdoor work's finished apart from a tiny bit of patching a bit of snagging it's steels day today there's the steel at the end of the drive that's got our hard hats well we have our hard hats so um yep we've got to get um we've got visors on them but they do get warm inside if you have a visor on so i'm taking my visor off i'm going to put my mask on and we're going to get this finished we're going to get this finished um i say that because we're staying till it's finished because we need to be away from here today we've been here we've been here nearly two weeks with all the delays and stuff but um we need to get this box stuff and get paid and move on to the next one which i haven't arranged yet so um i want to get my boots on i want to get inside it's got my headphones because i'll be having my defenders on for a bit i'm not going to take alex's easy so we can listen to our own music and take you inside there's the steel this is how easy it is to move absolutely brilliant those things thanks to robbie and robbie for the idea and thanks to my mum for buying us them from that from alde fantastic so all finished up there that feels good to have it finished in the rain i'm in i'm not being affected by it so we're up to in the medium of stock here because there's a chimney stack here so that's looks like a trim around the chimney breast so we're going to have to prop from this side now so we're going to bring the steel through put it on a couple of well put on the floor first it won't fit yeah might just go on the floor and then we're going to put these trestles so we'll cut it halfway up and then turn in it's hard work because we've got to not render first because it's that hard and then we've been screwing these together so these these are supported by these these are supported by these and yeah that's pretty much it we've got to not not dress this out and it's going to here here and then go to sales pass by 550 most of the electrics been done now but we know where the rest of them are shouldn't be any electric uh tripping out today and that'll be that's had a couple of days to go off now and i also need to knock a pocket out there 250 pockets of the steel on yeah it's even thicker in places isn't it sense cement as well so it's rock hard and usually yeah it looks about 30 mil there you can see where it's but it's the back of the flue was there's a black brick that smells you can smell the soot as well but yeah um the um usually in the old buildings the uh sand cement just falls off but this was done probably about 12 years ago so it's still good so it's still doing the job it's only going to get my headphones and my ear defenders on and my hard hat and then get cracking with olex it's just locked and the joist is still propped so we don't need to get the acres on the other side thank goodness that's a relief but um while i'm out here here's a little progress update with the air the one big pile of shit there you go and we've both got headphones in today i yeah i was thinking i was sitting back before i stand corrected i don't get how i used to do this all the time it's just very distracting i've uh i've grown as a builder but since we're making all this noise we've both got our headphones in for some tunes i've got my halloween playlist on but yeah um time are we on ten to nine not bad so i'll get while dad's making the noise i'll tell you here he's got all the plaster off that's needed for the padstone and there's obviously we're just getting the measurements of where the wall's going to end i don't think he's done now so it's just the case of getting it down now we're aiming to get this done today just done and dust it because it's get this wall down get the steel up and if the weather holds off just get this bit of snagging done obviously you can cut this down if you need to dad i know it's a lot of waffling but we've just got a few bits of snagging a bit of end of the viewpoint and all the foundation which i've nearly chipped out there we go um but yeah enough waffling i'll get you back in there just like give you a quick progress update so you know where we're at i'll let i catch you a bit hmm yeah quite safe yeah you're not using the breaker for a minute then pardon we have a crunch the reason i've got this acro is because we've come across the two steels which are the back of the house the size of them compared to what we're putting in and apparently they span from there they are packed onto the wall with the tiles so because i saw that we put this in for safety and then we'll get the steel in we'll pack them back up there onto the steel could have done with steel shims for that you know there's things we had it fixed you'll yeah so yeah just a precaution we're leaving this in here because a customer says it does span across the back because um the original house had like a lean two here and then that's the back of the house and it's been extended from there as you can see so yeah that's just precaution it's in the way but i'd rather have that in the way than have the house fallen off we've had worse in the way yeah so we're coming back to here if you want to crack on now and then it's 550 back for the padstone and steel bad boys are doing all the work now as you can see top course is out and that's as far as we're going with the actual wall obviously we're going past all the way up to the cable we've got 550 seating for the steel plus the padstone so there's a big hole to come out of there yet probably just point it out so 225 450 plus 100 probably 100mm past that and at least two courses plus i think two course of block plus another course out to come it's going to be big all that that's going to go into the cavity obviously because that's the cavity will return into the house the back of the house the back of the extension it's weird you've got the extension and you've got another little bit that sticks out the back of the house and then you've got a lean to it goes back to the back that's the upstairs back of the house it's funny detail but anyway you can see the new bit which has been toothed in like that so that's our line coming down like that and this is going to be out we'll have this down in 10 minutes 15 minutes easy because once the top's out it's just chop chop chop all the renders off it makes it easier this side obviously not but you just pop them off now look at the thickness of that and it's stuck like it to a blanket yeah so it's time to break anyway we'll see you have to break I said 10 to 15 minutes I think it's quicker than that it's that same old thing open end once those top breaks are out it's just pop them off even with the solid render on the back side it's you just get under the get under the one of the bed and just pop off and it's a straight corner there just break every other brick so that's really nice so while that's always rubble up I'm going to get the two um pockets cut out for the padstones at each end and the steel so um we also need to prop this ceiling with something so we'll have a look for something right quick one we've got a joist dangling in mid air then we've got one that one's okay that because that's in the corner against the wall but we don't know what's in this part here so we're going to take this out so we're going to put two temporary accros under this steel take this out and put that piece of phobia to it and put two accros in there to catch whatever's dangling down just to on the safe side we'll just come back a little bit give ourselves some room and then nearly nearly tidy up I'll tell you what I might have to cut some off the top of that timber yeah you know that's a lintel over that door remember when you got 340 there we need 250 for the steel only 15 20 minutes worth of tidying up to do when we can get the steel grab roll name that movie if you say this yeah it's so big because I want to get it it needs to be a bit decent sized concrete block underneath the padstone rather than a they've relieved the course of breaking it with a little split don't like splits from the padstone so we're going for the bigger piece plus the same these are hollow blocks if I just haven't knocked it off it's a bit ropey so I took it back to the top of the next block so that's that I have to watch these free bricks here on yeah and then we're going to have to get the laser level and go along all these joists and make sure they're all packed with the stagger to any packing out and here's the other hole you got 250 and 150 lintel so we're going to have to notch that lintel out but I've just looked above there's nothing above it there's only one two three four five courses of brick so we can notch that and it's still gonna have a good um good hundred mil left on the wood pity we didn't have the saws all with us yeah so again that's already just a bit of trimming to do a bit of patching and there's also a joist up there a rogue joist which um don't think the steel is going to actually come in contact with that if it does we'll have to notch it out because it's same it's lower a lot lower than all the others so we're going to have to make put a level across mark it out and notch it so there you go and then we've obviously got all the bricks to patching once the steel goes back up so I've got a got a lot to do this afternoon go the bricks you've got to go in before no you can knock the ceiling out you can knock all that from getting to it so um yeah so I'll get tidied up as best we can to us to a manageable state didn't need these got an interesting case yeah we've asked for that yeah because we can't wear them with our air defenders because the the headband on the air defends are rigid so they don't turn they're still like this so we need to end yeah on the cheaper versions you can move the headband round and wear it the band at the back of your head or anyway that's why we didn't wear them so um yeah let's get tidied up and let's get a quick dinner lunch we've got the lays a little and we're going to set it up somehow and we're going to check all these are in line most of them should be but we need to pack them all down so they're all fit and then yeah there is wall above isn't it yeah a lot of patching to do there we don't need to patch them all because no wall above it right lays the level set up and get all these packers ready see where the uh different levels of the joys are we need to make sure that's uh taken up we're gonna have to get off to get all those screws out they're all in the way there's three there oh yeah right time to try and get this stealing now i think we've got all the prep done all the joys and all the packers on so everything's flat we've got a cup we can pack after the bricks we're going to have to get slid in after and that's it we need to get the stealing onto the trestles onto the wall jacked up and then these padstones put in while Alex is patching the bricks above so we've still got a lot to do yet i don't know what time it is look it's going to be a little late one padstone needs cutting down still as well so we've got three blocks go back a bit and put it up onto the trestle yeah we're going to put it up into that corner now okay and then we're going to get the trestle underneath it as long as the trestle's on yes it is you want your trestle i was going to push it out and then two of us lifted pull it up on the wheels so two of us instinct and the wheels did it so i want you to trestle as far over as you can so we can get into that aqua and take this back out do you want to take the weight like just take the weight now push what are the holes for so Dave who bought timber inside it what say is it upside down i don't know no it's the right way up i checked before we went in so if you take the weight i'll push it out okay can i get out when you circle around the house do you want to um keep duck under there or circle around the house i always did it then we put on this one i think we should try a little bit more first while it's on wheels you just take the weight out and push it you just make sure it slides okay do it yeah you go up do it one more you can try okay go on all right you get ready to move that trestle so we need to yeah yeah that's that's sufficient remember to lift that two of us in the field what's up well that's what i was about to say to you then so we've had to come to a a decision which reluctant yeah the uh this is way too heavy for us both to lift way too heavy and it's gotta go it's gotta go up there we're gonna have to cut back some of that uh ceiling before this even goes in have to get the end multi-chill yeah so any but yeah so um it's it's half three now so the plan we're gonna we've had to decide is we're gonna get everything tidied up today get the genie the first thing in the morning tomorrow and then get this steel up tomorrow because by the time dad's gone to Hodgson's got a got a genie getting this lifted up and everything we're gonna be back till about eight o'clock so it's it's a crap decision but it's the it's the only one we can make where we get back in a reasonable time so yeah easy and then we've still got a load of snagging to do outside as well so before it's worth we'll have to suck it up and come in another day so dad's plan now then is he's gonna get this ceiling cut back now ready for the steel to go in and for us to patch the bricks back into it i'll get i'll pass in the multi-tools since we don't have the recent poll but um and i'll just get all this tidied up hoovewood and uh sent to the to the crap pile so uh i'll throw you one time lapse while we get our heads together there we go that's the tidies we can get it until everything's taken down so we will see you tomorrow at Hodgson's