Hello learners, welcome to the audiovisual program on the course titled Poetry, included in second semester Bachelor of Arts in English program. I am Dr. Chayanika Roy from the Discipline of English, Padmanath Guhaibara School of Humanities, Krishnakanta Handik State Open University. This video deals with unit number 11, which is titled Introducing Indian English Poetry. Please note, dear learners, that this is the first of the two video lessons on this unit. Well, what does the term Indian English Poetry signify? To deal with this question, we have to first gain an understanding of Indian English Poetry in general. For that reason, this video shall aim at the following objectives. To provide you with a basic idea of Indian writing in English, to acquaint you with pre-independence Indian English poetry, and to reflect on the important points who have contributed to the development of pre-independence Indian English Poetry. The term Indian English Poetry encompasses within its scope all such works of poets who are Indians writing in the English language. It must be noted that literature in English was produced in India much earlier. In fact, it dates back to second half of the 18th century. The poetry inspired by the Indian landscape and culture was called Anglo-Indian. These Anglo-Indian poets were British people who, through their poems, had shared their experiences about India. It was in the later part of the 19th century that Indian poets like Henry Louis Vivien de Rosio literally came out taking English as the medium of expression. Earlier termed as Indo-Englian to mark the Indian writing in English, Indian English poetry can be best understood by dividing the works of poets as pre-independence and post-independence poetry. And as mentioned previously, even before independence, there were writers like Henry Louis Vivien de Rosio who had composed poems on various Indian sentiments, establishing himself as the first Indian English poet. He initially served as a lecturer in Hindu College of Calcutta but later dismissed from service on grounds of misleading the students with his skeptical nature and reformist ideas. Within the short span of his poetic career, he contributed two poetry collections which were named as Poems, published in 1827 and The Fakir of Jahangira, A Metrical Tale and Other Poems, published in 1828 respectively. De Rosio as a poet was much influenced by Byron and the Romantics. When we glance through De Rosio's poetic output, we find that the relevant themes in his poetry are patriotism, love for Indian myths and legends, and a strong Indian sentiment. Apart from De Rosio, there were several other poets who contributed to pre-independence Indian English poetry. Namely, Kasi Prasad goes, Michael Madhusudhan Dutt, Govind Chandra Dutt, etc. However, it was Toru Dutt who had significantly raised the stature of Indian English poetry with her authentic flavour. One can see a strong influence of English Romanticism in her works. Toru Dutt's A Shiff, gleaned in French field, published in between 1856-7 became very popular. Her poems like Our Casuarina Tree, The Lotus, etc. showed a strong resemblance to the poetry of English Romantic poets. Her themes therefore mostly include love, nature, longing for the past, etc. It is important for us to remember her as the first Indian women poet who could make a mark in the field of poetry with her distinguished sense of simplicity and sincerity by writing in a foreign language i.e. English. Next, in the history of Indian English poetry, the contribution of Sri Aurobindo is remarkable. Some of his poems are Love and Death, Ahana, Baji Prabhu, etc. He has to his credit numerous translated works like The Hero and the Nymph, Songs of the Sea, etc. His most popular work is Savitri, a narrative poem consisting of about 24,000 lines. One of the significant women poets contributing to pre-independence Indian English poetry was Sarojini Naidu, who had made her mark through her poetry. Her first published work of poetry was The Golden Threshold, which appeared in 1905. The Bird of Time published in 1912 is her second collection of poetry. She had penned down many songs and was considered as the Nightingale of Indian Song, as quoted by Iyengar. She matured as a poet with each poetry collection and her last collection title The Broken Wing had seriousness of tone. Actively participating in the dance politics of the country as well as fighting for women's causes, Sarojini Naidu was a gifted speaker. She had dedicated poems to Gandhi and Jinnah also. They were some of the notable poets who wrote before independence. To sum up, it must be noted that Indian English poetry has been emerging ever since its beginning in the late 18th century, from Anglo-Indian poets to poets of Indian origin. Indian English poetry has seen tremendous growth in its output. Earlier it was imitative of the West, but gradually it has strengthened its base by producing many authentic works. Among the pre-independence poets, some names like Derozio, Torudat, Sri Aurobindo, Rabindranath Tagore, Sarojini Naidu, etc. are worth mentioning. Following are a list of books which you can refer to in your learning process. Thank you.


Big Ben Rothesberger officially retired. Now we have Tom Brady responding to Ben Rothesberger's retirement. Tom Brady does his own tweeting. He said, Ben defied the TB12 method in favor of the throw some ice on it method. His whole career and ended up in all time great with six pro bowls and two super bowls. There's more than one way to bake a cake says Tom Brady in showing his respect and appreciation for Ben Rothesberger's football career. What were your thoughts on Ben Rothesberger's retirement and is he all favorite all eyes he is, but I guess that is an actual conversation happening right now. Yeah, I think he's Hall of Famer. Ben is unbelievable what he was able to do for so long. I think it's cool with Tom tweeting that it's true. There's more than one way to go about it, man. Everybody has to do what works for them and this worked for Ben for a long, long time. I think Chuck told you he's like, Ben is just a great athlete. Ben can play all sports. I know I've said on here before, I think Ben was a great basketball player. He was a receiver obviously before he played quarterback in high school. If you think of the Steelers, you think of Ben Rothesberger.


This lecture is part of Berkeley Math 115, an introductory undergraduate lecture on number theory. And it will be mostly about Euler's theorem, which is a generalization of Fermat's theorem. So we quickly recall Fermat's theorem has two forms. It can either say a to the p is congruent to a modulo p, or a to the p minus 1 is congruent to 1 modulo p. Here we take p as prime, and in the second case it must be co-prime to a. And before giving Euler's generalization, I'm just going to give another application of Fermat's last theorem. And what we're going to do is to show there are infinitely many primes with last digit equal to 1. And you can see there are lots of primes like this. We have 11, 31, 61, 71, 101, and so on. And we're going to show this sequence goes on forever. This is a special case of Dirichlet's theorem, which says that if you've got any arithmetic progression, then there are infinitely many primes in that progression, unless there are obviously only a finite number. So we're doing a special case of primes of the form 10n plus 1. And we first noted that it's actually enough to show there are infinitely many primes of the form 5n plus 1, because any odd prime of the form 5n plus 1 must be of the form 10n plus 1. So we can just do infinitely many like this, and this will be easier because 5 is a prime, as we will see in a moment. So to show there are infinitely many primes like this, we're going to use the following consequence of Fermat's theorem, which says that if p divides a to the q minus 1, where p and q are prime, then either p is congruent to 1 modulo q or a is congruent to 1 modulo p. And it's easy to get muddled up about this. So the reason for this is we look at the order of a modulo p. And we notice that a to the q is congruent to 1 modulo p. So the order must divide q. You remember the order is the smallest positive power of a equal to 1, and it divides any other exponent such that a to the something equals 1. Well, since q is prime, this implies the order is 1 or the order is q. Well, if the order is 1, this means a to the 1 is congruent to 1 modulo p, which means a is congruent to 1 modulo p, which was one of the conclusions we had up there. In this case, if the order is q, we know that the p must be equal to 1 mod q because a to the p minus 1 is congruent to 1 modulo p by Fermat. So q must divide p minus 1 because the order divides this number. So this implies that p is congruent to 1 modulo q. And you notice this is the other possible conclusion. Well, we're trying to find primes that are congruent to 1 modulo something, and this sort of almost gets us there. If we take a prime dividing this, then either it's one of the primes we want or this other condition is satisfied. So we've got to somehow eliminate these ones. So what we can do is instead of looking at primes dividing x to the q minus 1, we are now going to look at primes dividing x to the q minus 1 over x minus 1. And this sort of tends to divide out primes of the form 1 modulo p, as we will see in a moment. So let's go back to this. And let's just take q equals 5 because we're trying to find primes that are 1 mod 5. So what we're going to do is we're going to look at primes dividing x to the 5 minus 1 divided by x minus 1 equals x to the 4 plus x cubed plus x squared plus x plus 1. So suppose p divides this. Well, p divides x to the 5 minus 1. So this implies that either p is congruent to 1 mod 5, which is what we want, or the other conclusion is that x is congruent to 1 modulo p. Well, if x is congruent to 1 modulo p, then this implies x to the 4 plus x cubed and so on or 1 is congruent to 5 modulo p. But since we're assuming p divides this, so this means p divides 5. So either p is congruent to 1 mod 5 or p is divisible by 5. If we also take x so that 5 divides x, then obviously p does not divide x to the 5 plus x to the 4 plus x cubed plus x squared plus x plus 1. So we've got the following conclusion that if we take any number divisible by 5, so if 5 divides x and p divides x to the 4 plus x cubed plus x squared plus x plus 1, then p is 1 modulo 5. So we can, for example, just take x equals 5 and we find 5 to the 4 plus 5 cubed plus 5 squared plus 5 plus 1 is equal to 781 and this factors as 11 times 71 and you notice these both have lost digit equal to 1 because they're 1 modulo 5 and they're odd. So now all we do is to show that infinitely many primes of the form 1 modulo 10, all we do is we take 10 x to the 4 plus 10 x cubed plus 10 x squared plus 10 x plus 1 and we take any prime p dividing this. Here x is the product of all primes we already know. And then we see that first of all p must be compared to 1 modulo 10 because we've seen it's 1 modulo 5 and it can't, or 0 modulo 5 and it can't be equal to 5 because we've put in a factor of 5 here and it can't be 2 because we put in a factor of 2 here. And secondly we also see that x is not equal to a known prime. So if we've got any collection of primes with lost digit 1 we multiply them all together, multiply by 10, form this expression here and take a prime factor of it and this will give us a new prime with lost digit 1. You notice by the way that this is an utterly useless method of finding primes in practice because if we take x to be say even something like 11 then already we're getting 100 to the power of 4 so we're getting 100 million or so and we have to factorise that to find a new prime which is obviously a really inefficient practical way of finding primes like this. However it's really good as a theoretical method. It shows there are an infinite number. So now we're going to look at Euler's generalisation of Fermat's theorem and we want to look at what is a to the power of something modulo m? So let's look at powers of a modulo m so we want to look at 1a a squared a cubed and so on modulo m. More generally we might just look at the function taking x to a times x modulo m and try and wonder how it behaves and let's just take m equals 12 and take a look and see what's going on. So the numbers modulo 12 is 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11 and we're just going to draw a little arrow to show what happens if you multiply each number by 2. So what we do is 0 times 2 goes to 0, 1 goes to 2, 2 goes to 4, 4 goes to 8, 8 goes to 16 which gets us back to 4, 3 gives us 6, 6 goes to 0 and then 11 goes to 10, 10 goes to 8, 9 if we double that becomes 18 which is 6. So if we look at this what we see is if we start with 2 we end up with this loop here. So if we take powers of 2 we get up to 2 cubed and then we get 2 to the 4 which is equal to 2 squared and then 2 to the 5 which is equal to 2 cubed and so on. So we've got a sort of vague analogue of Fermat's theorem except that it says 2 to the power of 4 is now equal to 2 to the power of 2. So things are getting a little bit more complicated. Well first of all we can get a weak form of Fermat's last theorem so if we're given a and m then a to the x equals a to the y for some x less than y. This is congruent modulo m, I guess I should have said. And the reason for this is you just look at all the powers of a so we start with 1 goes to a, goes to a squared, goes to a cubed and there are an infinite number of different powers, different number of possible powers but they're a finite number if we take the modulo m because they're at most n of them. So two of these must be equal. So eventually we must get some number a to the y that's actually equal to a to the x because we've got an infinite number of powers of a and we're trying to fit them into the finite number of numbers modulo m. So we've at least found, we can always find two different powers of a that are equal. Well we can do a bit better of that. Suppose that a is co-prime to m, then a is invertible. So a to the x equals a to the y or congruent to a to the y implies that a to the y minus x is congruent to 1 modulo m. So if a m equals 1, if a and m are co-prime then a to the x is congruent to 1 modulo m for sum x greater than 0. So that's the sort of, you see we've now got weak forms of Fermat's theorem so Fermat's theorem would say that a to the p minus 1 is congruent to 1 modulo p which would be a better form of this and it says that a to the p is congruent to a modulo p. So this is stronger than saying that a to the x is congruent to a to the y for sum x and y and it's stronger than saying that a to the x is congruent to 1 because we've said explicitly what these exponents x and y are in the case of primes. So what we would like to do for Euler's theorem is to make it more precise and actually identify a good power of a that is equal to 1. Well to see this, let's just look at the case of m equals 13 to get an idea of what's going on. So let's take a equals 5 and look at powers of a. So we start by looking at powers of a. Well we get 1, it goes to a to the 1 which is 5 and it goes to 25 and 25 is congruent to 12 and then 12 squared is congruent to 8 and 8 squared is congruent to 1. So we've got this little cycle of 4 numbers 1, 5, 12 and 8. So this is 1 a squared a cubed a to the 4 which is congruent to 1. Well now let's see what multiplication by a does to other numbers. So we get 2 maps to 10, 2 times 5 is 10, 10 times 5 is 50 which is congruent to 11 and 50 times 5 is 55 which is congruent to 3 and 3 times 5 we now go back to 2. And what other numbers are there? Well there's 4 and 4 goes to 7 which goes to 9, goes to 6 which goes back to 4. So what we've got is we've got the 12 numbers up to 13 are divided into these 3 cycles where if we keep multiplying by 2 we go around in these cycles. So the numbers up to 12 can be written as a union of these cycles. When you notice the cycles are disjoint, they're either disjoint or equal and that's because a is invertible. So if these 2 cycles say 2 numbers there had to be the same then obviously these 2 numbers would be the same and these 2 numbers would be the same because we can multiply by a to the minus 1. So the cycles are disjoint or the same because a is invertible. Another key point is the cycles have the same size and to see they have the same size we notice that this number here, this number here for instance is equal to 7 times a squared. Now if this number were equal to this number then we could divide by 7 and find that a squared was also equal to 1. So if 2 numbers in any cycle are the same then we can divide by 1 of the numbers and find the corresponding power of a must also be the same. And conversely if some power of a is equal to 1 then obviously all cycles have at most that size. So what we have found is the numbers co-prime to 13 mod 13 are a disjoint union of cycles and each of these cycles size the order of number 5. And since these numbers can be written as a disjoint union of cycles we see that the order of 5 must actually divide the number of numbers co-prime to 13. So we need them to be co-prime to 13 so they have inverses. You remember in order to show the cycles were either disjoint or the same we needed to actually take inverses of elements so this doesn't work if you take elements that aren't co-prime to 13. Well what we see is that this works for any number other than 13. So similarly if a is co-prime to m then the order of a divides this number 5 of m and 5 of m is Euler's phi function is the number of numbers co-prime to m. So we've now got Euler's theorem which says that a to the phi of m is common to 1 modulo m and this follows because we've shown the order of a divides this. Here we must have a co-prime to m otherwise because we need to take inverses of a in this argument and remember phi is the number of things co-prime to m. So the special case of this is Fermat if we take m equals p to be prime then we see that phi of m is just m minus 1 because the numbers 1, 2, up to m minus 1 are the numbers co-prime to m if m is prime. So this does indeed generalize Fermat's theorem. By the way what we've done we've actually proved Lagrange's theorem which says that if g is any group, well what's a group? A group is something with a multiplication that's associative and it has an identity and it has inverses a a to the minus 1 equals a to the minus 1 a equals 1. So the numbers co-prime to m have these two properties and the same argument shows that if g is a group and g is an element of the group g then the order of g divides the order of the element g divides the order of the group g and exactly the same argument we've given works for this and in particular this implies that g, the element to the power of the order of g is equal to 1 in the group g. So let's look at some examples of this. So let's just take m equals 1, 2, 3, up to 12 and take a quick look at the numbers co-prime to m. So m equals 1 is easy. We've just got 1 number 1 modulo m which we're going to take as either 1 or 0 and we notice that this number here just as order 1. If m equals 2 there's only 1 number co-prime to m and again this number here is order 1.  If m equals 3, so if m equals 4, can't count, we get these numbers 1, 2, 3 and 4 and now we've got to be a bit more careful because the numbers co-prime to 4 are now 1 and 3 so we only get 2 numbers and we have, let's write down what 5m is. So 5m is 1, 1, 2, 2 and again we find the orders of these elements are 1 and 2 so they both divide 5m. So for m equals 5 we have 1, 2, 3, 4. I guess I should have put 0 in here and the numbers co-prime to 5. Sorry, I shouldn't have put 4 in there. I've got 0. The numbers co-prime to 5 are not 0, they're 1, 2, 3 and 4 and this is order 1, this is order 2 and this is order 4 because you can see that 2 squared is not 1 but 2 to the 4 is 16 which is 1 and similarly for 3 and 5m here is 4 so again we see all these orders divide 4. For m equals 6 the numbers are 0, 1, 2, 3, 4 and 5 and this time there are just 2 numbers co-prime to 6 which are 1 and 5 and you can see the orders here are 1 and 2 so 5m is 2 and again the orders all divide 2. For m equals 7 we get 0, 1, 2, 3, 4, 5, 6 so there are 6 numbers co-prime to m and now we have to start thinking a little about the orders so 1 always is order 1, 6 is minus 1 so this is order 2 we notice that 2 cubed is 8 so the powers 2 and 4 all of order 3 and 3 and 5 are left over and of order 6 so this is the case we wrote out earlier and we know 5m is 6 so all these numbers divide 6 as they ought to now in every case you see there's always a number that has the maximum possible order so here we've got order 1, here 5m is 2 and we've got something of order 2 here we've got 2 things of order 4, here we've got something of order 2 and here we've got something of order 6 so Euler's theorem gives 5m as the best possible exponent in these cases so let's look at m equals 8 so we've got these numbers 1, 0, 1, 2, 3, 4, 5, 6, 7 and the ones co-prime to 8 are just these numbers 1, 3, 5 and 7 we know 5 of 8 is equal to 4 so every element should have order at dividing 4 and if you look at the orders there are 1 and this is order 2 because 7 squared is minus 1 so you might guess the elements 3 and 5 of order 4 but in fact they both have order 2 and now something has gone wrong you see in every previous example we always found something of order equal to 5m and here there's nothing of order less equal to 5m so the orders are always less than 5 of m so Euler's theorem isn't actually always the best possible sometimes we can get a better exponent let's just do a couple more cases to finish off and see what's going on so m equals 9 we get 0, 1, 2, 3, 4, 5, 6, 7, 8 and why did m equals 8 go wrong maybe something would do with it being a prime power well let's check this prime power the numbers co-prime to 9 are just these numbers here let's work out their orders well this one is order 1 and this one is order minus 1 and if we take 2, 4, 8 well this has order 6 and this is order this is 4 has order 3 and I'm getting a bit confused about what order 5 has 2, 4, 8 8 times 2 is 7 that is order 3 and 5 has order 6 again so 5m is again 6 and we see that there are 2 elements that have order 6 which is the maximum possible and for m equals 10 this is still okay numbers are 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 and the numbers co-prime to 10 are 1, 3, 7, 9 and if we work out the orders these orders are 1, 4, 4 and 2 so again 5, 10 is 4 and we've got 2 elements of order 4 so there seems to be often an element of order 5 of m well actually it's often for small numbers we'll see a bit later that for large numbers this is actually a fairly rare phenomenon these elements are called primitive roots the reason for the name primitive root comes from roots in complex analysis and I'll just sort of recall this so in complex analysis you remember the roots of unity lie in a circle and if we take something like the sixth roots of unity they all form a nice little hexagon and if we take one of these roots here then all other roots of unity are powers of this root so if we call it z then we get z squared, z cubed z to the 4, z to the 5 and z to the 6 so z to the 6 equals 1 and you notice that modulo 7 this is exactly what's happening for the primitive roots so for instance if we take this number 3 we notice that 3 to the 6 is equal to 1 so 3 is the sixth root of 1 and it's a primitive sixth root of 1 because all the other roots are powers of it so we sometimes have primitive roots of numbers and however for other numbers like 8 we don't seem to get primitive roots so we'll be examining exactly which numbers do or don't have primitive roots later in a later lecture so here's another example where you don't get the best possible results suppose you take m equals 30 and we can count the number of things co-prime to 30 and we get 1, 7, 8, 9, 10, 11, 13, 17, 19, 23, 29 so there are 8 of them so phi 30 is equal to 8 so actually 8 is common to 1 modulo 30 if x 30 is equal to 1 by Euler's theorem and is this the best possible? no it isn't and we can see it isn't best possible without actually checking all these numbers which would be a really tedious thing to do what we notice is that x to the 4 is common to 1 modulo 5 because phi of 5 is equal to 4 and x squared is common to 1 modulo 3 because phi of 3 is equal to 2 and x to the 1 is common to 1 modulo 2 because phi of 2 is equal to 1 so x to the 4 is now common to 1 modulo 2, 3 and 5 and because 2, 3 and 5 are co-prime we find that in fact x to the 4 is common to 1 modulo 30 so we can sometimes so here's another case where we can do better than Euler's theorem now I'll get finished with a couple more applications of Euler's theorem so first of all with the following problem let's find the last 2 digits of 7 to the 403 I don't know why you would want to find the last 2 digits of 7 to the power of 403 but here's how to do it if you want well what we do is we notice that phi of 100 is equal to 40 that's because these are all numbers with last digit 1, 3, 7 or 9 and it's kind of obvious that there are 40 of these so 7 to the 40 is common to 1 modulo 100 by Euler and as we remarked 40 isn't actually the best possible but whatever it's good enough for this case so 7 to the 403 is common to 7 to the 40 power of 10 times 7 cubed which is common to 7 cubed modulo 100 which is common to 343 modulo 100 so the last 2 digits of 7 to the 403 are just 43 so finally we have a sort of common recreational maths problem which is what is the last digit of let's do 7 to the 7 to the 7 to the 7 again totally pointless but it gives a sort of exercise in getting familiar with Euler's theorem well we want to know what is this modulo 10 so we have 7 to the power of something where something is this big rubbish here and we want to know 7 to the something modulo 10 well in order to work out this modulo 10 we want to know what is this something modulo 5 of 10 because we can just subtract multiples of 5 of 10 from this modulo 10 is equal to 4 and this something is 7 to the 7 to the 7 so we need to know what is this we need to know what is 7 to the 7 modulo 5 of 4 which is equal to 2 and now we can sort of work backwards we know 7 to the 7 is congruent to 1 modulo 5 of 4 so remember this is just 2 because this is 7 is congruent to 1 modulo 2 so 7 to the 7 is congruent to 1 modulo 2 so now we want to figure out what is 7 to the 7 to the 7 modulo 4 well this is congruent to 7 to the 1 modulo 4 because 7 to the 7 is congruent to 1 modulo 2 so we can replace this 7 to the 7 by this 1 because of this which is just congruent to 3 modulo 4 so now we can work out what 7 to the 7 to the 7 to the 7 is and we know that this is congruent to 3 modulo 4 so this item here is congruent to 7 to the 3 modulo 10 here we are using the fact that 7 to the 7 to the 7 is congruent to 3 modulo 4 which we have got here so all we have to do is to work out 7 cubed modulo 10 which is congruent to 343 which is congruent to 3 modulo 10 so the last digit of 7 to the 7 to the 7 to the 7 is 3 and needless to say you can't do this by working out this number explicitly because this is insanely large so next lecture I'm going to cover Wilson's theorem which says something about what factorials are modulo a prime


Thank you Good my name is Wim Remes. I'm a security consultant working in Belgium, and I'm gonna talk about OSEC today There's a lot of information about me on the internet, and there's a great tool that's called Maltigo I don't know if ever everybody has ever used it, but if you find my phone number you can call me and we can Go and have a beer. There's three things. I want to show you first before we go into OSEC I was a volunteer at the Brucon conference in Brussels last year. I don't know if everybody Anybody has visited Brucon We're gonna have another event this year in September if you have something interesting to talk about the CFP will be open. I think somewhere this month or next month and Anyway, it's a very good conference. It was awesome last year, and I'm sure it will be awesome this year also Then I was lucky to be invited to Excaliburcon, which was a security conference in China Who's gonna have another? Edition this year also. I know it's a stupid picture, and I'm very happy that I'm not in it, but Good if you ever want to combine security and China, this is a this is the place to be and then the third thing that I'm involved in is the Eurotrash security podcast It's me Craig Balding, Chris John Riley and Dale Pearson we met at Brucon and We were all listening to podcasts. The problem was that all the podcasts that we listened to were hosted by US people And there was no Eurocentric podcast, so we we are trying really trying to make a European podcast Using very basic tools and it's fun to do and I think we provide some information that you might find interesting If there's something we're doing wrong after listening to the first episodes don't hesitate to give us feedback on that So on OSSEC I'm not a developer of OSSEC. I have to make that clear. I'm not a developer at all I'm I started as a user of OSSEC and I've Talked with Daniel Sit who is the lead developer of OSSEC a few times My job is merely to to introduce OSSEC to the community and make people use it more To do their log management and system protection So the tool is developed by Daniel Sit Somewhere before 2005 he had he was using tripwire Which you probably know on a lot of systems and he had a lot of problems managing those those logs So he started developing Starting from a problem he had himself And that developed into syscheck. It was the first name of OSSEC Then he started building tools around it and in 2005 he released the first open source version It's licensed under the GPL v3 Now the tool itself was very good But there was no support on it and Daniel Sit was doing most of the development in his in his free time Then he had the opportunity to join Turbogate. Turbogate was a small company involved in security projects The project state open source and they provided Support on it. So you could get commercial support, but the product state open source and in 2008 Turbogate was Acquired by Trend Micro which you know as a big security company and there have been doubts About the product staying open source But I've done a talk at ESA a few weeks ago and there was a guy from Trend Micro in the in the audience there And he thought that it was still going to be open source and to remain open source At agenda for today First I have to introduce you into the boring parts of log management the theory behind it Then we're going to dig into the OSSEC features a Little bit of the OSSEC architecture and I'm going to introduce you how to do log analysis How it works and how you can do your own log analysis on any log that you have from any application from any system that you Might want to install OSSEC on So log management. It's so easy that even the babies can do it It isn't okay There's a lot of sources that logs can come from first biggest problem on all all systems if it involves security There's users interacting with our applications if there weren't any users there wouldn't be any need to do log management There wouldn't be any need for applications either. We're good Then we have the applications databases behind it the systems and they all generate enormous amounts of logs What I've learned is we look at logs Only when there's a problem to see what what has happened if we could that could do that proactively it would be very nice The reasons why we do log management I think there's only two because we have to because there's requirements Regulatory requirements. It can be an internal policy It can be somebody requiring you to do log management Then you have to and then there's a very few because they want to I haven't met any yet If you're gonna look at logs, you know in any corporate system, you're not gonna have only things logging to syslog, but you're gonna have your windows logs Your network appliances will have their own proper format of logs It's a big mess Then if we talk about log standards the first log the first standard that comes up is is syslog I think you all know syslog The problem is that it has been abused a lot Which with abuse? I mean there's developers. I don't have anything against developers. Otherwise, I wouldn't be here Or I would be wearing armor But we're dumping chunks of source code in in a syslog. We're dumping user names passwords even credit card numbers in in syslog messages and If we're gonna do proper application logging most of the times we only find Cryptic strings that don't mean nothing to somebody analyzing the log And it might mean something to the developer behind the application, but if you're gonna put it in production, it's gonna be a big problem Then there's a second type of logs which are the proprietary proprietary logs. There's been efforts by Websins by IBM and then the last one is CF is from ArcSight They they thought they were the if they were the biggest one everybody would be would be adopting their log standard It hasn't happened. There's some applications now moving to CF. ArcSight is one of the big Seam security incident and event management solutions and Some applications are already moving to CF, but it's not too big So we know what happens when a proprietary standard tries to be the big standard. It never happens And then we have IDMF which was an awesome initiative by some academics. It was very complex And it wasn't in relation with what you see in a production environment. So it didn't materialize either Most recently. Oh, that was the next slide good What do we need if we want to talk about log management? We need to have a language that everybody agrees upon We also need a syntax so that every log log message looks This looks the same So everybody can understand it then we talked about Cislog first Cislog by standard in the RFC is UDP If you're gonna roll out Cislog in a production environment the first engineer that you're gonna meet is Gonna try to move you to Cislog and G. Cislog and G is an awesome tool It's also very flexible to get your log management and it supports TCP, but TCP is not in the standard You need to be able to to do your To use a transport according to the to the message that you want to send Some messages might want to use UDP, but if you need more log more logging in in case of an incident You might want to move to TCP And then we need recommendations that guidelines that everybody can use to do do their log management And there isn't many of that either There is one one initiative from from NIST, which is a US organization that you might might want to check out But it's about the only one that gives proper recommendations for log management then more recently there's become the common event expression that that is a Standard that might make it because it's very flexible. You can do binary binary logs. You can do plain text logs You can use XML for logs depending on what logs you want and what what in which case a log Event happens now for OSSEC OSSEC is Defined on the website as a host intrusion detection system Which means it's something you install on a on a system to detect intrusions. It's Much more flexible and just just that description the three main future features of OSSEC are log analysis so you can have it consume logs Interpret them and have Throne alerts or have reaction to to that log message or log messages then the integrity control you can monitor several folders on your system and When a file changes an alert can be thrown With the active response, which is a part of the of OSSEC you can have the original file put back So you remain your system remains The integrity is is controlled and then the root key detection. It's not It's it's not a replacement for any anti malware solution, but it's a basic It's a basic set of signatures for for configurations That are interpreted as as root kids We dig into the architecture There is First I have to touch upon the install mode You can install OSSEC in three modes, which is standalone For a web server or a server that you have in a DMZ that you want to have intrusion detection on you can just install it in standalone mode Once you have multiple servers Or multiple clients you're gonna want to install the agent version on the on the clients and have a central server for the For the for the log management The good thing about that part is that the agent runs on the system, but it doesn't do any any analysis on the system itself It means it's very low footprint on on your on your server And all the computation is going to be done on the on the OS X server itself And if you do it on the OS X server, you're also going to be able to the correlation of events if somebody is scanning multiple servers in your in your environment with nmap like we Learned before then you're gonna be able to to correlate those events the two Two main processes that are running on the clients are the log collector And that is in fact the only process that is running as root because you need root access to access most of the system logs And that's the only reason the only thing that it does is read the system logs And any new messages are forwarded to the agent The agent is responsible for communicating with this communicating with the server and all communication is encrypted and compressed The standard port for for OS X is UDP 1514 You know 514 from from syslog, so they just put a one in front of it Then the server receives all the communication from the agent and it's gonna forward the messages to the analysis demon If there is an event room You can have two actions you can have a mail sent either to the system manager Or you can configure to have for a certain application a mail sent to the application owner or the application developer So you can act upon that message and then a very nifty feature for me is a Xxd which allows you to to run a script in reaction to an event a Very good example is on at Defcon. They you Defcon is a security conference in the US. They usually have a What they call a poem to own contest? There is a box that they put there if you can hack it the box is yours and in 2007 there was a guy who Configured the system to do an art poisoning attack once somebody tried to Intrude into that system.  You cannot install an agent on it because they're closed But you can have them report using syslog to your say to your OS X server and you can interpret that those logs as well So we have servers we have our network infrastructure But maybe we have installed an intrusion detection system on our network as well We can have that report into OS X as well Snort is by default supported so OS X already has a whole set of rules to to read OS X messages Snort messages Then of course we have applications. We have databases We can monitor those logs as well. We just point the OS X agent because applications and the database are running on our servers We point the agent to to those log files and the agent will consume those as well and then if we're going to do virtualization you can install the agent on any Linux or Unix based system to even a VMware ESX you can install the OS X agent on and With that you have a complete centralization of your of your infrastructure logs These are the rules that are by default included in the OS X package package So you see there's Solaris rules. There is Sonic wall Cisco asterisk Apache And you can create using the local rules you can create exceptions or extensions on the existing rules one thing to note if you're going to change a rule in one of the Application-specific rules those are going to be overwritten during during upgrade, but the local rules XML file will never be overwritten How are we going to do log analysis? I already told you that everything happens on the server The first thing is going to do is pre decoding at that moment. He's going to get basic as an information from the from the from the log message But not going to do in-depth analysis on it Then in the decoding part, we're going to extract a lot more information like IP addresses user names host names And specific strings in the analysis We're going to give meaning to that to that information. We're going to interpret it and We're going to make it clear so this is an example of a Pre-decoding rule the only thing that we want it's a default syslog message So we can extract the time and date the host name is there as well and then we We extract The application name the program name And we just record to the log message Now we might have a have a tool that is monitoring the same application And then the application name is not going to match But we want to to have that log message For our application as well so we can use a basic Regular expression To extract the application name and still have it in the same rule set Then in the decoding phase, we're going to have more more information extracted So this is just a basic log in message And again, you see we use regular expressions to define which fields we want and with the order tag we give Meaning to that to that information in the analysis phase We're going to create rules So we know it's a decoded in the pre-decoding phase as a demon in this case And we're going to look for a for a string called logged in and that means that user is correctly logged in And based on the on the first rule, you see that every rule has a rule ID and By you reusing the the rule ID in the next rule you can Create a chain of rules So here we have if the user is not John, we will throw the through the message. Okay, this was not John Based on the source IP we can match it to a cedar notation of the of the network if In our current policy is not allowed to access a certain host from a certain network We can throw alert on that as well By building rules like that you you can really create a flexible rule tree and Have actions taken on certain events and that really makes it a really flexible tool to To manage all the log that is coming in instead of looking at edit When the event has already happened if you're gonna build rules You're gonna have regular expressions problem with the The real regular expressions on in an IDS situation you may not want The extensive extensive features you want to have speed because you want to have the the messages interpreted as as fast as possible, so The OSCEC team has decided to build a regular library For the decoders and the rules. There is two libraries. This is the first one, which is a very extensive a more extensive one And you can build your rules very flexible that way Then there is a second one, which is actually Only used in the rules and it's the simplest that you can have You can just look for a string and then you can have multiple strings chained with the with the pipe And this is the fastest one is the best to use for integrity checking OSSEC.conf is the basic configuration file where you do all the configuration for your host In the in the cys checks section you just define which Which directories you want to include to have the integrity checking? It's very important I for me if I configure it on systems. I always take the the lowest in the hierarchy or the highest in the hierarchy and then you're going to exclude lower in the hierarchy because if you Do the monitoring too high you might miss something while you can still exclude Files or directories that you don't want to monitor and those are mainly files and directories that you know change a lot You don't want to have alerts thrown on those Since version 2.2 There's also a real-time check in the past. It was run like you see on top In a in a defined pattern so every every few hours you could have it run Now you can have certain directories that are high-risk also monitored in real-time Then in the in the rules you're going to configure rules for your for your applications for for your for your files and these are the basic rules that are in the OSSEC configuration to to monitor File changes on your systems Like I said before you can use and those To create actions maybe to block a user if he has create created the file or or change the file Or just put the original file back. So you maintain integrity integrity There's a lot of commands that you can use on the on the server to check Integrity The c-check update is just updating the database That's not that's done automatically, but every every few hours if you want to have the situation updated now You can use that command With the c-check control minus L you're going to get a list of the of the agents My mind minus I is just going to give you from a certain Clients all the files that have changed after after short while it will already be along a very long list If you're looking for a specific file, you can use that last command then the management of OSSEC At this moment it all happened happens from the command line There have been I did there is a basic web user interface that you can use if you're gonna have a lot of a lot of server, it's not very I It's not very very well developed at this moment I Mainly use OSSEC to create meaning to the to the messages, but then they're going to be forwarded to something like Splunk to really create dashboards or information May make it visual so on the command line you have Managed agents and there's two versions on it if you compile it in the server version You're going to be able to create the central keys And you're going to have a central database of keys then on the agent side The basic functionality is there to import the key and that that's it Agent control that's your main tool to control all the behavior of the agents minus LC is going to give you the the list of the clients that are currently connected then minus agent ID is going to give you the information on the client which is the OS version IP address and if you're going to use central configuration Which I will explain a little later You will also see the MD5 hash of the central configuration file so you can compare it and see that it's up to date Mine minus small r a is gonna do the System check and the by the integrity check and the root key detection check on the On all the agents minus are and then provided with the agent ID is going to restart an agent and minus r minus you With the agent ID is going to do the system check on a specific agent. I Didn't include central configuration in my slides, but I want to explain it a little bit You have the possibility to create a central configuration file for all your agents and that's going to be pushed to the agents every Every two or three hours now In that configuration file you can either specify specific configurations based on the On the ID of the agents so if you have three web servers you include in the specific rules for those clients The IDs of those of those agents or you can create a configuration file based on the operating system so for Solaris or Linux or AI x you can create different different rule sets basic conclusion If you're gonna do log management from a corporate point of view you're gonna get a reseller coming in with a with a Solution a proprietary solution.  The problem is they don't know your applications They don't know your environment the only one that knows your environment and your applications is yourself If you're gonna start with OS sec you will have the time to Create rules based on your environment and not on what the proprietary solution Offers OS sec being developed since before 2005 is very mature solution to use It's it's very stable and offers a lot of Functionality for you to to start your log management as I said log management is something that has become Necessary due to regulatory compliance if you're gonna do log management You better start By understanding your locks yourself One thing to remember is that tuning the rules of any log management solution will never stop So You can create log Your rules now in a few months you will have to redo them and see Whether it still fits your solution It's a lot of work, but it's worth it. I think So That was my overview of OS sec. I thought I hope you found it a little bit interesting and if there is any questions Yes, I I Understand that the problem with UDP is the reliability because you have no confirmation The intelligence is built in the agent and the server. So when your agent when your server fails Your agent will will cue the messages and send them in the service available again. I'm gonna walk up to you So so you're asking if there's a redundancy building That that is that is not possible. What you can do You can have multiple servers. You can have one agent With keys for several servers. It needs some extensive configuration and I in my Does this still work not from here wait better I think there's two main courses for Reliability for redundants you can have Two servers and have the agent point to the two different servers, then you will have to synchronize the keys between the two servers That's one one solution the problem is Since there is already Reliability in the agent agent sites if your service gonna going down the agent will keep the messages until the service available available again and Build building a server is really a it's really very easy. So I Basically you have a server installed in about 20 minutes It's better to have a backup of your keys and rebuild then have one server running doing nothing in case Maybe the server will crash But you have that you have the possibility to make redundant servers. I haven't used that possibility yet Either you yell or I come to you Yeah, the the agent is currently supported on Windows from 95 to Windows 7 it's supported on AIX on Solaris and on most flavors of of Linux Excuse me. Yes Yes One second. There is the MS Regarding authentic authentication There is the DS DACP rules at this moment For the installation of the of the agent basically, it's a it's a simple install for the configuration or In no in most cases that there isn't a distribution package for for for all for all OSes so it's a it's a basic install and normally I create a package For the for the customer when based on the OS that he's using right now I'm busy with a project involving Solaris and AIX so I created a basic packages for those We have 50 minutes left No more question 20 minutes I talked too fast Yes One one OS X server can have about 250 clients Yeah, I it depends on on the memory you have on the storage that you have and on your on your network card and the speed of your network So that's that's different in every environment Excuse me. Yeah For for for the file integrity It records the MD5 and the Shaoan hash of the of the file No at this moment. No, but it's so open source applications. So if you want to contribute you can do that Yeah, sorry Yeah No, you you're gonna have a tiered approach if you have that that many that many sir That many clients or that many log sources You're gonna have a tiered approach.


Everybody doing a auto recap from the break-in title twenty-three bone jab baseball a box case of a 14 I just didn't recap the autos everything else is recaps Base of a Huna McDaniel Campbell Rodin Forrester Honeyman McLean Wiggins bowmeester winnaker insert auto class of 2023 Numbered autos here. We had gold honeymoon black honeymoon green Thornton true blue bush Farmelo and Floyd aqua lava purple hits fractures of Rock of Forte and Miller base of hit Patrono Taylor and Bashir's and then we had a I think I showed these already. I did show these already, but anyway Gold die-cut Wilson orange Shaw rose goldmire green Clark and a Langford base auto Thanks everybody


All right, welcome everybody to the April 27th hyperledger technical oversight committee call as you are all aware you've all been on the call before. Two things that we have to abide by the first is the anti trust policy that is currently displayed on the screen. And the second is our code of conduct, which is linked in the agenda. Any other announcements today we have the standard definitely developer newsletter that goes out each Friday. If you have something that you would like to include, please do leave a comment on the wiki page that is linked in the agenda. Any other announcements that anybody would like to make today. I will point out that hyperledger does have a Reddit and we staff have been given permission to engage. So, if you go to our hyperledger and tell me your Reddit username I will give you the appropriate flair as a member of the community and I, if you want to jump in and answer questions and stuff that would be great. All right, I try any other announcements that anybody would like to make. No, okay, quarterly reports are the hyperledger fabric report is linked here in the agenda. Steve and I did see that you merged that this morning. So, yeah, there were a couple people who hadn't had a chance to look at it yet but please do take a look if you hadn't had a chance, good information in that particular report. I merged it. Pretty sure that's what I saw. No, I'm so used to hitting an approval and then seeing the merge and merge button pop up that I just didn't even thank my apologies I shouldn't have done that. Yeah, it definitely was I think you were maybe just a couple days early on that merge but that's okay I think people can still obviously have a look at it and see if there's anything there that they would like to comment on but Dave, I really appreciate the reports that you do put together for fabric. All right, as far as other reports transact is another report that we have that's been passed to you. So I know Daniela did say that she was going to reach out to Sean this week I don't know if Daniela has had a chance to do that as of yet. And I do not see Daniela on the call. Hey, we had a call with Sean yesterday. So Sean supported moving transact to dormant status, I believe. So, and eventually end of life in it. They wanted to make sure that sort of all of the, everyone had migrated off before they totally end of life did, but he did support moving it to dormant status. Okay, thanks. We can then get a PR open, or I mean an issue open for that so that we can. Maybe at the next call, just to make sure that everybody has time to think about that, unless people feel like they're ready to do that today. So yeah, also I apologize I'm going to have to drop to head to the conference. Okay, well hopefully heart. We will get some comments or some input on your security documents during the task force discussion so hopefully look forward to some information showing up. Awesome. Feel free to comment or edit the document and you know I will try to make more changes and I would eventually like to take that back to the open SSF to get their thoughts on it as well. So, yeah, let me know if you if you all need me for anything and thank you so much. All right, so then, Ursa, we do have a conversation here to talk about moving that to end of life. But before we get there just a reminder some upcoming reports that are due. I did see some conversations happening on that report to get that submitted to us so hopefully we'll be seeing that show up shortly. For next week we do have the areas in the and non credits reports that are due. All right, so without further ado, I'm going to discuss this move Ursa to end of life. I did see Mike had created an issue for us in the TOC. And also on the Ursa repo to move Ursa to end of life. There has been some discussion on the ticket that's in the Ursa repo about people who supported people who would like not support that. And so wanted to I see that Mike is on the call Mike. Any comments or input that you would like to provide to the TOC. Yeah, sure. So the people that are probably requesting to keep it open. I believe Aroha and some from the Aries community. And I believe this can be resolved pretty easily by Aroha I think is only using it for like one or two items. And so those could easily be extracted and given to their project. The rest of it that people are interested in can actually be moved to the hyper ledger non creds project. For some code and just put it there because that's really all they care about the rest of it could just no one's really using it. And the rest of the maintainers. I mean, I was the principal maintainer for many years. And ever since probably about three years ago, I haven't been able to give it full time attention. And then as of 18 months ago I pretty much stopped giving it any attention. And then the other two maintainers have just kind of been limping along on life support so I believe those that are kind of requesting keep it open. Other concerns can be addressed really easily. And as for the rest of it, I don't see any reason to keep it open. There are open. There's probably about three open security vulnerabilities on it. One of them is, well they're all they're all fixable. One of them requires a lot of coding which the maintainers don't have time for that's probably what you've got the task force discussion right there. The third one is an easy fix from a coding perspective, but it will take a long time for the cryptographers to work out what, whether that is actually a sufficient fix or not, which I also don't have time for the third fix involves changing some code which could mean breaking changes for downstream dependencies which I think would be that's why I think it'd be better if they just pulled out what they need. And applied it to their project. So it doesn't break anybody else who might need it. That's all I have to say. All right, thank you for that Michael. And I did see Brent also on the issue in the Ursa repo did also say that he was in favor of moving Ursa to end of life as well I think Brent is another maintainer on the project. So I guess we have a couple hands here to start the discussion Alexander. Yes. You know how perspective has changed. We are in favor of moving the project to allow specifically because when we were planning to maintain Ursa, we planned to break it down into smaller modules which can be loaded independently. But some other functionality would have just been completely gone. Some of it is just re exports of existing rust libraries. Some other things could have just been extracted specifically the problematic cryptographic modules. That is the intention. And this is where we're going. And it will be. We will consider refining what was in Ursa and potentially spinning it off spinning off your crypto off of it. Whenever there's need. We will probably need to engage more with an uncred and see what actually needs to be done with that. And I'm available to help with that. I just don't have the full time capacity to maintain Ursa anymore so I'm happy to advise on how to do that and maybe code a little bit here and there. In all due honesty. Given the scope of the changes that we wanted to do. We will not have been Ursa anyway. It would have been a completely different library which had some of the code inspired by us. This way we're going to get some compatibility and so on. So we'll be happy to have you around and help us with that. We will need a cryptographer eventually but for now, the things that work. Let's assume that they work well and let's use them. So thank you for that. I just want to make sure that I heard correctly in the ticket you said you were against moving Ursa into life and I think you've changed your mind to say that. Yes, Ursa moving to end of life is okay with the era folks. Did I hear that correctly. Yes, precisely. Okay. Great. Thank you so much. Stephen. Yeah, I wanted to add to Mike's, I believe the BLS signatures where it needs to be moved to Indy. So that's a second piece that needs to be exported out of Ursa. So the CL signatures to to a non creds I guess, and then BLS to Indy. Other than that, I think we're okay with it being end of life. We can manage it to get it done right. I think we have a developer that can do it to do most of the work like you helping it would obviously be appreciated. We will get the one of the things we want to add on is getting the CI CD right so the big thing in for us is on a non creds being able to get arm supported and things like that. And it's the same sort of issues that that that we wanted so I think it's the right thing to do when we're fine with it. Okay. So it sounds like the objections that did exist in the ticket are no longer objections. Anybody else who has any objections to moving Ursa to end of life. Obviously not as a vote but as a discussion item. I have one question for Mike. If this goes to end of life, should the crate be unpublished. Yeah, I will yank it. Okay. Okay. unpublished. What does that do the dependencies that are using it today. Can you explain what that the ramifications of doing that. Yes. So, in rust, you can yank a crate and anybody who's currently using it is still has access to it. But if any new projects come online, it'll just say hey you should use this anymore. Just, it'll give them a hard to error. If it's a new project with existing projects that've already pulled it before won't have a problem. Okay, so anyone building a non creds or building indie would not have a problem. They shouldn't. Shouldn't because because I've, because I've pulled I've used crates that have been yanked. And it warns me and says hey this creates been yanked but since you've been using it. It will still allow it. It sounds a bit like magic but The other thing we can do is publish one last crate that all it does is update the read me right that just says this project is no longer maintained. Okay. I would prefer to do that that unpublishing it sounds like a scary thing. Maybe it works but it sounds scary. So I would like to do the ladder, and then maybe in three months or so yank it. Okay. So, can we collaborate a bit on the ring me. Yeah, just submit a PR, we can just submit a PR for that and then you can review it. Alexander make sure you're looking for that too. Don't worry about me. We're happy to help as much as we can. Okay. All right. Thanks for see Mike. Thanks for stepping up and being available for people who are using our side if they want to move out of our like take a part of the project that is of interest to them. And even the project is being proposed for you well. And like, because of the specialty requirement, which requires a cryptographer to understand or be able to answer some of the questions. We still request you to be also available in just in case. If hyper ledger staff or maybe the to see or maybe other men members are requesting your help. Any other comments before we get to a vote. No, okay. Would somebody like to make a motion to move or set to end of life. Sure. All right. Thanks. Do we have a second. Second. All right. Thanks Bobby. Right. You want to give us a vote. Sure. How do you want it? Do you want roll call or gays and days. The gays and days are okay. Okay on the motion before the TOC to move versus the end of life status is there anyone that abstains. Is there anyone that. Wishes to vote nay on the proposal. All in favor say aye. Hi. Hi. Motion passes. All right. Thank you. And Mike, thank you so much for the work that you did put into Ursa. Over the years and as Arun mentioned, thank you for volunteering to help. I think it's a great opportunity for the folks who are currently using it to. Make any sorts of changes that they need. No problem. I'll still be in the hyper ledger committee. Just not. Not as involved as I could be as much as I want to be. All right. Thank you. Oh, I'm rising high for Peter. I guess Peter is unable to unmute himself. Peter. You can unmute yourself. Yeah. I can't unmute him either. Peter. Perhaps type in discord. The host is not allowing it says allow participant. Okay. So I'm going to uncheck that box. And then I'm going to check the box again. Peter now suggests that since other people have been able to unmute themselves. It's probably an issue on your end. Perhaps reconnect. And if you could, should we continue? Or did you. Was there something specific you wanted to. Thank you. Yes, please. All right. So. Yeah. So I guess the next topic. Unless anybody else has anything they'd like to get to you before we talk about the task force. Is there any other topics for discussion today before we do get to the task force discussion? Okay. I mean, I think it's off to you then. Thanks. So I know I wanted to send an email. I hope you all can see my screen. Which screen am I sharing? The security policy vulnerability disclosure. Okay. Right. So, um, I know we have had multiple discussions. I think I'll get back to the Tuesday recordings and send an email up to the Tuesday mailing list. Sometimes today or maybe enough this week. Regarding all the discussions summarizing the meeting minutes across different to see calls that we had the task force discussions. So we basically went through the recommendations that were listed in the open SSF and we discussed through some of the policies that works best for us within hyper ledger. And heart was really nice to put up or summarize the document and then propose that as a policy. Over here in the document and I see already some of the review comments, which kind of discussions going on on the document. But if you have not had a chance to look at it, but please to review this document. Once and share your feedback. Since we have discussed the recommendation topics from open SSF, what's pending from the task force as an outcome is to bring those into actionable items that we can propose to the to see and get those voted upon. And then the reviewing the document that you see on the screen. So in today's call, I think I just wanted to go through the document itself. Unless you have any other topics to discuss. Since I don't say anybody raising hands will probably read through the policy document in today's call right. Tracy I'm not sure like, how do we want to take this for this. Do you want me to, again, discuss through some of this as a revision item, like the previous discussion points that we went through. Or like do a review of the document in detail that we'd like to do. So it might be good to just cover the sections as a high level to talk about kind of what's in there. So that people who haven't had a chance to look at it yet, at least know what they're going to be looking at when they do review it offline. And then, yeah, if you think there's any sort of comments that are maybe controversial for right where we do need to have a discussion on those comments as a wider group, then maybe that's a good thing to bring up as well. I think that's like minor edits or things like that. I don't think we probably need to talk through those. But if there's anything there that you just think might require some, let's have a conversation to see if where people stand on this. I think that's probably fine. Makes sense. So let's do that. Let's revise through the high level topic items are the sections that are listed in the document. Again, these are the same set of topics that were discussed in the previous task force meetings. And without going into specifics, we will probably try to revise and get back those discussion items that we had. And for the details, I would again request you all to read through this document and then add those. As we like recently heard us as recent as in today's doc call. There is possibility that like the projects end up in some certain vulnerabilities like they may end up because of indirect dependency through the library they're using or it could be possible that the implementation itself could be missing certain things from a security standpoint. And of course, like when we come to know about it, how do we mitigate the risk? How do we handle that? Now do we still keep the bar high for the projects across? So it would impact both the project as well as, let's say, from a community perspective, the confidence on the code base that Hyperledger as a foundation is having those projects that we have. So that's about the policy and since this impacts all the projects that are incubated and ideally like it's always good practice to have this irrespective of the project status, good practice to have the security practices followed. But at least for the projects which are graduated, it affects the most, right? So over the period and during the task for discussions, we did have a proposal of having an infrastructure to handle the requests that are being raised as a vulnerability issue, which are being raised for security reasons. And in terms of infrastructure, one of the key things that we had discussions over was having, so there are two types of infrastructure that we are talking about here, like the way of handling the incoming requests as well as if at all anything can be done in terms of regular audits or regular reviews. So we did revise through the existing options that we have from Hyperledger, for instance, when I say existing options, it goes back to the security audits and the reviews that Hyperledger was helping all the graduated projects with, right? Now, apart from that, the other part of the infrastructure setup that we wanted to bring up was, can we bring in somebody who is, let's say, a responsible person from each project and nominate them and create a small council or a group which deals with all the security related requests. And this is the core group who would then navigate through the issues and then distribute them among the project groups and try to mitigate and then coordinate and have these addressed eventually, right? And then as part of that, when we discussed, there was proposal that instead of having one single person from each project, we wanted to have, let's say, I don't remember the number, I need to go back to the meeting of the notes. But I believe we proposed at least two or three from each project to be representing in that forum. And they bring these, I mean, they are the ones who would navigate when an issue is raised or when an intake request is found. And they are also responsible to make sure that we navigate them through the request that are coming in. We'd make sure this group is responsible to tell them about available policies and present them with the options on how to and when to make the disclosure public, right? And we did have discussions about the scoring criteria or like the risk, this is kind of a number that can be associated against each issue that is raised and this number, higher the number, the greater is the risk that we carry unless we fix it sooner, right? So, and then we did have discussions around which tool to use for it. And as far as I remember, the proposal was that we start using the Github's provided option. And apart from the number or the like scoring criteria, we did discuss about the embargo list. So this kind of talks about, let's say there is like a core group of organizations who we consider has highly impacted a group of people. So these could be like say the platform providers that if these group is compromised, then there is high chance that like a large population is compromised. And we did have discussions around how to come up with the list and who is responsible to maintain the list and what are the responsibilities from a project team's perspective. And how are they supposed to communicate and what responsibility does the hyperlegious staff have or like what really does this embargo list supposed to do and not do. These discussions were brought up during those discussion items. And so the other things that we discussed was about, of course, the security advisories but I mean it does tell about us like for instance, if somebody is using your project, how do we inform them about, let's say there is this thing that that's going on with your project and then it has been fixed. And now you want them to operate so that they are not impacted. This is kind of making them aware that like they are on a lower like a previous version which may be having a vulnerability that needs an attention from their standpoint. And the other topics that we did have discussions over were the private patch deployment infrastructure. So this is kind of the option where you as a project team would develop or work on an issue in a private way. And when I say private way, like you're still involving the relevant stakeholders and having let's say a patch kind of approach that we do for bug fixes, right? So instead of testing and making all the code changes public, which may leak out the vulnerability info information. It's good to do that development in a closed circle or in a closed fashion where only the relevant stakeholders are involved through the process. And they are aware of what's going on and they do all the testing and then once there is an agreement and once there is enough testing done. Then the patches merged and we did also bring up the topic of how to merge it and when to make the announcement. Like generally there is a grace period after the patch is merged before when this vulnerability is like made publicly available. But there is also there was also discussion where we had we spoke about like why it is important to disclose that information as soon as possible. After a particular release is done right after the PR is merged and that's pretty much it that we discussed about it and throughout the process through the task force. We did bring up topics about how many days should it be before we release. Let's say disclosure vulnerability in a public forum or what's the metrics are like how many how soon should we respond back and in terms of responsibility of that core group of security representation that we have from each project. So these are the topics that were discussed through the task force. I can summarize that in NT OC mailing list and copy this document as well. But I hope this was a quick refresher and any questions so far on this topic. I don't see anybody raising hand or unmuting themselves. So I'm assuming there are no further questions. So this brings security task force at least for the scope that we had to a logical conclusion and like we need to formalize these policies that we have into proposal to the TOC and to relevant parties where necessary and make them aware of these policies with that. I guess I'll hand it back to Tracy. Okay. Just a question for those who have had a chance to review this and edit your comments. Are there any pieces that you'd like to bring up as discussion items for the other to see members at this point. Yes, Steven. I would say, I put in the comment there and it's in there and I think it might be worth the discussion but this idea of separating out the how to do this from the here's a sample document that a project or a repository could use. I'm okay with it being all in the same document but I think it would be worth not trying to combine the two where you're explaining what you're doing and providing an example in the same context. So that's the other thing I'd like to see is just there be a very specific thing that you copy paste into yours and then adjust for your particular project. Any thoughts on that or folks who've looked at it or even if you haven't looked at it. I mean, Steven, I think it mimics kind of what you did with the maintainer.md file, where you had kind of the sample file separate than the actual text around how we do, how we expect being here is that MD file to exist. That's, I just find as a, as a maintainer, it's, it's much easier to deal with it that way. Okay. I really did have your hand up is there something you wanted to add to that. I wanted to comment there's like, instead of splitting document if there were any other suggestions on how else to like, talk about the policy, if there are any other suggestions. Okay, anything else then that anybody would like to bring up as far as comments that they did add they'd like to make sure that we do bring up here to discuss. So it does sound like we've made some good progress then on the security task force. So very similar to, I think, what we did last week with the best practices will probably have one more time for discussion for the security vulnerability disclosure task force to bring back to the TOC kind of what they would like to make as far as changes specifically to any of our guidelines and or governing documents to make sure that the results of this task force are included there on the TOC website. So, yeah, I guess with that, is there anything else that anybody would like to discuss today. Okay, so Bobby, I think you're up next. It also sounds like maybe we need to take a look at our task force issues that we did create at the beginning of our session for this year to see if there's other ones that we would like to pick up at this point, going forward. Probably in the next couple weeks, so we'll probably take a look at those maybe next week as well. And I guess I will let you go and talk to you again next week. Sounds good. Thank you, Tracy. Thanks, Bobby.


The study examined the effectiveness of a new approach to treating severe combined craniocerebral injuries, SCCI's. This approach included identifying fat embolism syndrome, FES, through neuroimaging data and diagnosing it in patients with SCCI's. The study found that this approach resulted in a 13.5% reduction in mortality compared to traditional treatments for SCCI's. This article was authored by 1-0-2-5-0-0-5-slash-2-0-7-4-0-5-8-1-2-0-1-7-1-9-4-4-4-8-2-4-8-6 and M.K. Nazarov.


Hello, this is Brian Sliceman, BMC Software and today I'm going to show you a video on TrueSight Capacity Optimizations AWS Views, which you'll find in the presentation server. Now the wonderful thing about these views is they really help support the value cases around really that there's four value cases for TrueSight Capacity Optimization and these views really will are going to help with all four of those. And those are on enterprise visibility, reduce and avoid cost, improve capacity planning efficiencies and around accounting for and planning for future growth and business demands. Now with the AWS views, what you're going to see is it really plays to the strengths of TrueSight Capacity Optimization and helping you reduce and avoid expenditures from a cost perspective, avoid those negative business consequences around outages and things like that. That helps with the risk, helps you save on revenue because we can control what you're spending to make sure you're spending prudently in the cloud and also helps you with your strategy on planning for and accelerating innovations in your environment. So with that said, let's go ahead and take a look at the AWS views that we find in TrueSight Capacity Optimization 11.3. So as I mentioned before, the AWS views are located on the TrueSight presentation server. They're going to be under capacity. So we expand that, we expand cloud and we'll find it under AWS. And we're just going to go, for this video, we'll take a look at the EC2 instances. So one of the biggest improvements in 11.3 over version 11 is we added some different capabilities around filtering. We also added some enhancements to the recommendations. So from this, when I first click on this view, I get a really good insight into my environment. As far as, right to the top, I'm going to filter all of these saturated servers. Now I can sort on that. I can say, show me CPU days of saturation that maybe is lower or higher. But by default, it's going to show me the highest CPU utilized boxes. These are servers that maybe I want to take a look at because they're saturated, they're being overused. I can go ahead and I can drill into these servers and I can take a look at how they're configured and what that CPU utilization actually looks like. So I get really quick insight into actually what's going on in my environment. I can also see tags. These tags can be coming from AWS or maybe they're coming from your CMDB or a discovery tool you have. Or they could also be coming from tags that you've configured inside a true site capacity optimization. Now if I go back, one of the biggest waste of money for companies is, you know, they'll spin up instances in the cloud and they don't use them. They're servers that are sitting out there idle, they're not being leveraged. And for every hour that those servers are on, those are costing the business money that's coming out of your budget. So an easy way to save money on cloud expenditure is to shut these servers down. So with the AWS view, what we give you is the ability to identify those idle instances. You can export those to a spreadsheet and you can send that spreadsheet to your cloud team and say, you know, we need to take a look at these instances and see if they can be shut down, resized or, you know, we need to do something because we're not leveraging these resources that we're paying for. So that's very quick and easy to get out of the box. Once again, I can dive into these servers. I can see the tags. I can see how they're being leveraged from a CPU perspective. And I can see that they're not really doing anything. I can also take a look at my EBS volumes. I can look at maps. And basically these are heat maps. So these are different servers in my environment. And I can see from a very quick, you know, the larger the box, the bigger the EC2 instance. And I can see by the way they're color coded, how they're being leveraged. Another great thing that we've added to this AWS view is around recommendations. And this is where companies can come and they can gain a lot of value and save money very quickly and efficiently by using this view. You know, there's kind of a mindset of if I'm moving from on-prem to the cloud, if I have a certain size box on-prem, that's the size of box I want in the cloud. And what we fail to really realize is there's two things. You know, number one, maybe I wasn't really leveraging the capacity of that box on-prem. So if I had wasted capacity on-prem, I'm going to have wasted capacity in the cloud. And also on the flip side is when typically when I move to the cloud, that's going to be running almost always on newer, faster hardware. So that's going to perform better. So I don't need the same capacity that I had in a VMware instance that I am going to in the cloud. So what we do through recommendations, and once again, I can export this to a spreadsheet and send this over to my cloud team, is we're going to tell you, hey, you know, this is a server. You know, this could be terminated because it's not being, it's an idle VM. And you know, you could say $343 a month. Or in this case, this one's over-allocated. It's being underutilized. You've oversized it. If you resize it and we tell you what you could resize it to, this is the amount of money you could save. So very quickly, without knowing a whole lot of your cloud infrastructure, we can show you at a very high level, you know, what you can do to resize, right-size your cloud footprint to save your company money. And you know, this isn't soft cost. This is real dollar savings that you're going to have to your budget. And we also sort them by highly efficient, low efficiency and medium efficiency. So we let you slice and dice this data in a number of different ways. I hope you've enjoyed this quick intro into the AWS views as part of TrueSight Capacity Optimization. If you have other questions or want to dive deeper and see how this could benefit you, please contact BMC Software and we'd be happy to show you more.


Matthew Derbyshire on Sensitive. I feel so dumb right now. I've not been following this at all. Is there anywhere I can go to to get good and reliable info about the situation? I would say start watching. There's two people you should watch. You should watch the Doran, the Doran. You should watch Scott Ritter because they bring guests on and they talk and they do question and answer period and stuff like this. They're good. Okay. You should read Gideon Levy. He's a journalist in Israel. You should read Aleister Cook. He's in the UK, a diplomat and journalist. You should, if you want to learn about the history of this area, Norman Finkelstein. No one is better. No one is better. Norman Finkelstein. Know the history of this. He's on sub-stack. Just follow his work there. Okay. Those are five that I can give you like right off the bat. Five of the top ones. Five of the top ones.


Hey guys, welcome back to Food and Mentory Adventures in Food. My name is Andrea and our channel is all about the food. We do taste tests, grocery hauls, recipes, and what's for dinner. And I am super excited today because I am coming to you with an HEB grocery haul. Now HEB is a grocery store that is based in San Antonio, Texas. But in my area of Texas, we don't have these stores at all. And so whenever I visit family in South Texas or in the Hill Country, I love to go to HEB. And so I was in South Texas for my cousin's wedding and there was an HEB and so I had Howard take me to HEB so I can pick up some of my favorite things. So I am going to jump in right now and show you everything that I picked up. So one thing I will tell you about HEB is like I said it is a grocery store that is based here in Texas. But they have a lot of their own store brand products like this for instance. So this is Texas sheet cake. I don't know if you guys have ever had it before but it is so good and it's really popular around here. And I have bought their baking mixes before and they're pretty good. So this is a new one for me, Texas sheet cake. And it comes with the frosting and the cake. There are four pouches in here but the four pouches are enough for just one cake. So I got that. And then I also got some spicy Charo beans again HEB brand and some sweet and salty almond bars again HEB brand. Hill Country Fair that's also HEB brand and I got some saltines. And then I got two stir fry mixes again HEB brand. These are ready in 15 minutes. I got the toasted sesame with soy, ginger and garlic. And then I also got some just stir fry with soy sauce, rice, vinegar and sesame oil. And you just add your own meat and vegetables in this sauce. This is new for me. And then I also got some two alarm chili and I get this here locally in my store. This is not something that's exclusive to HEB but it was a lot cheaper. I want to say this these were like a dollar sixty something a box. And then I think I was most excited to see this skinny pop microwave popcorn. So of course I have found it here locally but this is new. So usually they sell these for about four dollars a box and you get three little packages of the microwave popcorn and when you pop them up they come up in a little bowl. Well these boxes are new and these are actually let me find it for you. Here it is. These are in the bag. So I was excited to see that chemical free line bags and you get six of them. So this box was 398 which normally three in a box is 398 plus they had a coupon on each box. So I got these two boxes of skinny pop microwave popcorn for 298 each. So I was really excited about that. I also got some famous Dave's cornbread mix. I've made this before on a What's for Dinner and Howard really likes it. It's pretty good but it's super sweet. A lot sweeter than I'm used to. Even sweeter than Jiffy cornbread but he likes it so we got a box. And then this is something that I've never seen before. It's lambs again made in Texas cornbread sweet southern cornbread mix. So I love cornbread so I wanted to give that a try. And then I got this Lomain seasoning mix. I guess I was hungry when I went but I don't remember seeing Lomain in our grocery stores. I've definitely had Sunbird before but not necessarily the seasoning mix so I grabbed that. I also grabbed these strawberry fruit crisps and they are just dried strawberries and these were at the checkout stand and I wanted to try them. And then these are not exclusive to HEB. I've bought these from different places before and I really liked them a lot but they were cheaper in HEB. Cookies on tour and they are a really crunchy cookie and they are vanilla biscuits and I don't remember made in Germany. But these things are really good. They're like a really crunchy crispy butter cookie. And then I really like HEB's trail mixes and this one was new for me. I mean since the last time I've shopped there was probably which was probably a year ago and this is Nettie Bliss and here's what it looks like and it has peanuts, well honey roasted peanuts, yogurt flavored peanuts, dark chocolate raisins, butter toffee peanuts and praline pecans. I don't really care for raisins but if they're mixed with something I can eat them. And then I saw these milk chocolate covered almonds and those look good to me too. You guys know that I love sparkling drinks and this is Peach Bellini. It's an organic Italian soda and then they have these organic blood red orange Italian sodas as well and there are four in a pack. And then I saw again this is their store-bought caramel corn. Never had this particular brand before but I do love caramel corn and then I just wanted to try some of their chips. Now these are just the individual serving size and I grabbed these at the checkout stand but these are ranch and then nacho cheese so they're knockoff Doritos. I think I may have had them before a long time ago but I don't remember what they taste like. Then they had cantaloupe on sale for 88 cents so I grabbed one and then I got some store brand organic marinara and I got some store brand saucy cage and cream sauce so basically you just add pasta and meat to this and then creamy poblano cream sauce again you add pasta and protein if you'd like and then I saw this Hawaiian barbecue sauce it's spicy and that looked good to me and then the last thing that I grabbed was this kins table side Caesar of course I know I can get kins here it was on sale there and it's a small nine ounce plastic bottle and I've never seen table side Caesar so it sounded good and I wanted to give it a try. So anyway this is everything that I picked up from HEB like I said it is probably one of my favorite grocery stores I wish they would come to our part of Texas but I don't think that they are so I'll just continue to go shopping there whenever I go visit family. So anyway this is everything thanks so much for watching if you haven't subscribed to our channel I certainly hope that you'll do so and we'll see you guys next time.