For now what I will do is I will get started with tutorial problems today because we need to solve those tutorial problems. Let us see how do we do that. So I have already a request from few participants that I need to solve 33, problem number 33 and problem number 37. So let me take problem number 33. So let me see how I can coordinate with myself. Today I am missing professor Arun. He has gone for PhD interviews. So let us get started with tutorial problem 33. What is this problem number 33 stating is there is a flat plate, there is a flat plate and its length is 3 meters and U infinity 1 which is flowing from left to right on the top is U infinity 1 is 60 meters per second and T infinity 1 is 200 degree Celsius, very high temperature, hot gases are flowing and on the bottom side there is movement of the air from right to left that is U infinity here is 10 meters per second and T infinity here is 20 degree Celsius. So there is a heat transfer from hot gas to the flat plate and there is cooling at the same time by the cold air which is sitting at the bottom. Now what are the properties at T infinity 1? So what is that I should do? See actually what is that I should do? I have to take the properties at average film temperature. Do I know the wall temperature here? I do not know the wall temperature. So what do I do? I will go ahead with by taking the properties at the T infinity 1 because I do not have any other option. So if I do that or here in this problem they have given as properties because to exclude as this confusion but where did those properties come from at this temperature only? That is Prandtl number equal to 0.7, K is 0.03, nu kinematic viscosity is 20.92 into 10 to the power of minus 6 meters per second meter squared per second. Similarly for the bottom stream it is Prandtl number equal to 0.707, K equal to 0.0263 watt per meter Kelvin kinematic viscosity is 15.89 into 10 to the power of minus 6 meter squared per second meter. Rest is straight forward. First thing is what I should do in any in any forces convection problem what is that I should do? Reynolds number. So what is the question asked? Assumptions are steady state and let me write this is important. Assumption, steady state is not an important assumption but there is an important assumption other than that that is the reason why I am writing steady state and second thing is that I am assuming that plate is very thin that is why perhaps everyone has asked the problem number 33 why because we need to make this assumption. Plate is very thin when I say why am I making this plate as very thin? You see what is happening? There is a boundary layer developed here like this and on the bottom how is the boundary layer developed? Like this that means there is convective resistance here that is 1 upon h 1 a 1 upon h 1 a and there is convective resistance here that is 1 upon h 2 a and there is conductive resistance to neglect that conductive resistance I am taking that is L by K a that is thickness by K a that thickness I am making it as minimal as possible so that the conductive resistance is 0. So plate is thin conductive resistance is negligible I am not saying 0 I am saying negligible ok is negligible ok. So what is the question asked? Question asked is I will solve only for one part second part is logical evaluate the heat flux through the plate at x equal to 1 meter measured from the left edge ok let us do that x equal to 1 meter so that is Reynolds number this let me call as fluid 1 and let me call this as fluid 2. So Re 1 equal to how do I calculate that? U infinity 1 x upon nu what is U infinity 1 here? 60 into x is how much? What is x? 1 meter nu is 20.92 into 10 to the power of minus 6. So what is that I get? I get 28.68 into 10 to the power of 5 why do I write in terms of 5? 10 to the power of 5 to make out whether it is a laminar or turbulent definitely it is turbulent. So this is turbulent flow turbulent flow so because it is turbulent I have to take the correlation for Nusselt number nu 1 equal to 0.0296 Re x to the power of 0.8 PR to the power of 1 by 3. So what is PR? I know PR 0.7 I know Re I will get Nusselt number as 3852 and from that I get h 1 x upon k k I know already 0.03 and x is what is x? 1 meter I will get h 1 as what is h 1? 115.57 watts per meter squared kilo that is h 1. Similarly I have to do for h 2 let us do it for h 2 so that is I will have to move on to the next slide h 2 again for h 2 what do I calculate? What do I calculate? Re 2 Re 2 equal to U infinity 2 x upon nu what is U infinity 2 here? 10 what is x here? It is 2 meters it is not 1 meter from the left I said but for the bottom one what is that? It is 2 meters from the right because fluid is moving in the from right to left we should not get confused this problem is specifically cook to confuse the reader. If you are clear in our boundary layer I will not get confused. So 10 into 3 minus 1 that is 2 upon nu is 15.89 into 10 to the power of minus 6. So what is the Reynolds number I get? I get a Reynolds number of can anyone help me out? I do not see your Reynolds number quickly. Yeah you are right 12.59 into 10 to the power of 6 watts per sorry Reynolds number has no unit I should not be writing 10 to the power of 5 what is this? It is laminar or turbulent it is turbulent. So again I will use nu 1 nu 2 equal to 0.0296 re x to the power of 0.8 pr to the power of 1 by 3 I get an assault number of 199.968 which implies that here remember h L by k equal to approximately this that is 1 triple 9.968 what is this L? I am supposed to take here again 2 meters no confusion 2 meters thermal conductivity is given that is 0.0263 if I substitute this I will be getting an h of 26.3 watts per meter squared Kelvin. Compare h 1 with h 2 compare h 1 with h 2 h 1 is 115.57 h 2 is 26.3 why is the heat transfer coefficient on the top wall higher than the heat transfer coefficient of the bottom wall? Higher velocity not higher temperature higher velocity higher Reynolds number because of which my nusselt number has gone up it is more forced convection on the top wall than the bottom wall temperature gradient has nothing to do temperature gradient will not affect I told that. So here my students says that because temperature gradient is more it is why I said again and again heat transfer coefficient is not a function of delta t and heat flux please do not think that it is because it is 200 that is why my heat transfer coefficient is high nothing to do I have seen phd thesis going wrong in this aspect that is why I am emphasizing this I have rejected phd thesis based on this fundamental concept going wrong. So please remember that heat transfer coefficient in forced convection is not a function of heat flux not a function of temperature difference because here Reynolds number is high on the top wall heat transfer coefficient is higher. So h 2 is 26.3 now heat transfer rate how do I get heat flux? Heat flux equal to how do I get that? t infinity 1 minus t infinity 2 upon 1 by h 1 where is a 1 gone I have embedded I am writing it for q double dash plus 1 upon h 2 what is t infinity 1 200 what is t infinity 2 20 what is h 1 115.57 what is h 2 26.3 I will be getting a heat flux of 3856.4 Watt per Watt per Watt per meter square remember I have not written L upon thickness upon k a because I have neglected the thickness is very small please remember this. So from where to where the heat transfer is taking place actually from the hot gas my plate is also getting heated up and at the same time my plate is getting cooled by the by the cold fluid. So hot fluid is transferring the heat transfer is taking place from the hot fluid to the cold fluid through the plate through the plate. So with this I think there is a second part so what is it saying is that is the direction of the flow important how would it affect the heat transfer that is what we are saying is that in the next part if I take in both the directions are same that is if I take if I take flat plate and instead of having reverse if I take hot air in the same direction as that of cold air what will happen what will happen the boundary layer will increase the gut feeling would be the heat transfer rate here will be lesser lesser the first thing is that but it is not right why I will tell you why because R e 1 and h 1 is not going to change what will I get R e 1 is same I am not going to write R e 1 h 1 is 115.71 but what is R e 2 going to be same or different x is 1 meter now it is no longer 2 meter. So R e 2 will become now 10 into 1 upon 15.89 into 10 to the power of minus 6 I get 6.29 into 10 to the power of 5 still it is turbulent if I put that I get h 2 of 30.197 what has happened to my heat transfer coefficient actually heat transfer coefficient has increased heat transfer coefficient is increased so because of that I will get q double dash as 4309.79 heat transfer coefficient is increased means what my resistance has decreased so my heat transfer rate should increase so that is what I have got earlier what was the heat transfer rate I got 3856 now I have got 4309 because heat transfer coefficient at this location has increased so this is how you can look at this problem in several ways several different ways and try to understand the heat transfer coefficient concept. So once you have understood this rest all problems more or less in fact once you understand the boundary layer concept solving problems in convection is easier but understanding is difficult. So what I will do is for next 10, 15 minutes I will not take questions now I will introduce one another concept which I had skipped that is what is called as scale analysis if you see here see I had taught you one scale analysis I will solve 37 problem do not worry I will solve only one more problem before we sign off today I want to introduce one important concept that is scale analysis and one of the professors had very earnestly asked yesterday and I had postponed because I myself was stuck and I said that you keep working as a homework because I myself had stuck and I perhaps have now understood that. So let me say what is that it is about scale analysis so we did scale analysis for Prandtl number less than 1 that is we did it for thin or thick thin boundary layer so let me see where it is here in the scale analysis. So we said that if we do the order of magnitude analysis I will get delta is of the order of L r e L to the power of minus half and C f is r e L to the power of minus half this is very well understood and we did it for Prandtl number less than 1 ok Prandtl number less than 1 and we got delta t by L as r e L to the power of minus half and p r to the power of minus half. Now nusselt number I get r e to the power of half and p r to the power of half now what will happen here Prandtl number is less than 1 means my hydrodynamic boundary layer is thinner than the thermal boundary layer that is delta by delta by delta t is very much less than 1. So delta is very much less than delta t here we went away went ahead and took U infinity is same throughout my thermal boundary layer ok that was an easy thing and very simplified thing. But now life is not easy when I come to when I come to thin thermal boundary layer that is let us do that I am going to do this because whole of this transparency whatever is there is wrong except this U by U infinity equal to delta t by delta ok except that everything is not right ok. So let me take thick boundary layer that is I am taking Prandtl number greater than 1 that is for water and oil I want you to derive along with me because this is an involved concept. So delta by delta t is greater than 1 what does this mean delta is hydrodynamic boundary layer is much much thicker than the thermal boundary layer. Now if I take a flat plate and draw the hydrodynamic boundary layer it will look something like this that is this is my hydrodynamic boundary layer it is U infinity and this is my hydrodynamic boundary layer thickness delta. Now what is my thermal boundary layer thickness ok. So thermal boundary layer thickness is smaller than that of hydrodynamic boundary layer thickness that is this is delta t ok. So with this let us go back and see how does U infinity vary that is U varies how does U vary how does U vary let me take U is varying linearly that is why I have plotted linearly you see when I am doing scale analysis I have plotted all straight lines if you have noted carefully why because I am assuming linear relationship but when I was plotting boundary layer I was plotting very nice parabolic nature but I am not doing that now. So now if I do that that is U equal to that is U equal to M y U equal to M y plus C ok. So what is that what are the boundary conditions when y is equal to 0 U is equal to 0 let me write that when y is equal to 0 U is equal to 0.  So let me not do this because it is straight forward U equal to M y because my emphasis is somewhere else U equal to M y U equal to M y what is M U infinity by delta. So U equal to M y is U infinity y by delta. So now U by U infinity equal to y by delta what is my y what is my y which is of interest to me thermal boundary layer thickness I am not interested what is happening above the thermal boundary layer thickness. So U by U infinity equal to delta T by delta that is it is not equal to U by U infinity is of the order of if you think that I am going very fast what is that I get let me do this if I am going very fast. So what is that I get this implies that C equal to 0 C equal to 0 now U equal to at y equal to delta U equal to U infinity equal to M into delta. So what is M what is M M equal to U infinity by delta. So now U equal to U infinity by delta into y what is what is that y which I am interested in here U is of the order of I should not be writing equal to why I am not interested about delta T because my heat transfer is taking place within that delta T. So y is delta T. So I get U is of the order same thing U is of the order of U infinity into delta T by delta let us keep this in the back of our mind. Now what is my energy equation U delta T by delta x plus V delta T by delta x T by del y is equal to alpha del square T by del x squared we always neglect and take del y square because delta T by l square is much lower than delta T by delta T square here ok. So what will I get what will I get for U what is that I should be substituting for U I just now form U infinity into delta T by delta into what is this del T what is the scale of del T delta T and what is del x what is the scale of del x l comma what is V what is V V is we have to be careful here we will go to continuity equation what is continuity equation telling del U by del x plus del V by del y equal to 0 ok.   So what is the scale of V now U infinity delta T squared upon delta l is that ok. Mejendra you are with me ok. So if I substitute that here U infinity delta T square upon delta l what is the scale of del T delta T what is the scale of del y which thickness I am interested delta or delta T in my energy equation delta T this should be of the order of alpha delta T upon delta T square. Now what will happen to this 1 delta T will get cancelled out with 1 delta T will get cancelled out with the another delta T. How do these two terms compare with each other how do these two terms compare with each other they are same what does that tell to me what does that tell to me it tells that U del T by del x is of the same order of V del T by del y I cannot throw any one of the two and they are same they are of the same order. So let me take only one of the two let me take see it is like telling 1 rupee plus 1 rupee is 2 rupees it is of the order of rupees only it is not if you take 10 rupee plus 11 rupee it is still 10s of rupees only not 100s is that right. So that is what we are saying so U infinity del T by this delta T delta T I can neglect del T by delta squared l is of the order of alpha upon 1 by delta T square is that okay I have to move on to the next transparency let me do that so if I move on what will I get for del T if I move this del T squared from right hand side to the left hand side what will I get delta T cube is of the order of yes alpha l into delta squared upon U infinity something missing delta squared I have put delta T cube is of the order of alpha l by U infinity into not delta squared where did this delta squared come from it is delta only sorry here I have made a mistake in the previous thing please note that this is not delta squared while transferring I have transferred it wrongly it is delta only I do not know whether I can do that erasing now yeah I am able to do that luckily so this is delta this is delta okay so I get delta this is right this is delta this is delta alpha l delta by U infinity so what is let me do some rearrangement what is delta alpha l by U infinity what is delta l r e l to the power of minus half this we have derived earlier then what is that let me divide both sides by l squared delta T cube upon l squared is of the order of what do I get alpha delta by let me multiply and divide it by nu that is what do I get U infinity U infinity this l squared only I have pushed it this side I am not dividing this l squared only I have pushed it let me multiply and divide by l okay let me multiply and divide it by l U infinity by U infinity l by nu I have done several things here let me tell you one by one l this l squared I have pushed it to the left hand side and I have multiplied and divided it by nu and I have multiplied and divided it by l okay now what is this and also there is another term no r e l to the power of minus half right so this l let me push to the left hand side what will I get delta T cube upon l cube what is nu by alpha what is nu by alpha no no Prandtl number Sameer one upon Prandtl number okay what is U infinity l by nu yes one by r e very good one by r e into r e l to the power of minus half so delta T cube upon l cube is of the order of one by Prandtl r e l to the power of if I push this one minus one by half to the denominator what will I get three by two so if I write delta T by l is of the order of P r to the power of minus one by three r e to the power of r e to the power of minus half and I will not do nusselt number equal to h delta T by k if I substitute that I will get directly nusselt is of the order of r e to the power of half P r to the power of one by three is that okay so elegant it is so all questions asked on this are now answered are now answered so I would take one or two questions for ten fifteen minutes and then solve the last problem so over for discussion nirma university amdabad any questions on the material which I have taught today and the concept and the experiments which we did yeah today you have discussed about the wavelength and the range of the red color being used for the traffic signals because of the longer wavelength now the question I am yeah here the red wavelength will also have the low energy content because its wavelength is longer so will it not affect the visualization at a longer distance because of intensity of the radiation emitted by the red wavelength will be as compared to other wave no the question asked by one of the participants is that red wavelength is having higher wavelength as opposed to that of the green and larger wavelength means smaller energy see wavelength does not decide energy I told in the morning what did we say wavelength it is decided by sorry the energy is decided by whom it is decided by the frequency so frequency decides the frequency decides the energy not the wavelength wavelength is decided by the medium okay so please do not get confused with the energy and the wavelength and the frequency frequency decides the energy wavelength is decided by the medium in which my electromagnetic wave is my electromagnetic wave is travelling ok.


Okay. So hello everyone, my name is Justin Jacobs and I'm the lead developer for Flare. Flare is an acronym which stands for the Free Libre Action Role Playing Engine. For those of you unfamiliar with action role playing games, here's my rough definition. The movement and combat which are core to the sort of game happened in real time. So this is in contrast to a game like chess where the players take turns performing their actions. Though as the player progresses through the game they'll earn some form of experience points in order to strengthen their character and their abilities. They'll also collect a loot in the form of items which they can wear and use to further empower their character. And lastly, they'll need some sort of reason to want to get stronger. So that's why they're a quest to complete in order to give the player some sort of broader goals. Flare is actually broken up into two components, what we call the engine in the game. Flare as an engine is responsible for all the functionality in the game. This includes all the level necessities such as handling input and drawing to the screen. And it also includes all the core functions such as how entities move in the world and the AI behavior of enemies. Technically, the engine is quite simple as far as modern video games are concerned. It's only about 46,000 lines of C++ and only uses the SDL2 libraries as dependencies. So this keeps it fairly welcoming to hack on and makes it easy to support a bunch of different platforms. We directly support the three major OSs, Windows, Mac and Linux, as well as a mobile version on Android and a version that runs in a web browser. What's pretty cool is that we've also seen other people port the game to more obscure OSs like Kaikou and Amigo OS 4. But the engine isn't much by itself, which is why we ship our own game alongside of it. One thing I should mention up front is that we use the terms game and mod interchangeably a lot. A game in this context is essentially one big mod. So the game that we ship as a mod made up of the text files and art resources that the engine can parse and turn to something that the player can actually interact with. So our game is called the Imperium Campaign. It has a fantasy theme, so thank Dungeons and Dragons, swords, skeletons, magic, that sort of thing. When creating a new character, players can pick one of three different classes. These fall into the familiar archetypes of warrior, archer and mage. Each class has its own set of abilities, which we call powers that are unique to that class. There's one main quest that spans the entire game as well as several side quests. So completing the game takes about three to five hours for most players. So what I like to do now is go through players past of it and give you an idea of how we got to where we are today. The original concept was created by a guy named Clint Belanger and was pretty different to what it is today. The concept was more similar to a game like chess where that it was turn-based and instead of real-time and the movement was fixed to a grid. It was also written in Java. But Clint moved away from that concept pretty quickly and transformed the project into an action RPG written in C++. Clint released the first public version of the game, OSARE, or open-source action role-playing engine at the beginning of 2010. You can see what that looks like in the screenshot on the right there. So near the end of 2010, Clint renamed the project from OSARE to Flare after a suggestion from Richard Stallman. I think most agree that Flare is a better name for the project. So jumping ahead a bit, March of 2012 is when I joined the project. I don't remember exactly how I found out about Flare, but I was no doubt looking for games to play on Linux. Back in 2012, gaming on Linux was much less established than it is today. There was no steam and the only real options were a small handful of preparatory games, a smaller selection of free software games, and console emulation. Flare stood out because it was a genre of games that I already liked and was well-made despite being in an alpha state at that point. It also ran pretty well on low-end hardware like the ASUS netbook I was using at the time. I enjoyed Flare so much that I wanted to try my hand at contributing. I was teaching myself to see programming at the time and it seemed like a good way to improve my skills. My first contribution was to make it so that the engine would not crash when the game couldn't start the sound system. It wasn't something particularly useful for me, but the actual code that needed to be written was trivial, so it was a good introductory task to get acquainted with the engine. After that point, I was now part of the team which consisted of Clint, myself, and about three to four other regular contributors. So development continued as normal through 2012 and 2013. The game content during that time was what we call the Alpha demo, which was a loose collection of areas designed to demonstrate the engine's capabilities. But it wasn't a cohesive game with a proper start and end. But then in 2014, some things started to happen. Clint was brainstorming ideas to create a complete game as a replacement for the Alpha demo. It was also at that point that we began to talk about the engine being featured complete and releasing a version 1.0. And there was also this idea that we needed to split the engine into two versions to support STL 1.2 and STL 2. And somewhere in the midst of all this, I ended up getting nominated as lead developer. But 1.0 didn't happen as quickly as we thought. In fact, version 0.19 would be the last public release for the next four years. Some of you might have heard this before, but there's the phrase that the last 10% of our project takes 90% of the time to complete, and that was certainly true in our case. But it turned out that taking our time solved one of our problems for us. STL 2 had become the standard over STL 1.2, so we didn't have to worry anymore about splitting the engine. Now the focus could be on developing the 1.0 game and doing any necessary engine work required to make that happen. During this, I was the only person working on game content and almost the only person working on the engine. We definitely had some great occasional contributors working on engine stuff, but it wasn't the more regular team like we had in 2012. But in my opinion, this type of philosophy works well for game development. Game development involves a lot of subjective decisions, and it can be hampered if too many people are trying to insert their ideas. The Alpha demo had quite a bit of this sort of design by community mentality, and it felt as jointed as a result. I wanted to avoid that for this new game. I was also very lucky. I don't have much artistic talent, which is why it was great that we had a very good collection of resources to work with. All the 3D art, the 2D art, the music, and the sound effects, all of it was already there and ready to be used. So I owe a huge thanks to all of the artists that had contributed over the years. Finally, six years after I joined the project and four years after the last version, Flare 1.0 was released in March of 2018. The engine was successfully migrated to STL 2, which made the Android and web browser ports a reality. Flare 1.0 was a big release with a long changelog, so I've highlighted a few of my favorite additions here. Not having the engine locked to 30 frames per second was an important one, at least to me. When it comes to action games, gamers want things to feel smooth, so being locked to 30 FPS was a big no-no. Vent scripts were also an important addition. When we're designing maps, there are what we call vents, which can be placed anywhere on the map. So what these will do is when the player triggers them, some sort of action, such as dropping loot or changing some of the map tiles will execute. So what we did was we pulled that functionality out so that these sorts of actions could be triggered in other places. It opened up a lot of creative possibilities for us where we now had access to all this functionality for items, powers, and NPC dialogue. Books were another feature that led us to be more creative. They started off as something simple in 1.0 and were only capable of showing some static text and images. As we'll see in a bit, books get the ability to utilize event scripts, which gave them all the functionality that event scripts have. And lastly, the changes that we made to the Monic system helped provide a better future-proofing for us. There was now some light dependency checking that tried to keep players from enabling a bunch of incompatible mods. For modders, we made it possible to change some of the text files without having to completely replace them. So it made it a lot easier for modders to make changes on top of the existing game. So at the release of 1.0, we gained a lot more players and we started to get a lot more feedback, which kept development very active for the next year or so. You can see here that one of the things we implemented was an alchemy crafting system. This was made using the book and event script systems, so it became a nice proof of concept for the types of interfaces that modders would be able to create without having to add any additional code to the engine. But then in 2019, things started to slow down again. Version 1.11 would mark the beginning of another hiatus for us. Version 1.12 took two years to finish and the change log was similar in length to 1.0's change log. There were a large quantity of changes to the engine, but many of them were pretty minor. So I picked two things from the game data side of things that I felt were worth talking about here. So we had three quests in the game that involved trapping the player in a portion of the map. They would have to work their way out and depending on the map, this could mean defeating a boss or navigating through maze. The problem with this is that we also have an item in the game that lets the player warp back to the hub area. So if the player started one of these quests, warped out, and then returned, we would have to awkwardly reset the quest for them. So I redesigned these quests in such a way that the players can now freely come and go as they please. And since the gimmick was gone, I tried to add a little to each quest to keep them interesting. My favorite might be the middle one. The quest description tells the player to travel a long ways back to an NBC to progress, but there's a faster way if the player has the right items in the inventory and a little intuition. The second thing I want to talk about is the new potions we added in 1.12. Clint had already made these really great icons for the health and mana potions. For the new potions I was adding, it was suggested to me to simply recolor the existing potions. But I wanted the new potions to have their own silhouette so the players could easily tell them apart regardless of their color. Now here's what I love that we have freely licensed artwork. Clint released the source files for his potions under the same Creative Commons license as the rest of our game data. So it was trivial to modify Clint's files in order to make my own designs all while retaining the camera, lighting, and materials he used. The end result is something that looks cohesive. Without knowing you might even say they all look like they were done by the same artist. Okay, maybe Clint's look a little bit better than mine. So that brings us to today. The current version is 1.13, which we released just a few weeks ago. I spent most of my time on improving gamepad behavior. It was an area that needed a lot of attention and it'll be important for stuff like the Steam Deck where the primary input method is a gamepad. So because I was focused on that, it was nice that another contributor was able to work on equipment loadouts and fog of war support as additional features. I also want to touch on the text rendering fix. I'm glad I wrote this talk because it gave me a reason to look back at some old screenshots. In doing so, I noticed that the text rendering looked much better in the old alpha versions of the game. Something broke with how text was being blended with the image behind it and it caused the text to look more thin and that was supposed to be. The effect was subtle enough that it went unnoticed for a long time. So while I was writing this talk, I made a last minute patch for 1.13. The fix itself was stupidly simple. We just draw the same text twice so it effectively blends with the copy of itself. If you get the chance, I recommend looking at the blog post for 1.13. There are some before and after animations on there that illustrate the improvements pretty well. Unfortunately, 1.13 also had some game breaking bugs. So the current version is actually 1.13.04. One of the bugs in question was something that happened when the player died in the game. Well, when you play testing your own game, you're usually pretty good at it. So I hadn't encountered it at all when I was play testing. But because there are now players with a wider range of skill levels playing the new version, it didn't take long for the bug to get reported. So there are a couple of lessons to be learned here. Number one is the bugs that are inevitable. No matter how much time you spend trying to be perfect. Number two is that you can't make good games without play testers, but you also can't get play testers out making a good game first. So what's next for Flare? Everything we have planned at the moment for 1.14 revolves around one of the core elements of any RPG, the stat sheets. In our game, all entities have stats that are used in combat. Some examples are the entity's hit points, the weapon damage, their accuracy rating, and their elemental resistances. We want to make some aspects of these stats more flexible, and we hope by doing so, modders will have an easier time making their ideas a reality when designing their games. That being said, our modding community has done a great job of exercising their creativity. There's games like Collimorphal and the Ghost Lore demo, which have their own unique design styles. And then there's stuff like Heresy, which builds on our art, as well as using stuff from the open game art community. We attribute this variety to Flare being relatively easy to mod. No programming knowledge is needed, and all the tools we use regularly are free software. Tiled in particular is a great piece of software. They've always been super supportive of our project, and the export plugin for Flare maps is bundled right in. I've also written my own plugin that helps perform some additional Flare-specific tasks, so I can't recommend Tiled enough, even if you're making a game that's not using Flare. So just to give an example of what modding is like in Flare, here's how you add a weapon to the game. On the left side is the definition that we added to the item's text file, and the in-game result is shown there on the right. Most of this should be pretty self-explanatory. The include statement might be a little mysterious, but all that's doing is taking the contents of another text file and inserting it at that position. We have a bunch of templates for various things, so in this case, we're using the template for a battle axe item. The template defines things like the icon, the sound effect, and the animations, so that we don't need to do that every time we want to create a battle axe. So if you're interested in modding or just want to try playing Flare, you can check us out at FlareRPG.org. I want to thank the FSFE for having me today. I also want to thank everyone who's worked on Flare over the years. If you want to follow me, I'm primarily on Twitter at J.A.J. Dorxter, and I'm also on Mastodon at Dorxter. The Mastodon account is pretty much just repost for my Twitter, but if you prefer the Fediverse over Twitter, I'm on there as well. So now I think we can turn it over to questions, if anyone has any. Yeah, it was a great talk. Oh, there's already a question in the chat. How do you test new features on modifications and requests? Is there some testing framework or another cheat to alter the game state? So we don't really have anything formal. It's mostly, I mean, we try our best to be forward compatible so that we don't introduce any major breaking changes with new versions. So even if we change the syntax for some of the mod stuff, we'll keep the old syntax in there and we'll just, in the game log, we'll display like a warning message saying like, hey, this is a deprecated feature. We might not support this in the future. So you might want to change it, but we try to keep things working. If there is a bug, whatever, we just kind of rely on people reporting them to our bug tracker either on the engine's bug tracker or even our game's bug tracker. All right, I hope this answers the question. Are there any more questions from, if not, I do have some. Okay, I will just, too, because I'm also doing the translator, the translations in the FSFE. And I was wondering, do you have any translations and if yes, how do you manage them? So yes, we absolutely do. I think I get how many languages we have. I mentioned on one of these slides. Okay, so yeah, we have 29 different languages. And before we would manage them manually by having people send in their translation files that you could just add it with a plain text editor, but we switched to using trans effects as a service. So, yeah, someone in the chat just posted the link to the translation page on our wiki. So, yeah, there's instructions on there for how to get into it if you're interested in translating Flare to your language or making some of the existing translations better. Thank you very much. There are multiple users typing right now. Is it possible that Flare will become available for iOS in the future? So we had considered it at one point. I think there's actually still an iOS platform file in the source files. But I don't think anyone's actually worked on it since that was introduced. We don't generally want to support iOS because Apple's App Store is so closed off that we don't feel well, like, supporting that ecosystem. I mean, one thing we'd like to do is get Flare on FDroid for Android devices as well, because right now you have to download the APK and install it manually. I mean, maybe iOS will come one day, but it's not something immediately in the plans. Thank you for the answer. What challenges did you come up against when initially setting up your development environment back in 2012? So, I don't remember the specifics, but Flare has always been very easy to set up. If you download the source for Flare, there's an install.ngin.md file, and that has pretty good instructions for a bunch of different OSes. So getting set up on Linux is very easy because usually you have all the tools that you need. All you need is Git, CMake, GCC or C-Lang, whichever compiler you prefer, and that's about it. And the SDL2 libraries in most distributions provide those. Recently, we made getting it built on Windows easier too, thanks to M-Sys2, which is a great piece of software. Before, people were trying to use Microsoft Visual Studio, and that was kind of a mess, so it's nice to have an over-source solution for that. But yeah, I think getting set up is pretty simple. I mean, I'm more than happy to answer any questions if people have them, like trying to get, if they want to start developing for Flare. How many developers do you have? So, I mean, I think it's been a lot, but right now it's mostly just me. Like I said, we had one of the contributors working on engine features for 1.13, so people come and go. That's the nice thing about free software, like there's no real commitment, so whatever you feel like working on, you can work on. Usually we're pretty open about new features. We do like it if people run it by us first so that they don't do any unnecessary work. But yeah, like you're free to kind of do whatever you want. All right. Regarding this, I do have another question if that's okay. Sure. What would you say are the challenges of developing a free software game, and what would you also say are the main advantages? I mean, I don't think there's any real challenges that are different than developing proprietary software.  So all the time I'm not, I don't spend my coding or even working on the game. It's usually just like answering emails or questions on the issue tracker or the forums or anything. So kind of like being community manager is part of it. Unless you have like a really big team where you can have someone like dedicated to that. Yeah, you do sometimes have to play like multiple roles and that's probably the hardest thing. But the nicest thing is that sometimes unexpectedly people will step up and fill in things that you don't want to do, which is nice. That sounds very nice. Yes. Okay, there's not a last question in the chat and then I would say we close the questions after this one. If that's all right. I see you support AmigaOS 4. Are there any plans to support older Amiga platforms? So we don't manage the Amiga port that was actually done just by a fan. So I guess that would be up to them. I don't know how well Flare would run with Amiga, like all the versions of AmigaOS. I mean, it might be okay. It might not. I don't have an Amiga to test it on. That would be interesting to actually see in action. Okay. Thank you very much. Yeah, thank you for this interesting talk. Yeah, thank you for having me. Chris of the Games world.


Every day, we find ourselves at a virtual crossroads when it comes to making decisions. Should I get out of bed now? What should I wear? What should I eat for dinner? Interestingly, the choices we make, and thus who we are, depend on what goes on at the very real crossroads where the billions of neurons in our brain intersect. Like tiny traffic lights, these regions between neurons, or synapses, direct the flow of information. Excitatory synapses signal go, whereas inhibitory synapses signal don't go. While scientists have a good grasp on how mature synapses exert their traffic signaling function, it's less clear how and where synapses are formed in the first place. To understand the rules guiding early synapse formation, scientists at the Max Planck Florida Institute for Neuroscience developed a cutting-edge technique that allowed them to precisely control where synapses formed and watch how they developed in real time. Decades of research has shown that activity generated by developing circuits plays an important role in how and where synapses are formed. However, many studies have focused on the role of the signaling molecule glutamate in excitatory synapse formation, because glutamate conveys the go signals. Less attention has been paid to the role of the molecules that convey the don't-go signals, because they usually act to stop activity. GABA conveys these signals at typical inhibitory synapses. To figure out how GABA affects synapse development, the scientists first had to figure out how to control GABA signaling at the spatial scale of individual synapses. They bathed live brain tissue from mice with chemically caged GABA molecules. Caging the molecules suppressed their ability to signal the way they normally do, but by zapping them with laser light, the scientists could set molecules in specific locations free and thus precisely control where GABA could affect synapse formation. By monitoring GABA's effects with the same level of precision, the scientists observed that GABA, despite its typical association with only inhibitory synapses, could stimulate the formation of excitatory as well as inhibitory synapses. Similar experiments revealed that glutamate could only stimulate excitatory synapse formation, making GABA the principal architect of the brain's synaptic layout. These results reveal a new role for GABA during development. By shaping where excitatory and inhibitory synapses form in the brain, GABA can sculpt the neural circuits that determine how the brain works, ultimately making us who we are.


walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Bruce Gachok. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Caitlin Buckley. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Chad Horner. From Balli Clare, County Hunter, Northern Ireland. Situated in the north-east of the island of Ireland. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Cornel Nemes. In Reno, Nevada. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Campbell Shelp. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by David Lawrence. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Newgate Novelist. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Florence Short. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Graham Scott Cheltenham, England. GrahamScottAudio.com. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Ian King. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Jesse Yellen. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Kevin S. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Leanne Howlett. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Larry Wilson. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Marion. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Sierra. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain. Walking up a hill at dawn, by Edward Poe's Mathers. Read for LibriVox.org by Thomas Peter. Here is the wind in the morning. The kind red face of God is looking over the hill we are climbing. Tomorrow we are going to marry and work and play together, and laugh together at things which would not amuse our neighbours. End of poem. This recording is in the public domain.


Hey, this is Brett and this 2018 Ford Mustang GT Premium Convertible is stock number 14012Z. I'm here at Summit Automotive in Fond du Lac, Wisconsin, you're new and use sports car headquarters. This 2018 Ford Mustang GT Premium Convertible has the 5-liter V8 Coyote engine paired up with the six-speed manual transmission and this car puts out an impressive 460 horsepower. It has been fully safety and inspected by our service shop per the state of Wisconsin inspection process. It has a fresh oil and filter change all the fluids have been checked and topped off and it is 100% ready to go. I'm going to go all the way around in this video inside under the hood in the trunk, put the top down and give you the most accurate representation I can of the car shadow black as the color and I shoot all my videos in 4k and if you like the video you can subscribe to my youtube channel which is youtube.com slash summit auto click the bell notifications you'll get updates on the videos I do each and every day as well as having access to one of the largest catalogs of vehicle and sports car walkarounds in particular on youtube over 8,000 videos and counting this one comes with the painted and polished aluminum 18 inch wheels it has some very big brake pads on here calipers are they look like brembo's they don't say brembo but they look as big as the brembo brakes and of course the nice rotors there has pirelli p0 235 50 z r18 tires and these tires I would say have probably 60 70 percent of the tread left maybe even a little bit more front fender is in excellent condition I didn't see any dents or dings on there it does have the nice led headlamps led running lights and led fog lamps I'm going to turn those on at the end of the video so stick around for that actually not too far away from that these videos are only about eight to ten minutes long front lower valence is absolutely perfect and the hood is in really nice condition I didn't see any dents or dings or corrosion on that hood passenger side front fender is in great shape as well and the passenger side front wheel no major scuffs or scrapes on there as you go down this side of this 2018 Ford Mustang GT premium convertible take note of how clean that body is how reflective and mirror like that paint is I take these HD videos so if you're far away or even if you're close by you just cannot make the trip down but you're still interested in purchasing the vehicle you can see the car hear the car and have confidence in the vehicle that you're looking at before you even get here so when you do get here there's absolutely no surprises or if you get the car shipped to you you'll know exactly what you're going to be getting if this video helps you make a smart buying decision let your salesman out you saw the video it was helpful and that Brett sent you back wheel is in excellent shape as well and the back tires have just as much tread as the front tires try and show you what I can of the underbody it's really hard with a gimbal looks really clean under there and coming around to the back of the vehicle get the LED tail lamps the backup parking sensors the quad tipped dual rear exhaust this car sounds really good has a really neat interior as well wait till we get to that in just a second back storage area is in nice shape there is a tire inflator kit you can get a 5 liter Mustang hat with this one and that's where your tire inflator kit goes and then of course part of your cover for the soft top when it's down and just very nice and clean back there trunk lid is in great shape I didn't see any denser dings on there and coming around the driver side just as clean as that passenger side no denser dings on the rear quarter and for full disclosure this back wheel is just as nice as the rest this one does have the capitalist fuel fill which is a really nice feature never get gas on your hands again and down the rest of this side of the car door looks really good you get the heated power mirrors built-in directional signals blind spot mirrors inside this one has the carbon sport interior package so it gives you the black leather and alcantara seats no rips no tears on those seats both of these front seats are power both of these front seats are heated and both of these front seats are cooled you get all-weather floor mats and then the other part of this carbon sport package is you get the carbon fiber trim on the dash and we'll look at the rest of that in just a second suede interior on the door sill power windows locks and mirrors back seats are in really nice condition no rips or tears back there and if you want to try and get a car seat back there you can there's a latch child safety system hop inside check out the miles radio and everything that this car has to offer on the interior and then we'll put that soft top down all right as you can see this one has 9409 miles you get the digital speedometer compass display comes with the leather wrap steering wheel bluetooth and information center controls on the right cruise controls and audio controls on the left leather wrap steering wheel that's in really nice shape comes with the sink eight inch radio you get the factory navigation system on there there is highway 41 so that is working nicely you also get am FM and serious xm radio capabilities and a cd player and bluetooth probably the last year that they had cd players in here you have your climate controls here as well including your dual climate controls all your different apps and then your different settings in here and it has apple carplay android auto where you can project yourself into the screen this is also where your backup camera shows up and you can see how nicely that works so before we check out the rest of the buttons down there check out that carbon fiber dash trim looks really good i believe this was a $1,500 option for the seats and that carbon fiber dash trim so that's pretty cool down here you're more tactile volume tune and climate controls including your stability control your different steering settings so you get sport comfort and normal and then you have your different drive modes which has normal sport plus track drag strip snow wet and normal here's your six speed manual transmission notice that that is also carbon fiber here's your keyless entry you get your illuminated cup holders your ambient lighting color change and display that you can do passenger side format and seat are in excellent condition as well and the inside of that soft top is in great shape so to get this open just got to go like so and then just hold that back you can see that that goes down nicely and it just stops when it's done also up here map lights and home link buttons for your garage door security systems and lighting systems all right let's start it up listen to that exhaust take a look under the hood check out all those led lights in the front as well starts right up no check engine lights or anything like that that light is for my parking brake let's go listen to the exhaust for a second sounds really good i would personally like to thank you for checking out the video today and hopefully from this hd video you've been able to verify the quality condition looks styling options and of course cleanliness of this car all the way around inside now there are those led lights and we're right at nine minutes told you wouldn't be that long under the hood we have the five liter coyote v8 engine 460 horsepower stock engine base very clean runs very smooth get the shock tower brace on there once again this car has been fully safe eaten inspected by our service shop has a fresh oil and filter change all the fluids have been checked and topped off and it is 100 percent ready to go there is the emission sticker and i would highly recommend this car from a quality and condition standpoint i think it's in fantastic condition looks really good that interior package is amazing and i'd be confident shipping this one anywhere whoever's going to get it it's going to love it california texas new york florida wherever whoever's going to get this car is going to love it and to see more pictures of this car or one of other 550 new and used cars trucks scvs minivans wranglers sports cars mustangs kumaros challengers chargers corvettes you name it we got it go to that website right there is summitauto.com full pictures and descriptions of every single vehicle all at summitauto.com and if you'd like to check out more hd videos you can go to youtube.com slash summit auto click the bell notifications you'll get updates and the videos they do each and every day as well as having access to one of the largest catalogs of vehicle and sports car walk around on youtube 8 000 videos and counting in fact in a second you will see a link to subscribe to my youtube channel the upper left a link to more Mustang videos have done in the upper right a link to this vehicle on our website lower left and a link to one of our latest youtube videos in lower right click those checks out we're super excited to help you with this ultra clean 2018 gt premium convertible in shadow black clear coat thanks again for checking out the video remember to like subscribe and share on the youtube channel i really appreciate it thanks again


I feel like my entire life is a monument to complacency. Should I start over? I rarely leave my couch. I haven't met anyone new in many generations. I'm pretty much a slug. Most days out of the week, I don't go more than a quarter mile from my house. My work, the grocery store, the restaurants that I go to, the gym I go to, are all within about a five-block radius. I've only been to a single bar the entire time I have lived here. Every Saturday, if I had my druthers, I would buy the same cup of coffee, buy the same scone, and watch 10 hours of law and order on USA. I nap on a couch and fall in the net of consciousness with law and order playing like a hearth in the corner of the room. I use grocery delivery apps, even though I live right next to three grocery stores that are within walking distance because they don't like dealing with lines or people. I have these grand ambitions to make web series and feature films and short films and all sorts of content, right? But what I find myself doing more of these days is not actually producing content or making strides professionally, but instead I get sucked in the wormhole on YouTube. In a new city, in a hotel room, my meetings were done for the day. I had free time.  I forgot to close my tab at the bar. I called the bar the next day and they didn't open until 10 p.m., so rather than going all the way downtown, I just thought I'd rather cancel my card than actually pick it up. I found out an hour later that my friend also forgot her card and was offering to pick up my card as well, but it was already too late. My card was canceled. I retired about a year and a half ago. My wife's upset with me because she says, go find something to do, and I don't want to. And it's a good thing. I'm just relaxing and enjoying myself right now. It has been absolutely wonderful to just sit and be complacent.


Anyway thank you so much for coming. This is a good friend and great person to be giving a talk here today um especially with all the live bug uh hunting we're doing there's GE devices and bird devices and google devices over there and there are all all those manufacturers are letting people do live bug hunting activities um and so with no more delay Amit Azari will be giving a talk on issues that affect those types of activities and researchers like yourselves are those curious. Thank you so much. Thank you everybody. Um is it already good afternoon? Good afternoon. Hope you're enjoying Hacker 7 camp. I'm I'm certainly uh enjoying it. I'm having a lot of fun here with my sister and my colleagues from Intel. Again uh a free upgrade to all of you there in the back if you would like to join us up here uh please grab a seat uh we are about to begin uh this is gonna be a train into the regulatory landscape so we're gonna cover a lot of material uh but I will try to take it slow which is something I don't often do but I'll definitely try for you all and um let me know if you have questions you know feel free to reach out so how many of you here in the room have been to any of my other talks seen my work seen my research you're my sister so yeah we we have a bunch of hands here so um as those of you who know me know um because I'm Israeli that's the accent I want to start with a direct question uh do you know this guy? Okay we we have a few hands here um well this is Kevin Finster uh Kevin is a friend um he is a security researcher that uh that has certain expertise in the area of IoT um he hacks drones among others um and he discovered the vulnerability uh that according to reports uh affected one of DJI products uh and again according to the media reports um exposed some of their uh users information and when Kevin here wanted to report this vulnerability at the time DJI just uh again according to the reports launched a bug bounty um and that's the way they launched their bug bounty uh with this kind of media report and at the time uh it wasn't it wasn't a full blown you know bug bounty brief like a contract with all the terms and all the scope it was a little bit more kind of vague and limited so Kevin contacted DJI um you know though he has lots of hair he wanted to do the right thing he wanted to wear the white hat and he asked them is this in scope um and again according to the reports um they indeed authorized that the vulnerability he found was in scope not only that they offered him a nice bug bounty thirty thousand dollars any bug hunters here in the room I think I know I know a few um that's a pretty high bounty that's a nice bounty right and then the plot thickens um and again according to the reports what we learned that because of some disagreements and how Kevin personally felt about certain letters that were exchanged in negotiations over the disclosures of the bounty um he decided to basically walk away from the process in that letter um according to the reports the computer fraud and abuse act was mentioned the computer fraud and abuse act who knows this this term this law I see a few hands so for those of you who are not familiar that's the federal anti hacking law in the United States okay so that's the one of the main laws in the United States uh that also has uh international jurisdiction in certain circumstances that apply to unauthorized access to protected computers okay just one of those these laws um so Kevin decided to not continue in the disclosure process and to walk away from an approved thirty thousand dollar bounty okay um and at the time again according to the reports he actually ordered a Tesla uh to celebrate this thirty thousand dollar bug and he had to cancel his order uh and that's how the plot ended there and at the time and again this is a lot of the prior work that I did at UC Berkeley I will tell you a few words about myself in a moment uh I felt this is a really interesting story because flesh house not just the important of the collaboration between the research ecosystem and you know cooperation companies and the entire ecosystem but also the importance of how the law plays into that collaboration and how we should continue and work and build bridges between corporations and researchers and kind of continue and refine and evolve the legal landscape that governs the area of bug bounties and vulnerability disclosure programs and that's where a lot of my prior work uh kind of focused before I joined uh intel and I don't know if if those of you in the room are familiar with that so um I'm gonna be walking um basically um with you um on these various topics but I'm also gonna talk today beyond anti-hacking laws also on how that that landscape of bug bounties and VDP vulnerability disclosure programs relate to IOT and the broader evolving landscape of IOT security uh so my name is Dr. Armit Alazari Barone I recently graduated my doctoral degree from UC Berkeley uh thank you so much I actually graduated five months early to join the Intel because I'm very passionate about what we do there and I also still teach at UC Berkeley in the master in cyber security program and at Intel all of what we what I do is work very closely with our security organization as part of the corporate government affairs uh group that works with governments around the world to inform policymakers around some of the challenges in the area of doing security policy right what what are the experts in technology say and basically how can we work together uh to address those challenges but as a true lawyer and since I do have my doctoral degree in the law uh there is a little bit of fine print so of course I have my disclaimer although I am trained as an attorney I don't I am not practicing law in the United States and I'm not your lawyer so this is not legal advice you should seek your own legal advice if you're looking for some EFF is is a great resource to consider and again um what I'm gonna be talking today with you is my own personal opinions uh so take that into account as well and with that let me go a little bit into the details why is this story about Kevin so important we know that with the evolving attack landscape the ecosystem collaboration with the researchers is gonna be much more and more important and we also know that researchers security researchers care and they think about the issue of the potential legal liability so here's some data points for you I don't know if you've seen those uh research and service being done but they're really important so we know for example for a survey done by CDT the Center for Democracy and Technology that half of the researchers that were interviewed in that in that report actually shared that fear of legal risks and specifically mentioning the DMCA the other anti-federal uh law anti-hacking federal law in the United States and the CFAA has caused them to consider how they do research even to change their research we also know in another research that was conducted with more with with more than 400 researchers that's a big sample that 60 percent of them 6 6 0 reported that a fear of of legal risk is something they consider when they have already done the research they they hold the report and they think on whether to disclose it to a vendor or not right so this serves to kind of really um emphasize the need to build those reasons and also to think about what we do with that with respect to the legal landscape how can we address those concerns of the research community uh another interesting research uh that was done by more academics actually showed that 20 22 percent mentioned that at a certain time uh they they were actually potentially threatened with legal action and I think the broader the broader issue is not just you know the culture itself because I know uh Intel and many other corporations around the world and especially in Silicon Valley want to work with the ecosystem and actually incentivize and you know uh uh distribute by bounties and grants to work with the security ecosystem but this there is also a culture issue there is a cultural uh there is a culture of legal risk that is embedded within the hacking community which is a very important reason why we need to walk and and kind of talk on these things we also know that 92 percent of researchers said that it would actually work with a vendor to responsibly disclose the vulnerability and this is a key issue cordon vulnerability disclosure is one of the most important things we need to talk about as we look at IOT security and the evolving uh technological landscaping embedded and 92 of the of the participants of the server say they would work with uh with the vendor and way they consider not to with mostly because of frustrations around communications which suggest we need to continue and work on these issues and how does this play out into the regulatory landscape so believe it or not VDP the notion of having a vulnerability disclosure program the notion of being able to put that channel of communication uh to enable uh researchers to provide you with reports and work with them is a key issues that regulators are thinking about right all these different regulators for example recommend having that practice having that channel of communication so when you uh you know um here in the room with us uh are performing research when you are finding things you will have a security app email you will have a detailed VDP that actually describes what should you expect when you try to work with a vendor to disclose and all those different regulators including the the FTC I'm actually uh taking into account this issue and provided gang this most notably and we will talk about it in detail the department of justice the department of justice the absolute experts on the CFAN the anti hacking land uh anti hacking legal landscape I've actually provided a very detailed framework on how should we think about common vulnerability disclosure so I'm gonna talk about a little bit of that in in um uh next but what I want to highlight here that even the FTC for example in two cases together with many other circumstances okay so this is not um you know just one issue but when they consider what is a reasonable security practice which is a key term and I have you heard this term reasonable security practice this is a key term in the regulatory landscape of IOT but more broadly in the federal security regulation landscape in the United States and even abroad and when the FTC look looks into you know what to pursue and what is a reasonable security practices in at least two cases among with other other things they've actually mentioned this issue that you need to have a process to receive and address security vulnerability reports from security researchers and academics so I find that really uh remarkable because it shows to to kind of look at the evolving landscape and how VDP will become more and more and more regulated I'm gonna give you a little bit more data points on how how that specifically relates to IOT security and here it is uh in the UK uh this is very uh one very interesting uh kind of uh evolving landscape I recommend you all to follow they are actually put in forward uh what they call a consultation that's what they do when they think about the future law on IOT security focusing on consumer uh in household IOT and this is uh something that they've that have developed from their code of practice anyone here heard about the the UK government code of practice for IOT security check it out it's it's a document outlining like 13 key kind of um capabilities they think that uh you should consider with respect to IOT security and they've taken three of them one of them is this notion that that they should have a public point of contact for researchers you should have that vulnerability disclosure program the channel of communication and they're looking into how uh basically specifically regulating that so we are seeing the IOT security regulatory landscape not just evolving but becoming more and more embedded with this notion of VDP and I think what this shows to say is that we recognize we will need an ecosystem right without evolving landscape we need the help of everybody involved not just you know the innovation and the technologies that we also do at Intel but also the researchers and that's why we need to also work on this idea of vulnerability disclosure programs and how does the law interact into that so I mentioned already the CFAA I mentioned the DMCA and I wrote some terms at you but I want to go a little bit into the details so the computer fraud and abuse act the CFAA uh really the key main federal anti hacking law uh here in the United States but it really embodies this notion of unauthorized access have you heard about this term it's a key term uh that there is a circuit split in how this specific term should be interpreted in different circumstances here in the United States there is a lot of a little bit of vagueness around that and a lot of people discuss this vagueness uh but this notion of unauthorized access is actually also embedded to some extent in the DMCA the DMCA is another key federal anti hacking law that you should be familiar with especially if you're doing security researchers in IOT and embedded uh this is basically an amendment to the copyright law that focus on uh circumvention of protection measures that are geared to protect the code as copyright uh protected uh work and this anti circumvention law also has some prohibitions on unauthorized circumvention most notably the DMCA is known for having a specific security research exemption so today uh and I think this is amazing work done by many people that care about the community already in 2015 uh recently renewed a DMCA exemption for security research now when this um exemption started it really focused on good faith security research and there was device limitation uh from that specific law it was focused on uh voting machines and automobile uh I'm glad to report uh that uh the copyright office is actually considered to expended and the DOJ the Department of Justice actually also gave comments uh to the copyright office and actually supported not only the renewal of this exemption that it allows for good faith security research but actually the expansion of this exemption so I think this is a really interesting thing to take a look at uh and without going too much into the details it's certainly something you want to explore and um be knowledgeable about because there are certain requirements with respect to how the security needs to be done most notably in the 2018 revision they removed the need to do the research in a controlled environment and one of the key points uh if you look at the copyright office report is that the security research ecosystem came to the copyright office and said to them listen research is not just being done in controlled labs and clean rooms research is being done right here and this research could be beneficial for society so actually uh they have removed this uh controlled environment they still have other very other important considerations taken into account uh and I encourage you um for example by the way that the research would avoid harm to individuals or the public which is a key issue uh and I encourage you to take a look how this plays out into bug bounty and vulnerability disclosure programs so that's a key issue that's really that was really the focus of my prior work at Berkeley before I joined Intel I did a lot of research into the contracts of bug bounties and vulnerability disclosure programs why because as I told you anti hacking laws really focus on this idea of authorizations how many of your pen testers or consultants right usually you would have a contract a contract that authorize you know your ability to test your products with many other uh you know different provisions with respect to under which circumstances and what are the terms and the like this notion authorization is also a key issue when we think about vulnerability disclosure programs and more importantly bug bounties so the way those contracts play out into this landscape is that and as you will see is that we kind of want to make sure that that that notion of authorization does not und is not undermined by the contract of the bug bounty of the VDP and I will get to that so I I mentioned that the Department of Justice the main experts on the CFA actually have a framework for vulnerability disclosure programs now if if there is something you walk out from this room today with respect to this part of the presentation I really want to encourage you to take a look at this document and I believe me it's only by the way it's only seven pages and it's very readable so the Department of Justice the good people and this is led by Lord not Bailey he often comes to Hacker summer camp I just met him yesterday he gives talk at B sites reach out to him is a really really remarkable lawyer but also a great supporter of the security ecosystem they have put forward this basically framework that flesh out the fact that if you think about the computer fraud and abuse act and the anti hacking anti hacking legal landscape yes there are interactions with the CFA but generally this this type of idea that we need to work together and there needs to be a channel of communication should be supported it's a good practice and they want to encourage corporations to do it and that's where that's why they put together this framework that outlines a few key considerations that you need to think about when you do a framework and I'm gonna walk you through a bunch of them and now if you're in a corporation you're considering a VDP if you're a researcher take a look at those issues and kind of look for them as you consider to report things so first of all they really describe the fact that you need to have clear plain easily understood terms this idea of making sure that you're clearly communicating this key because we have researchers from all over the world right and it's already a very kind of complex ecosystem so you want to make it as clear as possible and they also talk about establishing boundaries right more and more it's important as distance can evolve to be very clear where are the lines what are the expectations they also discuss the fact that you should be kind of taking it slow make sure that you have the process at the backbone to support the VDP and interestingly enough they talk about the need to create a safe harbor to think about what is the language the specific language you're gonna put in the VDP to make sure that you address the legal concerns now we talked about the fact that hackers think about it we talked about the fact that researchers consider the legal risk so you need to think about whether you're gonna put in that language for example provisions that you're saying you know we will not pursue legal action if you follow the terms and this is something that comes from the Department of Justice of the United States so I really you know encourage everybody to take a look at that document especially if you're considering you know drafting a VDP and taking into account you know those issues and I want to move along I would just add that this issue of how we should think about the legal landscape of VDP is not only considered in the United States this is a report by the CEPS task force in Europe and they also flashed out this that this issue of the legal liability of security researchers should be clarified it's a different landscape in Europe but what we see here is that this is an international kind of issue that many you know many different policy experts have flashed out around the world okay and how this this play us out to my own work well again before I joined Intel I did a lot of work are basically creating templates and standardizing this landscape creating one contract that companies can adopt that explicitly address these issues and I encourage you to take a look maybe you heard about it it's called legal bug bounty and I think more and more organizations are looking how to basically we can develop the contractual landscape to support VDP this is interesting work done by Dropbox they open sourced something that is focused not just on the basically contractual interaction between the researcher and the company but between the vendor and the company in the context of VDP and bug bounties among others so this is already on github this is open and it's from my good friends at Dropbox you can take a look and one more data point for you here disclose IO I don't know if you heard about it Chloe my friend is presenting it as well here at DEF CON basically while and when I was doing this research I identified this gap the fact that we don't have one open source license and equivalent of that one contract in this landscape there is fragmented fragmentation and we need to harmonize that landscape so I work with background on this project called disclose IO and the idea is again to create an open source resource so companies organizations and even researchers when they are looking into you know how VDP bug bounties should look like they can take into that account you should always you know seek your legal advice because these are complicated landscapes so this is just something you know like a data point but doing a VDP doing a bug bounty that's something that we have international standards to guide you and I think you know it's important to do it right and finally and one area in which this connects with IOT is this specific issue so as I was working on this research I kind of I looked at Tesla's bug bounty and one of the thing I noticed is they didn't have a safe harbor and I flashed it out on on Twitter this is before I joined Intel and it was a real joy I worked for for a couple of months with the team at Tesla and they in fact change your contracts they added a safe harbor but not only that because they're so great you and the guys there they even expended it and added something that is really a novelty especially in the IOT car embedded area they added a provision saying that if you follow the terms of the bug bounty not only if you follow the language yes it's important to read the terms if you follow those terms not only they will not pursue legal action and the and the research is authorized if for some reason your Tesla you know gets broken right because security research right I assume that could happen if you are an authorized researchers and you are participating in a bug bounty they will fix that Tesla for free you can take it to the shop they will fix it for free so they waive the warranty limitations for participating in bug bounties and I think this is this is one of the key issues we're gonna see in embedded in IOT in hardware where we need more and more collaboration and there are actual devices and you know there are complexities so I think this is really interested I mean a really interesting development and good for Tesla and I'm also proud to say and this is one of the main reasons I joined Intel that we also have a bug bounty and we invite you all here to participate and hack our hardware and we really focused on our collaboration with the security research ecosystem in fact we have many of our hackers here at Hacker summer cap we had trainer trainers that participate in the black in the black hat trainings for hardware and we also had one presentation concerning our own security research so please take a look at that and I want to move along and really kind of touch on a few more interesting areas so I really walked kind of briefly around the issues of anti hacking laws and the VDP landscape but they're key legal and regulatory developments that we are seeing in the area of IOT one of the things that we have seen is an influx of regulation with respect to IOT security most notably we have we have already in California and in Oregon specific laws that are going to come into effect on January 2020 on the issue of IOT security have you heard about these laws maybe the California law it's most most notably known as a law that addresses no default passwords but not only that we have also have proposed federal bills in the area of IOT security which is something really interesting to take a look at and monitor and we also have a key effort by NIST right our key kind of leader when it comes to security expertise on the federal level that is focusing on promoting an IOT security baseline what are the kind of key you know things you should expect in with respect to IOT security devices and they just released a new report last week and I'm going to give you some highlights from that report but that is one of the key developments we are seeing on not just not a regulatory because NIST doesn't do regulation per say but especially in terms of the harmonization and how you know that key technical experts federal body looks into IOT security and from there we're going to you know walk a little bit more into the details into the UK consultation if we have time but this is really interesting the California law going to take effect January 2020 in California for devices all in California this potentially will have a big impact and it's focusing on connected devices and we will we will talk a little bit about the definition of connected device one of the key issues to look at when we think about the IOT security evolving landscape is how devices are being defined right we want to define them in a way that comports with innovation that doesn't under my innovations while supporting the importing security capabilities and we're going to talk a little bit about that now this law basically specifically requires reasonable security features for four connected devices and we're going to talk about the definitions and it fleshed out the fact that if that device has a means of authentication one way to achieve reasonable security is by basically taking out this notion of default password by requiring a unique pre-programmed password into the device or a way for the user to choose their own password a unique password when the device is forced being used a little bit into kind of definitions because I want to also compare this to the Oregon law and again this law will come into effect January 2020 so it's really coming very soon interestingly enough the definition of connected device talks about devices that are capable of connected to the internet directly or indirectly and has assigned IP address or Bluetooth address as we walk through the definition in the Oregon law you will notice there are a little bit of different kind of provisions there so the Oregon law is also already signed will come into effect also very soon and interestingly enough it has very similar requirements it's kind of a mirror law but that law is focused on household and consumer focusing consumer focused devices and it has very you know in terms of the actual requirements of reasonable security which is a key term that we also seen on the federal level from the FTC in many other places it the approach and the definition is a little bit different right it's not it's a device or other physical object which that's the same that not is not capable of connecting because that's a little bit vague but connects right director indirectly to the internet and is used primarily for personal family or household purposes and is assigned an internet protocol address or another address or number that identifies the connected device for the purpose of making a short range wireless connections to another device so you see that in that we lame already the Oregon Oregon state took a different approach not just naming specific IP addresses of Bluetooth addresses but expanding a little bit the definition I really encourage you to track this I think this is a really you know remarkable developments in the area of IOT security certainly on the state level we know that there are mural laws that are being proposed in different states and I think one of the key issues we need to be mindful about is again these are devices these are whole systems these are not components and we should really when we are thinking about regulating this area to foster security we need to also be mindful about the technical realities right we need a dialogue between the technical experts between the security researchers and the regulators to make sure that we define the terminology in an appropriate way that fosters innovation and it's also mindful to the fact that this is a very evolving technological landscape okay why do we have on a federal landscape I don't know if you heard about this law it's not a lie yet sorry it's a bill it's not it's not passed we have two proposed bill one in the house side one on the Senate side with some differences between them that are focusing on I the bill is called IOT cybersecurity improvement act and it's really focusing on driving the security baseline that I talked about that NIST is developing through federal procurement okay this is the idea that if the government requires certain requirements then they want to basically use that federal procurement to kind of push us the security requirements across the board across industry it's an interesting development as I mentioned they want to utilize government procurement and most notably the law also has a big CVD section both both proposed a powerful bill sorry both the house and Senate has a section that talks about quote and vulnerability disclosure within the government and they reference as well the international standards and and the bill suggests that as you know best practices and as guidelines are being developed in this area it's very important to align them with the international standards and I think this is one of the key other messages that we are going to see the CVD landscape develop and it's very important we continue and kind of look at industry best practices because industry has been leading the way in that regard and working with the OLA ecosystem for decades but also that we have international standards in this area that are really fleshed out that consensus based both of the ISOs great work done by Katie Mazuris and others and I encourage you to take a look at that we are seeing those ISO standards being referenced in proposed bills and I think it's very important that we continue and harmonize the landscaping that regard what else okay so I talked a little bit about the NIST effort I think this is a key really recent development and this started is I think they first released their first draft there was a report but the first draft really focusing on the IOT security baseline capabilities that's how they call it on February then it was a workshop on March and just last week fresh out of the oven they released another draft that is much more fleshed out 38 pages really interesting take a look they're looking into some key baseline capabilities that they think are important when you think about IOT security device identification device configuration data protection logical access and more and it's a technical more technical document but there is a free page blog that can walk you through it and I think you know that is a very remarkable effort I'm proud to say that we Intel provided comments to that I'm gonna be going next week to to the area of Washington DC to Maryland to also kind of participate in that workshop and that's the kind of effort you know the consensus driven collaborations that we're gonna need in order to address you know the different challenges within that's in that landscape it's it's a really remarkable effort but you see a lot of in a lot of industry experts coming together with government with regulatory bodies with bodies like NIST with the technical experts on this sitting together and flashing out you know what are the different baseline capabilities we need to be taking a look at and one of the most interesting interesting things that they highlight is that this is gonna be different for different sectors and different verticals and I think for IOT a landscape which is still evolving we have great connectivity with a lot of great value that is coming to society but we have different verticals in different sectors I think this idea of having that contextability of application in various environments is really important so take a look at that that by the way that effort a version of it is referenced in our proposed in the proposed bill on the federal level so we're already seeing at least one bill looking into this effort as a something really interesting to follow and I mentioned before this the call of practice of consumer IOT in UK just bring this as one example I know the governments of the world are looking into basically this issue of IOT security and this is just one effort by the UK government really putting together a call of practice for IOT actually they also came here to the hacker summer camp to hear from the security researchers to hear from the community and I had the pleasure of hearing their presentation and engaging to discuss their next step the UK consultation on this issue and they've put in together a call of practice that also talks about 13 key kind of things to think about when you are looking into IOT security this is consumer focused and they've taken this to the next step proposing a consultation for a potential future law again focusing on free key issues the unique password issue that we have also seen in California and Oregon the notion of having that point of contact right we talked about the VDP the notion of the fact that you're going to have a security at or point of contact that researchers can basically know where to reach out to you when they find things and this idea around this issue of security updates right which is also a key issue that we are seeing in many proposed efforts in this area so that's another very interesting things to take a look at and I think when it comes down to there is a real opportunity and that's why one of the things that I'm really passionate about so I talked about the opportunities to foster that ecosystem to foster that collaboration with the security research community that's something that I think you know we all work on very hard and is very important but there is also an opportunity for innovation there is opportunity for technologies that are pushing security in IOT and beyond and there is really the opportunity to focus on this issue of of trust trust that goes all the way into you know the fundamental right the foundations and I think you know just sharing with you very honestly that's one of the reasons why I joined Intel because there is an opportunity to affect impact on a very foundational level and as we think about that I think you know we should think about what are the technologies what are the leadership that we can create in that area as so I talked a little bit about the capabilities and you know at Intel part of what we do is we think about security in such an essential specifically in IOT and we have a bunch of capabilities that are looking into you know taking those capabilities this idea into the to the next level into the foundation so things like you know secure device onboarding which is a non default password notion of onboarding devices things like how we can have hardware acceleration for cryptographic protections things like how we can protect keys and platform integrity and just generally trust wariness right so I'm not the technical experts on this issue but I didn't want to give you a little bit of these ideas with most notably this idea that there is an opportunity there is an opportunity for innovation and with that I want to finish it off and leave time for questions.