Very good. Okay, so you can direct your questions via the Q&A as usual, so first already came in Sort of a broad question here, whether your results inform a complementarity between fiscal policy and prudential policies and potentially advise a tighter coordination Yes, yes and no, I mean number one is of course what be I mean This is a more very general remark, but we typically see doing these crises is more coordination, right? I mean, we've seen it in monetary policy and prudential policy Micro pru and micro pru. I mean, there's much more coordination going on during crisis situation. It's also necessary, of course And similarly, I mean in the US I mean there has been close coordination in these crisis management programs between the Federal Reserve and the federal government So that's on the one side. On the other side, of course, it's important for regulators to know How are these loans being used and whom are they being used for? I mean, who are these these funds being lent to because of financial Financial stability implications further down the road. Now, of course if the if all of the losses are ultimately being picked up by the by the government Then that's all fine. But for example, if these are loan guarantees, that's as we had them in Europe, which is then It's a guarantee only up to 80% or 75% then of course, there is a still remaining risk, which then might stay on the banks On the banks books and this has of course implications for Prudential authorities and they are in the monitoring exercise. So I think there are two sides Coordination, yes, but then of course also careful monitoring afterwards and how these funds are being used Thanks, and then there's a question Related to the stronger results that you find generally Throughout the paper for exposure to lockdown policies as opposed to exposure to the COVID spread itself Could this possibly be because The lockdown index is easier to observe Than the other one or that the two may somehow be correlated Yes, I mean so under correlation, of course, they are correlated, but they in many cases they end up both independently Significant from each other so both in the significantly include them both So they're not that's not a perfect correlation And yes, one thing is of course the observability demand as a measurement bias Probably especially in the early days of the of the pandemic at the first quarter Definitely to a certain extent, maybe also the second quarter, but also, I mean interestingly enough if you look at unemployment So the X how can we explain explain variation in unemployment across counties and states both are Significant to the same extent so both can explain it Maybe it is When it comes to the banking system That's locked on measures and maybe effect The loan book more or maybe also the demand For loans more. I mean that that would be my explanation. Although I would have to think a little bit more about that Okay, and then there's a question by Francesca Barbiero Connecting basically back to Shepnam's paper Who showed that because of this massive fiscal support that haven't been so Hasn't been so much corporate distress also over your period So would you see any role for Some latent exposure to credit risk deterioration and explaining the behavior of banks I mean coming basically from the demand side and the fiscal support Well, I mean, this is a very very general question now, right? And I think that's the what we've been discussing over the last 18 months What happens is there a cliff effect when the fiscal support goes away, right? How will banks react? To fiscal support going away. Will they keep up the lending? Will they stop it? To which extent will they recognize losses if If if businesses get into trouble or to which extent will they try to throw good money after after bad money Or good money after government money. Let's put it this way So I think that's going to be a big question and I think that's Something to be carefully monitored over the next couple of months That is the stress test earlier this in the summer Seem to have indicated that maybe our first or worst fears Haven't come through in the sense that maybe there's not as much corporate distress And therefore not as much potential distress on banks, but she's had we had all feared But I think the final jury is still out because on the one hand I mean you're coming out of the pandemic, okay Let's assume everything goes fine and lockdown is all done in the spring But of course there is there are supply chain strains There is still real occasion to be had across sectors So I think there's a little bit more turmoil ahead And I think now I'm kind of going more normative rather than positive So I don't have any numbers on that but I think it will be a challenge for Regulators and authority more generally to coordinate in the sense that When for example fiscal support goes away that regulators then also kind of force banks to recognize losses when they have them and at the same time to also allow Corporates to restructure where it's necessary and where the firm is viable So there's kind of a multi-pronged approach where lots of Authorities have to coordinate In order to kind of get out of the crisis both before Kind of the the seed or the core for the next one is being laid through zombie landing for example So that was a very general answer to a very specific question. I'm not sure That's fine. I think it sounds like This is for another paper right a follow-up paper actually related so that did I understand correctly Thorsten that you said that the syndicated loan analysis You had some data Constraints there. So you had to answer them in the second quarter because Something was missing The deals can data seem to have ended in mid-june or late june 2020 and we try to tap another data source Unfortunately, we couldn't match it properly. That's why our data in this case ends there. Yeah, okay understood Okay. Well, great then I don't see further questions and we are you you put us a little bit back on track in terms of time. Thanks for that so this brings us to the end of today's conference, but There is a second day tomorrow. So, uh, please join us again then and uh, hope You have a nice recipe afternoon or evening wherever you are and Thorsten. I see you later this weekend Zurich indeed Uh, Carlo any anything from you to that? No, just thank you also on my side. It was a great sessions and uh, See you tomorrow all uh at three. So today the starting uh hours was a two but tomorrow We have one hour more of uh, uh, work and uh back. So see you all tomorrow at three. Thanks. Thank you


Well, hello and welcome to Jonathan from the heart. I'm Jonathan assay of Jonathan assay comment I'm so excited to be shooting this short video for you today our talk of topic Ask him these questions before you sleep together. This is what you should be asking before you have sex Really quickly if you're new to my youtube channel, please hit the subscribe button hit the bell So you can be notified of new content if this resonates with you hit the like button Lastly, these are my weekend videos that I shoot out on my balcony very similar to the videos I shoot my private group called midlife love mastery check out the link in the description to join my VIP group where you can Ask me questions directly and I shoot videos personally for you in the group and we have a Facebook group and a once-in-one Webinar all right. What to talk about before sex? I think this is a great conversation because often times now. I know many of you are Already in relationships, so you've already had sex with guys But this is for those of you that are maybe just beginning dating process or you're thinking about dating or whatever I think this is a good conversation. Even if you my hair seems a little messed up today Seems like a good conversation regardless because here's the challenge with a lot of women that I see today in the dating realm Because it used to be that if you wanted to get laid you had to get married Well, we no longer in a live in a world where you have to make the ultimate commitment to be in a relationship In fact, you have to make very little commitment to be in a relationship Other than maybe calling each other boyfriend and girlfriend or something like that and even just those words are actually very weak So what level of commitment can someone make to actually make sense to? Invest your body in another human being as well as your heart your mind and your soul And I think it's important to ask some really good questions ahead of time So what I'm gonna give you an example of what I do in my dating practice and see if it resonates with you And we're gonna go much deeper. So just give me a minute beyond this So one of the things I do very early on the dating process of maybe it's the first or second date I bring up the following.  So my first thing is I say I share this is how my standard and I ask how do you operate? Okay By the way, my coffee mug says do all things with love do all things with love my t-shirt says human kind be both And that's kind of what I'm leaning into today, but I want to go deeper. I want to go much deeper Before you actually begin in a physical intimate relationship with a guy because some men can say yes We'll do those things and not be sincere and many men will be I men don't intentionally Deceive women Oftentimes there's conflicting things going on within a guy that causes someone to be deceptive But for the most part most men are good guys They're just bad daters and I'm here to have you lean into a deeper way of approaching the relationship process And this is why I highly recommend Purchasing the book eight dates. I want you to purchase two copies The book is eight dates by dr. John and Julie Gottman check out the link in the description for Jonathan recommends books all my books that I recommend are there why you want to get this book is it lays out eight Fundamentals here The chapters include here I'm going to read this for you so you can get a sense Chapters date one Trust and commitment date to addressing conflicts date three Sex and intimacy date for the cost of love work and money date five room to grow date six Play with me fun and adventure date seven growth and spirituality and date eight your life of love and dreams And why this is so important before you allow the penis into the vagina or shortly thereafter is you have to decide is this person at At least this is my invitation for you. Is this person serious about wanting a commitment or are they just haphazardly going about life hoping that something will magically change for them because they're in a space of casual and They're hoping they're hoping for some magic fairy dust to change them to want to be committed I'm here to encourage you to choose people who are willing to make the effort and Someone who's willing to read this book with you As you're exploring a relationship Demonstrates that they're much more serious about the process than the Cavalier person and here's the challenge Probably 70% of men out there are cavalier Lee dating in other words. They're haphazardly dating. They're casually dating And what I mean by cat dating is that they're out seeking companionship connection and sex without any real forethought or Intentionality of wanting to be in a serious committed relationship. I'm gonna bet that roughly 70 75 80 maybe even 90% of men Operate that way now a lot of those men do end up in serious relationships But without any real intentionality, it makes it difficult for them to decide who to choose a partner This is why when you create intentionality when you create some I'm gonna use the word Well, when you create standards When you create your standard you have a better chance of assessing if this person is a good candidate For you to invest your heart in because ultimately ladies the minute you invest your body You're investing your heart and once you've invested your heart with the wrong person and this happens again and again And again it can wear on us emotionally. This is why I wrote my book.  It's a journey of personal development self-help and spiritual work to shore up our own because here's the reality When we've had one experience after another after another it Dating triggers the number one emotional health issue facing almost everyone and that is I'm not good enough I'm not lovable and I'm not likable And this is why I want to encourage you all to start shifting your Inter-narrative to loving on yourself and then being compassionate for everyone else Loving on ourselves and being compassionate for everyone else because when we operate from that premise We have a greater chance of not feeling such so much angst When we've made a choice that wasn't really aligned to who we are and what we want And this is why I recommend reading this book and let me just say one thing I'm getting so many emails from those of you for those of you that are watching my videos I'm telling you if you're brand new to watching this video I'm getting emails or messages from women who have done what I've just said they've adopted Introducing this book in fact I just got a message the other yes this morning from a woman thanking me because of the Recommendation of the books that I've suggested that she's introduced it to the guy She's with and their relationship is actually progressing at a much more deeply rooted space of trust Because it's not this bullshit haphazard men are chivalrous and they'll just claim you and all you have to do is just sit back And you're feminine and men will do all the work if that was such a great Narrative that's so traditional. Why is the dating process a clusterf? It is because a lack of intentionality and before you sleep with a guy I want to invite you to be more intentional Which is gonna create a greater chance for success is this sinking in is this resonating post a comment below? I'd like you to hear your thoughts on this All right, I'm gonna wrap up today's video as I always do first off giving myself a big gigantic jump and bear hug of self Love I'm gonna reach into the camera and give you a hug of love if that's okay I'm gonna ask you to turn to someone or a pet or a teddy bear or a pillow and give it or them a hug of love Because hugs are a great source of love and we can all use more love in our lives. Thanks so much. Bye. Bye now


scary Terry has signed with the commanders a three-year extension worth up to 71 million dollars in new money that places him amongst the NFL's top five highest paid water sewer sources tell ESPN Carson Wentz gets a weapon a weapon that he needed to have thought Terry was maybe coming back to Indianapolis as he held out from mandatory minicamp and wasn't exactly thrilled with everything going on there as you could tell young guy became a leader out of the Ohio State now he makes money 76.8% of that money's guaranteed AJ how do you feel about it for scary Terry that's pretty good and good the best part about all of it he will be a free agent again before he is 30 years old so the guy's gonna go dip again when who knows what salaries may be by that time


How are you going everybody? My name is Kevin Poon, born in Hong Kong, educated partially in Hong Kong, lived in Chicago, Vancouver, Los Angeles, and now back here. I am a entrepreneur with a lifestyle focus, so I've started with a sneaker store called Juice, which is a select store. Our own clothing brand called Klot, which is a streetwear brand, sold in lots of different countries around the world. A lifestyle design store called Wow, a chain of coffee shops called Elephant Grounds, a deli called Morties, and a Spanish restaurant and IFC called the Rumbla. Also a gym in central called Topfit, and actually a distribution company called District, which we distribute some lifestyle products. So that would be kind of what I do in a nutshell. Early on I knew that I wanted to create something, especially talking to my friends. Just having the idea of having a desk job a nine to five was really kind of scaring us in the negative way, just because we feel like there's two types of people in the world, right? One type of people that you work every day executing other people's dreams, or you take matters in your own hands and you kind of come up with your own dreams and get people to buy into that dream and then people have that common goal with you. Growing up we were really passionate about basketball, and basketball was really in our kind of core DNA because it teaches you a lot about teamwork. It teaches you a lot about winning. It teaches you a lot about handling how you lose. Also big part of basketball is looking good on and off the court, right? So I think we were really big into sneakers. We were really big into Michael Jordan at the time, and that was kind of our whole world, you know, basketball, music, looking good, fashion, sneakers, and that was all really kind of in our DNA, and these are our passion, and this is what we were interested in. And then there was an opportunity, because as I was doing this internship, that turned into a real job, and then I got fired from my job because I was too focused on doing, you know, I was daydreaming or whatever it was, and I had an opportunity to, well, I had no choice because my visa got expired and I had to move back to Hong Kong because my parents like, stop mucking around. You need to come back and really kind of be serious about your life, and this was like when I was like in my early 20s. And then we started looking around and seeing, hey, how come, you know, in Japan, there's all these cool streetwear stores or cool stores at the time. We were looking at brands like Bathing Ape or Neighborhood or even Bizvam, and how come there wasn't any comparables in Hong Kong? And so we found kind of an opening, and we thought, hey, this could be interesting to put in a store all the things that we liked that was hard for us to get, be it may sneakers or collectible figures or t-shirts or hats or any of these type of things. And that was kind of the beginning focus on juice as a retail outlet experiment. When we first started, you know, the idea is quick and, you know, my dad always used to say, hey, starting a business is easy, but sustaining it is where it becomes challenging. And we had no idea what he was talking about because, you know, as a young person, you don't really think about the consequences. You don't think things out that thoroughly, and that's also part of why it's cool to be young because you don't think about it that much. And so without thinking about it too much, we went to Incorporate a company and we rented a place, but no one had accounting backgrounds, and we were unpacking our own boxes, doing invoicing, you know, it was a lot of work, but it was fun at the same time. And, you know, some of the roadblocks I remember was we didn't really know how to kind of do the year-end audit, let's say.  And so finally, you know, we knew how to hire an audit firm or an accounting firm to help us with a lot of stuff.  And, you know, I was just leaving the office and there was challenges from then, you know. So every day is a challenge and every day is something new.


Did you actually see the shot or did you just hear it? There is a pause after that that I believe is way out of the baseline. Notice how rapidly before she was delivering information and right now she takes a long time before she then gives quite a convoluted answer there. I have gone around to the kitchen to get away from him and so back around so I don't know if you went in the house. I didn't so I'm a little bit of a disadvantage. Yeah so I didn't see when I didn't see the shot I heard and then I came back around and I saw that he was on the ground. This is clearly important, it's clearly important that she helps people understand that she maybe didn't see anything but only hear anything. I'm very concerned about this story it doesn't make a great deal of sense it looks like she's trying to distance herself from everything as carefully and as quickly and as boldly as she can.


I'm very happy to introduce to you my friend... friend? Yes. Okay, he's my friend. Evan Libon, the founder of the Business Agility Institute. And you will talk today about certain uncertainty. That sounds really interesting. Thank you. It's about the only thing that is certain these days. Good afternoon. Is everyone having a good conference? There we go. That's better. Okay, so for the next 45 minutes, I'm going to be outlining why uncertainty is the only certain thing you have other than, I think, death and taxes, as the saying goes. Over the next 45 minutes, I'm going to look very much at companies, the entire structure of a company. I'm not going to talk about agile at all. I'm not going to talk about frameworks or methods or systems because they're all rubbish. They can be useful, but none of them have an answer for you. To be fair, I don't have an answer for you either, but I'm going to give you ways in which you can discover your own answer. So, when I started the Business Agility Institute, people would always ask me, why? What is business agility? And I would talk very much about it's the ability for an organization to thrive in an ambiguous environment. But those words are platitudes. They don't mean anything. So, we went and we did a little bit of research. This is the Fortune 100 companies from 1983 through to 1993 through to 2003 through to 2013. So, it's about five years ago. In 30 years, 57% of those companies no longer exist. Six went completely bankrupt and never came back. 20-something went through an acquisition and no longer exist. Half a dozen went through mergers. Many more went through divestments and sold half the business and so are a fraction of what they are today. And if Dave's comment about an organization's success is about the continuity... Oh, no, it's fine. It's actually... Yeah, it does that. Is the continuity of concept? Then these organizations, as they were conceived in the 1980s and before, are now dead. So, business agility in many ways, and for that matter, agile HR, is about survival. But survival is not enough. Survival is easy. You just don't... Survival means don't stuff up. I've got a six-year-old girl. She's exploring. She's doing everything. For me, I want her to survive.   That's kind of my minimum bar of parenting. I like to go a bit further than that though. I do like to actually parent, but at a minimum, just don't die. My daughter has a very weird sense of humor now, so I suspect that might be an Australian thing. So, about a year and a half ago, people kept asking... So, if business agility is about survival and it's about thriving in an uncertain environment, in an uncertain economy, how do I do business agility? Is there a framework for business agility? No. Buntly? No, there's not. And no, there never can be. A framework by its very nature is generic. It is a simplified set of practices and processes. Frameworks work for a process. The software development lifecycle process. The recruitment process. I can give you frameworks for any process because they are, in many ways, repeatable and non-complex. And if Dave's in the room, I apologize, I am going to use these words wrong. So, about 18 months ago, I got sick of people asking me these questions. So, I wrote a blog article. It was about 500 words. And it was just, this is what I thought made up business agility. All the different components. Not a model, not a framework, but just some ideas. And I wrote that overnight, and I happen to be going into surgery the following day. So, I finish it up, I put it in a Google doc, and I put on LinkedIn and said, hey, I've just written an article about what I think business agility looks like. If you have some comments, feel free to look at this Google doc and make some comments. And yeah, I'll publish it tomorrow. What's the first thing you do when you get out of surgery? Check your email. So, I came out eight hours later, checked my email, and there were 60 people arguing in Google doc comments around what is business agility. So, what started as a 500 word blog post turned into a full on community consultation around what does business agility mean. And this model was created out of that. I call this the don't forget model. As in, if you're going to transform your business, don't forget these things. They're not a, it's not instructive, it's not prescriptive. Nowhere in here will tell you how to do something. It just tells you what not to forget. The next element then. So, I'm going to walk through this a little bit, but I just want you to remember that this exists. Because then we did something else. About six months ago, we ran a global survey of 166 companies all around the world, ranging from 10 people micro-consultancies through to 400,000 people, banks, insurance companies, and all that sort of stuff. Don't mind me. That's going to be important later. So, this, we asked questions around those domains. We wanted to know what the state of business agility was, what it looked like, who was doing it, who was doing it well, who was doing it badly, and what did good look like. I'm going to be blunt. The results were not good. But to be fair, that's also what we expected. On average, every question was rated out of 10. A simple spectrum, and seven, eight, nine, and 10 are good. Those are what we would consider to be agile organizations. One to six was either non-existence to pretty okay. The average was, well, average, 4.9. And we call this well within the walking phase. Now, noting these are companies who are self-described on an agile transformation. These are companies who have all made a minimum of sort of one-year investment in business agility, and they all sucked, mostly, more or less. There are some areas which came out well. The top areas, customer channels and pride, these were things where most companies agreed on. If we're an agile organization, our people have strong pride. If we are an agile organization, we engage with our customer through multiple channels. The lowest, market experimentation, funding models. These are the ones that had the biggest divergence between the best organization and the worst organization. Now, I share this with you, and I'm going to share some more insights around this as we go. But let me take a step back and talk a little bit about the domains. In that model that you saw, at the very heart of the model is the customer. This was one of those areas where we fought for weeks. What is at the heart of business agility? Is it the customer? Is it employees? Because employees, they're the ones who do the work. You make them happy, they'll make the customer happy, everyone does well. That's Virgin's motto. That's a whole bunch of agile organizations focused on the customer. Or is it shareholders? Shareholders own the company. They're the ones who have decision rights. Are they at the heart of an organization? We ended up coming to the customer as the heart of an agile organization for one very important reason. This might be a little controversial, but you are not in business to make money. What does that mean? That means that you are in business to do something, to create value for somebody. You still need to make money. We are a capitalist society. We still need to make a profit. There's a great quote by Frederick Lalu who wrote Reinventing Organizations. Profit is like the air. We do not live to breathe, but we do need to breathe in order to live. That's what's happening in organizations around the world today. We have this situation.  I guarantee nine out of ten items, KPIs in your corporate scorecard, are focused on the financial health of your company. There's probably one item in there about customer satisfaction. I guarantee no one gets fired if that's low. If you don't meet your financial targets, people get fired. Think about what that does for the morale of the organization. I bring this up because this is an audience of people professionals, HR professionals. You control in many ways the measures of people. We're measuring what's easy, not what is right. We're measuring money. Why? Because it's easy. I can see the money flow through. Customer satisfaction is intangible. Achieving value for our organization is intangible. Let me give you a real-life example. There's a bank in Singapore called DBS Bank. They are the biggest bank in Singapore. They're the national bank. They went through a process improvement program or series of PEPs. In these, they looked at a process, lost credit card. For context, DBS had the lowest customer satisfaction ratings of any bank in Asia at the time. They're down there at the bottom. They said, let's improve our processes. They look at the lost credit card process. It took three to five days to get a credit card replaced. It was inhuman. What do you do? You lose your credit card. What's the first thing you do? Hi, bank. I've lost my credit card. What's the first thing the bank says? Name, rank, and serial number, please, or I can't talk to you. They treat you like a criminal. The bank took a little bit more human view. They said, okay, we'll be more empathetic. You've lost a credit card. That's okay. Have you reported it? Are there any... If you haven't, here's the number of the local police. Here's some help to get you through this slightly difficult period. And then they went through the normals of Lean Six Sigma, process improvement. They brought in design thinking. They brought in ethnographic researchers. And they did it all by the book. And it was good. The customers got their credit card now in 24 hours. That process went from three to five days to 24 hours. The help desk was more human. But then they did something that they'd never done before. They called the customer. They said, hey, I'm from DBS Bank. You've just been through our new lost credit card process. What do you think? And the lady at the end of the phone is like, well, that's good. Thank you very much. But where's my debit card? Because think a bit from the customer's perspective. The customer didn't lose a credit card. They lost a wallet. Think about it from the bank's perspective. The bank has a credit card line of business. The bank has a banking line of business. The bank has all these lines of business which are standard in any large organization. And the process is owned by a line of business. But the customer doesn't give a damn about your lines of business. The customer just lost a wallet. So they got their credit card in one days and a debit card in three to five. So DBS credit to them learned and they created a customer journey program where everything that they did was around customer journeys. You lost a wallet. That's a customer journey. We will make transparent to you our internal processes. It doesn't matter what lines of business. You've lost your wallet. We'll make it easy for you. Fantastic. And there are many more examples. But it's just one around putting the customer at the heart. So I'm going to ask you to do something now. I am going to ask you to do something now. Pull out your phones. So go to pole everywhere slash or poleev.com slash biz agility. I'm going to ask you to actually rate yourself based on one of the questions from that survey. And we're doing a self assessment. So be a little bit honest. We're asking you about measures and KPIs. Why? Because let's face it. That's your responsibility in HR. So rank yourself one or two. If your measures are simple, qualitative, sorry, quantitative measures, revenue, basic stuff, rank yourself as crawling three to four. If you've removed the vanity measures, if those measures that you have left are real. And that means if you change that measure, it makes a difference. Rank yourself four to five. If you give your soft measures the same focus and attention as your hard measures. So staff satisfaction, employee retention. Seven or eight. If you start to measure a transformational, if you start to measure, if you're incentivizing people and measuring people to change and improve and to learn. And you're flying.  If your measures are aligned 100% to your customer. And this is something that we tried to do in a consultancy organization that I used to work for. Where we tried to change the sales people's measures. So instead of having sales targets, which actually they still had sales targets because we couldn't get rid of them, but we also said that here is your client's corporate scorecard. If you are going to be measured against their success on their corporate scorecard. So if you can sell something that will help them move their number, that's win-win. That's an agile organization. It didn't work, by the way. They rolled it back after a quarter. So take that with a grain of salt. There we go. That's about right. It's interesting to see how many people are in that middle there. But this is an agile conference. That's not too surprising, I suppose. So let's think about the customer for a second. Why? Why is the customer so important? And it all comes down to trust. This is what we call a trust pyramid or a trust ladder. At the bottom we have reference-based trust. Let's say you need a carpenter to redo your bathroom. You're going to renovate. You're not a carpenter. You don't know any carpenters. So what do you do? You go to Google or you ask a friend, damn, can you recommend a carpenter? Thank you very much. And I now have a carpenter. But I don't trust that carpenter. I trust Darm or I trust Google. Then we go to the next level. The carpenter I meet, we sign a contract. We agree for $10,000 you're going to do this for me. And I still don't trust you. I trust the contract. And here's the problem in most business, because we get to this level and we never go any further. So if you can only trust your customer as far as the contract with them or their contract with you, then, well, we have a problem. We can never actually truly have an agile relationship, have that engagement. This, by the way, could also be an employee contract from a HR perspective. If I'm interviewing someone, I have referenced, I don't trust the candidate. I trust the references that they have or I trust the interviewers on the panel. When you join, I trust the employee contract, not the employee. And this is part of the issues we have in many of these organizations because employees feel that. They feel untrusted. But then we go to identification-based trust and this is I trust you as a person. This is the only point where we can actually have agility. If I can trust an employee or if my customer can trust me as a vendor, then we can actually have this conversation. You did a great job of the bathroom chain. I need you to now come and do my kitchen. Now, let's forget the contract. I have a contract, but the contract's now an enabler. I can ask the following question. You know what? I got about $5,000. What can you do for me? I can't ask that question if I don't trust the person because they're not going to rip me off. I don't know what the work is. There's a lot of things I don't know. So I can only have that agile, adaptable, dynamic conversation once I have a level of trust. Now, partnership level trust goes another level. You're not going to enter a joint venture with a carpenter. That's kind of ridiculous. But look at someone like Rolls-Royce. Rolls-Royce make aircraft engines. When you lease one of their aircraft engines, you don't pay for the engine. You pay for every minute that engine is in the sky. If the engine is on the ground, you don't pay a cent. Now, think about that. That is win-win. If the plane is in the sky, you're making money. Rolls-Royce is making money. If the plane is on the ground, nobody's making any money. So that is a partnership level trust. Now, it takes a long time for organizations to get to that point. So let's go back very quickly to these domains. We break this model into three dimensions, work, connections, and mindset. The work dimension consists of the ways of working, technical agility, process agility, and enterprise agility. Technical agility is the way of doing your work. Now, if this was a software organization, I would say something like this is DevOps or XP. But in HR, this is about how do you do your work on a day-to-day basis that enables ambiguity, that helps you deal with uncertainty, that allows you to continuously plan. Going up, process agility. This is the entire value stream. In HR, how agile is your recruitment process? How agile is your onboarding process? Process agility is that entire value stream that exists in that context. And the agility in that can, in many cases, be measured. We then have enterprise agility. Now, this is where I'm going to introduce you with a different idea. So there's a book called The Goal by Eli Goldratt. In this book, he talks about, it's mostly around lean and manufacturing, but he brings up this concept called the theory of constraints. Now, in the theory of constraints, we have a, if I'm building a car, the slowest part in that production line is the slowest part, is how fast I can build cars. And if the slowest part is attaching doors, I can only build cars as quickly as I can attach doors. Make sense? So, I'll be arrogant for a moment. Evan's theory of agile constraints. An organization can only be as agile as least agile division. 30 years ago, it was probably software, it would take three to five years to bring a product to market. Thank you, software crisis. Thank you, software engineering for giving us all those practices. So we, as a counterpoint, there's the pushback, saying we need more agility in this process, not agile, agility. And so, simplistically, agile is born. 1986, you've got Scrum and so on and so forth. So, in that software domain, there is still a new constraint, because we are now able to create change every two weeks. But in software, you then have to deploy change. And 10 years ago, that became the constraining factor. We could make change every two weeks, but we still had to wait three months for a deployment window. So, we invent DevOps, fantastic. But where is it today? Amazon's statistic is I can deploy change every 11. something seconds. I'm using Scrum. I can make change every two weeks. But I have an 18-month budget process. I have a three-month recruitment process. How agile can I be? And the answer is 18-month agile, three-month agile, not 11-second agile. So, this is enterprise agility, that concept of an organization as a complex adaptive system, as an ecosystem, an organic, growing, living, super complex network of stuff. And every single one of you plays a role in that. And every single one of you has influence in that system. We're not going to use the word system, in that environment. And, hey, hey, I learned something today. Don't call it a system. So, each one of you is a part of that. So, that's enterprise agility. Agile, that's weight, that's working. All the characteristics of iteration and ambiguity and so forth in an agile way. So, let me ask you another question. And, sorry, how much time do I have? That time is not on. I just realized that. Another 30 minutes. I got plenty of time. All right, lovely. Another question. So, let's talk about your, now, think about your process. If you're in HR, this is your value stream. This is a recruitment value stream or an onboarding value stream. If you're in a leadership role, it might be, it doesn't really matter. But pick a value stream, a process. All right. Do you have agility in that process? Nope. Crawling. All right. You've modeled the value stream. You know the process. You know where there are unagile parts, but you're not doing anything about it. All right. Walking. You've introduced flexibility. You're able to, you have options and alternatives in that value stream. All right. Running. All right. Your work processes are based on the customer view of value, not on the internal siloed view of value. So, think about that. That's the, the, the, the, that is the wallet's problem. All right. We don't have a credit card process. We have a lost wallet process. And then running is where your processes can be flexible, are customizable. You can ignore them if, and you have autonomy and accountability. It's a double-edged sword. All right. In the delivery of your work. There we go. A little bit better. Interestingly, the, this actually follows pretty closely. Unlike the first results, which was a little bit more skewed, this actually does follow the global responses pretty closely. 50, no, 69% give a, around that, forgive me, I don't remember the exact number, was between one and six. So this is a bit weaker than, than normal. But that's good. One of the other insights that we had from that report were your agility is directly correlated to the number of business functions who have adopted an agile mindset. All right. So if you're doing agile in IT, just like everybody else, right, technology and product management, all right, then you have a pretty ordinary level of business agility. If you've started to adopt business agility in HR, and look, only 22% of respondents have adopted business agility in HR, right, finance and HR have the two, thank you, finance and HR have the two biggest positive impacts on business agility. And I don't have an hour, I have 10 minutes. So I'm going to speed up a little bit. So the next domain, connections. Three elements in the connections, in the connections dimension, leadership agility, the relationship that we have with authority, delegation, empowerment, servant leadership, structural agility, everything from self-managed organizations to the accursed Spotify model. And market agility, the relationship that you have with your supply chain and your distributors and the people in that network. And when you talk about an organization, these are the areas which are getting weak. If we look inside an organization, we had some very interesting insights where we did ask organizations to, some of them to self-assess, and they self-assess themselves in the middle. But when we had independent assessment of those organizations, then they were on average about 20 to 25% lower as that internal assessment. Now, the next set of research is going to explore a little bit why. And we hypothesize it's one of two reasons. It's either that the external people didn't have the full story, they didn't know everything, they didn't see everything, or that internally we have this blinked view that we are amazing when actually you're not. The other thing that we learned was if your business agility transformation is being led by the board, in fact, this graph, sorry, this one surprised me. I kind of expected that the more senior of an organization, the transformation was being led, we would see more success. I wasn't expecting how cleanly linear this line was. It is almost a 25% difference between the agility and the ability to succeed in a market if it's being run from a single line of business versus being run from the board. So if you're doing this kind of transformation and you're just the head of HR, seriously consider that you need to go up to the board and get them to buy into this because that's how transformations work. And there's a good example, SunCorp in Australia did the exact opposite. The board, I'm sure they're nice people, but they weren't exactly agile thinkers. So when the CEO who was an agile thinker left, this was what, seven years ago, eight years ago, something like that now, the board replaced him with a new CEO, great person, knew how to run a bank, didn't know, wasn't an agile thinker. So SunCorp in Australia was, I would say, a global leader in what we would now call business agility. And yet it's all gone because the board didn't consider agility in that selection. Another thing that organization is doing, this is from New Zealand Post Group. This is what they call the sorting room. So think about leadership agility. What do leaders need? Information. They need to make decisions. And it's interesting, sorry, sidetrack. At the Business Agility Conference in Australia, we had a major from the Israeli army give a talk. And she gave a literal war story. And in that she was saying that there are two things that a leader needs to do. The first is to set a vision, set a goal. And the second is to make sure that the team has all the skills and the right culture in order to achieve that vision. It's the only thing that a leader needs to be able to do. And so New Zealand Post Group, and this is, this is what, seven years old now? This is actually quite an old example now. They created this room for their senior executives, the CEO, the group CEOs, because it's a group of companies, a bank, a post office, a courier services, and all those sort of things that you would see in a postal service. And this is a room. This is their board room. Every wall is some form of kanban board showing some element of the organizational initiatives or organizational health. My favorite is the door has a big picture of the elephants. And I don't know if you have the saying here, the elephant in the room. Yes, this was the elephant in the room. And anyone could put a post-it note on the door and force the executive to talk about that topic. The executive went from meeting once a month to meeting once a week. It went from eight-hour board meetings to two-hour deep. They just looked at what was important. And they did this because they could see at a glance everything around them. And the other great thing this organization did was they made that room open. Anybody could walk into that room and go, huh, that's what we're doing. Now, obviously some things were confidential. So you'd have Project Omega, rather we're about to lay off 1,500 people because some things are confidential. But anyone could walk in and see what was going on. And we're seeing these kind of rooms happening. DBS has something similar, but it's portable boards. Every exec has a portable board. Amex is doing it. Actually, VistaPrint, I think, is doing it, to be honest. I think there's an example from VistaPrint. The last dimension, the mindset dimension. A lot of arguments around this. Think of this as the organizational culture. There are three domains here. A learning mindset. This is a growth mindset. The ability for an organization. And this, by the way, is not the mindset of an individual. It's the mindset of the business, of the company. The aggregate culture of everyone who exists. So a growth mindset. One that enables experimentation, learning, failing fast. A collaboration mindset. Something, and this goes sort of hand in hand with structural agility, but it's, okay, here's a question. Who wants to break down the silos in their company? Rubbish, you cannot do that.  We are monkeys. We evolved from monkeys.  Actually, no, that's the lizard brain. The monkey brain somewhere here. It doesn't really matter. We have a monkey brain. In that monkey brain, what do we do? We form tribes, not Spotify tribes, actual tribes. 150 people, Dunbar's number. Wonderful thing. These tribes happen. Us versus them. Literal thinkers versus emotional thinkers. We classify, we put ourselves in boxes. It's what we do. Our brains are coded to pattern match. It's literally how we survived. Well, everything. Humans are one of the... I would probably go so far as to say, I don't know if this is evolutionary theory correct, but we're probably the best pattern matches on the planet. But that means we build tribes. We build silos. Us versus them. Brown versus white. Male versus female. Liberal versus labor. Democrats versus Republicans. It doesn't really matter what the tribe is. We form them. A collaboration mindset is... Actually, let me take two things. Number one, the whole point of structural agility is to build silos. Not to break them down, but to build them, but to build them right. So that HR versus everybody else. No. That's how organizations are structured. There's this antagonism. Oh, HR won't let me do it. We have to follow the HR processes. They're not saying HR's a partner. They're saying HR is them and we are us. Instead, what we do is we build organizations where a silo, the value stream and the flow is harmonious. Where from idea to execution, from input to customer, is one team. And then we have another and it might be by products. It might be by customer journeys. It might be by customer experiences. There's no organization in India that structures their company around, this is the onboarding experience. This is the payments experience. This is the communications experience. And they're cross-functional. So there are developers in there. There are HR people in there. There are finance people in there. They build it around these ideas. So we build silos. It's natural. The last one is an ownership mindset, which is pretty much all about pride. Now, I'm out of time, so I'm not going to ask the last one. But I am going to ask this one. Top challenges. Deck. What's deck? Someone translate deck for me? No, deck is gone. Fixed mindset. Funding. Finance. No one likes finance. Mindset. Fear. So I gave this talk at the APAC HR forum a couple of months ago. And it's really interesting to see the answers from a HR context are actually very different from the global answers that we got. I've got leadership, mindset, fear. These answers are very... I don't want to say soft. But these are about the people side of the organization. The challenges that you're facing are people challenges. The top three challenges globally. Number one was leadership by quite a large margin. Number two was organizational structure. The organizational structure didn't work. And number three was buy-in. A lack of buy-in across the organization. So in the 30 seconds I've got, two minutes actually, I want you to think about your organization as not a system apparently, as a complex adaptive system, as a very dynamic living organism. With multiple moving parts, where the process that you are running, you might think of it as... you might have it modeled out in BPMN, and you might know the steps, but that is an overly simplified view of the reality of your organization. Your organization is complex, your organization continuously evolves, and there is no one shape. There is no framework for business agility. We do see benefits. We see... These are my favorite quotes from the survey. Our retention of both clients and staff is much improved. Business agility has given us a competitive advantage and allows us to react quickly and pivot as needed by our customers. This results in faster customer acquisition, faster time to value, and bigger market penetration. To be honest, I was actually surprised. As much as I believe business agility is a financial benefit, I didn't expect to see that in the results of the survey so quickly, because we are very young. It's been around for 100 years, but as a community, we're still fairly young. That was quite interesting. Let me finish up by saying two things. Number one, your organization and your role in the organization is dynamic. It will always be dynamic. You do not have a role. You have to do for the organization to continue to exist. Organizations that are fixed, organizations that put you in a box will be dead. Seers went bankrupt just a couple of days ago. It's... The biggest companies are failing and they've been failing for decades. And that change and that churn will continue. If you want to exist in the market five years time in ten years time, then I'm sorry, I don't know what that market's going to look like and nor do you. If you do want to exist in that market in five or ten years time, you've got to be prepared to change and adapt and if you can, try and lead that market. I believe I am out of time. You are. Thank you very much everyone. Have a wonderful day. Thank you.


So guys I am back with another science rule video and today I bring you a complete guide and how you can get the secret Vehicle known as the widow Maker has it gone guys. My name is DP. Jane if you do enjoy the video leaving a like really helps out and if you like quite See you want to see more be sure to subscribe Okay, so across the world of science shoulder hidden collectibles Today I cover the last wheels a bike wrapped in mystery collectibles There are five scattered across the map if you collect all five you get this secret bike Now what I do recommend you doing is guys going and grabbing a helicopter just to make life a lot easier So go to this part on the map right here Grab this helicopter then go and grab the five collectibles once you grab the five collectibles The bike is automatically added to your garage simple now What I will say is you can do this at the very start of the game as soon as you open the open world You're free to explore go grab this helicopter go grab these five last wheel collectibles and get this bike from the very very start Simple so yes guys go to the five points on the map I go to grab the collectibles get this bike and you are good people if you enjoyed the video living a Like really helps out if you want to see more guides on central get more secret vehicles and much much more Check out my channel again guys leaving a like really helps out feel like what you see Want to see more be sure to subscribe and hopefully guys. I'll see you on that next video


Joey, is the stage to see us. Okay, thank you. So I first wanted to just get a general idea, and I think that a lot of the people here are dev-in-developers, and probably everyone here knows what testing is, I hope. So I don't have to give AJ's talk, too. If there's anybody who isn't really clear on what testing is, could you please raise your hand and I'll go a few, a brief rundown of it. Okay, none, great. So as we know, testing is an automatically stabilized version of unstable, and it's pretty much unique among all the Linux distributions out there. There's really no other distribution than I know of, which tries to just take a program and look at the data that's available and generate a distribution out of that, like we do with testing. And it's actually worked pretty well, I think, in a lot of ways. We've actually managed to make, I think, two stable releases now using testing. Of course, there are some problems with it. One of the big problems with it, which came up as soon as we started producing it back in the year 2000, was that it's basically completely insecure and it's thought there's really no way to make it secure. It's basically insecure by design. So there's a lot of different problems which I've listed here. For example, any dependency between a library package and another package can block a security fix from testing. You have to wait for the library to get into testing first before the package that depends on gets in. And there's a lot of things that can hold those libraries out and you can get very deep library chains, especially if you have security holes in GNOME or in anything else that depends on lots of stuff. And one of the other metrics that's used in testing, of course, is the number of release critical bugs in a package can hold it out of testing. That's a real problem if you have a release critical bug which is really, really critical. But then you get another security hole on top of that. And now you have some maybe really hard to fix bug which is completely blocking some simple security fix from getting into testing. The next problem here is there's a testing delays. Packages don't reach testing until they've been tested in theory for 10 days. We can knock that down to two days but it still is a delay there. And it can be a bit of a problem if you're trying to just rush out the security fix for say a remote hole in the kernel or something. And so can the auto builders because before a package can reach testing, it has to be built on every architecture out there which is a big problem if an auto builder's down or if it's just slow or whatever. And the final problem here which I think is really probably the biggest one is that we don't try to really try to secure unstable either. We do our best effort at it when it's pretty good and the security team occasionally goes and checks to make sure that something's fixed and unstable before they issue a DSA for it. But we don't have a security team for unstable either. And so all these problems have basically kept people from using testing to any large extent or at least from admitting to using testing. And actually since the camera is pointing at me and not at you, I'd love it if you would raise your hand if you do use testing somewhere. Look at that. Until Sarge released. Okay, well that's fine. Let's say if you've used testing in the past year, let's raise your hand. So it's almost the entire audience. I think if we turn the camera around the other way, it would probably be half the audience. Well okay, well great, see? Gotcha. And of course, I think the reason you used testing in the past year of course is because we were trying to get Sarge released and it was a pretty good distribution and it just wasn't ready yet as far as security fixes and all that stuff which blocked it for a half a year. And so testing's really attractive for desktop users. I mean, I assume that there's a bunch of people who are scrambling right now to go install testings so they can go break their system by installing x.org because it actually went into unstable today. They're probably gonna, I mean in a week they'll be running to install testing. It's also really useful for custom Debian distributions who want to make a product that's based on Debian but that isn't as old as stable. For example, I worked for a year on the school Linux distribution which hoped to base its next release on testing or on Sarge. I believe that there's a couple of other distributions who have tried this, yes, question. I'll repeat the questions, I don't bother with the microphone. So a comment, this very building has machines in it that are running testing and that were apparently drive permit a year ago and I'm not gonna ask about how they're secured because I assume that the people here know what they're doing.  And I know that that actually happened when I worked for VA Linux, I think. I actually forget what they ended up rolling out but they definitely had to do their own security support and all that kind of thing. So as I mentioned, I was employed by school Linux who wanted to base the product on testing and so they actually hired me and part of my job description was to try to figure out a way to make testing secure which is probably one of the most scary things I've ever had in a job description. And so I procrastinated it for a while and finally last fall I was urged by Petter who may or may not be here, there he is, hi Petter. He suggested that I actually get around to doing something about it and so I began trying to form a team of people to work on this and I think it's interesting that this team formed pretty much exactly five years after testing was introduced and for five years we had no security support and nobody dared to try to do it and I don't think that it's because I'm special or anything, excuse me. I think that it's more because it took that long before there was enough buildup deployments to testing and enough experience whether the people were actually comfortable with the idea of trying to do this. So we have right now a team which consists of, well there's probably about 10 or 12 people who are on the mailing list and five or six who commit on a regular basis. An interesting thing about this team is that even though we're working a secure Debian, probably two thirds of the team are not Debian developers. It's just an open team. Pretty much anybody who demonstrates their confidence can get in pretty easily and we have checks and balances in place that they can't screw anything up and so. Actually before I gave this talk I surveyed all the different team members to find out why they had specifically decided to work on it and I thought it was really interesting that of the responses that I got back, approximately half of them actually worked on either a derived distribution or they worked at a large institution like at a university or something and were already doing testing security and the other ones were also just as interesting I thought because besides the obvious reasons like making testing secure, some of them thought that it was actually fun to work on the testing security thing which I thought was amazing because personally I think it's a little drudgery to believe it. And another response that I thought was really interesting is that they appreciated it just because of the transparency of the team. Unlike the stable security team since we have members who are not Debian developers pretty much everything that we do is done in the public on mailing lists. We don't really have any privilege information. We're not on vendor sec and of course this has its downsides because there are security holes out there that we don't know about which other parts of Debian do know about right now but it definitely has its upsides in that we can get more people into the team. We don't have all the overhead of worrying about keeping this information confidential and that kind of thing. So when I came up with this team I actually started by having us go back and look at every single security advisory which had been published since the release of Woody. I think that was, I forget how many thousand advisories that was but it was a lot. Most of them didn't actually affect Debian but about a thousand or two did and most of those had already been fixed and unstable but probably five or 10 hadn't and some of them were security holes that were three or four years old at that point which pretty much just proved to me that we really needed some kind of a team who was adding an extra check to make sure that a maintainer doesn't just forget about a hole or just fall off the planet and the whole holes sit in Debian for ages. So in the process of going over all those holes we actually worked out some ways to keep track of all this information and to work together that I think have worked out really well as a team. It seems to be fairly scalable to fairly large number of people because we all just, we can basically work without communicating a lot with each other. We work in a subversion repository as far as tracking various holes. So I should actually speed up a little bit and talk about how we find holes. I don't know if the audience is generally familiar with the CVE database and the lists. If you're not you should become familiar with it because it's pretty much the way of the future as far as this goes. It's a list of all the security holes in basically all the software out there and the way it works it basically gives a single name or a number to every security hole. And from those we go through and look at all the holes. And actually I have Micah here who's a member of the team and I'd like him to just show us basically what we do on a day to day basis while I'm talking if that's possible. So let's see here. Here you go. So what he's gonna show us is we have a list of all the holes and the new ones automatically get added to this list as soon as MITRE gets around to releasing new CVE entries. And then we just get an email because we all watch the commit logs. Yes, Brandon? Micah Anderson? Yeah. Oh, I don't know it. So new holes get added to this list. Automatically we get the email and then we go in and each member of the team when they have free time we'll just claim a block of holes. And I think Micah's already brought it up and it's looking for the ones that he's claimed. Okay, so these are, you know, they're marked as to-do and he'll just go through them and figure out if they actually affect Debian, which on average they don't.   But it can be a little bit tricky sometimes to figure out if a piece of software in this list is in Debian. I mean, there's a lot of stuff in Debian and a lot of strange names. You have to try to map back into Debian package names and things like that. So it gets to be, take some experience, but it's fairly easy to learn. Exactly, he has no idea. So basically we work from this list and the list is then used to generate some web pages which can tell us what problems are actually holes in testing. What if we found a hole? We gotta use this xsoups on a Debian server. There you go. So we've probably just found a security hole right now. Yeah, so basically once Micah comes up with whether or not xsoups is actually a Debian package, he'll work out if this bug has actually already been fixed which it often has been and he'll figure out exactly what version number it was fixed in and then he's gonna add that into the file. And, yeah, yeah, there you go. So we actually have a bug report, well, yeah, yeah. So, and that's another thing we actually track is ITPs and make sure that we don't add things that have a known security hole to the distribution. Security box feed from before. Exactly, yep. So once we have all this data though, we can actually start using it in some fairly useful ways. Yeah, we can say, you know, I have a script which basically runs on one of the Debian servers and looks to see, you know, it looks just as simple version comparison to see if the holes are still out there and generates a page which the release team is fairly happy with which lists all the things in testing. Would you mind showing that page to them? Yeah, you have to go back. Yeah, so this is the page. It lists a lot of holes right now. If you look at the really deep red ones which you probably can't read on this display. Yeah, those are ones which are remote security holes, that kind of thing. Yeah, the ones in yellow or security holes that we haven't classified yet. We don't have enough information to know how bad the security hole is or we don't have anything about it.  The ones which are in white are basically they're security holes in theory and they're more of them than anything else just because people don't really bother to fix them very often in my experience. And so these are all holes in testing and if you go down to the very bottom there, as you can see we have 55 unfixed holes in testing which are also holes in unstable, of course, because they all have bugs. And today we have 24 security holes which are fixed in unstable but aren't fixed in testing right now. And of course we have a certain number of items that we haven't checked yet and so on. So that sort of gets me to the point of how do we actually try to get, yes. Ah, that's a good question. The reason we have some advisories. Yes, I'm sorry. He asked why some of the advisories are CAN 2005-XXXX. Those are security holes which have been found by another means than the CVE list and haven't actually shown up on the list yet. One of the problems with the CVE list is it's updated about once or twice a week and in between that a lot of stuff goes on and we have enough people in the team now that we're covering pretty much every security mailing list out there that's useful. I mean we cover full disclosure, bug track, we read the WNBTS, we read DTSAs, we read Gen2 bug reports, we read Ubuntu bug reports, everything pretty much at this point. And so we do know about some holes which haven't shown up in the CVE database yet. That's great. So Matt Zimmerman just suggested to me that we can forward holes that don't have a CVE ID to him and he can get an ID and that's great because that's something that we've wanted to do but the stable security team doesn't really have the manpower or something to actually do that for us at this moment. I think you also said that you can get us to become an authority so we can actually have our own part of the namespace and assign IDs out of it. Is that what you said? Yeah, of course. Yeah, yeah. No, the way CVE works is there are multiple groups who can assign CVEs as I understand and I can't really go into details about that because I... Right. Yeah, exactly. The whole point is to not have more than one name for any given security hole. So yeah, we should definitely get together and talk about it. Thank you. So anyway, moving on to how we can try to get these security holes into testing a little bit faster and avoid the problems that I showed you at the beginning. One nice thing is that I am on the release team which means that I do have certain powers which I can use to try to force certain poles in, yeah. For example, if there's a security hole which is uploaded with, say, severity or urgency is low, then I can look at that and say this is bullshit. I'm just gonna upgrade it. It's gonna go in in two days assuming that it gets auto billed everywhere. I can try to not, if necessary, we can try to push packages out of testing. That doesn't really fix the problem for our users so it's not really worth doing, in my opinion. But the fact is that those issues that I listed at the beginning are design flaws of testing which make it impossible to secure it if you get right down to it. There's no way that you can say given this security hole which I have a patch for, I will get into the testing tomorrow. There's just no way. And so at some point, we've been hoping to get together a repository of our own and an auto builder network of our own so we can actually issue advisories, yes, I see. Why can't we use testing proposed updates? Okay, that's a good question. In theory, I think we could, assuming that it's auto built and assuming that we can then get the fixes from it into either testing or into something that's useful for our users. And that's definitely one thing that I'd like to do but it's been a little bit unclear to me as to whether it's gonna continue to work now that we've gotten Sarge out. And I'd really like to talk to somebody about that and see, it's being used. He says it's being used for security stuff. Okay, I haven't really noticed. Okay, I didn't catch the name of the advisory. That you said. Okay, let's see the issue there. I mean, people can upload to it but at the moment the test and security team doesn't really have any ability to deal with it. It sits on testing. I mean on security.debian.org which I don't even have an account on, you know. And if we have access to it then you run back into all the issues with a stable security team having uploads to this repository which are undisclosed security holes. I think that they upload them there first and they probably don't want random people who aren't even Debian developers to find out about them. So it's an issue. I mean, I would really like to use that. I think that would be the ideal thing but in the short term I'd be just as happy with a simple app repository somewhere which we put packages in and push them out and our users can put it in their app sources line and use it.  Okay, great. So there's a few things which I would, if we can get back to the slide show here. Yeah. There's a couple of things that I would really like to just run through in the audience since there's so many Debian developers here ways that you can make our life a lot easier. And yeah. The most important thing and I misspelled it's not change logs, it's change logs but anyway, the most important thing that Debian developers can do is when you write a change log entry that closes a security hole list the can number in the change log. That just saves so much time and effort right there. If you don't have, if you have a security hole and you don't have an ID for it, then get one. And thanks to Matt, we have a way to get one and you can contact the testing security team also and we'll just do something until we get one. Very important, don't hide security fixes. Sometimes you may have a security hole and it hasn't been disclosed yet and you know about it and maybe in that case, you wanna make an upload to unstable and fix it and put in your change log entry, fixed man page or something. That's your call but it's just gonna make a lot of work for us down the road and we try to go back and figure out when did this actually get fixed and why isn't there anything about it in the change log and what is this fixed man page thing and where do we download a diff to see what he actually did and so on and it's just, I would personally think it would be better if you just waited until it was disclosed, uploaded to unstable or talked to the stable security team about it or something but it can be a real problem. I guess the next one's pretty obvious. It'd be great if everybody responded quickly to security holes. I think the important point is that you will be NMU'd if you don't. I have a list now. I know where the security holes are and whenever I have free time, I go through that list and make NMUs and there's zero day NMUs without any, you've got the bug in the BTS, I'm gonna NMU you. So, as far as I'm concerned, zero day NMU policy is in effect for testing for security holes until Steve or somebody tells me it isn't so. You may be waiting a while to hear that. Yeah. Of course the last one, the last way that you can really help is just to talk to us. If you see something on our page that isn't accurate or if you know about a hole that we don't know about which is publicly disclosed, please let us know about it. We're human too, we make mistakes all the time. We don't always catch the other person's mistakes in the team. So, the big one, put those CVIDs in the change log, put them in the bug reports, Matt. Yes, that is handy. Yeah, so Matt is pointing out that even though we have this new sort of list of security holes in testing, we do have the BTS and it does have the security tag in it and you should use that correctly and look over your package. If it has bugs which are security holes that aren't tagged as such, tag them and ping the security teams about it. I mean at some point, ideally we get rid of this temporary page which lists security holes in testing and we just use version tracking and the BTS to say okay, let's see which security, which bugs tagged security are still open in testing and then we can avoid some of this work that we have to do. Did you have a question? No, okay. So, the last thing I sort of wanted to talk about in this talk is how well we've done so far but it's a very hard thing to actually quantify in my opinion the big question which is how much more insecure is testing than Debian stable at the moment or the other way around. I've seen so many comparisons of the role of security of different Linux distributions and different operating systems and they're all just bunk in my opinion. So here's my try at it, which is also bunk. But, yeah, since the beginning of this year, every time that the security team, the stable security team has issued a Debian security announcement, I've gone and looked, is it fixed in testing yet? 50%, exactly 50% of them were not fixed in testing before the DSA came out. 37% or no, 33% were fixed in testing before the DSA, which is pretty good when you consider that we didn't know about some of these holes in advance and that the security team did. Then the 17% that didn't affect testing, stuff that was removed, stuff that, there's various things like that, not generally. This doesn't include packages that were already upgraded. Those are in the 33% number. And then I have two numbers which I have no idea what the correct value to put in them is how many of them, yeah, that's a good question. I have no idea what that one means. So, there's obviously a certain percentage of security holes that affected Debian in this year which didn't affect stable and did affect testing. And I don't really know what that is. Oh, I'm sorry, I know what this one, the affected stable with DSA, I believe that should be without DSA and the idea is that the fact of the matter is our stable security team doesn't fix every hole in stable. I'm sorry if this comes as a shock to you. But they look at, they prioritize, they sometimes miss holes. There's always a list of holes that they haven't fixed and it's basically always growing. Probably, yeah. Are they very obscure? Yeah, right. Like design flaws and stuff like that. And then there's also the ever-present bug in Mozilla which requires upgrading to the newest version of Mozilla to fix. And bug in Kernel which for some reason hasn't been fixed in six months, though, well. You know, huh? Oh no, of course not. I just don't run test, I just don't run stable on servers but I don't know if I should have said that on camera. I was asking if I'm bitter. Yes, that's true, my point is just as far as getting the numbers, yes, the question was shouldn't these be zero? Yeah, the last one. Yeah, sure. It should be zero in a sense. But my point is that there are security holes that didn't affect stable so it sort of outweighs the fact that yeah, we fixed 33% of all security holes that affected stable before the stable security team got around to it but the fact is that we had other holes that were affecting testing at the same time and so these numbers are bunk. And it would be great to come up with some better numbers, maybe actually look at the kernel security holes which are, you know, they tend to affect all versions of Debian pretty much. They tend to be pretty serious. They'd be a great thing to compare if somebody wanted to do it. Unfortunately, I didn't have the time to do it. He asked if I wanted to look at security or kernel security bugs, could I please involve the kernel security team? So Horms told me that if anyone here is working on kernel security bugs, please file bug reports properly, please contact the kernel security team. And we do do that in the testing security team because frankly, keeping track of kernel security holes is probably the hardest thing out there. It's a lot of work. They're very old defined often and so we pretty much just lean on the kernel security team for that. So, yeah. Scott asked if I file bugs on packages which the maintainer is clearly not aware of. Ah, well, yes. You'll see a few of which we don't, such as de-package. The issue that, yeah. There was a recent security hole in Zlib and it potentially affects de-package which embeds a static version of Zlib. This could potentially, I believe, cause de-package to crash de-package when it was queried or something. So we haven't filed a bug on that. It's just because we only found out this about two days ago and we haven't gotten around to it. I think we could do a little bit better at just filing the bug immediately. But, you know, yeah. That's definitely something we need to improve. I think there are a- And there wasn't and then we filed it with the bug number. I don't know if I need to repeat that but Micah said that, I mean, a lot of these bugs are actually bugs that we filed based on looking at the CV IDs and saying, well, the bug hasn't been fixed so we file it and that is generally our policy because otherwise it's just completely useless to have it in this list if there's no further information or if it, you know, if nobody else knows about it, it's just exercising futility. So, the next steps for us as a team are pretty much to try to get that repository that I spoke about up and running so that we can quickly push security fixes somewhere and to try to get the delay for security fixes down from whatever it currently is now which I frankly don't really know in general but in some cases it's been as much as 20 or 30 days for some holes down to, you know, three or four days would be nicer. And we'd really like to start actually issuing security advisories just like the stable security team does or even ideally in cooperation with the stable security team so that DSAs can say this is fixed in testing in this version. We're probably only gonna start out with supporting I-386, maybe a few other architectures and work up from there. And I think that's pretty much it. I guess if I have any questions from the audience I'll take them out and thank you. Does that say? Yeah, could you flip back to the slides? Sorry about that. Keep tearing Mike away from his work here. Okay, so this is our webpage. It does have a contact address. It's a listed alioth. Oh yes, there is a tool to missing. Well, I don't know latex, so sorry. Yeah, there's a tool before the JOEH, yeah. But yeah, this first page links to the second one so there's we, you know. The second one also links to the first one, but anyway. Any other questions? Yeah. Is it working? The scripts, the tools you have shown are generally for the whole Debian. And I would like to ask if there's any support for tracking bugs in a subset of packages which I have, for example, installed on my machines. That's a great question. A member of the team, do you remember who it was who was working on this? Don't forget to update the bug. I don't know what it is. No, it was already said. Okay, yeah, I don't remember either and I wouldn't be able to pronounce it if I could, but the basic idea is that we'll have something similar to App List Bugs which can actually go out and query our data and say these are holes which affect you now. Exactly, out of the packages you have installed here and if you're running testing or maybe even if you're running unstable since we also gather data for unstable, of course. These are the security holes that you're vulnerable to and since we have all this data in a machine-participal format, it should be fairly easy to do and it's already being worked on, I think, but if you'd like to work on that, that'd be fine. You can download all these files right off the web or right out of subversion, either way. Yeah. He said that there's an issue that on some machines he has untrusted local users on some he doesn't and that is the point. We don't actually, at the moment, differentiate between holes which are only remote holes and holes which only affect machines with untrusted local users. We started to move in that direction with the coloring here, but the coloring isn't particularly well-defined. It's just more of something, you really wanna work on the red ones first. So we could do that but it's gonna take more work on the part of the team as far as categorizing all these holes. So I think we'll probably see how it works out as far as adding these urges and maybe work up to more metadata that's more useful from there. So anything else? Anyone else? Question up there, Matt? So where I work, I'm often asked if Debian has a fix for a particular bug or if Debian is vulnerable to a particular bug and usually they'll give me the can number for that or some other number. And often I will go and I'll look at the change log and that kind of thing and sometimes it'll be in the change log but very often it's not and so I have to go in and actually look at the patches, that kind of thing. You guys seem to be doing a very good job of tracking down and figuring out the direct mapping for can numbers and that sort of thing too, the packages. Is there any way that you could somehow put that data, make that data, well I mean it's kind of available here but I would really like it to be in the package itself so that somehow I could look at the change log and know that for any given security hole that's opening in that package, whether or not the package is affected. Even if it just doesn't apply because it's not the right version or something like that, it'd be good to know that sort of information so I could very quickly determine that. Wow, that's cool. Yeah, you can also subscribe to the Commits List. Yeah, I wanna go to look at the package. I think the issue with putting it into the actual packages, often we don't find out about a security hole until it's been fixed by uploading a new upstream release of a package and so we can't really retroactively put it in but it is good to always put the can number in your change log because it does help but I really think that as far as your application goes it'd be better to just have a web front into our database and you can just query by can number then. And would it be bad to go back and edit the old change log entries? I think it'd be fine. I mean is that- Or just to add a new change log entry saying previous entry fix can blah, blah, blah. You know, it's perfectly fine to do that but it's sort of hard to enforce it on Debian. So the thing is that we have done in the past has been applied to the source if it's not listed in the change log. We might go look at the source and see oh, this has been fixed and then we just know. Michael said that sometimes we go look at the source to see if it's been fixed. I mean we basically go to as much length as we need to go to to figure out fairly certainly whether a hole's been fixed or not. So it can be a lot of work to figure that out. Yeah, I'm just trying to avoid duplicating that word because you guys are doing a great job of doing that. Yeah, and I mean we would also be happy if you are doing that work on any kind of a regular basis to give you commit access so you can go in and fix it if we get it wrong or added if we don't have it yet. So I think the pair's had his hand up for a while. Yeah, it's the one that put Joey to work on this task. I wanted to make a note in public that I'm really pleased with the results of my small job assignment to you. It's the result actually from a meeting in Spain we had, it's one and a half, two years ago where we decided that if you actually want people to use testing we need to get it secured and we decided in debut to get that done and try to get people to do it and Joey was apparently the right man for the job and it was fairly easy job description. Make a security testing team and make sure testing is secured. And while he hasn't quite succeeded on the last thing but we definitely know the state of it and how much work that's left to actually get it secure and it's a large leap forward compared to the previous state where everyone claimed that testing was really bad and secured and no one actually knew what kind of bugs were in there. So I would like to say thank you Joey for a great, great, great job making this happening. Thank you, Peter. I hope you're better than that. I'll give you a stand. You know, I also have to thank the rest of the team because it's not just me. I mean, I take a week off now and then it keeps happening and that's really good. And I think we have a question over here with Blar's. I'd like a list of the CVE IDs for a package linked on packages.qa.debian.org. That's a great idea. That's the perfect place for it. That's a great idea. And I think we had maybe one more question. We have another minute or two. I could, might as well just one, but whatever. I just wanted to say along the same lines is Peter's comment that when I first started talking about the idea of using package pools way back in 97 or so, AJ usually can quote the URL for that email message and I can't. One of the motivations for it in the beginning was not as a way to make releases easier per se but because I had the very definite impression that the vast majority of our net connected users wanted to run something that was fresher than stable and didn't want to put themselves at risk the way that an unstable of that time and an unstable since the release of Sarge can feel on certain days. And it's incredibly gratifying after what's now been what, eight years or something to finally see that part of the original package pools motivation and vision come to pass. So, dude. The testing security was this sexy, but okay. I find a way to promote everything. Okay, I guess we might have time for another question. Wow, great. Okay, I won't say AOL. Thank you too, of course. But my question would be, are there, from your point of view, are there any chances of integrating testing security with stable security and making use of the infrastructure which at least I cannot judge for the stable security and what exactly they use. I can see what you guys use and it seems to be working and maybe I think it makes no sense to have a duplicate infrastructure but maybe actually integrate this more and more. If you have a, I'm sure you've discussed this. Could you give us 10 seconds of... Yeah, I mean, I think it'd be great to integrate things both ways. I think that both teams have their strengths and when I settle to do things like this, I find it useful to do it from the outside and then work your way in. And I think that the fact that people now recognize that the test and security work is valuable is definitely gonna help convince people to make it more official and to integrate with the security team. But we do have the big divide here of disclosure versus non-disclosure and that's gonna just be an issue which is gonna cause problems as far as getting the two teams to work together well because the way we're set up, we really can't know about undisclosed issues. So it's definitely something that we need to work on going forward. That's all I can say. Okay, well, I think that I'm out of time now. Yeah, and how are we because we are taking the food picture now. Sorry, but thanks anyway for your quietness in the soup. For the nice talk.


Hey everyone, welcome back to Nintendo Prime. Now, before we jump into this video, we got some big stories for you. Six of them, we got Zelda, we got Metroid, we got Mario, we have a big bevy of news. Before we dive in, though, I wanna remind you that we are giving away a Nintendo Switch. Here's to the kingdom, Switch OLED Edition. Pretty neat, we're also giving away a pin from PAX East and a collector's edition, which I don't have on hand because it hasn't released yet. If you guys would like to enter, go down to the pin comment or to the description. Click on the link. We're drawing the winners this Friday on May 12th. And you know what, folks? Let's get into the news. First up, Nintendo is doing a giveaway. You know, we got our giveaway, they have theirs. They are giving away, hmm, a sweepstakes entry at the My Nintendo website that you can enter up to three times as 10 platinum points per entry for eight tiers of the kingdom prize pack. Now this tiers of the kingdom prize pack includes a Nintendo Switch carrying case. It includes the hardcover collector's edition guide book which we recently talked about. It also includes, huh, a one terabyte micro SD card, a custom Zelda controller, which I believe is a Power A controller. I don't think it's a Switch Pro controller, but I guess I don't know 100% because they don't provide the full details on it.  That looks absolutely incredible. All the rest of the stuff in this giveaway pack you can actually purchase except for that. And I think that that glass etched thing is a big deal because if you actually look at the full details of the giveaway, they estimate an over $2,400 USD value on this giveaway.  That must be a one of a kind, custom made thing. And I'm assuming it's huge. I mean, like here's the OLED box. I mean, it's probably at least this big, if not bigger. So yeah, I don't know, guys, that's just something that Nintendo is doing. And now we can move on to our next story. We'll have links down in the description, by the way, to enter that sweepstakes. Now here we have a rumor for you guys coming right off of the rumor mail. This one comes from Zippo. He's a much maligned leaker out there. Sometimes right, sometimes wrong. I don't really know, but he's talking and speaking my language, so I figured we'd talk about it here. He says four Mario games are done and Nintendo is sitting on them.  One of them is a brand new 2D side-scrolling Mario game. Okay, somewhat believable. We've had rumors on that before. One is a remaster of Paper Mario Thousand Year Door. Again, apparently done. One is a Mario sports game that he heavily suggests is like Mario Sluggers, a baseball game. Okay, that's possible. And the other is a Sonic and Mario at the Olympic Games or Mario Sonic at the Olympic Games. Now they're just sitting on that as well. Now that one could obviously be timed to be more around like Winter Olympics, so it could be understandable why maybe they're sitting on that one, but it's kind of interesting that Nintendo would be sitting on all four of these. Remember, Nintendo's slate dries up entirely after Pikmin 4, besides DLC, so they gotta have some games coming and maybe some of these Mario games are it, maybe they're saving them for their next platform. Why we don't know about these? I don't know. We've had rumors for at least a year now that Nintendo is just sitting on a bunch of games and Zippo's claiming it's these four. I guess we'll see if that's the case. I don't know. Someday this year, next year, I don't even like, how do you prove a rumor like this? You just, if all the games happen, I guess he was right, but then if they're sitting on it, like wouldn't it matter when they come out? Look, I don't know. It's a thing. It's floating out there. Figured I'd bring it up. Next up, we have to talk about this thing right here, not because we're giving one away, although we are, but because this thing has caused a surge of sales in the UK. We now have April sales data in for the Nintendo Switch, and while it is still in number two slot behind PlayStation 5, it actually saw a 26% increase in sales in April over March and a 30% increase in sales over April of last year. Now, what also ended up making up the majority of those sales? This thing, that's right, 29% of all Switch sales were the Nintendo Switch Zelda Edition OLED. So, needless to say, that did help boost sales at least for a singular month. Won't be surprised if it helps boost sales a bit this month if there's more out there as the Zelda game launches, but yeah, that's a thing that happened. And look, the Switch is going to be in decline. For a car, we'll let us know yesterday that he doesn't really see any way to turn the Switch around. It's going to just keep declining. He's probably right. We are in the swan song years of the Switch, the end of the line, probably time for a new system, but who the hell knows when that's going to come? So, for now, let's just enjoy tears of the kingdom coming out this Friday, because that's what matters in the year end now. We have a bit of news from Hollow Knight Silk Song, and unfortunately, it's not the news you probably wanted to hear, or maybe you did, because there was always a silver lining to news like this, and that is because Hollow Knight Silk Song has been delayed. Previously it was shown at a Microsoft event last June, and they said everything at this event's coming out in the next year. And Hollow Knight Silk Song was surprisingly announced there. Well, here's the thing. We got some notes here coming from Twitter from Matthew Griffin, who handles marketing and publishing for the game. He said on Twitter, hey gang, just a quick update about Silk Song. We had planned to release in the first half of 2023, but development is still continuing. We're excited by how the game is shaping up, and it's gotten quite big. So we want to take the time to make the game as good as we can. Expect more details from us as we get closer to release. Of course, you didn't mention how long that delay is going to be, but it is a delay. It is unfortunate. Obviously, we'd rather a delayed game happen and get a better product in the end. A lot of people think sports story last year should have been delayed for a better product. But what are you gonna do? Eventually a game doesn't have to come out, and it just seems like every time we get a smidge of news about Hollow Knight, it just seems to be how it's not coming out. It's very weird. So here's some random fact for you. Breath of the Wild just got a new award, apparently, from GQ Magazine. That's right, that men's health magazine, or is it a fashion magazine? I don't know. I've never read a GQ magazine. But the point is they put out a top 100 video games of all-time list, which apparently was based on 200 experts. We don't know who those experts were. And Breath of the Wild was number one. I mean, seriously, Breath of the Wild was number one. It beat out Last of Us, which was number two, the furry first one. It beat out Tetris at number three, Bloodborne at number four, and Witcher three at number five. Now, that top five is a pretty banger list, but man, seeing Breath of the Wild number one after all these years is crazy, especially since we're hopeful that Tears of the Kingdom is an even better game. So, hey man, congrats to Breath of the Wild, and let's get into our next story. So our last story comes from Nate Drake over on the FAMY boards, and it deals with Metroid Prime 4.  I actually heard from a source a couple of months ago that Metroid Prime 4 is done. I never really put it out there, but my friend, Andrus Restart, definitely did, and I wanna get full credit to him for reporting on it, so I'll link to his video down below. But yeah, Metroid Prime 4 is done. That's a game that Nintendo is reportedly sitting on. That's what I have heard. Well, Nate Drake has come out to talk about a few things, and I wanna make sure I quote him correctly because it's context matters, and here's what he put out there. He's a well-known leaker out on FAMY boards. I do know of unannounced stuff slated for this year. I'd suspect we see Prime 4 no later than September of this year if the fiscal year remains the intended target. If the game moves beyond that, then they could opt to hold it for an early 2024. Correct. Now, when someone asked him if this was just speculation or something he's heard, he said it's more of the former with a bit of the latter, essentially meaning that he's heard it's coming out this fiscal year, and then he's speculating on when that might be. So, hey guys, that's pretty cool. Obviously, it could be delayed. They could push it. They could decide to launch it from New Harbor. They could do a lot of crazy things, but it sounds like Metroid Prime 4 could be a big deal for this year. If I just had to guess, I don't think they would push this as their big game to come out this holiday, but who knows? We did get Metroid Prime Remaster just randomly dropped, so Metroid Prime 4 coming out in the same year does make a little sense. I would like to see two and three before that, but it doesn't appear that's gonna be happening anyways anytime soon. So, you guys want me to know if you think about all this news down in the comments below, whether it's Zelda, whether it's Metroid, whether it's Mario, how the hell did we get news about all three things in the one video?  Sometimes the news just comes as the news does. Thank you so much for tuning in and I'll catch each and every one of you in the next video.