Rhaid i'w ddweud y ffordd yn ystyried, felly mae'n edrychwch ar y ddweud. Felly y ddweud yma maen nhw ydweud y freartos cyfnodwch ar y prosiect. Rhaid i'w ddweud hynny, mae'n gweithio'n dod yn fawr o'ch mwynhau'r bwysigol cyfnodwch ar yr arfer o'r ffordd o'r ffordd o'r system. Why are we using anarthos? The benefits of using anarthos means we can make the design more modular. It's very good if the parameters of your project haven't been completed. It's also very easy to add and remove functionality if you decide it's no longer important. We want to use the anarthos so that we can add more functions, as we add the FATFS, the text on the LCD, the push buttons. We can add all these things as one-off individual sections rather than having to modify a big list of code. It's available to us. We can do it. For this particular example, we have far more flash and RAM and performance than we actually need from the device. This particular application is not really going to push the STM32-L4 to its limits. We're just using it so that we can show you how to develop an application using the freearthos within the CubeMX environment. Some of the basics of anarthos. Conventional code would be a linear bank of code with a switch statement doing all the various functions. Each of those tasks in the switch statement are now classed as an individual thread or task within the arthos. Each of these arthos will have their own small amounts of stack. Each thread will have its own small amounts of stack available to it. Each of these will have their own routines and own while one loops inside. Some basics on the arthos. We have different modes. We've got thread mode and handler mode. Every time each task finishes its time perimeter it's been assigned, it then moves on to the next thread. You can set things so that they wait for other threads to be actioned as and when they're needed. You can play around with the functioning and signalling and messaging within the arthos itself. A signal is a way of sending one bit or a condition from one thread to another thread. If you want to send more information then you can use a message so you can send a full 32 bit value between different threads that are in the system. The final way is you can use mail or a mailbox and that means you can send a whole block of memory between different tasks or threads within the system. There's different ways of transferring information between each of the different tasks that are running in the whole application. Quick introduction to how it sits. FreeArthos is bundled inside the Cubimx. It's usually the latest version that we've ported to the STM32 and every time we update the libraries of the Cubimx if there's a newer version of FreeArthos we'll add it at that point. Normally your application code will sit at the top and your main code will go through into the arthos in one direction, interrupt and manage slightly differently in the Arthos API commands. They are taken care of slightly differently so that you don't lose the benefits of an interrupt-based system just because you're using the Arthos. There's two more very useful documents that we have. There's the user manual 1722. It shows you about developing applications using the Cubimx and then there's the FreeArthos website as well. There's lots of information there on the freearthos.org website. Back to our cube environment now. We're going to add the FreeArthos to our project. To do that we can do it from the configuration tab and enable the FreeArthos. If we go back to our cube project and I'm already in the configuration tab I'm now just going to enable the FreeArthos and you'll see it's now appeared as another middleware available to us for configuration. We'll now go and configure the parameters of the FreeArthos. In the config parameters tab we need to set the heap size for our application to 32,768. If I go into my cube FreeArthos and configure parameters and if I scroll down to my total heap size I need to change it from 3000 to 32,768. Apply and then so now we need to add some tasks and queues so we need to select the tasks and queues tab first we need to modify the default task so this will then become our app task. It will have a priority of normal a stack size of 4096 and the entry function will be app task body. If we go back to our tasks and queues tab in the cube we want to modify this one so you need to double click on default task so we're now going to change the name of that to app task priority is normal our stack size is 4096 and our entry point is app task body and capital B for body and then we can okay that so that's our default task amended to become our application task. We now need to add a new task which will be our usb task so again we fill in the various parameters stack size for this one will be 256 the priority for this one will be high and the entry function will be usb task body so if we now go back to our cube we want to add a new task so it's called usb task with a capital T our priority is going to be high our stack size is 256 and our entry point will be usb task body with a capital T under capital B in task and body so there we go so we've now got two tasks added to our freeartos settings so there we go so this is what you should now have in your freeartos so we now want to generate our code again but again do not open the project until we've done the patch to add all the actual application parts of the code so I need to go into my IAR that I had originally and close it first and now I want to OK that and project generate code so there's a warning message being brought up by the cube environment telling you when freeartos is strongly recommended to use the hal time base other than the sys tick do you want to generate code so we're going to say yes because the whole point of using the sys tick is so that it doesn't use a resource on the device itself so the sys tick was specifically designed for running OSs the reason why cube is warning you that is because you have no way to change the value of sys tick so it is a fixed duration whereas if you went to a normal time base then you were able to control the duration that you put into the freeartos but we're happy to use the sys tick so we will say yes to generate code and as we said earlier we don't want to open yet because we need to apply our patch so I'll say close to that and again we need to add some source files which contain all the various elements that we are using the freeartos.c with all the contents in there to do the control of the freeartos the usb control because we've now added a usb task into the freeartos and because we're using the sys tick now to control the freeartos we are making use of the interrupt for the sys tick timer so those are the three files that we need now need to patch into our created project so if we go into our project so section 2 the patch this is the artos section so there's the three files that we need to select and they now need to go into our audio player source file paste those in there copy and replace for all of them and that is created so we're now going to our eWarm and launch our project EWW


We're gonna practice diving in, high, and then circling slow. So start from a high altitude, that way we can get the entire scene, control your throttle, and also center your subjects, keep the throttle chill, get as close as you can while circling them. One more time. All right.


When I felt my phone vibrate and I got that call, I feel like my body just went and shocked, my heart dropped. It was something I'd been with you for my whole life. So when I seen the area cool to Atlanta, Georgia, I was like, it's happening. Hello, appreciate the opportunity. I'm ready. Go on to Atlanta. When I hung up, it just was like, everything happening once all my emotions came out. The Atlanta Falcons select Kyle Pitts. And I was just like, I'm now at the next level. It's time to boss up a little bit more. So now that all the draft stuff is over, I'm ready to get back to working, make a name for myself at the next level. When I realized I was a unicorn, was when I would just say like, going through this past season, I felt like I was doing things that after the game, I would like sit down and watch the tape. And I was like, that was pretty good. I wouldn't realize it in the game because it's just like instincts and certain things just happened. But just to realize I feel like my game was starting to go to another level. And now that was in college. So now that I'm in Atlanta, I kind of want to take it to another level. You never really hear of tight ends going top five. And to be the first ever is something that's special. I feel like I could do different things that other tight ends can't. And I felt like it's my knowledge of the game. I take a lot of time and preparation to, in order to win my matchups and just whoever I'm going against. I feel like once I know what you're doing, I feel like I can counter and make sure I win every rep. You just think about just balling every day, being the best player. You can be first one in the building, last one out, you know, making sure that you're doing everything right. Then everything else to take care of yourself. But to think of, I have to do something to prove myself now. I just didn't go out and ball, then everything else to take care of yourself.


Thank you all very much. I hope you've gotten the decent lunch, and I hope you can provide some decent food for thought. In honor of the setting in the Federalist Society's traditions, I'm going to make my case largely in an historical way. The question on the table, as Yaron and I understand it, is a two-part one. What principles should inform governance role in the economy, and how far can and should government redress economic problems? I start with a simple principle which generally goes under the banner, not of egalitarianism writ large, but equal opportunity. It seems to me, if one's looking, not for the theoretical best possible world, but simply the ideal with respect to economic life that most animates American legal and constitutional culture, one is drawn to equal opportunity. My own account of equal opportunity, again, is an historical one drawing on a tradition which Professor Joey Fish, and many of you know, and I call the democracy of opportunity. It is not an ideal of perfect equal opportunity. For the simple reason that perfect equal opportunity is simply too hard or well-nigh impossible to attain, but a democracy of opportunity, as far as what government should be doing in respect of economic life and economic inequalities, means roughly the following. There should be, and government to its utmost, should strive to attain a broad middle class, not simply a formal, formally available middle class, but a realistically attainable middle class life in terms of the distribution of society's economic goods in exchange for, you know the refrain, hard work, contributions, engagement with the production and reproduction of social life through hard work. That's the heart of the matter. And the other principle with respect to a democracy of opportunity, in addition to looking to the middle, is to look at the top and to say, again, I think deep in the American brain that our elites, those who enjoy the greatest wealth in our society, the avenues to wealth and distinction in a fair and just American economy need to be open. Our elites cannot, our economic elite, political elite, they tend to march together, cannot be a essentially hereditary one. Just as the Constitution was framed to upend aristocracies of the old school, so from the very beginning, our American founders talked about a moneyed aristocracy or an oligarchy as a peril to the Constitutional Republic. That the kind of political economy we must have is one where, free from oligarchy, one in which not withstand the absence of any old-fashioned legal aristocracy, there can be an elite that essentially entretches itself and reproduces itself over time by the kinds of advantages it's able to enjoy in respect of access to the gateways to opportunity. So that in broad strokes is the kind of political economy and the kind of broad principles that should inform how government addresses economic inequalities. Often in the early Republic, that meant, surprisingly enough to many, initial endowments as economists today recall, that there was a fairly robust commitment to initial endowments of certain social goods, what you might call not redistribution, but a predistribution of certain things that seem broadly understood to be indispensable to a democracy of opportunity in the old days, in the early Republic, that was land, either land in the form of homesteads, or, as James Madison said, government can't spend too much energy taxing large estates in order to ensure that there be, indirectly, broad availability of cheap good land. Land is no longer the foundation, the material foundation for a middle class life and a measure of economic independence, and over time government, or this tradition of government's duties, has looked to other ways of a fair predistribution of certain basic social goods. One that's been almost uniformly agreed on is a decent education, and what that means over time has obviously changed from common schools that don't go more than four or five years to all the way through high school, and today we tend to think that a secure middle class life requires post-secondary education as well, and there's obviously much political and social ox about the accessibility of post-secondary education in the Americans with the economy today, but it seems to me that that too is one of the endowments that all Americans must have in order to have a fair chance, not an equal chance, but a fair chance at a middle class way of life. So, how much time do I have left? Who's timing? Four minutes, okay. So, I would underscore that what government can do involves both making sure that wage earning jobs are jobs that Americans can make a decent living, and then entrepreneurial opportunities as well are as wide open as a sort of industrial economy can make them. The latter project we often think of as an antitrust, anti-monopoly, that those kinds of laws that government administers and makes available to private litigants have to be aimed not simply as many economists these days would say at consumer price concerns as important as those are, but also at ensuring that not simply individuals but corporate actors don't monopolize opportunities in various growing sectors of the economy. To my thinking, antitrust has a kind of constitutional and fairness dimension to it, and certainly again historically that was the case. And in respect of wage earning jobs, I think in the real world, empirically it's proved to be the case that the kind of precipitous decline of unions has been one of the underlying causes for the remarkable diminution of wage earning jobs that have gained people a middle class way of life. To my thinking that needs to be repaired. There are many problems with unions as someone who knows well I'm the first to underline that, but I don't think that simple command control, minimum wage laws on government's part can do that much of the heavy lifting. So that's a fair description of my position. It's not outlandish, but neither is it obviously all that popular today, or we wouldn't have the present president. So I stand before you kind of old fashioned, but I wouldn't say unreconstructed, sort of New Deal liberal for the 21st century. Good. So just referring to the last comment, I just want to be clear that I am not here representing Donald Trump or have anything to do with that part of the political perspective. So I honestly take a very different perspective on the role of government and on politics. I find it troubling and somewhat strange that the role of government should be revolved around classes around what we should do with lower class and what we should do with middle class and what we should do with the upper class. And I find that quite disturbing in terms of the attempt to manipulate that kind of thing.  And a big chunk of the shrinkage of the middle class right now is a consequence of the way the statistics are done. A lot of those people are now richer and therefore not defined as middle class. Is that a good thing? Is that a bad thing? I think that's great, even if it means the middle class is strong. I take an individualistic perspective on this. I take the perspective of I'm interested in individual human flourishing. And I'm interested in the political system and the role of government that allows for individual human flourishing. And to me, it's unequivocal that individual human flourishing is a consequence politically, a political freedom of governments that respect as a primary individual rights, individual rights as understood, I think by the founders, as understood as individual freedom, as the freedom of the individual to pursue the values necessary for their own survival, for their own flourishing, for their own success, free of coercion, free of coercion from their neighbor and free of coercion from the government. Individuals left free and that the role of government, the role of government is to leave them alone and to protect them, to protect their freedom, to protect them from coercion from fraudsters, coercion from criminals, coercion from foreign invaders and terrorists, and to resolve disputes, to do what you guys do, right, to adjudicate disputes. But other than that, leave people alone. Now, it is interesting that this is also to the extent that this kind of political system is practiced, called a capitalism, free markets, is also to that extent that you actually get a middle class. That is, a middle class is not a creation of government. The middle class is indeed a creation of markets. It is a market phenomena. There was no middle class before capitalism. There was no middle class before the rise of capitalism in the late 18th century, early 19th century. It is a phenomena of the industrial revolution and everything that enterprise. And indeed, there was no middle class in China until China freed up its markets even a little bit. There was no middle class in South Korea until South Korea went a little bit at least towards capitalism, towards leaving individuals free to pursue the happiness. Not far enough, and I'll be the first to admit, my specific political system has never been tried fully, consistently. That doesn't worry me at all. The American political system was never tried before it was tried. So, we're still young as a human race. There's still a lot in our future, and I'm convinced that one day I will win. So, my whole approach to this is focused on individual freedom, on individual liberty, on leaving individual strength. And indeed, such a system is a system in which you get a lot of these results. A, you get a middle class. But B, what you get more importantly is that mobility. You get the ability of poor people to rise up much more than you did in the control economy, much more than you do today. Cronism, one of the real problems that we have today when we look at wealth is the idea that that wealth wasn't earned. It wasn't created. It was derived from political influence, from what we call cronyism, and that I think we will share as something that troubles us both. I would suggest that the only way to get rid of cronyism is to get rid of government power over the economy. The only way to get rid of influence of business over government is to get rid of the influence of government over business. The smaller government is, the less incentive I have to lobby. There's a famous Microsoft story before, in the mid-90s, Microsoft was invited in front of the Senate. Aaron Hatch was the residing senator, Republican from Utah, still is there. And he yelled, literally yelled, at Microsoft executives, you guys need to start lobbying. You need to build a building inside Washington, D.C., and you need to be involved in the political process.  And in those days, Microsoft spent exactly zero dollars on lobbying. Six months later, the justice abounder comes knocking. Antitrust violations for giving a product for free. I reject the idea that utter trust is a good thing. I think it's an awful thing. I think it's a political tool used selectively against companies that piss off politicians. It always has been that way. That's why it's so vaguely written so that almost any business activity, in some way or another, I mean, the wrong audience to get into the argument about antitrust. But from a philosophical perspective, it's a violation of the individual's liberty. If you're successful, cool, you should be, you should be, you know, held, not prosecuted for your success. So I guess I'm getting antitrust. For saying we're not going to be involved in politics, guess how much money they spent today on lobbying? Tens of millions of dollars a year, they have one of the nicest buildings in Washington, D.C., right equal distance between the White House and Congress, right? So you want to get rid of cronyism? I'm all for that. Get rid of the government's power over business and business will leave government alone. So my concern at the top is certainly cronyism. My concern with the middle class is not so much the size of the middle class. There's no optimal size. Who cares, right? My concern in the middle class is there's no economic growth today or there hasn't been economic growth or very much economic growth in the last 15 years, 16 years. And the reasons for that, and as an economist, the reason for that is pretty obvious, the size of government, the level of regulation, the level of taxation, all of that has restrained economic growth. Economic growth is easy to attain. And if you look at history, if you look at economic history, every country that reduces regulations, cut taxes, gets economic growth. That's easy. We have other reasons why we don't do those things, but they have nothing to do with the need for economic growth. So many of the redistributive programs done in the name of leveling inequality actually reduce economic growth. And then finally, I am concerned with poor people, right? I find this focus on the middle class a little strange. I care about poor people, particularly ambitious poor people who would like to rise up from poverty. And then the question is what kind of system allows poor people to rise up from poverty the easiest, the simplest, the smoothest. And again, it's a system of freedom. It's a system which has no regulations, which doesn't restrain the individuals into what they do. So you don't need a license to shampoo hair. You don't need a license to braid hair. You don't need a license to open a nail salon. You eliminate the barriers to entry for young employees and you don't have a minimum wage because all the minimum wage does is it drives people away from the workforce. So demand for low-skilled labor gets reduced. The incentive for automation increases. We can go into the minimum wage if you really want to, but the economics here are pretty settled. Although not based on some economists, but they really are pretty settled. So, you know, in every economic issue, what I perceive as the moral is consistent with the practical. That is freedom, focus on the individual, focus on liberty actually produces the best economic results and the kind of economic results that create a fight with dynamic economy. So because I wrote a book on inequality, just a word on inequality, the gap, the difference between the wealthy and the poor is irrelevant to any discussion. We've got problems with the top cronyism. We've got problems with economic growth and we've got problems with lack of mobility at the bottom. None of those have anything to do with the gap. The gap is an economic nothing. It's insignificant in spite of Thomas Piketty's big book. It doesn't mean anything. It has no moral significance because if people actually made the wealth, they created the wealth, then it's theirs. Morally it is theirs and if they create $70 billion of work to themselves, good for them. If they create $1 billion, good for them. If they create only a little bit like some professors and some teachers, that's good for us. It's ours. It's whatever it is that we create. That's what we have. Some morally and economically. The top is not a problem. And again, for the bottom to rise up, what we need is more freedom. That creates opportunity. That creates the fight with the economy that makes that mobility possible. Thank you. Good. So I think, not surprisingly, Aaron and I share the fundamental liberalism even though we take it very different directions. So it is not the good of any particular class that concerns me or the system of thought I would share with you. It's individual flourishing. I think there's little quarrel in terms of certain first principles. So maybe let me make three points. First of all, sort of in respect of how the framers, the kind of classical liberal and Republican traditions understood freedom. We also agree not only in individual flourishing, but on freedom as the sort of guiding principle. But freedom in the tradition that our Constitution, Declaration and fundamental traditions have emerged from freedom had two faces. It was the freedom from an overbearing government, but it was also the freedom to govern one's selves. And it was always the case that that latter freedom was understood to require a material foundation. That it was thin to a breaking point unless the individuals who were constituted as self-governing citizens of a Republican society had the wherewithal to stand up to their so-called betters. So the problem of freedom isn't just a freedom from an overbearing government. The problem is it's also a freedom from overbearing social actors as well. Which brings me to the second point. This tradition is not sort of hardwired to look kindly on overbearing centers of power for as long as the economic landscape only had the threat of landlords as the big overbearing powers. The answer was, as I sketched at the beginning of my talk, measures to make sure land was publicly distributed. But very swiftly, first banking and then other corporate actors emerged as other centers of power. So that the problem and the paradox of this liberal scheme that Ron and I have in problem is one to which antitrust I think was give or take an inevitable response. The paradox was as the nation became an industrial society. You saw growing concentrations of capital. It became legally and conceptually laughable, if Ron will forgive me, to think of US Steel as the sort of product of one gentleman's effort. It's no longer possible to think about the key economic actors in our society, whether it's Google or US Steel or Chevron or the other large corporations as somehow the rightful sort of results of individual efforts to which the major shareholders are entitled as a sort of first order moral matter. It has to be a more pragmatic approach when wealth takes the forms that it does in modern society. And so we have to deal with not one but two. Worries. One worry is that government becomes the vehicle for self-aggrandizement or oppression. But the other is that private actors and specifically corporations in our scheme of things become precisely the same thing. That's the central insight of legal realism. That the problem of coercion, which Ron and I agree is the central problem of one of the liberal thought, doesn't neatly fall under the rubric of what government can do to us so that if we shrink government, everything is okay. The problem is if we shrink government, we're left without any countervailing actor to ensure that corporations and large concentrations of wealth don't translate into exploitation and immiseration in the economic sphere and domination and coercion in the political sphere. And that is why as much as it would be a tidier and more elegant system if we could simply worry about shrinking government, we also have to worry about what we do with the fact that there is nothing hardwired in the capitalist economy to ensure that there will be sort of the kind of mobility and broad distribution of goods. That, you know, Ron and I think, all things equal is what you want. So we agree that, A, the middle class is the product of the capitalist revolution, there's no dispute there. The question is what you do when the middle class is no longer a broad sort of self-sufficient group of agrarians, but instead, the product of a whole system of really nearly collective actors and governmental involvement in economic life. There is no escaping that. Property, as the realists told us, contract all the great institutions of private economic life, which we both cherish, are themselves the creatures and constructs of government. There's no sort of escaping that. And the question is a pragmatic approach that is neither pro-nor-anti-government nor pro-nor-anti-private actor, but instead says, show me the results. So, I would say one of the great flaws in the founding of this country, and among the founders thinkers, thinking, was a lack of differentiation between two types of force, two types of power, economic power and political power. The founders had this and one of the consequences of the fact that they were fearful of economic power is the banking system that we inherited from them, which has been, for 240 years, pretty much a disaster. We've experienced 12 banking crises because Jefferson won the argument about banking concentration of banking power, whereas Canada, which had much free of banking system from the beginning, has had zero banking crisis during that period. There's a fundamental difference between economic power and political power, and the difference is the gun. Politics is about force. Politics is about coercion. Politics is a gun. If you talk about endowing people with some kind of starting wealth so they can start out with something, well, that has to be taken from someone, and the only way to take it is with coercion. If it was done voluntarily, I'd be all fine with it, but the fact is that the only way to give somebody something is to get it from somewhere, and the only way to get it is to cause somebody to give it. Political power is the power of coercion. I think we can all agree on that. Economic power is the opposite. The essential feature of economic power is voluntary action. It's voluntary exchange. When I buy a Microsoft product, it's because I want a Microsoft product, and I'm willing to pay $100 for Microsoft product because it's worth more than $100 to me, and by its very nature that trade is a win-win transaction, and indeed it is, yes, Microsoft made $70 billion for himself by having billions and trillions of transactions with billions of people that were all win-win where everybody is better off, right? And you can walk away from those transactions. I, since my days at UT, have been an Apple user. It's been hard. During the dark days, it was hard, and I resisted Microsoft, right? I didn't want a Microsoft product, and I succeeded. And others succeeded in other ways resisting Microsoft, because you can. There is a hard-wired system that corrects for the economic power that becomes exploitative. It's called a market, and it works. It works much better than any other system, and indeed it is what protects us most of the time. The marketplace corrects for if Microsoft gets too big and its products suck. It's called competition. When JD Rockefeller had 90% of all over fighting in the United States in the 1870s, the only reason he could sustain that was because every year, you can go back into records and find it, every year prices went down and quality went up. But at the time the antitrust was passed and they went after him, and they bulk-standed oil up, he had less, he had about 20% of the over-financing capacity in the United States. Why? Because of competition. You can only sustain 90% for a while, and even then the only reason he could sustain it for as long as he did was because he was so good at it. That's the beauty of markets which you cannot replicate by any other mechanism. So, economic force, economic power is a good. It's not coercive unless it mingles with political power. And yes, I'm all for finding ways to prevent business from gaining a gun from gaining political power. The only way to do that is to make politicians not have access to the world of business. So, in my constitution, I could ever rewrite a constitution, right? I would have a separation of state from economics. I don't think the state should have economic policy. I don't think the state should be involved in economics. One I owe, they should help define property rights and arbitrate disputes and leave us alone. Leave us alone. They don't need to regulate how we do business markets. Do it great. They don't need to tell us how much we should earn to none of their business. Because the only way to intervene in markets is by use of a gun. And a gun does not belong in voluntary human transactions unless there's fraud, unless a gun is being introduced by one of the actors. So, I am for 100% free market, a market in which people voluntarily can exchange and interact free of government coercion and free of coercion from their fellow citizens. So, we can talk, if you have questions, I'd love a question on education because this early endowment is important and we should talk about it. But, yeah, so I think I'll start. We'll take questions. I'll moderate the questions. So, does anybody have any questions for Dr. Krupp? This is a question for Dr. Krupp. Do you mention the degree for the minimum wage and how all the events are near that? They had to express some medicines to actually go into the realm. But my question is sort of broader. It speaks to the minimum wage issue, but more generally, given your economics and political theory, how do you deal with what amounts to the collective actions problem? So, for instance, as a people we might not want like Nike or anything, but when it comes down to it, we really want to buy a cheap pair of shoes. So, we have like competing desires with us and we need someone to tell us that we can't buy shoes. So, I don't have a competing desire. My only desire is a Nike, not enslaved people. Not with them, not used force. We talk about coercion, not coerced people. But I actually believe that sweatshops, if you want to use the term, in Indonesia and Malaysia, wherever they are, are wonderful things. Because they enable Indonesians to get a job instead of dying of starvation. Which is the alternative that they face? By the way, the same alternative that we face in the birth of capitalism, and that's why wages were so low, and that's why you had child labor. It's because there was no alternative. There was nothing else they could do. There was soap work. The alternative was either work, children work. They've always worked. They work in farms. Throughout human history, children have worked.  Half of them tend to die before they reach 10. Today they get to live because, well today we're rich enough to educate our kids. We want Indonesia to get rich enough or whatever the country is, Vietnam or whatever. Rich enough, so the parents, instead of sending their kids to work, instead of sending kids to school. That is a function of wealth, not a function of Nike. Nike has influence over the decision whether children work or not. The people who have an influence over that are parents. And the parents make that decision in the world, so laws that forbid child labor, this is a well documented, always happen. Once income of the lowest kind of the poorest people reaches a certain threshold, and as soon as that threshold reaches, parents are pulling their kids from the labor force and putting them to school, government then decides to be their so-called good guy and passes a law. Same thing happened in England, same thing happened in the United States, by the time the laws passed there were almost no children in the work force. So, my view is these countries need to go through certain stages and want to achieve wealth. I don't want to deny them those stages because otherwise what I'm doing is institutionalize them into poverty forever. And I think this is what happens with a lot of these policies, like minimum wage. We think we're doing something in your favor by raising the minimum wage to $50 an hour. But what we're actually doing is we're taking the worst up, the least educated, the people with the lowest skill level and saying you will never have a job. Because how do you get to produce $15 an hour? Let me tell you something about your employers.  They will pay you just a little bit less than what you're worth to them. And you will be willing to take it because it's worth more than your time, any other alternative that you have. It's a win-win transaction. That's true at the minimum wage as well. An employee can only produce $7 an hour. Let's say he's producing an 8 so I'm paying him $7. I'm never going to pay him $15. Ever paying $15. Unless I can raise costs. And if I can raise costs since everybody's here, then I'm just penalizing him and his family because of the people buying from me. So all of these policies, and I would say all of them I will take them one at a time if you want. All of these policies are supposed to help people like let's stop buying Nike because they have low-wage workers in Indonesia. Land up hooting the people that supposedly you care about. But I think we don't really care about them. What we care about is our middle-class conscience and feeling good about ourselves is what I think we mostly care about and we evade the consequences to the really poor people who need these jobs, who without these jobs would really be suffering. So it's one of the elegant if you listen to kind of libertarian economists like Aaron you'll hear again and again what English teachers call a trope of these measures totally hurt the people they supposedly are meant to help. And as a theoretical matter as a kind of theoretical description of a free market, sort of a global free market economy that makes a lot of sense. Aaron's story as simply a just-so story is I think unassailable. I think in the real world the the facts on the ground are a great deal more complex and run against many of the things that your own has asserted. So the impairments of minimum wage certainly in the U.S. are a much more complicated story. Wild increases in the minimum wage as much as the people who live on it would like them do suppress the number of jobs in a regional economy or a city's economy. But the ones which the just-so story of this will only hurt the people at the margin who you're trying to help simply isn't worn out by the facts. But that's a deeply empirical question. Let me put that on the table and say that it is likewise the case when one looks at the global economy that there are many other factors that go into the determinants of what the wage level is like amongst Nike subcontractors. They have to do with many other factors including the regulatory regimes and the law that obtains in the given jurisdiction where Nike is producing. It is not the case that the Bangladeshi child laborer short of slavery but nonetheless working 12 hours a day at 12 years old will necessarily be worse off if Bangladeshi's unions or legislatures and whatever global institutions attend to them manage to boost the wage. It all depends on a great empirical factor. But let's get to a more conceptual level. Keeping the gun and the economy separate is just not on. Why is it that the workers in the widget factory go to work for whatever is on offer when one's what's on offer is less than they want. Well, Yaron says it's until win-win. They still are better off than if they didn't have the job. But the other question is why don't they simply go in and make the widgets and share the profits? Why don't they sort of go into the plant and make the widgets themselves? The answer is because they don't own the plant. Well, how is it that the owner enjoys the right to refuse to let them in except on his or her terms? It's the gun. Who wields the gun? The state. There is no institution of private property nor any institution of contract. The building blocks of this world of win-win private and coercion free is all at the point of a gun. We can't have I don't say this as a critique but just a fact of the matter that coercion is as invigorated in any free market capitalist economy as any other kind of social order. It makes no difference. The important question is how much net liberty, how much human flourishing how much freedom and innovation you have with what particular arranger. But any arrangement is going to be at the end of the day at the point of a gun. So, as a theoretical matter, I can't imagine as much as I'd like to a sort of social economic order that isn't entangled with coercion and the problem of choosing what forms of coercion what kinds of rights and duties yield best human results. There's no other way around it. It's why we lawyers get to pay the big bucks. It's because you can't just have an economy and wish away or assume away the laws to constitute private property at the point of a gun. And that being so, finally the bargaining power that the Bangladeshi workers enjoy vis-a-vis the subcontractor is similarly not sort of just hardwired into some free market. It has to do with all the details that we lawyers love so much about what it means to be an employer or an employee in any given economic order and that will make a world of difference as to what share of the profits of the Nike factory the workers, the contractors the owners, the landlords the lessees, the managers all enjoy. You can have an efficient humming shoe factory with many different arrangements but how much the working people get is a function of the particular legal ones. It is also just blackly not the case that economies with the lowest taxes and the least regulation thrive the best, right? That is a dense empirical question as well which we can go into if anyone's interested but I'm here to just push back against Aaron's live empiricism. You can respond really quickly. The important point I want to respond to is the coercion point. As I said there are many ways to protect our rights. Somebody built a plant. Property rights are not granted to us by government. They are defined and protected by government. So the outline of the property is defined. Somebody built that plant. Somebody bought the machinery for the workers to walk in and take it over. It's theft as we've understood it for thousands of years. But before there were factors all the government here is doing is using its cursor power to defend the rights of the people who built it. The same thing would be the case if the employer changed his people to his machines and whipped them three times a day. That would be the equivalent of slavery. That would be a violation of their rights. And the government would have a role stepping in to defend the rights of the workers. The ability or its job is to use its cursor power in defense of individual rights. Not in violation of those. Not in order to take property from some and give it to others. But to protect the property that people have. The reason the workers can't just make the widgets is they didn't come up with the idea. They didn't raise the capital. See, they didn't take the risk. They weren't willing not to be paid until the widgets made a profit. Just think of a biotech company that might only be profitable after 10 to 15 years. And yet everybody gets paid. All the workers get paid. They have to be scientists and engineers if they get paid well. For 10, 15 years while the capitalists are sitting there wondering if you'll ever see a dime from it. Now I don't feel sorry for the capitalist. But that's the way democracy was. The scientists would never do that work if they weren't getting paid. Just like the workers in the widget factory were waiting for his return. So, yeah, they could steal it. But that's exactly the opposite of what law is supposed to be about. It's supposed to protect property. Not give us, but protect. Okay, let's take this to the questions. It's really a problem for the environment. I just got the proof that you bring it here. I was thinking how, I mean from my point of view, the coercion of the whole system is a violation and the whole issue is new law. And I would be in the case of, for instance, small-scale economies in which farmers, for instance, contribute to the whole economic system because of their overwork lack of regulations, lack of regulation. And if we impose and promote this proposal that you bring in which I've got the quality of the constitution and its whole set of principles should span aside from the economy where should small-scale need them? Where should what? What would happen to small farmers and small businessmen? I don't know. So, for example, I'll give you an example. Right now there's a thriving industry of small organic farmers and they specialize in close to market, right? These restaurants where you only eat stuff that's close by and there's people who want to consume that and good for them and that's why small farmers still exist in America, otherwise they wouldn't. Sorry. The thing is that coexist when a normalized world in which we are moving forward to a what economy? Structivism. Structivism in which we have crisis in the field of natural resources that have open barriers to its natural resources just in areas where that small populations are affected. So, if we have economy that can understand the constitution now, the whole political iteration is just because we have to predict some economy model then how? I'm not trying to predict the economy model I'm even willing to say I don't care about the economy model. I care about individual human flourishing and the standards, what are the requirements of individual human flourishing and in my view the standard for individual human flourishing on the political level they're moral standards which I'm not getting into but at the political level the only thing we need to be concerned about for the perspective of individual human flourishing for the political level is freedom. Freedom means the absence of coercion from government and absent from coercion from your neighbors, from other people so that you're free to pursue your life. You don't want to buy from Walmart? Don't buy from Walmart. You don't want to buy GMOs? Don't buy GMOs. You can do what you want with your life. This is the difference. You can't get together with your neighbors and decide how else I should live.  It's none of your business. It's my business. And this idea that big businesses like U.S. Steel somehow lose that now they don't. They become more complex. The number of contributors becomes larger. So U.S. Steel could not just it did not just depend on Carnegie but it depended on J.P. Morgan and depended on a bunch of other people. All got rewarded. All got paid. All got compensated. All played a role in it. Microsoft not only did Bill Gates become a Brazilian air but 11,000 people in Microsoft became millionaires. All of them shared in the prosperity that are these companies. So yeah, these companies are complex entities but because of the way they're constructed which is voluntarily people benefit from it and markets do have this wonderful hard wired mechanism. If you work at this widget factory and you don't like your wages well there's a sewing factory over here and you can produce more than what this guy's paying you. This guy will pay you more for it. If markets drive wages up not down it is a fallacy that has existed since at least Karl Marx that wages are driven down by markets it's exactly the opposite. When you free up markets wages are driven up. Why are they driven up? Because productivity is driven up and there is a direct correlation between productivity and wages and always has to be. I don't think because I don't quite understand what you're asking. If you're worried about small community suffering because big business comes in my perspective is the other is exact opposite. I think they benefit enormously if they have and this goes to the governance in other countries. If the governance in other countries is rights protecting governance. So to the extent that other countries have rights violating governance then that's what we should be upset about the multi-nationals coming in and offering jobs to the people. I'll take one more question. Hi. Your model depends on sort of a completely voluntary market but I'm wondering about sort of involuntary things like food and water that I need to purchase to live. How those factor in your thoughts? Well I mean you need them so you better use and notice and retain them. That is you don't have the fact that you need them does not present a model obligation on me or political obligation on me to provide it to you. So you need food, good go get a job and buy the food. So if you don't get a job it's not my obligation to feed you. But like say someone monopolizes 90% of the food industry and then raises the prices up then I will compete them out of business and this is let me give you an endless number of examples standard oil that didn't happen. Alcoa had 80% of all the aluminum production in the world at some point. Crisis went down quality went up every year and otherwise they knew they would be driven out of business. Microsoft got sued for antitrust violation because it was offering a product for free. That was a great sin. It was internet explorer at the time. We were paying I remember paying $70 for Netscape browser and it was for free and Microsoft was penalized for that. So the markets don't work that way. This idea that you can create a fictional world. You can do it on a blackboard in a classroom where they teach you the ridiculous model of perfect competition and monopolistic pricing. That is not reality. That's not how the world works. It's never been how the world works. What's perfect competition? Perfect competition is utterly boring. All products are the same. There's no innovation in such a model. So nobody controls 90% of the food. And if they did, competitors would rise up and demolish them. And sometimes those competitors would be far overseas if we had free markets. Freedom does not sustain those kind of science fiction stories. They don't happen. Theoretically or practically. One of the problems I'm guessing you were talking about maybe in the 19th century the problem with the land scarce or wasn't enough land for the homes. The whole western half of the United States almost would be in favor of privatizing all that land. If it's a problem. I don't necessarily think that that's a problem. But if you think that the land issues a problem, would you be in favor of privatizing all of it? Most Americans aren't farmers anymore. I don't mean just to farm. I don't mean just to farm. I don't mean just to do whatever they could sell it. I mean just so they could own it. Do whatever they want with it. I think you misunderstood what I was using land as what was at the time the most important basis on which to build a household, a family a life and contribute to the economy and make a living. So it was a basis for an independent livelihood because that was a moral good and a political good. And in that long 19th century, the federal lands were precisely used under a whole series of homestead acts to do the kind of work at once economic and political that I describe. In other words the federal lands were parceled out. Sometimes to big railroad as incentives to build or because of their cronies in Congress or the states but by and large at least the ideal, the aspirational sort of project was to give out the federal lands to settlers who would work hard and make a life on. And that's no longer as much as like Iran I'm a fan of small farms in the United States. I don't see that as a major part of reconstructing the American economy in a better way. So no, I think it's a major part but that's a lot of property out there that can be used for other things that's all I'm saying. I mean that's what I was just wondering. Mary, you know again I tend to see these questions as pretty complex in many sides. What to do with the federal lands and how much to privatize them would seem to me to be a harder question than it may be to you. There you are. Alright guys we're out of time. Thank you.


Unless we understand that from the beginning the settlement of North America was a rivalry between Catholicism and Protestantism, we will miss much in our understanding of America. In a sense, Catholics were alien, not to America of course, but to British America. And one of the great stories of America is the acceptance over a very long period of time, not only of Catholic populations, but indeed at certain moments of Catholic social thought and Catholic teaching as well.


So we have Adam, a founder, CEO of HunterDev, and then we have Erez from BT Street, a computer research tech lab. They are going to be talking about the supply chain. Thank you so much. Hi, everyone. Thank you for joining us here today. So we believe there are many reasons that traditional application security is failing us. Join the long series of talks I'm doing on that, but today we're going to talk about supply chain in specific. So as introduced, my name is Erez. I'm the VP of security research at Checkmarks. I started my IT life as a developer, and then everyone noticed that I'm better at breaking things than building them. Later I noticed that I'm better at managing other people to break things than breaking them myself. And I'm also a big believer in spreading security awareness and education. And this is why I'm here today. Adam? Yep. Hi, everyone. So yeah, Adam Nygate, founder and CEO at HunterDev. Previous roles include working in security architecture at GDS, a part of the UK government's cabinet office. I'm a kind of rehabilitated hacker. I first had my run-in with the authorities when I was about 17 years old. Ended up fleeing the UK, moving to Singapore. No, just kidding. But did end up moving to Singapore. And from there, I started helping organizations to stay secure in Australia, Singapore, Kazakhstan, and various different countries. And then over the last four years, I've been working with over 10,000 hackers and maintainers to help keep the open-source ecosystem secure, sometimes unsuccessfully, sometimes stepping on a few toes. But it's making it all that sometimes you need to break a few eggs. So if you are standing here, you understand that supply chain security is something that is everything that is the code, but not your code. You have the parts that you write in-house, and there is part of code that someone else writes. Yeah. And so there's vulnerabilities in malware in affecting an open-source supply chain. With regards to vulnerabilities, we're trying to understand the situation, what does it look like, begin to evolve our understanding of the risk in the supply chain, explore the vulnerability disclosure lifecycle, and then think about how to approach it differently. If you're here, this is not news or something you don't know. The reality of open-source vulnerability is that 80% of the application code is open-source. We are focusing usually on the 20% when we're talking about security, but the 80% is left alone. Also, this is also not something surprising to us that 97% of applications use open-source software. Now, when we're talking about supply chain, people ask me frequently, OK, we have supply chain for years, basically, since we had supply. What is the difference? Why are we talking so much about software supply chain, security? What is the difference? What happened? Definitely in the last few years. So if we compare the traditional world of supply chain and the software supply chain, it's pretty simple. We can see that it starts with raw materials when we talk about traditional supply chain. In software supply chain, it will be different sources or dependencies. And then we move through build systems and networks and application repositories. And instead of using tracks, we're using the internet. But then eventually, it comes outside to production or to the users. Nothing is different, right? Well, almost. Let's imagine a well-known scenario of supply chain, a very, very old one these days, assume that you are a manager or running a factory for assembling cars, OK? So you're running the factory. You're getting your tires from Japan, the chassis from the US, the engine from Germany, whatever. Everything is strictly done. Everything is very, very carefully under specific standards and compliance. And everything works very well, every nut and bolt. Now imagine that you walk in the street one morning as this factory manager. And someone comes to you and tells you, listen, I created an amazing system for breaking cars. It's a breaking system. You should use it. It's free, by the way. Why don't you use it? And you say, wait, wait, wait. I'm worried about security. Is it good? And he tells you, of course. It has 5,000 likes on GitHub. And you say, oh, OK. So let's take it. I see you smiling, but this is how open source security looks like today. And this is the supply chain that we're talking about today. And it is basically all about misplaced trust. We have trust paradox. If we have someone, random person, come from the street in our office and start, I don't know, typing on the keyboard into our code base, we will probably have security or police or both escort them out. But if the same person is doing that on GitHub or any other repository and call themselves not a random person but a maintainer, immediately, let's use it. This is a problem. This is a real problem. And when we are trusting these people, the maintainers, what do we really trust? We need to trust them, first of all, that they care about security. If they don't care about security, there will not be any security. We need to trust them that they know what they're doing. If they don't know what they're doing, even if they care about what they're doing, there will be no security. And most interestingly, although we really like to ignore that because it's a horrible thought, we need to trust maintainers to not be malicious. Now, the first two kind of trusts is something that is easier for us to accept. It's a mistake. It's a bug. It's coming from some sort of misunderstanding. It's a vulnerability. We know how to deal with that. We have mechanisms to do that. We even have some tools to do it for us. But as I said, we forget that when we talk about malicious maintainers, we are dealing with malware. And this is kind of the two sides of the coin we want to mention and discuss today. Let's start with vulnerabilities. Yeah. So to kick us off on vulnerabilities, let's start exploring the situation a little bit. So a few examples of well-known open source vulnerabilities. While ago now, there was a pretty prolific vulnerability called Heartbleed. It affected open SSL, one of the most used components to help keep websites secure globally. Now, at time of discovery, Heartbleed ended up affecting about 17% of the internet during the time in which there was this exposure. Millions of records were stolen. And it remained undiscovered for two years. In 2017, another big vulnerability affecting Apache struts. This was the exposure that led to the big Equifax data leak. 160 million records stolen pertaining to people, real people, their private information. This vulnerability was undiscovered for four years. And most recently, Log4Shell affecting the package known as Log4J. It's estimated that this vulnerability affected 93% of enterprise workloads. And it was undiscovered for eight years. And this is just the tip of the iceberg. And I'm sure you guys are familiar with this kind of image, memes on the internet showing that we know what the tip looks like, but beneath the surface, there's all these other scary things. But I think that's what's most terrifying in open source. We don't know what lurks below the surface. All we do know, as an example, is in 2021, across 50 million open source repositories on GitHub, only 5,000 vulnerabilities were found. And this is just dropping the bucket. So let's zoom in a bit. What does this risk look like in depth? So when we start to think about risk, it's important to bring in the concept of time, thinking about how does exposure develop with it. And typically, we think about this risk from the moment the vulnerability was disclosed. So once we're made aware of the vulnerability, to the point in time that it was fixed. And we can crude the model like what this risk looks like, something like this. And what this effectively means is that for a period of time, the risk is accelerating. And according to GitHub, typically, this risk affects us for about three months on average. So we're exposed. We have this vulnerability for three months. That's typically how we think about it. And this is what I like to call recognized risk. This is the risk that CSOs, security engineers, security analysts, think about today within organizations about how to keep open source supply chain secure. But I want to introduce a phenomenon, multiple discovery. It's a concept that explains that most discoveries are made independently by many. An example of this was with Heartbleed. So prior to it being publicly disclosed, it was exploited by multiple threat actors for up to five months before disclosure. And allegedly, the NSA was aware of it for over two years before public disclosure. So with that in mind, how should we start thinking about the risk? We, again, start with time. But this time, we want to think about the starting point of the risk is not when it was publicly disclosed, but when the vulnerability was first introduced. Because that's when we can get hacked. That's when organizations are really exposed to this risk. So we pull in these two data points when it's introduced, when it's fixed. We bring that zero day, that public disclosure point, back in. And now this is what the risk starts to look like. And there's our recognized risk. And then this area to the left of the zero day is what I like to call unrecognized risk. And what's most terrifying is that risk exists for over four years on average. Now let's zoom in a bit more. What does the vulnerability disclosure lifecycle look like? So let's walk through it. First of all, when the vulnerability was first introduced. Again, as Erez mentioned, this is simply a bug, a mistake of code that the author introduces as part of a feature or a bug fix in their project. Some point in time later, it's discovered. Fingers crossed, that's an ethical hacker, a white hat, who reports that to the open source maintainers. They then go ahead and verify it to make sure it's a real vulnerability to determine how significant it is. They will then hopefully create a fix for it. They will then publicly disclose of that vulnerability, normally via something called a CVE. And that's when organizations can start hearing about it. They can get notified by tools or by subscriptions to databases which watch for these CVEs. And finally, if a fix is available, the organization can adopt that fix. They can deploy it to their production workloads. And again, so this is four and a half years. So this lifecycle from when the vulnerability is introduced, according to GitHub, is over four and a half years on average. And here, again, this is the portion that we recognize as a risk that we try to address today. But to the left of that public disclosure point is this unrecognized risk, which we currently are very limited in the ways that we address it. When we address the recognized risk, this is what I like to call traditional thinking. It's quite reactive in nature. We use tools like source composition analysis, which I always like to describe as kind of like an antivirus. It's got a database behind it which knows about known vulnerabilities. It'll scan your open source code, try to match up the open source code that you use to its vulnerability database, and then alert you when it finds a match. There are also newer tools out there which include things like automated patching. So if a fix is available, it'll help you include that fix in your source code. And there's novel tools coming out here today, like runtime SCA, which tries to improve upon kind of that traditional SCA. And just to be clear, SCA is very much needed, but it's just no longer enough. We need to start becoming proactive to the way we approach security in this process. To date, the only things really done to try to address this unresolved risk is limited investment in critical open source software. And what I mean by this is a few organizations help to try to secure the 0.0001% of open source projects that we most depend upon, like the OpenS cells of the world. But an organization doesn't just depend upon that 0.0001% of projects. They have a whole breadth of different shape-sized projects from code that's sponsored by big enterprises to pieces of code that's written by a university student out in Algeria or something like this. And I know how hard it is to try to solve this problem, how to create new solutions to addressing this problem of how to become proactive. I've spent my last four years trying to solve this problem. So let's talk about a new approach. How can we begin to invest as the open source ecosystem as the open source ecosystem to harden open source software? So first of all, supporting security researchers or security researcher maintenance, not just with funds but also with people. So it's not just about engineers contributing code back to GitHub or something like this. It's also researchers delegating time or using their time to find vulnerabilities in open source software that's used. And analysts helping to conduct things like thread modeling and other security activities to try to understand the security perspectives of a project. And it's really important that we don't just focus on the 0.001% here of projects. As mentioned, an organization depends upon different shapes and sizes of projects. And any single one of these can be the weak link and the chain and can bring down an organization. So how can we start? We can ask for help. But we reach out to the organizations that are trying to make a difference in the space. This is the open source security foundation and myself and others. And we can help answer questions like how should we spread our resources? Should we focus on what part from the 0.001% to the one developer homebrewed project? How can we spread our resources? And don't just take this from me. Take this from Isaac. He's the founder of NPM, one of the most prolific open source tools out there. Supports open source code usage across JavaScript, TypeScript, et cetera. He really significantly backs an approach like this. And to capital loss. So on top of trusting maintainers, we need to also think about supporting maintainers. And the longer we wait here, the longer we are exposed. So that was the interesting part of vulnerabilities. But as we said, this is something that we as APSEC professionals been looking at for years.  This is not our problem. Well, it became our problem. And I want instead of explaining what malware is because we all instinctively understand what it means to get malware running on my machine or on my developer's machine, I want to start with examples that will show you the attacker perspective here and also how useless almost is everything we were brought to believe that secure software means from the side of developers and shows us how hard it is for a developer to avoid that kind of mistakes. So let's start with Brandon. This is Brandon Nozatsky. He is a really cool guy. He runs a YouTube channel about superbikes that are electrically-engined with electric engines. He's pro a very green world. And he's in his time, free time. He is contributing a lot to open source. He has 41 different packages very popular on NPM. One of them is called Node IPC. Very, very popular, very, very useful. Would you let your developers use that? I see yes, I see no, I don't know. Let's check, let's check together because I'm not sure myself. So popularity, 1 million weekly downloads. That's a huge amount of users. 1 million weekly downloads for the package. To be honest, this is where I say, yeah, I would let people use that. But let's not be sure. Let's test, let's check another factor. How much time it's on. This specific package, Node IPC, is being maintained for more than eight years. This sounds good to me. Anyone here would say no, don't use it? Of course not, because these are the only factors that we have. And everything was fine for many, many years until March 7th, 2022. Brandon adds one line of code. You can maybe see it below, but let me magnify it for you. This is the line of code, even if you're really good with code, you'll have some problems because this code is obfuscated. So let me be obfuscated for you. And the only thing we need to look at are three new functions that Brandon added. The first one, first one is going to a website called IP Geolocation to check where the code is running from. When you run that, if you're in the US, you'll get back United States. If you're somewhere else, you'll just tell the software where you're running from. Why does Brandon want to know that? We have a hint in the next functionality. The next one checks if you are from Russia or Belarus. Starting to get the picture. Why does he want to know that? Because if you are, and you don't need to be a developer to understand that, delete, delete, delete, delete. Brandon is trying to delete everything you have on your machine. Obviously, Brandon decided to take sides on the Ukraine-Russia war and put it in his open source. And many people asked him, Brandon, this is being used all over the place. We trusted you. What happened? What's wrong? What are you doing? And this was Brandon's answer. You downloaded my software for free, so I'm allowed to wipe your computer. Also, he added that this is all public, documented, licensed, and open source. So I guess he's not wrong. And on that day, a new word started to being used and it's called protestware. It's software that is protesting things. Let's go back to the first question. Would you let your developers use this package? Of course not. Because now he's against Belarus and Russia. The more it can be something else. We already understand that this developer is problematic. This package was reported to NPM and they removed it, obviously. So this is not a problem anymore. What about these other 40 packages? They're fine. There's absolutely no problem with them. Would you let your developers use these packages? The answer is yes, you would, because you wouldn't know. There is no mechanism, no test mechanism that tells you this is a problematic maintainer. He has a problem with his reputation. There's no such thing in traditional testing. So the answer is yes, you would let your developers use these other packages. By the way, what about these packages on Python or Java? Do you think that the platforms are connected somehow or discussing between themselves? NPM just removes it and that's it. There's no even metadata stays. Nothing, it just never existed. Another example, two packages. One called Pompey, one called Pompeio. Which one is the right one? Which one is the malicious one? So both of them are doing the exact same thing. They have the same code. If you use them, you know that none of them will break any of your tests, no bugs at all. Everything runs smoothly and that's it. And it runs like this forever. The only thing is that Pompeio has one small dependency. That's called red APTY. We'll talk about it in a second. But this kind of attack of renaming something very, very closely to the original correct package is something that is called typo squatting. Here the typo is a bit different. It runs on the fact that the website of Pompey is Pompey.io, so they just registered Pompeio because many people know it that way. But we see typo squatting all the time. And you can see that many popular packages, this is the middle column, got their evil brother or evil sister with kind of a different change there. And you see attacker packages. And the monthly downloads of these packages is amazing.  And again, the functionality is the same. As long as this package exists, you don't break any tests, everything runs smoothly. Do you have any tool that is checking that in traditional application security? The answer is no. As long as it doesn't break anything, it works. So let's get back to the small addition. This small addition takes one picture from AIMGOO, this PNG. This is the picture, as you can see here. Just sad eyes and apparently, we found that in the picture is embedded some code. Again, obfuscated code that when installed, runs and steal your passwords and send them to the attacker. Everything else is the same as the original package. This is not something you can find out by testing or by any other means. So we started removing them. We started letting know the Python platform that they should remove this package so the attacker just made another one and another one and another one and eventually they started to talk to us to communicate with us through the names of the packages. It started with lowboy, continued to not so awesome and you can see how it ended. But this is happening all the time. And when I say all the time you want to know how widespread it is, in checkmarks, I'm proudly running a team of threat hunters and there's no typo in this number, okay? Only in checkmarks we already flagged, found and reported more than 200,000 evil open source packages. This is not going anywhere. This is a huge number and the rate is just keeps on going. So why is it so problematic? We said malware, it's not a vulnerability, okay? It's not a mistake, it's not a bug, it's not a glitch, it's not an error, it's doing exactly what it's supposed to do. We just don't want it to do that thing. But there is no pattern of an error that we can find. Also it has no CVEs, no CWEs. If something is removed, there is no access to it anymore. We cannot learn from it. And you don't even have CVSS or something like that because as long as you run it, it's the most critical thing that can happen to you. You're literally running malware on your system. While vulnerabilities we talked about four and a half years which sounds awful, but as long as somewhere on the way you fix it, you will be maybe okay. You cannot allow it to run even once. Even one time means that it's game over. And sometimes you don't even have to run it. Only installation of an open source package with some sort of malicious payload might mean game over. So the only thing we can do to avoid it is to make sure that these things are known and found ahead of time. Again, proactively. We cannot wait for our developers to do that and then something test for it. The developer needs to know, no, you cannot use this package immediately when they try to do so. Yeah, let's wrap up, Ed. Yeah, to wrap it up. So some key takeaways. So when it comes to vulnerabilities, the risk starts, the day the vulnerabilities are introduced and not just once it's disclosed. That's the four and a half years from initial disclosure that we talked about earlier. Also important to remember that it only takes one week link for the chain to fail so we shouldn't just focus on the .0001% of projects. And the longer we wait, the longer we're exposed. When it comes to malware, it's not about vulnerabilities, it's about the attackers. We need to hunt them down before they strike within your organization. And some closing thoughts on open source. So open source software is a blessing and a curse. There's a reason as to why it's so prolifically used. It comes with a lot, a lot, a lot of benefits, but it's wide usage also makes it a very, very attractive target for both people introducing vulnerabilities intentionally, unintentionally, but also to malware. And widely exploited vulnerabilities are only going to increase. We saw that trend when we looked at the rate of these big critical zero days from heart bleed to log for shell. And it's important to remember that open source software is a commons. There is no higher return on investment for each dollar slash hour spent trying to improve it. And the reason being here is because each dollar spent to try to secure it doesn't just help secure ourselves here, but it's also helping to secure partners, customers, users, and people worldwide. Yep, thank you very much. Thank you both very much. We have time for questions, so please be happy to answer. So specifically when it comes to typosquadding or intentionally malicious package names like that, have you looked at how many other packages on the registry import those as a dependency? So people that might be getting exposed to that without even realizing it if they're not looking at their transitive dependency tree? The answer is yes. I don't have the numbers now. We've seen several of those. It is less common than just hoping to use that to drop someone using that as a, let's call it first degree use. But I remember seeing at least three or four things like that in the last year. That's interesting things for sure. I mean, I guess do you have a way or do you have any suggestion or anything like that? So as a best practice, if someone is proxying the dependency server or something like Nexus or Artifactory or something like that, do you have any recommendations for how to protect your supply chain against the torrent of packages like that other than developers being really careful? Yes, I'll try to stay off the marketing pitch. Well, the main reason that we're seeing that is because we at checkmarks are looking for that. We have a specific team that is doing that. We have our own engine part of the platform that is checking that either when you're mowing things or it can be used as API or it's part of the platform for every customer. It's probably not perfect, but it is doing exactly that. It's running several tests for a supply chain. There is an engine looking for typosquoting. And yes, the solution is exactly that. And to do that, our people are walking all the time ahead of that exact place in time where you are trying to use that dependency. So when you're using something, it was either hopefully removed because NPM, PyPy or whoever did what we asked. By the way, this also takes sometimes days and weeks when we ask to remove something malicious. But you're being flagged that I'm not sure that this is the package you want to use. More questions? Yes, please. I was just curious. You mentioned at the beginning of vulnerability or was it the Heartbleed thing that the NSA knew about two years before it was reported? I think Adam specifically said allegedly, right? It's a local. Oh, did you say allegedly? Yeah, yeah, yeah. Are we bugged? I was just curious on why they would do that. So we can only speculate, I think, right? But when it came to Heartbleed, listen, to have knowledge of a zero day, especially with something as prolific to what Heartbleed affected, which was open SSL, right? So it basically gave you a way to kind of access a server like a server that was protected with open SSL. And so I would expect that the NSA wanted to keep this information private or undisclosed so they could leverage that for their purposes. At least that's what I would speculate. Duh, I should have thought of that. It's kind of the ultimate backdoor, right? Yeah, yeah. Just follow on another question, which is another challenging for the software development community. The code snippets from Stack Overflow, what do you guys are thinking? So, objectively, they are bad. Yeah. We see problems, more around vulnerabilities, honestly, than malware. I was part of a try many years ago, like six or seven years ago, to convince Stack Overflow to add a red frame when the community says that this code will work, but it's also vulnerable. They refuse to do that. They said that it will make people use less of Stack Overflow, and I guess they're right. Same thing. We need to make sure that we know what's going on there, specifically in vulnerabilities. You need to scan that code like you scan any other code because eventually it's your code. And if you see there the use of dependencies which might either have a vulnerability or something malicious, again, it's currently no one is taking responsibility. We need to be responsible for that. So this was a long answer for, and so basically telling you that, yes, it's a problem. And yes, that's a big problem. Right now, take out the Stack Overflow for the new generation who are graduating from the universities, zero. They have no capabilities, I have to say, up front. So, yeah. In reality. I don't think you need to take it away. I consider myself a Google developer myself. That means that if you take Google away, I cannot do anything. But education. Policy. Policy is important. Monitoring and policy. Monitoring is okay. Policy will not always work. Education. Just educate what might happen. That's it. I'm sorry, just to make the answer a bit longer. But I think there is a bit of a difference though because open source packages, software, software developers download, right? We're talking about hundreds, thousands, if not larger amounts of code, right? And so you can't really have the expectation for a developer to read through it and to understand it and to form some kind of opinion on whether it's secure. But I think most snippets on Stack Overflow are quite short, five, let's call it five, 10 lines of code, maybe 20, I think the majority of snippets are probably quite short. And so I think we can maybe place some expectation on developers to get an understanding of anything they copy-paste. But I think the problem is gonna get far worse now that we're walking into a world of GPT, AI, whatever you're gonna call it, spun out code, where it is generating hundreds, thousands, maybe whole applications in a few months or a year or whatever it might be. And I think that's a scary thought.  So other than procuring checkmarks, right? So if we're looking at, in an SSDF attestation, is there anything we should put in that sort of attestation that someone would, to get the company to say that they're looking at these sorts of things, whether they're buying checkmarks or not, but they're testing to some set of activities. Any recommendations on what that activity would be? You're talking specifically about malware, I understand. Yeah, so secure software development framework, right? So we're part of the effort right now within the government to have all companies attest that the software they're delivering followed secure practices. So the question is, what would they attest to, right? That says that they're looking for the type of squatting in sorts of errors, right? And malware sorts of things in their software deliveries. Yeah, I was just gonna, but I think there's two levels to it, right? So there's the kind of, are you doing the checking for the kind of the malware supply chain side of things, such as type of squatting and these kind of things, but then there's the, we could take that one level lower, which is, what about attestations from open source, like the dependencies that you're building on top of, right? And I think it gets really tough there because I think it's going to be a very complicated journey to getting open source maintainers to elect to do the work, whatever it might be to get them to do attestations. And then also, I would say that there's probably a better legal perspective on what attestations look like from companies and responsibilities around that, but I'm not sure of a maintainer who provides an attestation to either security best practices that they're encompassing in kind of their workflows. Not sure what that then looks like, right? Like, does that include the work, you know, is that scoped by the warranties of open source to say, you know, no liability, you know, use it at your own risk kind of thing? I think this is where a lot of questions start to be asked about, you know, what does the attestation mean for them? Right, right. Yeah, and just to add to that, this is almost a green field. I mean, supply chain security was the buzzword of 2022. We're not there yet. We promised to show you the problem, we did that. I don't want to see it. We are trying to do some sort of mindset change, to understand what we completely missed, almost deliberately so far. I think there is a process here. The process is, if we need to take something here, really one word from this entire thing is proactive. We need to do things proactively, because the traditional things does not answer to that, even, Adam, you mentioned automatic patching. Automatic patching is great for attackers, because if someone like, right, because if everything so far was great and then I want to change something to become malicious, excellent, you're the first one being infected. So we need to have some sort of mindset changer, mindset switch, thinking proactively. I have all this open source here being used. Malware is a specific thing, okay, type of squatting and all that, there are 30 different other attacks. I gave you one example. Think, think before you use something you don't have to, if you're in charge of a repository or a mirror repository that have only the things that you are allowed, make sure that you allow the right thing. If you have an option to support, again, not check marks or Hunter Dev or anything else, but the way to, any way to support the open source you are using, support them. Some people are, they will be very happy to do things securely, the maintainers. We need to help. We need to, the entire community of open source, users, maintainers, supporters, creators, whatever you want to call ourselves, vendors. We need to help this community, because eventually this is the only insurance we have that what we're using is secure. So, maybe I will have a specific answer if we talk in a year. So, let's have a date here. Same place, same time, next year. Sounds good, next year. Okay, do you consider open SSF scorecard a good possible solution for a flagging, malicious packages, type of squatting sort of things? Maybe now, maybe as it evolves in the future. I think it's a great project, I personally love it and I think everyone should use it. This is not directly telling you if your, what you're using is malicious or not, but it will tell you how healthy this package is. And health has a very, very clear line towards what are the odds that this will be malicious somewhere in the future. If we see how many different entities are contributing, so there's no, just one person who might do that. How many people contributed in the past? Is it trending up or down? What was the last time that something happened? So, definitely this is one of the tools to use. Again, like everything in security, we're doing the onion thing, right? Another layer, another layer, another layer, scorecards is one of them, for sure. Hey, as someone who plays malware researcher on TV sometimes, have you submitted any of these samples that you found to VirusTotal or some other clearing house or plan to release some sort of research samples or research set? So, we have a plan of creating some sort of package zoo, making sure that it happens. We are currently contributing a lot of code to Backstabbers. I don't know if you're familiar with it, a very good project. And as far as I know, OpenSSF is planning something similar to what you're describing specifically for open source malware. It sounds good, open source malware. For open source infected with malware in the future and when they do, we'll be first in line to contribute. Definitely. Excellent, thank you. I do have a question and follow up on that. I go back to policy, right? You create policies in the organization or check marks and you apply those policies across your teams to discover this malware. Are you currently working with the manifest managers like NPM, for example, as you discover this malware to notify them of your established relationships to say, hey, this is malware discovered in your package. Can you remove it and rapidly address the issue? Is that something in place now or are you trying to create that sort of relationship? Everything you said is happening except one word, rapidly. We're doing that. I mentioned before I think in an answer. Sometimes between the time we are letting them know until it happens, it can take our days even a few weeks. During this time, the only people who knows about it is basically the people we reported, but we're waiting for them to make it faster. By the way, this is not, we're not complaining about that because we know that many people over there are also volunteers and they do it. So it's not a complaint, it's just a status. For example, when we find a malicious campaign with 10,000, 20,000 packages just going at once, theoretically we're supposed to post them one by one, for example, for NPM. This is not possible even for us, so we just send them complete lists and hoping that they will do it fast enough. As we said, the mindset is waiting for a change for everyone. It's not just users. It's also the platforms. No one is ready for that and this is why we're screaming off the rooftops. But yes, the process exists and we share the information with them. This is the first thing we do, actually. Thank you. Okay, cool. So we'll still be hanging out around here if you want to talk. And thank you for joining us today. Thank you so much. Thank you.


Hey everybody, I'm Lance Coyke and today I want to talk about a question that I got from a client today There's this there's this idea that you know we work at computers a lot and people sit down a lot in this day and age and We don't get a whole lot of activity So the question that I got today was does my walking to the train station count as exercise? Like should I should I be counting them and I guess the short answer is no, I'm sorry There are different types of movement that we talk about so when we classify somebody's activity level We say that you might be sedentary Meaning you're sitting down most of the day.  Those days are very active. So That would be the comparison between a sedentary job an active job and a very active job now Those things are just describing your day to day. It's not describing your activity level your Your exercise, right? So we make distinctions between sorry I really messed up when I said activity level we make distinctions between your activity and your exercise Activity is generally I'm moving around but I could kind of keep doing this pretty much indefinitely Whereas exercise is something that if I kept going eventually I would have to stop and so you think like jogging Even for somebody who can do a marathon if they kept jogging eventually they'd break down and they'd stop right even if they were eating But if you you know, you can kind of take a pick a wheelbarrow up move some mulch over Dump it and then wheel it back over and that is that is something that you know, if your body's not prepared for it It's very challenging. Don't get me wrong, but if you do it day to day For a living you're probably pretty well trained for it and it's not too strenuous for you So back to the question is walking exercise. So walking we would consider an activity of daily living an ADL That is just it's extra credit, right? It's not that we don't want to count it. It's not that it doesn't mean something. It's not that It's not effective for keeping you healthy every day But it's not quite exercise so How am I category? Categorizing exercise so if an activity makes you sweat a lot in a way that you're kind of like weird about being around people and Makes you breathe really hard in a way that you can you know It's kind of impacting the way that you talk then I would consider that exercise So walking on the treadmill at two and a half miles an hour with like a 2% incline. I Mean depending on your your physical condition It's probably not that strenuous For somebody who hasn't been very active It can be very strenuous and so you can kind of use this talk test we call it as a way to Tell yourself, you know as a way to measure your intensity level So if you can't talk while you're doing something It's a pretty good indication that you're not going to be able to do it for terribly long You want to kind of like be on the barrier if you're doing some sort of cardio workout You want to be able to talk but kind of like Taking weird breaks where it's like if you weren't exercising it would sound really weird, right? Whereas if I am just walking to the train station Generally, I could talk on the phone while I do that and it wouldn't really impact my conversation I would be comfortable having a business conversation while doing that sort of walking as long as you know The microphone is working and things aren't too loud in the the neighborhood So that's that's kind of the answer Walking know doesn't really count as your exercise, but it does help you get your steps in Keep you a mobile person an active person and it helps combat a lot of other good stuff like you know I didn't even go into that but It helps just keep your joints moving when you walk your your pelvic bones have these these tiny little short little movements and Though they are tiny they are very important because they get amplified throughout the rest of the body, right? So if my shoulder blade just moves a little bit My arm can move a whole lot differently and that's kind of the principle behind walking in general keeping me loose You know movement is medicine to an extent right you can you can do too much and you can hurt yourself but In general you want to try to move as much as you can you want to try to shoot for at least 10,000 steps per day, so you know go for a walk after lunch maybe go for a walk when you get home Make it longer if you don't walk at all during the day and that will keep you an active person But make sure you're still throwing on exercise in addition to that