Good afternoon everybody. We will get started in about a minute for now You can answer our poll question of what is security. I like how we've gone from Hell to wearing a cool hat to the latest iteration of Broadway theater Manifest is rapid illustrations of safety followed by the feeling of despair when your main site dies only to realize that it was a typo by your intern after management decided to switch to the next tip Technology their nephew right on the internet. I think we've all been there At least I've been there at some point maybe and now it got very quiet, so I feel like I should just start Okay, fine. Well, welcome. This is the security team presentation. Yeah. Oh, are you waving to somebody? Okay Little early for questions welcome. This is the security team presentation We've got a large number of slides and a bunch of stuff to get through so I'm gonna go ahead and get started I'm gonna come see it. Okay, so What is security and obviously the follow-up question is what makes something secure and you know We don't have a good answer for this which is ironic because we're the security team We have lots of answers of things that help make things secure But there really isn't any one single thing that makes something absolutely secure When we think about security, there's a lot of definitions for this Yeah, I don't think these are any of the definitions we would use maybe awareness of risk The the typical definition we use is this is what's called the CIA triad CIA is not reference referencing a government agency here in the US It's referencing three areas of security confidentiality integrity and availability But there's lots of answers here and it ultimately depends on your organization I'm here today working with the Drupal security team All of us are members with the exception of Tim on the end. Tim is with the DA We're a vault we're a group of volunteers who work to improve the security of the Drupal project as a whole Come on in find some space We've got some room at the table up front where we were all sitting earlier So Currently the security team has 29 full team members and five provisional team members They come from everywhere and they come from all different, you know use cases of Drupal from agency work to nonprofits To for profits to education So for the security team members that are up here I kind of like to go through and do a little bit of introductions here because it's nice to know who you're talking to My name is Michael Hess. My favorite vulnerability is probably sequel injection Just because you can do so much fun stuff with it Neil you got to turn your mic on Yeah, I'm Neil drum I Guess stored cross-site scripting Because then that you can pivot that to do more interesting things like sequel injection as as an admin I'm Angie Byron Guys both took my answers. I'm gonna go with Social engineering. That's a lot of fun You know using your charm and your wits about you in order to infiltrate your way into an organization And then you can do you don't need SQL injection or CSRF because you just grab the database on a USB stick and walk out Hi, I'm Benji Fisher provisional member of the team and Since all the good ones have been taken I'll say Insecure components or or not not keeping your software up to date because it's sort of like brushing your teeth You know you should do it, but are you? Have you seen these slides? As the non-security team member but member of the Drupal Association and helping to secure Drupal.org's infrastructure I'm gonna go With my favorite vulnerability being Supply chain or dependency resolution for vulnerabilities where a malware package can be introduced into something secondarily installed on your software stack Thank you everybody. So we have 29 full team members I've put some of their avatars up here some of these avatars and pictures of them are very very very out of date Like in this example, I still have hair. We won't go there You know we have people who volunteer on the security team But we also have organizations that in some manner sponsor work on the security team and so what this is is this is a Listing of organizations that were credited on four or more security advisories Between yesterday and a year ago yesterday because yesterday is when we ran the query for this So thank you for these organizations So lots of things that the security team does do and some things that we don't do and so I've got kind of a slide here to help coordinate and help you know set some expectations of what the security team does and doesn't do I'm gonna move this microphone This was not designed for somebody who likes to move around when they talk We we you know the primary thing we do is we help coordinate Disclosure to help keep Drupal secure. So if you get those emails on Wednesday, that is the primary thing we do And obviously it's not just the emails the emails are actually the easy part of the process It's all the work that happens prior to the emails of coordinating that issue We help with security related Drupal initiatives making sure that We have resourcing and that we've coordinated resources and if if Larger organization will need is brought into it. We help with that aspect We will help sometimes advise other open source security teams we've been doing this a long time I think 2004 or 2005 somewhere in there is when the security team was for 2005 Was when the security team was formally started? And so we've been doing this a long time We've got a lot of policies and a lot of procedures in place and we often coordinate with other open source teams on How to handle some of their bigger issues or how to get started? We've worked with get lab on there I'm sorry get hub on some of their security issues and kind of the formatting of that we've been an advisory member there We've also done some coordination with Google and other open source content management systems around You know Google's brought us all together to kind of solve some common problems You know we do some other things in here, but these are the main things that we are after as a security team in general We also have some misconceptions around things that people think we do But we don't do We do not proactively search for vulnerabilities and code We have 29 people we do not sit around and you know read every piece of code committed to Drupal dot org I Think that would be untenable for an individual to do there are team members on our team that actually do do code review, but it's not a primary goal of the team itself and Despite emails of pleas to do so. We do not fix your sites when they are compromised We are often interested in finding out how they get compromised But we don't help repair a damaged site. That's what your backups are for you. You are keeping backups, right? So the primary tool set that we use for for doing vulnerability remediation is something known as coordinated Disclosure and coordinated disclosure is exactly what it sounds like It's getting all the parties on the same page figuring out how we're going to address a problem addressing it and then letting the world know at the same time The the inverse of coordinated disclosure coordinated disclosure might be a zero day where somebody just says hey There's a security issue here That's bad. We don't want that to happen For a lot of reasons coordinated disclosure is a lot of work There's a fairly complex workflow that goes behind this Effectively we get a vulnerability that gets reported to the team and we do an initial triage of that vulnerability If the vulnerability appears to be valid we start working with the maintainer to figure out how to fix the vulnerability We don't proactively fix the vulnerability ourselves. We work with the maintainer of that code piece fix it test it and then eventually disclosure on a Wednesday We aim to do this around Wednesday at 4 p.m. UTC We've got the fixes ready to go at this point And it's just a matter of going through the effort of publishing the fixes and getting the releases out there The goal of this is to allow people to apply their security updates at a predictable time Without worrying if their sites are gonna break most of the time the goal is security updates only contain the security update itself so for example if we are doing a security update for a Module we will try not to actually fix Not to actually apply the security update to new features that have been released or new features that have been made since the last release But only to what was done on our last release effectively and get terminology We check out the tag that was made apply the fix there and then release a new tag By passing anything that's in the pipeline sometimes this doesn't work for a variety of reasons But that is the goal so that you're safe to apply that Version without actually having to you know worry. Well, what are all these new features going to be what what else is going to break? Now obviously in order for that to work. You need to be on the most current version of that module prior to the release or core so the output of this in the end becomes a coordinated a Security advisory which we refer to as an essay we abbreviate it and you can subscribe to these under your user edit page under Newsletters which at some point will probably move off of there Into another format, but there that's where all the newsletters used to be and I think we're the only one they are now You can also view them on Drupal.org at Drupal.org slash security and Drupal.org slash security slash contrib Occasionally we publish public service announcements public a service announcements are just you should be aware of this They're not necessarily something you have to take immediate action on and we don't typically handle those on Wednesdays Our goal with coordinated disclosure is we do this on Wednesdays Sometimes we have to do it on an off-cycle security release where we'll do something that isn't on a Wednesday And typically that's when things happen beyond our control When we issue a security advisory, we've got a lot of metadata attached to that security advisory. It's not just hey Here's the fix Probably the most important thing is The risk score now the risk scores are this you know generic fictitious site And what the risk might be to a generic fictitious site and obviously what you're doing on your site is You know you're gonna have to figure out what that risk is with what you're doing on your specific site But it gives you an idea of how how critical this might be You know it is it is a risk profile So some of you are running sites that have highly sensitive information your risk profile is significantly higher Some of you have sites that are effectively static brochure sites. Nobody's logging in. There's no user interaction There's only one user your risks are most of the time lower as a result We keep track of who's worked on what issue who actually fixed it Who actually reported it and who on the security team helped coordinate the process and that's tied into the issue credit system See the list of names and the companies from earlier in this presentation We also have version fields and how to fix the problem in some generic text Just some stats because we get asked for them in 2021 we had 10 core security advisories and 47 can trip in 2013 core and 38 can trip Okay Moving onward the end of Drupal 6. Yes Drupal 6 currently has Vendor provided support until October 22nd of 2022 That's hard to say twice and So if you're still running Drupal 6 anybody still running Drupal 6 Okay, couple people are still It's time to finally move off of Drupal 6 Which brings me to my next subject how many people are running Drupal 7 Okay, that's yet. Yes, we are starting so that that's more than can I get those hands again actually that's 85% of the room 89% of the room so we've kind of you know originally Drupal 7 was supposed to be end of life in 2020 it got a it got or 2021 2021 We bumped it a year to 2022 mostly because of COVID And we've now kind of changed this as opposed to continually bumping it We are reevaluating that decision frequently You can kind of see the Drupal 7 usage and the Drupal 8 and 9 usage and they appear to be Almost at that convergence point where you know, we'd expect them to continue on that trend afterwards Usage isn't the only thing we're making this decision on there's a lot of different Factors that go into this but ultimately in the end. This was a moral imperative to the project the security team Drees the Drupal Association and other concerned folks met and talked about this and tried to figure out what do we do here? How do we handle this and you know ultimately given the show of hands in this room? That's a pretty powerful sign that you know, I think we made the right call at this point We will at some point need to end of life Drupal 7 But it it has been extended for another year and we will continue to reevaluate that as time goes on We'll announce in July whether or not we're gonna bump it again And so we've kind of moved from this thing of well, you know Let's set a date and then let's continually like change the date to we're gonna evaluate this annually based on use need and other factors You know one of the reasons for this is running software. That's past end of life is really really risky The security team isn't watching out for it You're kind of just you know over there running it and it's kind of just you know doing its thing But it becomes a larger and larger attack surface You know large enterprises don't allow it If anybody's got you know those scanners out there they find end-of-life software and then you get emails saying hey You've got to take this off our network You know the other problem with end-of-life software that that's a larger factor here Is they often have other components that is required for them to run? that isn't part of the end-of-life itself and so you know if Drupal 7 still required PHP 5 3 that's a problem PHP 5 3 does not have any support from any vendor as far as I'm aware and Definitely not from the PHP project You know this is a this is from a site called sciware Which tracks some of these things and basically these are end-of-life products that got compromised in mass Because they hadn't been updated and so you know some of these are more serious than others But you know the bottom line here is running end-of-life or out-of-date software is not a good thing What does this come down to update? You know the minimum thing you can do is update.  Hopefully people are brushing their teeth for longer than a minute And it prevents you from having to do a bunch of work when your site gets compromised You know if you're running the software and we send out those Wednesday emails update the software easiest thing you could do So some other things you're able to do in this sphere is if you're using composer npm pin your dependencies Specify specifically the version of the software you want to be running so that your site doesn't accidentally upgrade To something that isn't insecure or something that breaks your site within a security window There's been lots of do you want to talk quickly about supply chain attacks since you brought it up? I mean there've been quite a few Some well some deliberate supply chain issues and some non-deliberate ones I mean even in the earlier days of npm do people remember the left pad situation right like you have the deletion of a dependency That was used by hundreds of thousands of sites and suddenly they couldn't build anymore And if people had committed deployment artifacts and all these things instead of relying on rebuilding them live from hot Linking from whatever repository their sites would still be up right and so but instead like half of the modern javascript based internet broke for like 36 hours or something like right and that wasn't even malicious Explicitly right and then you know the the other issue here is if someone compromises an upstream Dependency and releases a new version that is suddenly phoning home with database keys right like you do not want to suddenly Just accept that update on a regular cron run or something like that right we try and avoid these things and there's there's more To be said throughout the conference there's a couple other talks I don't know if you're gonna get to mention these or should I I don't think they're in the slide deck Okay, so We're working on supply chain security for Drupal's package management and updating In particular as part of automatic updates in the project browser initiative, so you'll hear more about this in the Dries note you can go to Ted Bowman's session which is Also Wednesday afternoon, I believe it's in the schedule that isn't here. Yeah, okay But yeah, lots of good things that we can do to protect ourselves, but also just some good hygiene That what we should fall pin pin your dependencies also You've got an entire operating system running. You've got other things that are running your site Make sure they're up to date as well So keep track, you know if you're hosting this yourself keep track of your Apache versions engine X PHP Lennox itself all of these things increase the surface attack range for your site itself You know the The you know this question here, you know keeping your reducing your surface area keeping your dependencies in code up to date PHP 5 3 I was originally going to say hey Raise your hand if you're running PHP 5 3, but don't do that Because you're pretty much telling me although the DA did not print Companies on name badges this year, but if they had you're telling me where I can go and attack because PHP 5 3 is pretty insecure at this point It's missed a lot of security updates. It tells me that if you're running that you're probably running older versions of kernels and other things So just keep your stuff up to date Anybody have any fun stories they want to share about up-to-dates or security best practices fun stories Fun in quotes Angie I feel like I need more warning than that. I will probably think of one fun stories I guess there's a famous Drupal vulnerability that goes by. It's I'm gonna get the name wrong What's the right way to say it say oh five that one? SA core zero zero five It was a famous one. It went by the tagline Drupal get in back in the day What was interesting about that one is that we traced the commit that caused that issue to be introduced into core and Drees committed it at about 1 a.m. On January 1st So it was a really good lesson in being mindful of you know What you're doing it when you might have had a few too many and maybe just go to bed instead of working on court I will tell you what that when that happened. I got calls from you know folks whose websites I was in some way responsible for consulting with and you know, thank you for updating my site. I Didn't My sites patch so I'm good, right? Did you patch your site? No, I didn't patch your site Well, then who patched my yeah, you're not very good No, you should assume that is compromised want to be attack patterns actually with sequel injection at the time was to Patch the site so that other people couldn't come in and get control of the site So speaking of patching sites What if you in your time zone or in your team you don't have the ability to be around on Wednesday and patch One of the things that we are working on is a product that the Drupal Association and the security team are offering called Drupal Stewart And this is a service that basically allows for some delay in patching highly critical updates Drupal Stewart acts as a web application firewall And it protects your site from certain known vulnerabilities before the vulnerability is disclosed and even before the update is released Web application firewalls work like network firewalls except they're down the food chain Basically, they look at the web request and they inspect it and if it meets a certain pattern, they deny it This is a great way to protect your sites against known attack vectors And in the case of Drupal Stewart unknown publicly attack vectors Stewart closes the gap Between the security release and when you update your site for highly critical issues That means your team doesn't necessarily have to be on alert to deploy a bunch of site changes quickly And for large multi-site installations in the enterprise where you know, it's not just as simple as hey Let's apply the patch and push it out to all of our servers. There's often a more complex QA process This can help with delaying that QA process It does have some limitations as everything has limitations at the moment. It only applies to highly critical core Vulnerabilities we may expand it in the future. There are some vulnerabilities that just can't be Can't be protected against using a WAF rule And there's a lot of false positives at times One of the things that we do with Drupal Stewart is we actually run it in what's called alert mode So that we can figure out what the false positives are in advance so they don't actually impact business traffic How does it work? So Security team is going to identify a vulnerability in its normal process that we think can be highly critical and mass exploitable So here's an example of one We figure out whether or not we can mitigate this with a web application firewall and we can And then when we release the PSA for all highly critical vulnerabilities We typically release a public service announcement that says hey upcoming on this date We are going to be releasing a highly critical vulnerability be aware We'll let you know whether or not Drupal Stewart actually can mitigate the problem so the WAF rules get communicated to our partners into a monitor only mode and We get feedback we do some refinements and Once we are ready to release we do the release prior to doing that release we switch this out of monitor only mode into enforcement mode and You've now got some protection against this between the time of release and the time it's updated now. This is a service It's not offered for free There's some pricing tiers to this there are three tiers around this I'm going to turn this over to Tim who's going to talk about our pricing tiers Yeah, the simplest way to understand this is that there are some platform level partners who've committed To cover everyone they host with so today aquea and pantheon cover all the sites hosted on their platform So if you're hosting with them, you are covered If you're working with another agency or if you own your own site There is a community tier level and basically it's between 10 and 15 dollars a month with some amount of usage based traffic To put the WAP in place. It's a globally distributed WAP application So the performance should be good kind of where you are and if necessary there are ways that it can be configured in concert with a CDM that's something you can talk to us about We tried to make it about as affordable as we can And all the proceeds we do make from it get reinvested back So hopefully we'll take those and put them into either bounties or security hardening programs Or other things that we would do with the security team and I would say as the early slide before we got to this Product came update update update is still the rule right this gives you this lets you schedule your update This says hey, there's a firewall protecting me while the vulnerability is there So I don't have to update the minute the release happens But over the course of the next day to maybe week you should still be hey doing your QA Making sure everything else is good and getting that update deployed so and just to be To be clear on that the the code fix for these is always free and always distributed This is a service that lets you delay applying that code fix Oh, and I saw a question submitted via your slide. I wish I don't know if you intended to take questions But one of the questions that I saw there was was about like how how steward works in terms of the WAF rules Themselves so the rules themselves are not shared publicly because they could be used to reverse engineer what the vulnerability was Right, so there you are routing through the service without direct transparency into those rules That's a kind of a limitation of the way it works But that's also why we're coordinating together with the security team and the platform level partners to you know check For false positives and things before we deploy so anyway Happy to answer more questions about that if you want to reach out to the DA at some point and we'll get there in One second if you're interested in learning more if you're a site owner and just want to sign up and see how this works You can go right now to Drupal org forward slash steward and follow the process to sign up and engage your site in it There is a 14-day free trial if you're a potential partner, please email Drupal steward at Drupal org and Tim or I likely Tim we'll get back to you with any questions You know Drupal steward's one way to apply updates quickly the other way to apply updates quickly is automatic updates You know the security team is working with the strategic initiative the I'm just David Strauss, I just blanked on his name. I apologize David Strauss is security member Ted is a provisional team member Ted has a presentation on Wednesday at 11 a.m On getting ready for automatic updates and core and kind of what this is going to look like and how it's going to work And how it's going to pull in the comp the composer dependencies and all all the mechanics that go around there one of the things that we're doing here is we're actually investing time and energy into a update framework and You know that could be used by multiple projects Neil do you want to talk about that a little bit as I'm putting you on the spot with no warning? Yeah, I mean the basic idea of automatic updates is Be able to automate composer and also Verify Cryptographically what composer is doing is you know comes from trusted source like it's been signed by Drupal works keys so you both know that you can't update automatically and You know if someone changes to stns or some sort of man-in-the-mill middle attack You're updating to something that Drupal dot work has provided signed rather than It's been a couple other supply chain probabilities where Attacker gets your automatic update system to download malicious code And that the framework is based on a standard an open source Standard called the update framework or tough to you F for short We'll talk about it a little bit also in the Drupal dot org panel tomorrow morning at 8 30 And I'm sure it'll get mentioned a little bit in this automatic updates panel as well And one of the great things about it is as we work together partly funded by things like Drupal steward And other collaborations We've made a php tough implementation that is also being explored By Joomla by type of three by other folks in the php ecosystem And we're hoping to kind of present it as a prototype so that it could be integrated into packages itself and make the entire php Ecosystem done so we're trying to prove it out in Drupal and get get the advantage of it We hope to secure everybody else because that's in the spirit of open source So given that I want to have time for Q&A. I'm not gonna actually take the time for people to answer this Well, apparently people are answer answering it. I'm glad that so far everybody has said yes and not what teeth But you know as we've mentioned earlier We use this analogy around brushing your teeth as this security framework and you know I know lots of projects I just got a bid for a project and they literally had a line item for security work at the end of the project and I'm like No Security is is this is the type of thing that has to be built into your daily workflow every time you take an action in the Site you are potentially changing your security footprint in your attack surface By adding that module by adding that third-party dependency by integrating a JavaScript front-end you increase that surface area Which isn't necessarily you know a reason not to do something, but you need to be aware of what those actions are It's not enough at the end of the project to come back and be like okay What security holes did we create because now you're fighting a release date and fixing your security holes? And so we typically talk about this framework of you know every time you do something Just take the extra minute or two to figure out what your security impact is so that you're not trying to do this at The end it is a lot more work to clean up a compromised site than it is to put a little bit of work in Every week towards your site security You know there are lots of like best practices around security. I'm not going to get into those There's I think there may be there's a history of presentations on security best practices But you know most of these are common sense Have a password policy don't make your admin user username admin and the password admin Don't you know don't commit secrets to your database like there's all there's all sorts of Best practices around security keeping your site up to David running the Running if you're running critical infrastructure making sure you've got the support in there to do it making sure that you're hosting is Up to what your site is don't you know spend lots of money on a complex website and then host it on you know Not performant hardware or not secure hardware You know shared web hosting is one of my Things that comes up a lot like if you're not doing shared web hosting right every single server on that site Is running as the same user account and if one of them gets compromised they can all be compromised Ask for code reviews This is like an easy thing to do. It's a great way to learn Ask for code reviews either from a peer from a consultant Sharing your code on Drupal.org will get people doesn't happen overnight But we'll get people to add comments to your code run a red team exercise We're effectively you turn to a group of people who are not directly involved in your site so can you compromise this and Anything is on the table from doing that from doing brute force attacks trying to guess passwords to social engineering Figure out if you can get into your site put your patch Wednesday on your calendar You know just make sure you've got the time set aside just to look at the end of the day What was released and does it impact our site? If you are interested in joining the security team there's a bunch of information on doing that at security dot Drupal.org slash join and We will be here on Thursday For our contribution day come find one of us wearing one of the three flavors of hats There's a blue version a black version and a white version flavors here and and a Yellow hat on the end But come find us if you're interested in getting started learning more come find us We do have about ten minutes left And I do want to have time for questions because this typically does take a Q&A standpoint. So is anybody Either come up and borrow a microphone if you would like to ask a question or we'll repeat it back Yeah, we'll repeat it Yeah So when traffic comes in what was the question? I'm sorry. Thank you So the question was the the individual has a site hosted on Pantheon They're using a third-party web application firewall in this case cloud flare and where does Drupal Stewart fit in? Thank you And the answer is that before your before traffic from the internet whether it's being routed through cloud flare or not Hits your website Pantheon takes care of enforcing the rule So it's built into Pantheon stack above your Site itself Yeah, so that is one of the problems with continually extending. I'm sorry. Thank you. I'm really bad at repeating these questions Question was what about Drupal 7 end of life? and the The ecosystem around Drupal 7 mostly contrived modules falling out falling out of PHP support So there's you know some contrived modules don't support Drupal 7 In that space And the answer is we're extending the support for core mostly the Contrib modules are still in the contrived modules hand and we don't have the resources To enforce that they get updated. We can't knock on a contributor's door and be like you must update this We can we can take responsibility for core itself. So, you know What does that actually translate to it translates to you may need to actually Watch that space to see if a module gets marked unsupported because the the maintainer no longer is interested in maintaining Drupal 7 code Which most aren't PHP? 7 Drupal 9 is the newest thing and going back and looking at the procedural oriented code of Drupal 7 Not that interesting for a lot of people There are some vendors in this space that may be willing to step in and help there But ultimately we can't force them to update Drupal 7 is PHP 7 compliant I think it's almost PHP 8 compliant. I'm not quite sure on that Yeah, but the intention is before Drupal 7 goes end of life to get it working on the latest versions of PHP and MySQL so that it can write it out for a while the other thing I would say about what Michael Michael's correct You can't we can't force anyone to do anything. It's an open-source community However, if you have some modules that are strategically important to you If you I don't know if I just still called this but it used to be called abandoned module process or something like that There is a process for taking over a module and if you you know Say you have to run a bunch of hacks in order to make it run on PHP 7 4 and the maintainer is a wall There's a process that you can follow to take over a maintainership of that module and it's pretty straightforward It's like ping the maintainer a couple of ways wait two weeks if they don't respond then file an issue and then you know For the most part, especially if you're present in the issue queue helping You know review patches and post things and stuff like that It's a pretty easy process and then that ensures that you don't have to run like a baby of like custom hacks on top of The module and then you could be part of the solution instead of kind of feeling like a victim waiting for you know Somebody to show up and do something There's also I've seen a lot of spaces where maintainers will say you can maintain the seven code and we'll keep Maintaining the eight or nine code so you don't actually have to take responsibility for all of it and some maintainers are very open to saying Yeah, please help us And if you know, you've got a bunch of patches in the issue queue and the maintainers not applying them and not allowing for You know collaboration talk to the DA Any other question Well, we'll help facilitate the process. They'll help facilitate the process any other questions comments or concerns. Yeah, so the question was The question was easy crowd The question was what what is the timeline for contrib maintainers to fix the issue and there's not a set Timeline on it what the security team likes to see is activity happening on the issue at at regular intervals There are some really really complex issues that take a while to resolve Especially, you know when you've got a module that's been around for a while it has a large use case and You know the the way the module is being used might actually be part of the security problem There there are sometimes times when issues can take you know several months to actually figure out What are the what are the issues to resolve? How are we gonna go about doing this what the security wants to team wants to see is progress on the issue? And so we you know we formally say I think it's I think it's a month We typically give a lot longer especially with COVID But we want to see that people are engaged commenting on the issue working towards a resolution and when when that doesn't happen We go through our abandoned module process Which is why back to Angie's point if you do have contrib space modules that are vital to your use Become co-maintainers you don't even have to be the primary maintainer asked to be a co-maintainer And one thing I'll add to that is like you know Often the security team will if they do have to mark contrib modules as unsupported because of a vulnerability That isn't responded to you right they might do a batch of those and at that time That's often when we see tons of people step forward and say hey wait, that's really important to me I want to help I want to get involved If you can try and do that sooner a part of your security practice can be hey Is there anything we depend on that looks like maybe it doesn't have enough support right and you can slip in there So you don't have to be reacting after you suddenly get the scary red message that says you're using an unsupported module So what what flagging those modules is unsupported is an enormous amount of work going back and unflagging them as Supported again is double the work. So if you can step in early, please do step in early It makes this a much smoother process for everybody Any other questions that I can remember to repeat Some on Slido, okay What is okay, so let me go through these in order Should core and contributed modules support EOL versions of PHP asking for a friend So By default core and contributed modules do support EOL versions of PHP because that's what they were built on You know, I think that core formally supports PHP 5 to Think that's right. I think it's five two or five three It's some very very early version that we don't have automated tests that work for it probably isn't supported very well I think that if you're you know, if you are running older versions of your stack including older versions of PHP Yes, it's good to update core But you probably have other security problems in there that aren't going to be solved just by updating core So yes, you're gonna resolve a highly critical issue by updating core, but you're not necessarily going to Like gonna you're not necessarily safe by just updating core What is Drupal Stewart What is Drupal Stewart? Is it only a service or more is it open? Is it an open source rule set? So I think Tim already answered this do you want to yeah, I addressed this earlier So again the rule set itself we don't publish because it could be used to reverse engineer the vulnerabilities It has to remain within the circle of trust which is why it's operated as a service Which is why we have infrastructure costs, which is why there's an expense associated But again, that's part of what we're using to finance things like the automatic updates effort to hopefully make it less necessary Right putting ourselves out of a job in that sense would be not so bad So yeah, we can't release the rule set there What's the recommendation do security review for internal code any automated way to do it? So there are lots of automated ways to security reviews I Am not going to repeat four letter words most of the time what they do is generate an enormous amount of false positives and Then you spend a bunch of time chasing ghosts That's not to say they don't have value where where they're valuable to me is if you're running a secure version of Drupal And you run it and it changes the output that might be worth investigating So if you've run it and you get you know 18 things and you've gone through the critical ones You're like yeah, these are all false positives and you add a new module and now you have 19 things That's probably something to look into but the the automated rule sets typically generate a lot of noise That's not to say they're bad there. They have a use. They're not the only thing you can do You know my my favorite thing. I don't know if anybody's familiar with rubber duck debugging You can Google it But effectively talk through your code out loud or have someone else talk through your code to you and you will spot lots of things Just by thinking through code and that's in that manner Also, you know, there are serve there are vendors that do this as their primary business model where they just do security reviews Finally also Just following general best practices like use the database API rather than write you write your own queries and You know if you use the API's Most of the time what you're doing will be secure by default Yes, that's absolutely correct You use the use the API's we have for databases for text for markup all of it And you get a lot because Drupal's a powerful platform on top of that and their pages on Drupal dot org for developers Describing how to write secure code in Drupal to talk about this in more detail. I Think that's answered all of these questions But it's hard to read and present because I'm looking down and I don't like doing that while talking about there's the Automated penetration testing. Yeah, that one. So automated penetration testing We have played around with this using third-party services And what ends up happening is just the number of things that get reported that are False positives end up being too much signal to noise One of the things that's been really really productive in the past if anybody has interest in funding it again Is we have done bug bounty programs Where we basically pay people to find security vulnerabilities Those are typically pretty good, but are expensive to run and they need a sponsor So if you are interested in sponsoring it, please come talk to me other than that it is 45 after the hour, I'm sorry, 15 We have five more minutes. Oh we have five more minutes So we have time for one more question that I will repeat. I do say that now any last questions Well, I'm glad we've solved all the mysteries about security Thank you very much everybody. Thank you all


Hello folks. Hello. Hello. Hi folks. We're gonna get started on the panel while we enjoy lunch as well. I just want to thank everybody again for coming today. We have a thank you for participating in the activities we had earlier and we're super excited for the second portion of the day. I'm just gonna briefly introduce myself and then I'm gonna introduce the panel. Good afternoon. My name is Kirk Rankin. I use he, him pronouns. Thank you all so much for attending today. It's, as I mentioned, so nice to see familiar faces and new faces as well. And we really appreciate you coming today. So welcome. I'm from Washington DC and I'm a senior at the University of Vermont. This semester I'm the advocacy intern for the Vermont chapter of the Alzheimer's Association. As a student in high school, I began to see two close grandparents in mind, experienced struggles with dementia and later Alzheimer's disease. It was a pivotal point in my life and seeing what my parents and a set of family had to endure was truly frustrating as they navigated the best way to provide for my grandparents. Having experienced this was left the impression of sadness, but also commitment. And last fall I embarked on this opportunity to intern with the Alzheimer's Association, and it felt fitting to involve myself, not only as a student, but as a community member. Right now in the state, we're seeing roughly 13,000 Vermonters who are 65 and older struggling with Alzheimer's. However, as many you know, these numbers do not reflect the reality of the situation here in Vermont. Given family members with early onset dementia, people who are misdiagnosed, and people who would rather not be diagnosed due to stigma, this demonstrates how this number in the demographic is in fact way larger. I also want to mention that in Vermont we see approximately 26,000 unpaid caregivers supporting our family members with early onset dementia and other Alzheimer's. On a given day two thirds of our caregivers are women, more specifically over one third of dementia caregivers are daughters. I feel humbled today to introduce our all women panel as speaker as our speakers reflect a devoted cohort of stakeholders in Vermont. I'm super serious about that, you know, those statistics reflect their reality, and I feel humbled to introduce them. The problems loom large, but we're starting to address how we go forward. And right now I want to introduce Rhonda. Rhonda Williams comes to us from the Vermont Department of Health, where she holds the position of chronic disease prevention in the division of health promotion and disease prevention. In this role she works on health systems policies and strategies to prevent and reduce risk of chronic disease and illness and improve population health and reduce health inequities. Since 2020 she is the director of the Alzheimer's and healthy aging program funded by the CDC's building our largest dementia bold infrastructure grant. She has been with the Department of Health since 2011 and previously was the deputy director of programs, policy and medical education at the respiratory health Association for Metropolitan Chicago. In 2021 she was appointed to the National Advisory Council on Alzheimer's research care and services and serves on the CDC public health center of excellence on dementia caregiving stakeholder engagement advisory board. She lives near Virgins with her family and is a distinct caregiver for her mother who has Alzheimer's and vascular dementia. Welcome Rhonda. Nice introduction. So I'm going to, right, so I'm going to try to be, and I apologize because I'll probably go over slightly Meg. So my intent today is just to give you an idea of what the Department of Health is doing on Alzheimer's as a public health priority. And you, is the sound okay? I hear a little bit of echo. It's okay. All right. And so I have some slides to share with you. So in 2018, the Congress passed a very significant bill and is called the bold infrastructure for Alzheimer's. And why? It's because we need action from public health departments, state and local health departments. And several intentions of the bill is to create centers of excellence. And these centers include on dementia caregiving, on risk reduction for dementia, on tribal health, as well as early detection. And so in this infrastructure building is at the state level to Vermont was one of the first states funded for this work. And we received $250,000 a year for three years that ends in September of next year. So not a lot of money, but enough to get us started. Also want to just share that, you know, this work is not alone, right? This is all of you are likely some way involved in healthy aging in Vermont. But often is what is Dale doing? And what is Department of Health doing? So I put together just very simply, these are core activities that each of us are doing. But then together, we're also working concertally on building capacity among our clinical infrastructure. I'll talk a few more minutes about that. I'm raising awareness about caregiver supports and increasing those as we can. But importantly, as I've heard, right, we need more communication and coordination. So we're working toward that. We are cost sharing on a new full time healthy aging analysts starting in May. And we are also sharing between the Department of Health and Dale a substance use prevention specialist for older Vermonters substance use opioid use alcohol misuse tobacco all contribute to brain degradation. So we need to be very proactive in this area. So in terms of what is the bull program doing? So I'm just sharing a couple of bullets here. And, and so you can see those for yourself. But what we've accomplished thus far is we've hired a full time program manager at DeMont. We've also funded surveillance. And we've started communication campaigns and I'll share you a couple updates on what those communication campaigns are doing. But importantly is over time, we want to address stigma. We want to help people feel more comfortable about raising their concerns or memory concerns with her with her providers and that for those providers to feel comfortable and capable and having the tools to address those memory concerns without having to refer to the memory program in Burlington. There's a nine month to 12 month wait at the memory program and that is very hard for anyone to have to face. So importantly is data without data. We don't understand the full significance of the problem. We can't identify the gaps or assess our progress. So we've working toward having a brain health and healthy aging data plan. And every year our intent is, and especially with your support health department, please feel the caregiver module health department please feel the subject of cognitive decline module. I can't do that alone. It's determined by a committee that with support from others. They hear that Vermonters are wanting this data and that we use this data to improve caregiver supports and to understand the burden and the opportunity for addressing Alzheimer's in Vermont. We're also taking steps to building the clinical capacity. So we are in a real estate, we have very busy PCPs and, and I think some of the historical and cultural piece of this is let's just refer, let's just let's give you referral to the memory program at UVM. When it's estimated about 80% of memory concerns cognitive decline diagnosis can be done in the local primary care office. This is what we're building toward. We have three projects underway that are listed here. And these are intended to help primary care providers feel like they've got this. Well, it's going to take a little time. It's, you know, it's, it's can be daunting, but there are tools available and we're, we're, we have training underway through project echo, which started last September and is concluding in, in May, but it's been very, very engaging with over 100 participants. We also have a new platform for my health learn and on there we're building out dementia curriculum that anytime 24 seven clinician, you know, a social worker can go on here for free and earn continuing medical education credits. And so this is 13 out of 14 areas or counties of the state are participating in project echo. And like I said, we had a robust response to this learning opportunity. And this is what it looks like. So in terms of we're taking so Dr. Levine was involved in the early planning, how can we learn from the opioid response and apply it to Alzheimer's and related to matches. So this is illustrating what we're intending to do is basically that local primary care offices can be the spokes can be the resource go to for those families, caregivers, and importantly is those who do get diagnosed with dementia to have the support they need. So this describes it a little bit. And this is what we're measuring. So we created an evaluation plan. I'm happy to share that with anyone who's interested. And these are the measures that we're using to see for on the mark. Are we making progress? What else do we need to do so that people feel supported locally in their clinical treatment. And then also I just wanted to spend a minute or two on communications. So health promotion, right? It is a field where we are working to help people be the healthiest versions of themselves.  Smoking cessation for example does that.  So we're working on these campaigns. Let me show you a few examples. Last October we used these ads on Facebook. We got the strongest response we've ever received at the health department for $1,000. Three weeks and people, over 12% of people who visited might help you do it. Sign up for more information or for a class on diabetes prevention and management. So we have free resources that are available and we're really trying to help for monitors now that they're out there for them that help their brain health and reduce risk of dementia. So here's an example of a diabetes management workshop. These are known, a diabetes management workshop proven to reduce risk of diabetes and even prevent diabetes. And then also we have what we call rat cards and these are cards that are available to any of you. You can contact me. I can help you order or order for you. You can co-brand with a CDC and they're intended to help raise awareness around how can I have a healthier brain. Very tip specific, science-based. And then lastly is that we're updating the state plan and we've had over 40 individuals and organizations give us their input. But if you haven't and would like to give us input, please let me know. This is intended to be an action plan on Alzheimer's and healthy aging that is used that is improved over time and that we assess our progress. So help hold us to that and we're coordinating as best we can with other state plans that are in creation. Importantly and lastly, we need to work upstream to and the social determinants of health in terms of who has access to housing, who is able to be socially engaged and physically active in their community. This is where we need to make it equitable for all of our monitors by addressing social determinants of health. We're a small program, but what we can do is speak to the importance of working upstream together. And I thank you for you being here and speaking to the need for those with Alzheimer's. Very nice to be here and I should go the right way. There's my contact information. Thanks very much. Thank you so much, Rhonda. And I would like to introduce Jenny and her daughter and care partner Betsy. They're joining us today from Killington, Vermont. Jenny is not the famous diet lady, but like that Jenny has voted her life to helping others before being diagnosed with Alzheimer's eight years ago. Jenny was an independent world traveler and community volunteer who was enjoying her retirement from an accomplished career as a school social worker. During the early stages of the disease, she moved to Vermont to be near family and participate in the clinical trial for Adju Kenema. Unfortunately, she was forced to stop the trial when she had an adverse reaction, but does not regret her involvement because it helped advance science. Jenny and Betsy participate in Alzheimer's fundraising and awareness raising activities and have traveled together to Washington, D.C., advocating for research, funding and support for Alzheimer's. She's in mid-stage now, Jenny and Betsy. So mom? Yes, dear. So we're going to just kind of do this very easy so you can answer what you want and you don't have to answer what you don't want. Okay, thanks, dear. But tell us how you feel today. It's been a long time since you had your diagnosis. What does Alzheimer's feel for you today?  So it's sad and what happens is that there's no way that we know about to stop the problem of it's kind of like dying out.  They just smile and keep walking. How's that? And that's the way it is. And my best friends smile and give me a hug and we know that's what the situation is. And what we need to know I think all of us is what are we missing? What can we do about what we haven't been able to find out that would help people or that would keep you more in the world that you have been or we have been than we are now. And it is what it is. But there's probably stuff that we should be thinking about that we just haven't gotten to figure out how it works or is this really something that is never going to be okay? I don't know. But I sure would like to know what you all feel. So do you have a piece of advice for somebody that just got Alzheimer's diagnosis? Well, talk to everybody you can about it and make sure that the people that you got the diagnosis from know what they're doing. And so that it's the right diagnosis and not just somebody that just said, okay, you know, that's the best you're going to be, babe, and move on. So what I know is the fact that it's just not fun anymore. When you get this age and you can't do, you can't make things work the way you used to be able to make things work.  And so what we need to do is to more and more find out what we can do about to keep us circulating and knowing who we are and keeping us interested and full of fun and finding a way to smile and laugh with everybody continually as we continue to grow older. Anyway, I'm done. Thank you. For our next person on the panel, I'd like to introduce Pamela. Pamela lives in East Middlebury with her husband. Her daughter functions as a primary caregiver and lives nearby. Pamela moves to Vermont to attend Middlebury College and decided to say to raise her children here. She feels thankful to have two children and two grandchildren. Pamela spent her career working in human services after earning her master's from UVM and went on to working, went on to work in mental health. She was a case manager, therapist, crisis clinician, guardian and executive director, amongst other things in the field. She first noticed symptoms at the age of 50, was diagnosed at age 52 with younger onset Alzheimer's. She now says that advocacy for herself for folks with Alzheimer's and in particular for folks with younger onset Alzheimer's is her purpose and passion. Thank you, Pamela. So, I was given a couple questions, so I'm just going to kind of roll with those. So, how did it feel to get an Alzheimer's diagnosis? You bet. Oddly, the first one was relief. I've been complaining to my doctor for two years every three months saying something's wrong, something's really wrong, something's really, really wrong. And got lots of misdiagnoses along the way. So, when I confirmed, yes, you have younger onset, well, okay, you know, not, not totally crazy. Something's actually wrong. You didn't do it. I didn't do it. But to speak to one of your points, my IQ dropped 40 points.  And now you need your daughter to do financing for you because you can't do it anymore. Let's see, my next thing was feeling vindication because I've been saying something was wrong for so long. And in the end, I was right, something's wrong. And then sadness started hitting. You start mourning the things that you're losing for abilities. The mourning sort of grew into grief and even depression. I feel pretty clear that the anxiety and the depression that I feel now is consequent to Alzheimer's. And it's not because I'm not having memory problems because of it, which was one of the things that I was told. I was a crisis clinician for 18 years. I, anxiety was not part of me. My daughter was always saying, you should, there are times you should have been a little anxious. But I was just so that was a brand new thing for me. I felt very alone. I'd never met anyone with, with younger onset. I think we're, we're even more isolated. I think we're even more embarrassed. Here we are at the height of our careers often and now I, you know, I had to drop out. And I felt useless. You know, here I was, somebody spent a career helping people and now that career was gone, you know, nearly overnight. It was gone. And what good was I going to be now? And I, and I felt and feel fear of what is going to become of me as things move along. Next thing, what type of stigma did you feel an experience? I felt very ashamed and very embarrassed. But mostly is that I was internalizing the stigma. So for a year, I didn't tell anybody but my closest family members, it was, I got diagnosed literally like the week COVID started and the state shut down. I was diagnosed over zoom. So it was easy to hide, frankly, very easy to hide. But after about a year of that, I decided that I was sick of that stigma doesn't change unless somebody sticks their head out and works to change it. So I, I, in my county, I'm not like famous, but I'm pretty well known because of the jobs that I've held. And so I decided to write a letter to the editor and was quite full about my experience and I posted on Facebook. And I thought, well, now I don't have to tell people one by one, they're going to find out in mass. But you know, I got, of course, lots of nice responses. But the main thing was I wanted to say I'm done with hiding and I'm done with not living. That's, that has been sucking. I don't like it. So, so instead I went the other way. I tell people readily, you know, I'm at the gym and the owners like, gee, you should, you should move things along or whatever. And I'm like, I have Alzheimer's if I move stuff, I don't know, I will not be able to find it later.  So I just say it very matter of factly. This is just what it is. When I was telling people one by one, which you still end up doing, they don't know what to say back. And the interaction often ends up with me making them feel better about how bad they feel for me. And that's kind of tiring. That was sort of why I was like, can I just tell everybody and then that it, that's, you know, everybody has to process it. How did I share the news, pretty much told you told my closest friends, I told my supervisor at my job that I was no longer capable of doing my job. I had fallen behind in paperwork, in some cases six months to a year, though I had kept unbelievable notes because I couldn't, I couldn't remember who I saw this morning. I couldn't remember who was at the meeting that I went to this morning. And so I started having to write notes like a maniac and keep a calendar with tremendous detail. But that was hard, you know, making the phone call that ends my career and saying it's because I'm not confident anymore to do this job that I love. The big thing was, I finally found a support group that was based out of Massachusetts and somebody there was working with their legislature on a bill to get equal access to services for people with early younger onset Alzheimer's. And I went, huh, I think I could do that. I've been advocating for other people for the last 30 years. And why don't I use that skill for myself, but really for the broader community who are all sitting home alone feeling embarrassed. It's really feeling like somebody needed to say that, that we exist to type of caregiver support do I need. We need comprehensive case management, we need the kind of case management that adults with intellectual disabilities get those people need that service. And I've come to feel if you acquire a cognitive disability, then you need the same level as somebody who already has a cognitive disability. We're expecting our families to know how to do case management. That's crazy. I was very lucky in my family. I was the one making the calls. And at the end of the day, I'm like, this is crazy. The lady with Alzheimer's is the one who's trying to find the service. I didn't say, I didn't say it angrily. I was crying. I was sobbing at that point. And Aaron was also making calls and getting the same run arounds because I'm not on Medicaid. Well, my husband is 47 years old. He has to work. He pays child support. This is, you know, he's young, which has its advantages, but not for collecting Social Security and Medicaid. So I'm not going to get Medicaid. So there were age limits on programs. There was you have to be on Medicaid. Nobody said you can private pay at the rate that we get Medicaid because I believe, you know, that would be fair. So we need affordable comprehensive case management akin to what adults with intellectual disabilities get. And I know because I was one of those people and I know the range of what can happen. We need in-home support, again, that is affordable. We need training for families. There's a lot about training caregivers better and the doctors and I couldn't agree more on that. But the same training that we're saying it paid in-home support people need to get through this must be extended to family home providers. They're dealing with it way more. They don't get to go home and have it disappear. So I would like to see more of the trainings that are available to quote-unquote professionals because the reality is our children are professional at what they're doing. They are doing case management. They are doing in-home support. They are not getting paid. I don't understand that. If person X gets paid for doing this service, I don't understand why a family member can't be paid. And since familiarity is so critically important for people with Alzheimer's, you know, we need to stay in our homes. We're in a community that we can walk around. We need to have people in our lives that we know and trust. That's enough on that, I guess. That's it. The last thing that I think I was asked was, I'll be really quick though. Challenges relying on family. One, most family needs to go to work and earn money. So then they're not available to us. Most have no experience in performing case management or financial planning for other people. There's a lot of skills that we're expecting family members to know that in the reality, people go to professionals for those things. And we are left feeling a burden to our families. It exacerbates the shifting roles that are needing to happen. And typically our family members aren't getting any support for that or limited support. Piece of advice. Act quickly to get your wishes codified. This, I mean, the second I got diagnosed, I went, I completed my will. I revised my advance directive. I got my power of attorney who has financial rights completed. I got my beneficiaries up to date. Have your chosen financial person attend the Alzheimer's Association financial planning class so they do get some clue of what to do. We lose our confidence and we want to make sure when we're making decisions that they're done while others recognize we are still confident. And then the very last thing is tell everyone, don't be afraid. Don't be ashamed. Don't be invisible. Keep on living. Thank you so much Pamela. I would now like to introduce Lisa. In 2018, Lisa lost her mother to Alzheimer's disease. 18 months later, she lost her father to a really body dementia. With a tremendous amount of assistance from others, Lisa and her siblings were able to take care of their mother at home.  Through these two experiences, Lisa learned how challenging it is to find resources to help with dementia care and also how limited those resources are compared to what's actually needed. She witnessed the toll caregiving takes on the whole family and the financial impact of caring for parents with dementia. She has become an advocate in the hopes that her story and experience will help identify ways to bridge the gap between what's needed for care and what's actually available for care. So in 2015, three years before my mom passed, it became very clear to me and my siblings that my mother's care needs were increasing while my father's abilities to care for her were decreasing. The signs were subtle at first and often being hidden by my father who thought that he had everything under control and didn't want to worry us. But then there started to be what I would refer to as crisis moments. Sometimes it would be that my mother had fallen and he couldn't help her get up. Sometimes it would be that she was doing something that he knew was unsafe for her to do, but he couldn't redirect her. And so those challenges became bigger than him and he started to having to reach out to us for help. And in those moments, we realized that we needed to do more for my mom and care more for my mom. The fear of something happening to her in one of those crisis moments was just too great and we worried about it constantly. So we decided that somebody needed to move in and help care for my mom. I had a younger daughter of my own and a full-time job and it was just not an option for me to move in to care for my parents. My brother and his wife, who both also had full-time jobs but their children were full-grown and out of the house, had moved in to help out my parents. My brother's wife, who is a saint, took care of my mother when she wasn't at work and my brother took care of the house. That left the financial planning, the legal and the medical care, the case management stuff that you had spoken about. That left that all to me. That was my role. And so I started to take over those responsibilities. At that point, my father had approximately $400,000, probably a little bit more than that in savings that he had built up over his life. It seemed like enough at that point. $400,000 really did. And we didn't know he had the lead body dementia, but it really did seem like enough at that point. But then I started to hunt for some assistance to supplement my brother and his wife living in the house. I was sure there was more resources out there. I was sure that there was more financial assistance. And I quickly realized that there really wasn't, and that a lot of that care was going to fall on us and bringing people into the house and the financial expenses associated with that. And as I started to total that kind of stuff up, I realized maybe we don't have enough money to do this, and that was concerned. So we used resources such as Meals on Wheels, Age Well Vermont, the Dementia Respite Grant. They did cover some, but they did not cover enough. They didn't even come close to covering enough. Oh, excuse me, adult day programs in home caregiving services are very expensive, but we had no choice. We had to turn to programs like that and we had to pay for those out of pocket. Alzheimer's disease is a very slow progressing disease. There's no predicted timeline. We had no clue how many years we were going to have to do this for, and we really didn't know if we were going to have enough money. You can't budget and plan for something that you don't know how it's going to turn out, how long it's going to last for. After a while, we were referred to an estate planner, but not just any estate planner, one who specialized in elder care. And that was the recommendation to us. With his assistance, we were able to qualify for the Choices for Care program. It took some extreme measures for us to qualify. We had to remove my mom from the deed to the house. We had to put the house in a life of state plan. We had to remove hers of beneficiary from everything. We had to remove her from the checking accounts. At the end, she owned nothing, but qualified for financial assistance as a result. I've even heard a story from another caregiver who was recommended that he divorce his husband in order to protect his own assets. So it's kind of scary what you have to do to qualify for assistance. The financial assistance was helpful, but we still had to supplement the difference. And that sometimes cost us over $2,000 a month, even with the financial assistance in place. When my mom passed away in 2018, my dad had approximately $200,000 left. Caring for my mom over three years, even with that financial assistance, took over half of his life savings. It was much easier to care for my mom in the home due to the fact that she was much smaller and rarely moved around much. But my dad was much larger and Louie Body Dementia is a very different disease. He was unaware of his limited physical abilities and his hallucinations led to wandering. It didn't take us long to realize that it was no longer safe for him or for my family members for him to be in the house.  Budgeting $10,000 per month for such a facility, I became very concerned that we weren't going to have enough money. Body Dementia is also a slow progressing disease. We had no idea how much longer he would be with us. It was impossible to know if we had enough. 16 months later, my dad passed. In another three months, his money would have been gone. Shortly before he passed, I had already started coming up with contingency plans that included taking loans out in my own house or borrowing against my own retirement savings. By the end of the battle, it took financial assistance, hospice care, countless hours of our own time and over $400,000 of my father's savings to provide care for my parents in the last few years of their lives. We all know how dementia ends. After all, it is a terminal disease for which there is currently no cure. But until you've seen it firsthand, no one really realizes how bad it is when it begins. We all think we can handle it in the beginning, but then find ourselves in crisis moments desperately looking for resources and help just to find out how little of that there really is. We shouldn't have to wait for the crisis moments. We shouldn't find ourselves in these moments of stress desperately looking for help and then having to wait for those resources to become available. Those resources and assistance should be available as soon as diagnosis is received. We have that toolkit, so when we have those moments, we're prepared for them. We don't have that today. No one should have to navigate aimlessly through the system to try to find help on their own during such a stressful time. The system should be there to support and guide them through it. The systems we have in place today fall short of need, and I hope to see this change. Don't watch Lisa. Now come to our final panel member, Karen. I'd like to introduce Karen. A 15-Karen became caregiver to her mother, who was diagnosed with lung cancer past a year later. Several years later, her father was diagnosed with neurological disorder. She became his primary caregiver for six months until he died. Her role as a family caregiver included negotiating state support in New Hampshire, Massachusetts, and Vermont. She managed all their finances and medical care. After the death of her parents, Karen went to work in human services and homeless outreach. She started a career at the Northeast Kingdom Council on Aging in 2018 as an options counselor, helping elders to find the resources they need to live independently. In 2020, she tapped into her caregiver experience and became director of caregiver and client support, managing the services provided by the Council for Caregivers that include support groups, grants, community education, client and family support, outreach, and management at Geralta, a new e-learning portal for caregivers that provides 24-7 access to informational workshops and classes. Karen's passions be used for dedication to caregivers and improving access to the resources they need to take care of their friends and loved ones. Welcome, Karen. Exactly what I wanted to say before these ladies spoke. Coming to this work hasn't been easy for me, but it's also been pretty rewarding as well. I've lived in the Northeast Kingdom for 47 years, and now I get to help the elders in my community live and die the way they want to, which has been very important to me. My parents weren't afforded that luxury because I was 15 when it started and at 38 when it ended, I didn't know the resources, and I've made it my mission to seek out doctors' offices, community partners to make sure that the pre-planning starts. The Council on Aging, we do provide respite grants, and no, they don't cover everything. We advocate for more money. We're given grants, and if anybody's ever done grant work, you understand the difficulties of grant work. We have guidelines we have to follow. Some of us are willing to push a little bit more than others, but we are there to support. We have our support groups, our community education that I partner with with the Alzheimer's Association to get those classes happening and get the support groups happening. I work with a wide variety of caregivers. I have young caregivers and I have older caregivers. My oldest caregiver is 100 years old right now. She's fabulous. I get to go into my friend's homes. I get to go into my former teacher's homes. I get to be a part of this journey, and it's one of the most rewarding things I've ever done. I wish I could have been there for all of you in the beginning of your journey as I'm listening to these things. The resources are not easy to come by because of where we live. Oh, you live in Vermont? Okay. Location, location, location is a big deal for us here. There are five caregivers, five directors of caregiver in the state of Vermont, and we oversee these programs. We work with our options counselors. We work with our information referral specialists and we work with our case managers. Our case managers at our Treblaze do a lot of caregiver support without realizing what they're doing because nine times out of 10, our case managers are dealing with caregivers, not the client themselves. We work very closely with community partners. Home delivered meals are offered to caregivers regardless of age. There are things that we do all the time to help support our caregivers. I don't know what else to say because this was just, it was very powerful. And I honor the work that you do and the journey that you're on. And I thank you. I just want to take this moment and again, applaud you five for sharing your stories and echoing the parallels between case management, community education, stigma, compassion. All five of you spoke on that and we really appreciate you being here today and telling us your stories. So thank you again. One more round of applause for this five. All right, so now it's time we are going to mosey over to the state house and do some photo opportunities.


And we're doing it. What's good? Good morning. Sorry to the neighbors. It's friggin seven in the morning. Do I have time for this? I make time for it. Seven in the morning. What time is it? Seven, 20 people walking their dogs. The birds are gonna go nuts in the background. I hope you can hear them. I don't have time for this. Did I bring my good mic instead of my travel mic because I want to give you the best vibrations in the morning? Yes. Can I test if it's sounding even correct? No. Did I plug it in on this side of my computer and it wouldn't record even though it's the same exact chord and I didn't change anything besides the positioning of it and it didn't record? Yes. I can't figure it out but it's going well. Everything's going well. I got to keep this super short. I'm going to your world within YouTube event. I'm really excited. I know a few people there and I'm just looking forward to seeing what they talk about. I'm getting to know a lot of people, big YouTubers. First time I'm going to collab with some people. I don't even know how to collab. I just want to meet them, see what they're doing, if they have any tips for YouTube because I'm a YouTuber and I'm super pumped. I got to get out of here. Is my hair not even done yet? Yes. I got to take a shower still. Did I drink two double espressos and they were such little liquid? I didn't think it would do anything and now it's catching up to me? Yes. That's how we do it and I have nothing else. I can't believe it's only been one minute. I feel like I've been talking for 17 hours already but feeling really good. Yesterday I did hamstring curls. I'm literally like jittery right now. Hamstring curls. I want to talk about rehab real quick. Think long term. I'm working on my hips.  You saw my isos on my Instagram.    I understand it.  Just look at my Instagram with that. I can't even think.  It's the worst feeling. I much rather lift weights that's going to crack my spine. I much rather go for that. Actually, I don't like that.   Yesterday I did hamstring curls, strengthening my hamstring because I know they're super weak. I know they're weak because little things are really hard for them. The isometrics are really hard and that shouldn't be. That's because I have such a big imbalance. That's why I'm inflexible. When I was doing the hamstring curls yesterday, it was a tiny bit of pain but you have to go to a little bit of pain to stimulate it. There's that balance and I've been doing it on the low side of the balance for a couple weeks now where I stimulate it with no pain. I'm trying to do isometrics where I don't feel any pain. Now I'm extending my leg a little bit so I feel a little bit of pain because I need to start pushing it a little bit. I pushed it yesterday. Felt good to push it. I'm noticing when I do strength training, when I do hamstring curls, it feels more range of motion. That weight really does help push the range of motion. I know that but I can't push it yet until it's healthy. That's what I'm talking about. I want to see movies this weekend. I want to see ones upon a time in Hollywood. Tarantino is a cool director. What else do I want to do? I want to make my part two video of how I gained 47 inches in 92 days and I also want to make another video of how I became a human being and all the different things about it.  I don't know why I'm leaning like this but that's how we do it. I'm looking for new artwork for my podcast. I want to make it official. Do I want to change the name? Did I have to enjoy more? Yes. But am I going to do it? I don't know. Am I rebranding myself too many times? Yes. Is it going to hurt my brand? You know that already. But should I just make it Steven Selly podcast? Maybe. What does it matter? Is this even a real podcast? Yes. Because we're growing big, bro. We're growing big. Today I wanted to tell you, cars going by, if you hit the notification bell today, all these jitters that I'm feeling will be in your blood and your skin will be shaking. If you're watching a video podcast, it will be shaking like this and you could talk this fast if you get the notification bell right now. So if you have a lot of things to do and you have a lot of people to talk to and you have a lot of information to get out, hit the notification bell because when you hit the notification bell today, the YouTube implemented partners gave me the feature that if you hit the bell that you get to talk this fast too. So if you really want to talk this fast and you really want to start your own podcast today and start a whole new business to make billions of dollars and have insurance and all the litigations and auditations, you can do it by hitting the notification bell and that's amazing. I can't believe it. If you're already subscribed and you already hit the notification bell, then you automatically get the feature. You already get it.   And you're like, oh my god, I can't because Stephen gave me this ability and I can't do it and that's what I'm going to probably end in podcast because I don't even know what it does to do. But maybe we should do on this day in history because I totally forgot about it. Let's do it. Okay, by the way, I don't even really need coffee for energy. It just kind of makes me jittery. I was ready. I slept really good. I wish my Fitbit would tell me how much I slept, but it's connected to the camera. Once again, same mistake I made yesterday. I didn't check it before the camera and now it's connected to the Wi-Fi of the camera, which doesn't have actual data, which can't bring my Fitbit thing. Today in history is my computer. Oh, September 7th. I love it. Here we go. 70. Year 70. Roman army under general Titus occupies and plunders Jerusalem. Did you see how much I struggled reading that sentence?  This one looks cool. Oh, what? Shout out to Leo if you're listening. 1822. Pedro I, son of King Jiao, the sixth, declares Brazil's independence from Portugal national day. Happy Brazil Day to my boy Igor II with a state over my house yesterday. He gave me this shirt. Remember?  What's happening right now? You remember? Dunklef Daily, baby. I wish I had my little soundboard and I do. I can't hear because I don't have my headphones in, but I hope you did. Cool. Um, and today in film, 1980, 32nd Emmy Awards, Taxi Lou Grant at Asner. That's too long. Today in music, 1996 rap artist Tupac Shakur shot multiple times in a drive-by. Damn. Die six days later. I should listen to more Tupac. I don't, I don't really, I love rap and I haven't really given him enough, uh, listen time. I don't know. I listen to it. It's, yeah, I gotta, I gotta go into more. Yeah, I'm more cerebral now. I'm thinking of more lyrics instead of just dumb bumping like I used to do. But so I'm branching out. So I'm probably gonna listen to more Tupac recently or in near future. Don't hold me to that. I say a lot of things that I forget because I think nonstop. My mind is racing constantly and imagine if you're running marathons all day long.  No. 1896, A.H. winning first automobile race on closed circuit in Cranston, Rhode Island. C.J., that's for you, something about racing. C.J. is about to post videos about racing, dude. It's super cool. He's branching out as a human. All right, the dunk lifer of the day, baby. Let's go. By the way, I'm bringing back the dunk subscriber reviews. I might only do it one time, but I'm trying it out. You could, you could, I think today's the last day you could submit your videos. The link will be below or in the last video, whatever. Find the link. I posted everywhere. If you can't find links by now, my goodness. So, yes, post the more times you enter with like following my Twitter, following my Instagram. I'm trying to help myself out. You know, I gotta grow. I gotta grow. You do that and you submit your video and if you win, I'll review it. Only one winner, bro, and you'll be on the podcast most likely. Let's see. Stephen Selle beef versus Drake, Anthony Sanchez. That's what I like to hear. Beef versus Drake. That's it. I'm gonna roast Drake all day long because he talks like this. Yo, I got a podcast, bro, and I'm speaking from my brain, but my brain is the same if it never changes.  Okay, what the fuck?  All right, we're gonna, we're gonna stop it. That's seven minutes. That's seven minutes of heat. If you want to see a centaur, go to my Instagram. If you want to see my nonsense, go to my TikTok. If you want to have more energy, you got it. You already have it. This is what it's about. Have a great day. I can't wait for tomorrow. Gonna have another podcast. Guess what? Another one. I love doing this. I hope you enjoy your day. It's so much fun. Sun's not even up yet. The birds are going nuts. I hope you can hear the birds because it's fun and I'll let you know how the YouTube event goes. I just realized I should probably bring my camera because I'm a YouTuber and I should vlog a little bit and see how it goes because that's what we're doing. If it's a YouTube event, gotta be a YouTuber. I'm pumped. Let's go. Follow your dreams. You gotta do it because if I didn't reach out to people, if I didn't meet people, if I didn't make this big YouTuber, I might not go to this event, you know? But you gotta do it. You gotta make the dots first and then you see how they connect going backwards. Steve Jobs and we're out. Toodaloo. I dropped it on myself.


Whitney Battle Baptiste. I am at UMass Amherst and I'm in the Department of Anthropology. I'm a historical archaeologist and my area of specialty or my area of interest is the African diaspora, black feminist archaeology, and landscapes of slavery, post-slavery, and the materiality of race and racism. Why anthropology? I started out in history and I love the archive. I loved the unfolding of history. I loved the material aspect of learning about history and through the words of others. However, for me, history, there was so many stopgaps in history that I knew there was something more. I knew about anthropology but I did not know the hands-on experience that archaeology gave me. So right at the time when I started graduate school, I also decided to, well, I didn't decide to, I was given a fellowship for historical archaeology field school in the summer and it was amazing because I was at the same time writing my thesis going into the archives at Colonial Williamsburg, looking at wills and inventories at the same time that I was actually in the field digging up objects that were used, owned, discarded by people of African descent on a plantation. And it was at that moment that I realized that historical archaeology was a way for me to look beyond just the archive. It was a way for me to look beyond the secondary source and primary source but also to look at the tangible evidence of race, racism, and the African American and African diasporic past. Also what it did was it provided a means for me to enter into an identity as a black feminist. I began to concentrate on the experiences of women, of women of African descent and realized that pretty much I didn't have to look at artifacts and gender them. My theory was what was driving my interpretation but also as a black woman I was asking very different questions of the archaeological material than my predecessors or my mentors or my peers. And so in that sense I got into archaeology at a very vibrant time in which it was shifting from African American archaeology to African diaspora archaeology which was incorporating African diaspora theory, critical race theory, archaeological theory, but also what was material? How does material and consumption patterns? How does the availability of things? There's all of these ways in which stuff actually we are defined by the things that we have. The symbolism of objects, our relationship to things whether it be a phone, a computer, an iPad, which is a contemporary moment, but what about something you've passed down from generation to generation? What about something that a piece of jewelry or the ways in which you've taken one object and manipulated it to make it something that you really need at that moment? And so all of these also enhanced for me this idea that the African American past was so void of material. And as we know in the new National Museum of African American History and Culture we have a whole building that is filled with material. It's the material of our past. My concern is or my one of the things that I would love to do from this point forward is to really talk about why anthropology but not just anthropology, why archaeology is important to understanding race and racism, the African diaspora, black women, black men, black folks across the globe. And I think that we need to be a bigger part of the conversation as black archaeologists and that's why anthropology.


Anani kuhu, anani kusha Na, bonus na sum the same Nikina sum mechisa sum mojandefu Ni watitu wa man Wa me change luga maybe kenya nasema But anyway it is what it is And a couple of Ii amia pienu ki answer You asked me a question And I answered from a place of ignorance But I still answered Ulu nuliza kama nuna Ama pienu ki ka Na uli nipatia Reason Ya wo oni ki ka But me nili kwa nuna ki ka It was from ignorance You knew more than me But nuna sasat kona siji hadima Ama pienu mande Siju ni ni Ii nipatia tumali zehadi Ucho ke oki skia That's when Kenyansu Temi ya kiku karubu Eo nuna Sija li Sija li Temi ya kiku karubu Yes Kitu eni watu engiwa jai juwa Music Siya kuisha pa se Aitai isha niwevingi ni takami takeover Sii kama fashion Sii kuna kwaitu Sii kuna kwaitu Na usainu wa kwaitu badawako E It's a genre Kila time kuna kwa naki tumpia Naki na tuju ni ni ni ni ni tako ampia Sii tu gongo na renbi please Imi na misku bembelez wa evo Oh na kiyuze is not about that life Not at all Karibu nisa, this is your favorite show And if it's not please just to give us Samutime, yes Warm up, warm up to us We are lit Hashtag is first nation You can find us at White Fire from Facebook Y254 channel on Twitter White Fire for underscore channel on TheGramminativa Who likes colors, color meva And I want to know what's going on King Kingsley Yeah Top boy representing called Black Yes Kamakau Yes Uma dam konia yuko lewa kut Black Yuko, uja mskiya E bum finia ni mskiya E, e Gwanya Makosa Kibdogutu Kibdogutu Uda uma dam nukuwa nongiliya Anyway we are all present So are you nantakwa ntikichu wa roko In a little bit So please don't mess it But I do want to discuss The lovely lady in studio With us guest number two Hello Hi How are you? I'm well Hashtag maps Hashtag tii Oh my gosh Una kwitana ni rewe I'm called Winnie Paul Tell, Winnie Paul Yes Ati? Yeah, I'm called Winnie Paul Any relation to Willie? No So I'm Joani Ati Joani So where is this pikisha ujoba Because I have things to tell him All right Tell us about yourself Winnie Paul Yeah, so my full name is Winnie Paul Yeah, um From Westpacot Ah, that's why you look so fresh Yeah, and yeah I do gospel music Okay Yes Nimona You have been nominated for one Affirma awards Tell us about that Yeah, so I received the nomination Two weeks ago Yeah, as the new female Artist of the Year Yeah, and I'm requesting you people to vote for me We have come to the right place How do we vote for you? Yeah, so to vote you just go to your phone Chukwasimu Belike poli poli madam Okay, chukwasimu Yeah, and then you dial Star Tunaenda kwa Ya ni kwa kukul Kwa kipad Kwa kipad, yeah Yes, star Star Sawa, uko nasimumpia Star Yeah, so Just do star 483 483 Star 733 733 Hash Hash Then you click the green button Ni pesanga api kwaanza Ni ten bob tu Oh, so neza kwaanayo E msu ni check ya please Nati junu kwa kwa tivi Enter nominee code Ya, the nominee code is Two Two Zero three Zero three Eight zero eight Eight zero eight Two zero three Eight zero eight Yes Okay, reply Yeah Voting for we call Inferna Awards 2021 New Female Artist of the Year category Enter number of votes Ha, ya You can put as much as you want Wait, wait After I bring this Isu sa ni ki reply ni seme Maybe number of votes No tukazi kuetano It's okay I just write five Yeah Now if you put five It's 10 bob per vote So it will be 50 bob So ni ki seme Already ni meka moja, sendeyo So ni, ni seme Let's say for example I'm just trying to see if it's going to work Number of votes Ni me seme Payment via mob Ehi Ehi Na pesa zinum naja poziti Ja pay with this number Okay, I'm sorry I'm sorry Pay with this number A payment request has Allah It's even Wow Imen peneka adipin Umefika kopin All right A payment request has been made Please enter your pin to kopin Ni meka pin So ni goja tu Apo tu ni maleza So I've given you That's it Yeah, that's it Oh Yeah Okay, it's quite simple Guys, let's do that So siya ti tunenda tuneka Siji email address mahali Tuna Click for five days All right All right And what will happen Winnie Paul I have a question Kablai tukia apu kwa yoni ni Tumona apu kuna yotu Ni tumeweka Do go Kulingara na number of votes Where does the money go?  What's the first thing you're going to do? Who are you going to thank? You tend to be social media Who told this conference talk to us? What are you going to do if you win? Yeah When I win because I believe I like that I'm good for me I'll win Yeah, so once I win I'll appreciate you my fans By doing more More better music Yeah Yeah, and I have very good music On my channel They can go and look at it Winni Paul Yeah, very nice music On my YouTube channel I'm still on this name Aha Ni apu Ni aide Aide ya fanaide ni Winfredo Anzakaf tui Wow, sasa Paul ame tokawati Paul is my hobby Ah Yeah, so shorten So you can't do anything You can't do anything You can't do anything I'll do anything I want to do Yeah You can't do anything You can't do anything You can't do anything Yeah I want to say I want to say My dad My dad Aha My James Sifi Aha Please say ameziona I want to say DJ I want to say Christmas Ah, Badu Badu Okay. We have Meshla when you call. So they shall never give up Atakati metyoka? Atakata metyoka. Miracles can happen in the seven remaining days. Okay. Let us believe, see to live, remember to tapio according to our faith. Yes, yes. So, to engage the volume, take the logo with faith. See if faith man yon na fukiria. That's right from Facebook, Hashtag is advanced nation. Now let us release you. Oko sao? Kambisa. Let us release you to her amazing focus.