Welcome to another round of the OAuth happy hour. I'm Aaron Perrecchi and I'm joined here with Vittorio Hello It's been a while since we've been here lots of interesting stuff has happened in the meantime, so sure we've got a lot to catch up on today Yeah But as always we will cover we'll talk about some of the new things that have happened in the world of OAuth some of the new specs that are Working their way through the standards process and there's been a couple of recent events as well that we were both attending and participated in OAuth security workshop and a couple of the interim meetings from the OAuth working group, so We will chat about some of the new things that have happened in those sessions as well If you are watching live feel free to ask questions in the chat and we'll see if we can answer some questions as well Yeah Have you not had enough coffee yet today? I did take a decent amount But apparently I'm having a hard time and metabolizing it, but hey, I'm here by a big light I'm definitely awake Well fantastic With that so what event should we I think that the events to give us a good the backbone for Slotting you know the various things there and yeah, I have to admit you have been a bit negligent with Innering and so I didn't follow all of them, but you did attend all of them, right? I Think I did actually I think I did Let's see. Let's go back to the back to the First the last time we've we chatted which was the last OAuth happy hour would have been October 7th, right?  It's a lot. That's a lot and in the in the meantime We've had a handful of other events happening. So That was Right after that's right. I remember chatting about the HTTP signature spec we had a we had our our Yeah stream right after that interim meeting I remember yeah So yeah, since then we've had a lot to point one rich authorization requests d-pop and Token exchange and then the OAuth security workshop So lots lots going on there Yeah, although token exchange might be a bit misleading Talking exchange is done. It's an NFC and everything then there was someone that presented in possible use of that particular Of token exchange for that particular scenario, but it was Now like my collection is a bit foggy, but I seem to remember it was a very very very specific and That basically no action was taking while I work in droop like basically they wanted the feedback And I think that they they also repeated that at the Security workshop. They did. I remember that. Yeah Yeah, I did not have time to that because like after I've seen that Here it was interesting, but I don't think it was a generalizable. It was like a very specific Circumstance and scenario and yeah, it was an interesting application of a spec But not something that would become a spec in itself at least that that was the consensus That I believe Matches my recollection of that as well. I will I will drop a link to this in the chat though and in case See if it's gonna show up on the screen. Yeah In case anybody is curious about the details, there is a recording of the presentation at the From the interim meeting and I guess there's a recording of the security workshop session as well Oh, yeah videos are all online now. So, yeah Definitely can go and dig into it If you're curious, but yeah as far as I remember the the group decided to not do anything Directly with with that Yeah, yeah So what else where there wasn't your to the one like you presented the update on off to the one Yes. Yeah, so all two dot one we Also recorded and I embedded the video here the Presentation that I did was mostly like a status update of What's changed since the last time we met that's how I usually usually start and plan changes that are still in progress A lot of it is from from you so No pointing fingers. No point. It's very very helpful But we did have a couple of issues I wanted to discuss with the group while everybody was there and These spun out some pretty long discussions so Couple of these were pretty straightforward This one Everyone was like cool. This sounds good. Let's add that paragraph and it helps clarify things Yeah, and it just expanded for the audience This one was another one that I felt very strongly about and the point is off to that one omits any reference to the implicit flow and And so as a result a lot of people looking at open eddy connect, which does feature one flow that you can Technically consider implicit because tokens come from the Physician endpoint as opposed to the token endpoint that like people legitimately ask the question Does that mean that those flows define the open eddy connect can no longer be used and the fact is We already discussed it is in the past Of happy hours, so I won't go into details But the point is open eddy connected trades id tokens Which have a very different usage pattern from access tokens and also in particular form the particular flow Which is in common use they are all sent through post as opposed to your ads and so These new language, which is in the slide, which is a non normative sections of off to that one Clarifies that the fact that the implicit grant is dropped from actually is no longer even mentioned In off to that one in no way invalidates using that particular flow in open eddy connect And my hope is that these little snippets of language and thank you so much for adding it is going to facilitate so many conversations with customers which instead Required the entire world salad with HSCs now instead of now I should just be able to point to this particular fragment in the spec Done. Yeah Yeah, I think the the the confusing part about it was the Way that I guess it gets talked about is that removing the implicit flow is what's sort of happening is the way That people are talking about it, but what's actually being removed is response type token, which is a lot's implicit flow and Response type token. Yes, the intent is to make that go away By not including it for any use of response type token, but that has nothing to do with other response types that are defined elsewhere The big example of course being response type id token, which is an entirely open eddy connect only thing It's an extension of OAuth uses the extension points available in OAuth And it does those by defining new stuff defining new security considerations and new protection mechanisms, which is totally reasonable to do and A lot of people also call that implicit, but those two things are completely different things and This is hopefully going to clarify that it's not we're not trying to bundle those all together You know, I think that the challenge in general was in nomenclature to begin with like it Implicit just means tokens token comes actually not token artifact comes from the authorization endpoint and As you say people used like the only instance the only concrete distance of that when OAuth to the top first came out was a single page apps and Response type token and they're using fragment for returning it So most of the things co-occurring ended up having using exactly the same name. It's kind of like Calling a sneeze and called the same thing because they come together, but yeah So here we kind of were in the same situation And actually we have a question along these lines so Open any connect on top of OAuth 2.1 a hybrid flow. Yes or no, so This is this is related and I'm I was kind of curious whether it needs to be put into this paragraph as well And I decided not to for the first pass at doing this because I feel like it complicates things too much by mentioning All of the different combinations of things in open any connect. However There isn't a single hybrid mode in open any connect there are multiple hybrid modes and the There are hybrid modes that include response type ID token as well as response type token and the intent is to Not use any mode that includes response type token. Basically Response type token is no longer part of OAuth 2.1. So That But that doesn't mean that the other hybrid modes that open you connect uses are bad because those are not response type token. There's there's a I Think I have a slide of this somewhere, but I don't know if I have it fast enough to pull up but there's You know response type ID token with code response type code which gives you an authorization code and that is open back in the in the redirect and Then you can go and exchange that code for an access token And that's fine because that's using the good authorization code flow from OAuth 2.1 And it's using open any connects ID token response type. So that's fine But no, I don't think that there's any reason to use any of the hybrid modes that include response type token because those all have the same problem that we've been trying to avoid so and because of that I always always discouraged people from ever doing it even before to that one enshrined that as in ID token code. I love because it's a Nice graceful slope of complexity like say that I only want to authenticate and so I do a response type Equal ID token and I'm happy with that use it fine Blah blah blah, but then I decided now I want to start calling APIs and then if I add the code The flow remains the same like my middleware still accepts an ID token coming from the front channel I'm only adding on top of it They are a dimension of the code and the access token that I get is an access token for a confidential client It's a very zombie guilty because I do my request to the token endpoint so It's neat. I always love it and now I'd say it's the only hybrid flow that makes sense at this point Yeah I think that's a good way of thinking about it as if you if you only start with response type ID token Then you can just add this response type code in and nothing else has to change like you You're all your other code stays the same and then you just added in a little bit of new stuff as well Yeah, although now I'm going into a paint myself in a corner One a classic discussion of what happens at that point, which I had many times and it becomes a matter of opinion. I'm afraid but Save it that you have your middle Save it your middle are successfully get an ID token and these are the token is valid And so allegedly if you have a response type ID token, you are done You get the other token you validate it you drop your cookie and now you have your session Save it now you add the code on top of it and save it for some reason the code redemption doesn't work And so you don't get the access token. So the question is what should the middle where to do? should it create a session but then Simply not have in cash any access token or should it fail the entire thing and my position is that I Prefer that it keeps working as if I receive a validate it in Before adding code that was enough for declaring the user sign Oops, I think we lost you. Are you still there? Am I still here? Oh? I'm sick here Okay, we lost you for a second Let's Okay, which part did you lost? You were you were talking about Getting just just to the point of getting the getting the code and deciding to Whether to consider that user logged in Right, so to me the idea is if the ID token that I received was enough to Create a session for my relying party then it should remain between because I'm only adding The only exception to that to me would be if the access token you're getting is for the user info and At that point that these integral part of a sign in semantic Let's say that if you just authenticated, but I cannot get The attributes I needed then I cannot say that they are signing in is concluded So I didn't want to get into a rat hall, but I just wanted to highlight that this stuff is deceivingly simple, but Once it comes to implementation you do need to reason about it and some of the choices are non-obvious Okay, fair enough fair enough. Yeah Do you think it simplifies things to use? Only response type code to get both the ID token ID token and access token at the same time then If it fails it all fails It it simplifies it in a way. I don't like it for two reasons one is that It simplifies it thinking about it, but in terms of user experience It creates more pain. Let's say that if you decided that there was an Acceptable situation in which the ID token is enough for signing in then from the user experience They get less errors. So it's better, but from the developer experience. I am also a big fan of Being able to set up sign in if you don't need to call any PIs Just sign in the way you were setting up samol or WS Fed Which allegedly are more complicated But in this particular case they aren't because if you are doing this flow in which you get ready talking from the front Channel then you don't need a secret Because I can you just rely on the fact that the token gets redirected in the correct redirect you arrive and You should need the secret only if you want to call an API and You might want to call an API also for sign in if you don't want a token to end up in the user agent Which is a valid concern or if you want a skeleton token in the user agent And then actually get the attributes through so it's a valid choice but unless you are not in that situation then I try to Delay having to use a secret as much as possible because we know that secrets are problematic like you might put Git repo you might you need to through refreshment or a cycle of them if you have Like a cluster every instance of your app needs access to a secret. So you needed to so It can be done if it's it's needed But if it's not needed, I wouldn't just do it as for like for short cut What has a lot of people in our industry do that because it's simpler like if I just give you a sample for the SDK But that's just the code my life is simpler But I care more about the life of an user the quality of life Yeah, the other one. Okay. Okay, it makes sense Okay, let's see what else was what else was in here. Um, Yeah, the the is was controversial It was it was surprisingly controversial. I thought I was going to be more straightforward. So the it's a relatively simple mechanism for preventing a mix-up attack that only exists in certain cases for example, if A client uses ever talks to more than one authorization server And uses The same redirect URL for all of them. So so we should tell I think to the listeners that there is A draft which describes these particular parameters in itf For the reasons that you just mentioned and it exists as it's own draft And it's going through the process at record speed, but it's not at fc yet It is going through at record speed. I think partly because it's a pretty simple mechanism that is well scoped to a particular problem. So there's not a lot of Not a lot to talk about like there is a problem in these cases It is documented and here's a solution that is pretty straightforward to understand So that draft does exist. It is going forward, but it's not an rfc yet so the question was do we bring this into oaf 2.1 because it seems to make sense and The way that we left it after the interim meeting was No, we're not going to incorporate it yet, but we will revisit the discussion after it becomes an rfc because one of the goals of oaf 2.1 is is to just Collapse existing specs Not invent new things. So until this exists as a rfc It doesn't make sense to talk about bringing it into 2.1 Makes sense. Yeah Requiring htps redirect URLs that one was also pretty straightforward the the um Oaf 2.0 was created so long ago that Deploying htps was a challenge. It was a big challenge and expensive often Expensive certificates you have to buy and let's encryptors change everything And now it's pretty trivial to deploy htps on your applications, which you should also be doing for many many other reasons beyond besides using oaf so it makes sense to just Require it now for all redirect URLs It used to have even to have this note about the authorization should actually Warn the user about the insecure redirect, which I don't think I've ever seen anybody do But it was one of the recommendations of like, you know on the oaf consent screen The idea would be you would see a warning that says you're about to get redirected to an insecure location, which Seems like a very scary warning to give to users And I don't know if I ever saw that anywhere I I haven't and I think that these points to a more general thing I've observed, which is When we put in the specs indications about experience Very rarely implementations follow the spec It's mostly like if it's something that it can't be verified in a certification a test suite Then people just say whatever which includes the Consent like we have a number of places where we say you have to ask for consent And then if you look in real systems, there are always circumstances in which they are for decisions. I will skip it so I'm not surprised that we haven't seen this Warning in the wild yeah, but the good news is that The circumstance that required that sentence or made that sentence appear in the original spec doesn't really exist anymore So it's actually simpler and it no longer will be part of the recommendation That's true. That's true. And it's good that for a development time. Like if you go hit localhost although it is really simple frankly to add HTTPS also for localhost and You have to to be complete like in a spare in the spec we can say, yeah, you can you need You are not strictly forced to use HTTPS for a localhost But if you look at how cookies behave today, if you are not doing HTTPS Then various browsers will interpret the same side property of a cookie as strict No matter what you specify when you write that cookie. And so in practice, even if we make this exception The reality of the user agency is that eventually people will have to Use HTTPS and if you have questions on how to do it like you know the end of that and similar Hit us and we can help you to do that But yeah, and at the spec level technically you can omit it if you want to Yep, there's another another good reason to use HTTPS in development as well Which is there's actually a lot of browser APIs that require it So things like the location API or the I think even the web crypto API requires it And I think so, yeah Yeah, there's a handful of these javascript APIs and browsers that don't exist on a plain HTTP page so I've long ago set up HTTPS for my development machines because It it's basically required if you're doing any sort of modern Modern development these days, so And that's one of the things that I miss to be honest of a Microsoft ecosystem When you add a visual studio, it was just a checkbook saying here was the HTTPS And behind the scenes every test thing be it an API be it a web page Would go through IIS express or modern recent times they have some other I would say test web server and it would just do everything in there What has now is I have to use node because of zero is mostly node Um, although I can technically use a speed of net, but when people look at me and say, huh, are you the guy from Microsoft again? So no no no no no no, here where's not where's not Uh, then a basic I use a cad Caddy is a super easy reverse proxy You just make sure that you have a matching ports between your node and it does have a self-signed certificate on its own. You don't need it to do any OpenSSL magic. It's super simple, just download the caddy, launch caddy and reverse proxy mode wherever part you want. And that's it, really, really easy. That does sound a lot easier than what I've been doing, which is I usually install Nginx on my laptop and it's a full Nginx install. And then I have my own certificate authority that I created ages ago, probably over 10 years ago at this point. And I have that public key up on a web server and I always download that onto my new machines and make my machines trust my own root authority. And then I go and I have a website that I made 10 years ago, where I can be like, hey, please sign the certificate for this domain and my authority will go and sign it and I download the cert, plug it into Nginx and off we go. But yeah, caddy sounds a lot simpler than that. Then running your own certificate authority and moving it on every machine you get. Yeah, yeah. Yes, I'd say it is simpler. But, hey, it's like now you have a complete control and the internal security was a developer machine, so in theory you shouldn't bank too much. But yeah, having your own certification authority is a far stricter than using self-signed certificates. But for me at this time, at this point in time, when I call this just because I'm trying to do a quick proof of concept, I don't really code. So yeah, if I were to maintain my own certification authority, I'd have way more white and all this stuff. Yeah, yeah, exactly. Anyway, okay, last one, which is the most complicated one. The last issue that we talked about during the session was there's a handful of things in the spec that were in there because Pixie didn't exist originally that are trying to prevent certain things like authorization code replay or other mix up attacks and things like that. Things like authorization codes being single use, including the redirect URL when you're going and getting a token, which is like, the redirect URL's already done, it's already been used by the time you've got the authorization code, why do you need to send it again? Well, it's in there for a particular reason. So things like that that basically are more or less not needed if you're doing Pixie and the discussion was whether or not it is a good idea to sort of remove some of these features. And it turns out that there was a pretty strong differences of opinion in a lot of the different points here. So it actually spun out into a whole long mailing list thread as well, which is still ongoing. And my takeaway was that no, we should not try to group all of these together into a single issue. And maybe it's worth addressing them one by one. For example, there are, it was pointed out on a bunch of the discussions that there are other reasons that authorization codes are still make sense to be single use, even though some people don't actually enforce that because some people let authorization codes be reused within a short amount of time in their authorization servers, which is technically not allowed, but people do anyway. And my personal feeling about this one is I would just like to get rid of that one because that's really not needed if you're using Pixie, but didn't make sense to group these together in the way that I thought it did when I created this slide. Yeah, this was a difficult one because the thing that you guys are doing with it to that one is a very brave thing, which is like trying to, you are gonna touch on things that people just took for granted like axiomatically. And questioning common wisdom is hard. We tend to try to build on top of it, run and then going back to it. So it's these kinds of things and visceral reactions to like, oh no, authorization code is single use. How dare you suggest otherwise are to be expected.  Is he like, no, you need it rather than bringing the exact scenario that they thought they broke.  But at some points where it were valid, like I think about the thing about the single use of the authorization code, some major, major implementations supported using the same code multiple times within a certain interval, simply because there are practicalities behind it. Like if you have a network failures and now you can't actually, like you from the authorization server point of view, you're already redeemed with code, but from your client, you didn't. Then when you attempt again, then you get to the rejection. Allegedly, you have to go back to the front channel and ask the user again so you get another code. And these was the reaction of some of the old people, not old as in a demographically old, but old as in they've been in this space for a long time. The immediate reaction was like, you obtain another code and say, wait a minute, what about the experience? What about the code you need to write? You are now already running on there back. And now you needed to go back to the front channel. It's like, this isn't on trivia, but some of these arguments are really deeply rooted. And so that's why I'm saying that you guys are brave because questioning that stuff is just going to be more difficult than if this thing would be brand new and you'd just look at objectively the merit of the argument. Now you also need to fight the inertia of, we had these since forever and it works and so why do you want to mess with it? They redirect your eye in the token endpoint is also tough. Cause like for that, I remember in the past using these as a way of differentiating between deployments, let's say that you could have one app that can run in staging or in some special cluster and then in proper production or like public cloud and some other cloud. But eventually the same idea though. Same clarity, but multiple redirect your eye, which you can also like there, some of these stuff could be for multiple reasons. Like you might have a jail in which you want to sandbox some interaction. So you send them to that party, to a different redirect your eye because you want to hit the test cluster, something like that. And so providing that thing, like providing the redirect your eye to the token endpoint was part of a larger transaction which also when you trigger a sign out and maybe the sign out is from the back channel specifying the URL is just a way of saying this is the particular thing I want to sign out from. If you have a multiple deployment of the same app, I acknowledge that this is probably beyond what the specification intended, but at the same time these logic like these requirements of like you can rely on that URL to be there in shrine of a spec for many years. And so you can expect people to have taken dependencies on it beyond the security aspect. So I kind of understand also some of the reluctance also because it feels a bit like a switcher on one side you say we are only going to do into that one what is best practice. And instead of visa seems a bit like going a bit farther. It's more like optimization is like now I no longer need to do this because I have this extra measure. And it's not unreasonable but it's a bit of a different deal than how at least how I've heard to that one to be presented. So I understand why there's so much I won't say animosity, but let's just say passion when discussing those issues. Yeah, I don't think and I don't get the sense any of the discussions have been have any animosity. That's not the sense that I'm getting with these. I just think there's a lot of different opinions different perspectives coming at it and some people have been doing things for a long time. So they wanna make sure that those things keep working which is totally reasonable. But that's why we discuss them. That's why we bring these up. Yeah, exactly right. So that was 2.1. And here I'll say the same thing I said that way in a room I am looking forward and dreading the moment in which into that one we'll come to the native clients discussion. Because I think that in the current formulation that there is a one single set of advice and guidance for both mobile apps and desktop apps. And I think that today the characteristics of the two environments both from the security and from the experience perspective are different enough that they warrant different guidance. And if you try to add one single one you'll pay a price in terms of usability or convenience and stuff like that. So but there also I think that there will be a lot of rooted opinions. So it's gonna be an interesting discussion. I hope it will be productive and not to say pitchforks but we'll see how it goes. We'll see how it goes. I hope so too. That's basically next on the list for after we resolve any of the current things we just talked about which seemed like a lot of the ways as we'll get resolved is by not changing things. Yeah. Yeah, so then we chatted about rich authorization requests. Were you there for that one? I was but I was heavily multitasking. So my recollection is if Brian was presenting or was it Torsten? I think it was Brian. I think it was. I'm pretty sure that Brian presented a deep hope. But there are. Oh, you're right. Yeah. And I know that Torsten also presented something but I don't remember what he presented. I don't actually remember this meeting now that I'm thinking about it. And the minute I don't know why that's why that is going. That's wonderful. Let's see if this one works. This one works. All right. Oh, I took notes. No wonder I don't remember it. Cause you're like very, very just a conduit.  And then what's just that much? Yeah, yeah. Totally when you're taking notes you just kind of have to channel the words that are flying by and writing them down as fast as possible. And see it was Torsten. It was presented by Torsten. There we go. Oh, Brian is here and he says, it wasn't me. But does it say we have a little song here? Or like, wasn't me? Yep. All right. What was the recap of this one? The, oh wow. So we're talking about implementations of it, talking about, I guess that wasn't much of an update. Yeah. It seemed like pretty plain. And then we took a tangent on the usual, can we touch our scopes to make them do more than they normally would? Oh, Dennis had concerns about privacy. I'm very surprised. A surprise? Yeah. I'm being funny. Like for the listeners, Dennis is a character on the list. He's like one issue of water. He cares mostly about privacy. So everything he says is about privacy. That's why it was being funny. Yeah. And I remember because he brings up stuff that is from my spec. The access token profile. Yeah. That was kind of confusing. Yeah. In fact, I stayed out of it because Thorsten and Justin handled it. Yeah. Now I remember why, I 100% remember why I don't remember this conversation was because it was very, a lot of back and forth. If you look at the notes. Yeah. A lot of back and forth I was trying to capture. So, yeah. And some of it was also partly in the chat. Like I really don't know how notetakers manage to stay on top of those events because like part of it was in the queuing system, part was in the chat. Also, I'm not a touch typist, which is why I never volunteer to do that. Also, I don't speak English very well. So I don't understand when people speak very fast. Those are my excuses for never taking notes, but you guys are heroes. So thank you for your service, sir. Yep. Oh, I'm probably due for another one because this was a couple of months ago. So get back in that queue for me. Yeah. So then, oops, I lost my tab. Then we had Deepop. Oh, that one was interesting. And if I remember correctly, that was, oh, that was Mike. Mike presented Deepop? You know what we might be remembering? We might be remembering Brian doing these at the OSW. He did present on Deepop with all his fantastic photos and similar. I love this in the notes. Brian starts to start the presentation, but Mike shows up just in time. And starts to start is like an acceleration of sorts. He's like, okay. He's starting to start like, where does it end? It's a philosophical. The Deepop discussion has been fascinating because there's a lot of, I feel like it's another one of those where there's a lot of differing opinions and differing amounts of how far people want to go with it. And it's still, there's still a lot to untangle, I feel like. I think that the expectations need to be set. Otherwise we'll just keep iterating. And there is a lot at stake behind Deepop. Like to me, one of the most urgent reasons to have a Deepop finalized is a FAPI two. Like a FAPI one, like the financial service APIs is predicated on MTLS. Like it doesn't just say, I need sender constraint, I need MTLS. And MTLS is an interesting beast because given that it talks about the pipe, if you operate a service at a high per scale like a lot of us do, and you might be using things like Cloudflare and similar. So the way in which we implement this has important infrastructural implications. And so in FAPI two, the language is more generic, it's like use sender constraint, but let's let's make each other in the face. Right now, sender constraint is MTLS and maybe tomorrow Deepop. And Deepop is the only other contender because we know that token binding died and dignified the death when Chrome abandoned it. So yeah, I should be more careful with my language because I know some people are still processing the grief of that happening, but that's what happened. But anyway, the point is, I think that it would be super useful to have Deepop at least a subset of it finalized. But the challenge is that Deepop is different things to different people. On one side, there's the crowd that says, I want to use Deepop for everything, not just for single page apps. The other is like seeing confusion with credentialed clients or like actually having more stable credentials. Other people are more interested in, in terms of performance for hyperscaling, which using asymmetric stuff as we do today might not give them the level of performance that they need. So I think it would be useful for us as a community to put some stakes in the ground and say, okay, was that all interesting problems? The problem that we are pursuing with this version of the spec is, and once you agree on that, then we can resume the technical discussion. Because right now we are, it looks like on the surface, we are discussing technical merits, but in reality, my impression is there are different word views in five. It's not just a matter of the technical stuff. Discussing of us to level at the same time is super hard. So my suggestion to the stewards of the spec would be clarify scope and then we can try to close this thing. Otherwise we'll just keep, I can't say being idle because there is a lot of work. Like this is one of the most exciting things in our space, but I really do hope that we can find ourselves to deliver something so we can implement it. I agree, and I think that was one of the pieces of the presentation at the interim that I was seeing a lot of confusion about, which was the, I was seeing a lot of discussion about like particular solutions or applying it in a certain way without providing the context for it. So I felt like that was the missing part was like, okay, we understand you want to use it for this, but like what exactly is the problem that you are facing that is causing you to want to do that? And I felt like those problems weren't getting expressed well enough, so that was one of the pieces of feedback that they did take away and then came back onto the mailing list and did some more discussions there and provided that context. And I think that's been very helpful because if we are all, if we're, if the group has five different problem scenarios that everyone is thinking about differently and then we all go and want particular aspects in the spec without agreeing on the problem space, that's what causes the mess. So if we can all get on the same page about like, here are the problems we care about, these are the ones we think we can solve with this, then it should be a much easier discussion to actually solve those. Yeah, 400% agree. 400, cool. Okay, D-POP, we talked about token exchange. We did. So then the security workshop was the, was a little bit later that was just two weeks ago, in fact. Yeah, that's crazy. Beginning of the month at virtual, virtual coordinates 00. Very Cartesian. And so this event for people who don't know, actually hold on, before we get to this, there was a question that I just remembered, I saw that I wanted to mention before we move on to the security workshop, which is this one, is there any way to join the OAuth Working Group Meetups as a listener? Yeah, you can join the OAuth Working Group Meetups as a listener. Isn't there an IPR? Yeah, so you have to, like there isn't a special listener mode, you can just join it. So there's no like membership process or anything, but if you are interested in joining, you can absolutely join. You do have to agree to the terms of participating in the ITF Working Group, which is pretty straightforward. And yeah, you can definitely tune in. The, they are, the interim meetings are held, I think usually in WebEx, and then the recordings get put up later on YouTube with the rest of the ITF meetings, but anybody's welcome to join. There's no- So now I might be confused with the OpenID Foundation, which is a different animal, but I know that apart from special events in which explicitly it said no need to sign an IPR, like the ITF has this like note well, which includes something that you are agreeing upon, and they might be a document to sign, like if something that you might have to do with a doc you sign in order to participate. So- I don't recall if it applies to ITF or not. That is not the ITF. I'm trying to find the link now. Let's see, not now. I'm trying to find the link for it. It is, I think it's in this Working Groups page. Information about participating in the ITF. This is the page. So- Or maybe exactly, you can read, but if you want to send mail, then you need to have, there might be some of those aspects. The thing is there's no like, there's no formal, yeah, it even says it here. The ITF has no formal membership, no membership fee and nothing to sign. By participating, you do accept the ITF's rules, including the rules about intellectual property. There it is. It is very accessible. Fantastic. Yeah, then it's really open idea in which you needed to do the IPR. In fact, I could- That sounds- I had an IPR for Connect, and then I started recently contributing to FastFed, and I had to go and sign another document to extend my IPR scope, but apparently the ITF is more relaxed. W3C is even worse. There's even more hoops to go through if you're going to participate in those. Yeah, even for the community group, I get to sign something, which I remember because like, of course, before signing anything at all, I sent to legal, and they said I had to venture. Every time you speak with a tornado, like, of course they mean well and they want to protect you, but it's kind of like, it's different than working with engineers. It's just a completely different plane of existence. So yes, that is, this is the link for how to participate. It's essentially you just show up. That's the short version. And if you're curious about when the meetings are, I've been putting them on this events.oauth.net, which is an unofficial document, a place of OAuth events. I put the ITF meetings as well as related community events on here as well. It's incredibly useful. Like, that page is fantastic. Yeah, I feel like it's a lot more... A lot more accessible than some of the other ITF pages. Oh, yeah, absolutely. And also I can hear you all. You include everything, including things like IAW, right? Yeah, yeah, we don't, oh, I shouldn't, I need to add that now that it's got the date and registration's open. But the past events, like you can see we've got, yeah, Identiverse, when there's like a major conference that's relevant, I'll put it on here as well. The Federation of Browsers Workshop, which is the W3C group that you've been involved with. So I've been putting on here as well. Very nice. And, yeah, the, I was putting our happy hours on here, but I haven't been lately because I feel like it's borderline. Whether it makes sense for going on here. Anyway, that is a great place. And if you do want to add it to your calendar, there's a feed at the bottom, just subscribe to that in Google or Apple calendar or whatever you want your phone even. And you'll just get the events on your device, which is great. Yeah, so the, yeah, the ITF meetings, those are the like official ones where there are, you know, minutes on the record, official decisions, all that kind of stuff. And you do have to agree to the ITF's IPR rules and stuff by participating. It's very informal, but that is technically the official. Totally separately is this OAuth Security Workshop, which is not part of the ITF. It is not official in any way. It is a community organized event that invites people from the OAuth community as well as others. And it's mostly others. Mostly others. And no, it's a handful of OAuth people that offer them. So the thing with the ITF is, first it's the weirdest conference you'll ever go to. But the main thing is if you are interested mostly in one working group and the main advantage is networking, like in the same space, you'll find a lot of experts that care about the same things you care. And so you can add a lot of good network discussion, move things forward. It's very meaningful. But in terms of structured moments, those are ridiculously small. Like you travel all the way to this city and then you have something like two hours. And your presentation is something like 20 minutes. I remember the first time I did in person. I went, I got to the mic to present my spec and have some high bandwidth conversation. And all my time was lost because someone said, I didn't really have a spec, but, and he had a question which we already covered in the mailing list. And the entire 20 minutes of a high bandwidth, we had a gun. He was like, but luckily at dinner in front of a beer, via everybody's discussions with the idea to have. Do you know if the next ITF is going to be in person? If I remember correctly, it is virtual. No, it keeps going back and forth. Now I can't remember the current state of it. It was going to be, it was going to be in Bangkok and then that got canceled. But I think it's still going to be in person but they don't know where yet. But now it's getting to be pretty close. It's only three months away. So I'm wondering if it's back to virtual. Yeah, IAW is in person, but Omicron. So who knows if it will actually happen. I hope so because I am so tired. I'm so done with Zoom. And after having tasted Identiverse and the European Identity Summit and Authenticating Seattle, yeah, virtual stuff. Like I love the iOS W, but virtual stuff is got really old. Let's face it. Yeah. The OAuth Security Workshop has been an in-person event up until the latest last year. And it was virtual this time two weeks ago. And it was a great event. I thought it was well-run. The sessions were, there were a lot of useful sessions. It was pretty dense, a lot of good discussions in all of them, but it's still a virtual event and it is still very tiring being on Zoom for eight hours, two days in a row. Yeah. And you don't get the snack breaks in between to chat with people. So, yeah. Yeah, there is no serendipity. It's all structured at the time. And I guess that we'll talk about the content next time given that we now have only three minutes. Ah, I guess we are out of time. So, yeah, we'll have to chat about some of the interesting sessions there later. But the workshop, it was two days, full schedule, both days, lots of great sessions. You can see the timetable here. It's mostly time zone conversions is what the space is used for because people were joining from everywhere. But it was really good, a lot of good sessions, a lot of good notes coming out of those. All the videos from those are online as well now. So, if you are curious about any of these topics, you can go back and watch those as well. And I think it's gonna be worth to do commentary. Even like, guess what the next time we'll do a day at the hour will probably be January. But my suggestion is we should pick it up where we are leaving it today because some of the ideas very well actually, pretty new. So, I think it's worth having a high bandwidth conversation about it. Yep, I think it's a great idea. So, yeah, if anybody wants to do a little bit of reading through the notes and come with any questions, that's great too. We can kind of have a discussion that way. So, yeah, sounds good. That'll be a great place to pick up after next week. Wonderful. I don't know why I said next week. Next, it'll be sometime in January. Yeah, next month. All right. Yeah, thanks for joining. Thanks for joining live and drop questions in the comments later. If you have any other questions, we're always watching the comments on here. So, with that, I guess we will say goodbye for now and make sure you subscribe to this channel so that you can get notified when we do have the next one. We post them on YouTube. Otherwise, you can also find the schedule of upcoming events at octadev.events. That's our calendar for the workshops that I run, the OAuth workshops that I run, as well as conferences that our teams are speaking at and these happy hours get posted there. So, lots of good places to find us again later. All right? Wonderful. Wonderful. Thank you all. Thank you. And happy holidays. Bye.


Joining us for our Your Health segment is Dr. Andrea Bafford, assistant professor and chief of colorectal surgery at the University of Maryland School of Medicine and University of Maryland Medical Center. Dr., thank you for being with us. Thanks for having me. It's great to be here. Good to have you. We're here to talk about colorectal cancer, which I understand has been declining overall, but increasing in people under age 50. What's going on? Right, that's right. That's exactly why it's increasing. And still, cancer patients less than 50 account for 10% at most of colorectal cancers, but it has been doubling in rate as opposed to declining, like you said, in everybody else. Probably something to do with dietary habits, lifestyle, rising rates of obesity. These are some reasons we think it may be rising, but it's something that definitely is being seen and has even changed our guidelines as to how to screen people for colorectal cancer. I was going to ask if it's gotten to that point yet. How have the recommendations changed? It's starting to shift to 45 for the age of a first screening colonoscopy as opposed to 50, which it was in the past. And that's in the case of somebody without a family history. That's right. That's right. So, people with family members who have had colorectal cancer are at higher risk. And those people should have colonoscopies 10 years before their family member had colorectal cancer, even if it's before 50. But this is the general population. Some of the societies, like the American Cancer Society, recommends 45 now. What's the process? We'll talk about polyps. Is that how it always gets started?  So, yes, the cancers do start as polyps. And we think it takes a while for those polyps to become cancer, maybe about 8 to 10 years. So, the whole point in doing your colonoscopy is to find these lesions and remove them before they have a chance to become cancer. Okay. And this is obviously, it's a major cancer. It affects one of the top cancer killers. Right. Third most common cancer in men and women. And the third most common cause of cancer related death in men and women. And if everybody got a colonoscopy when the recommendations say to do it, as a surgeon, you would be far less busy, right? That's right. Yeah. So, there's an opportunity, but the procedure itself has a bad reputation, you can say. Yes, it's not, mostly the prep ahead of time isn't the most pleasant. You have to clean out the bowels to be able to see things, okay? There are some other screening tests now available that rely on DNA changes in the stool, for example. There's virtual colonoscopies. So in certain cases, there's other options to the standard colonoscopy and that may help in some cases. What are the pros and cons there? If you're able to get somebody, you can't talk somebody into the colonoscopy, but you can get one of these other screening tests. What's good? What's bad about that? So, the other screening tests certainly have less prep involved and then the procedure can be done without any sedation, for example, without anesthesia. The con definitely in why I think a colonoscopy is always going to be gold standard is a colonoscopy allows you to intervene. So if you find a polyp, you remove it right away, as opposed to having a second study or procedure done in order to do your preventative test. And then also, if you could see something in biopsy, you diagnose it. Cancer is earlier. Let's get to the phones of Prince George's County. This is Nadia. Nadia, thank you for calling. Go ahead. Yes. Hello. You're on? Yes. I was going to ask Dr. Bedford that recently I did do colicard and it did come back positive. My question was how reliable is colicard and how do I prepare myself for the procedure having diabetes? Interesting. Thank you very much. Best of luck to you. Sure. So colicard test is quite sensitive. It's less able to be specific. So you may find a change, but it doesn't always mean that there's something there. But it's a good entry so that it allows us to screen people who would benefit then from the more invasive procedure, the colonoscopy. And as far as how to prepare with diabetes, we do keep patients on liquid diets for the most part, the day before the procedure. So I think that helps to maintain the blood sugar levels, not at a more normal level as you're doing your prep. And then if you have your procedure earlier in the day, for example, the next day, then there'll be less chance of having a low sugar level in the morning. But definitely ask your doctor about that because it depends on, like for example, if you're on insulin, we tend to halve the dose of the insulin. So they'll have very specific recommendations for you. They'll review your medications and let you know what to do. But it's definitely something that we're very familiar with and adjust accordingly. Any advances in the prep itself? You mentioned that's an objection for a lot of people. Has it changed at all? Yeah. There's preps available now that are very, very low volume, so you're almost doing a couple shots as opposed to having that jug of solution. So that helps a lot. There's ones you can mix with Gatorade, for example, and that's a lot easier to tolerate as well. So there's definitely improvements. Let's take a phone call from Howard County. This is Steve. Steve, thank you for calling. Go ahead. Hi. I've had regular screening since I was 50. I'm 72 now.  And this last one that I had, had the next one when I'm 75, and my doctor has said that that will be my last one, that they don't screen after your age 75. So I'd like to find out why and why not, and why can't I get one? Steve, thanks for the phone call. You mentioned there's a long period of time between when a polyp proceeds to become cancer. Is that it? So that's a great question. And a lot of our guidelines do recommend stopping screening at the age of 75 because you're benefiting less from a prevention standpoint because, again, it takes maybe a decade for a cancer to develop. However, between the ages of 75 and 85, and even older than 85, you really decide based on a specific person. So if you're in great health, you have very little medical problems, you know, very active, I still would continue screening patients over the age of 75 because you're in such great health, you'll still benefit from finding a cancer early and treating and expect to do well afterwards with treatment. So a caller can probably talk a gastroenterologist into doing a colonoscopy. Can he talk the insurance company or Medicare into paying for it? Yeah, I think there's a lot of different reasons to continue to do colonoscopies, and it may be that you have, you know, a family member or some symptoms like blood and the stool, for example, that if you have those things, we do, especially in that over 75 to 85, are a little more selective with colonoscopies, but reviewing any symptoms that may trigger a lower threshold to do the study. A call from Western Maryland, this is Lisa. Lisa, thank you for the call. Go ahead. Yes, I think you may have just answered my question, but it was more of a case of how is the insurance companies taking advantage or lack thereof at a 45-year rule for colonoscopy and going forward? Thanks very much. Probably not something you deal with directly that much. Yeah, I'm less familiar with insurance coverage, and right now some societies recommend the 45-age screening initiation, and others don't. So I'm not, as far as insurance companies, I think there is definitely enough data and having the American Cancer Society recommend the age of 45 should allow for insurance companies to cover. Is there anything people can do to prevent colon cancer or lessen their potential for developing it, particularly if there's family history? Yeah, so we've been talking about screening, so definitely getting adequate screening, but other things you could do are dietary changes, a healthy diet high in fiber, lower in animal proteins and red meats. That is shown to increase, those things are shown to increase colorectal cancer, so if you're able to control those things, it's helpful. Regular exercise of physical and activity has some association with colon cancer, maintaining a healthy weight, avoiding excess alcohol intakes. So for men it's considered two drinks, more than two drinks a day is excess, and for women one a day some moderate alcohol intake are none, and then not smoking. So these are all lifestyle things that everyone can do to decrease their risk. What's happening on the treatment side? You do surgery, you do with robots sometimes. Yeah, so with surgery we are able to do the same surgeries with less and less invasive means, so robotic surgery, laparoscopic surgery, those are surgeries with minimal incisions, so you're able to do the adequate cancer surgery, but decrease the time off of work, the amount of pain after surgery, improve recovery. We're trying to preserve organs more, so maybe doing less surgery in a way, period. And then from the chemotherapy standpoint, more of the therapies are now targeted, so we're looking at specific cancer genes or the proteins they make or the environment they're in, and targeting those specific things so you can individualize treatment. And even with radiation therapy, which we use for rectal cancer for example, there's improvement, proton therapy, something we offer that decreases. Dr. Bafford, we're going to have to leave it there. We appreciate the visit, thank you so much for joining us. Your health segments are a co-production of Maryland Public Television and the University of Maryland Medical System.


It's great to be here. My name is Kylie Kwon and I am the founder, co-owner and chef of Billy Kwon restaurant in Sydney, Australia. For the next few hours I will be introducing some of the speakers and many of whom I'm very lucky to know. First up is Michael Miller who is the co-founder of the London Meditation Centre and New York Meditation Centre. Michael teaches regularly throughout Europe and New York also leading retreats across the world. He teaches the ancient technique of Vedic meditation in a way that is accessible and relevant to people living modern lives. Something that I can certainly attest to having attended a session of his back in 2016 during our week at Mad Jail. Would you please put your hands together for Michael Miller. Hi everyone. It's been a fantastic couple of days and so great that we're coming into this right in this moment having just eaten that amazing food from Rocio who of course spoke yesterday about meditation and in Ayurveda the science of health that comes out of ancient India they would say that the consciousness of the chef is as important as the ingredients and the preparation. The state that that person is in. So here we are infused with meditation food about to have an experience. Now the title up there was peace in the kitchen and so here we've been having amazing food and probably a lot of people have been having amazing drinks and now suddenly here we are at the wellness session. And some people this is the moment you've been dreading. I go oh no. Is he going to have beads? Will there be a big beard? Is that you turn to the person next to you? Do you think there's ice cream out there already? Maybe we can sneak out and skip this one. And I just want to say don't worry the worst is over. Just the title that that part is done. Peace. This is why people come to learn to meditate to find peace and they might not quite frame it that way. You know someone comes along and their blood pressure is high and they say I've heard meditation does a lot for that and great there's really good research on meditation that shows blood pressure normalizes. If it's high it comes down, if it's low it comes up. Someone else comes along and the CEO says I want to be more focused and engaged in my work and absolutely she discovers that when she learns to meditate her focused attention and her creative and critical thinking skills go up and she has that sense of peace that comes about from knowing you're doing your work in the very best way. Someone else Michelin star chef comes along and says things going well at work but home you know my ability to be in the moment and be aware and present with my family my child it feels like it's undermined by the other work I'm doing and they do start to discover that sense of I can be where I am instead of still back in the kitchen and there's a piece that comes from knowing you're being the very best for your family. Where is this piece? How do we create it or how do we find it? Where is it? Because it's easy to say ah peace it's inside man it's inside you just got to find it. What does that mean? So I want to do a little exercise to demonstrate for us all to have an experience of where peace actually is. So I'm going to divide the tent in half kind of right here so if you're on the line just lean one direction to the other decide which side you're on and there's our two halves and if you're at home streaming just lean one way or the other. So this half this half I'll come back to you just relax for a moment. This half in a moment I'm going to raise my hand and when I do I want you to make a sound and I'll tell you in a moment what the sound is and just keep making that sound making that breathe as you need to just make the sound for a little bit until I bring my hand down. And so the sound might be spelled O H H H H H H O something like this. Okay so when I raise my hand ready and go. Nice good yeah I'm back to you. So same I'm going to raise my other hand in a moment and I want you to all make a noise and just keep making that and breathe as needed and the noise I want you to make is a lot aren't to be really noisy scream yell stomp your feet really make a lot like so much noise like if a tour boat is going by filled with English people who voted for Brexit. They should be scared they should think Scandinavia is rising up to reinvade the British Isles this loud. Okay ready and go. Oh my god if you're at home I hope you didn't do that. The person in the next room is concerned. Okay that was perfect it was the Brexit bit. Okay in a moment I'm going to raise both my hands and make your particular sound until then your hand goes down this hand or this hand yeah makes sense right. Okay ready could you hear that when you're making that racket. Could you hear yourselves. Did you did you only start when when they stopped. No you were doing it the whole time it was there. There's peace it's always there. It's the baseline it's there underneath all the time it's just there's noise there's excitation. And this is stress this is stress in our bodies pieces here pieces inside that's the background that's the baseline of all of our experience but we've layered in stress on top. And we call stress different things anxiety irritation anger sadness depression over excitation mania boredom these are all different ways that stress gets expressed. But it's the same thing over excitation and it drowns out the piece that we have inside. And how do we find that do the opposite of excitation the excite and this is meditation that the technique that we teach research shows that when you meditate in just a few minutes you are resting two to five times more deeply than sleep. This is really significant the excitation. So let's do another exercise to experience this inside close your eyes before you close your eyes don't change the way you're sitting if you're kind of relaxed and leaning back this is perfect this is just the way to do it.  Just sit comfortably close your eyes don't feel like you have to be perfectly still if you need to shift and move a little bit this is fine. You're going to hear some noise the rain fantastic beautiful white noise in the background but some noise of people around you and a little bit of my voice but whatever happens fine there's no need to focus there's no need to concentrate. These are not things we're interested in I taught in Sweden a few years ago I said what's what's Swedish for focus they said focus. So how do you say concentrate in Swedish concentrate English Swedish poorly pronounced. Let your attention turn to sensation in your body somewhere in your body there's a dominant primary sensation maybe it's a little heat still in the mouth from that amazing.  Maybe it's just the feel of the weight of your body on that vaguely cushioned bench you don't have to hold your attention there just note that your attention gets drawn to a sensation. And then that stall or it's it starts to dissolve or shift a little and your attention gets drawn by something else another sensation little ache in the lower back.  And again the attention starts to shift and when you notice other thoughts coming it's not a problem it's good thinking as a part of meditation tells us you're meditating correctly. You just notice I'm thinking I thought now back to the body. And the attention goes to the sensation as easily as lightly as a mote of gold dust lands on the pedal of a rose. Maybe you find your attention on more subtle sensation a little air moving across your face the warmth behind your knees the feeling of fabric on your upper back and now without changing without engineering. Notice the sensation the physical sensation of your breath is your chest rising and falling is your stomach moving pressing against your belt.       Take one minute 30 seconds each turn to a person next to you something not your buddy not your friend that you're here with but someone close by you haven't spoken to yet and just take 30 seconds tell them about your experience here from then go. Okay, fantastic. So some people felt tired. Who felt tired? Little dozeness coming you had no idea how tired you were until you slowed down till we quietened down a little bit some people felt distracted mind going other places this is fine. One of the biggest myths about meditation is it's training and how to not think that's like training and how to not eat the body is designed to think just like it's designed to digest. We're not going to stop that what we gave here was a little exercise to give you an orienting device stress resides in the body and when we do this what we call body feeling technique. And if you email Molina she can send you a PDF and tell you you'll do this but you'll send a PDF to anyone who's interested with little instructions for how to do this. We're tuning into the language of the body the language is telling us this is where the stress resides in the body and we want that stress out.   All of you want to be engaged in meditation makes you more engaged and more available and more dynamic you're not going to turn into some spaced out bliss bunny. Cross legged in your apartment while someone robs you it's cool I'm a meditator I'm here to give man that's not the deal you will find yourselves more appropriately responding. Rest is the basis of activity the deep rest of meditation is the basis for very very dynamic activity. And you do something do something with a little bit of regularity and you create a different experience inside of yourself you find peace that lives in here because we can't wait for it out here. You can't wait for your employees or your chef or your customers or that president over there or that company over there or anything out here to deliver it for us we've got to find it. We have to find it inside and then it spreads from us out into the world find peace inside to create peace in the world. Thanks everyone.


The big question that we're interested in is how the brain supports aesthetic experiences. For example, when you go to a museum and you find a painting to be beautiful, or when you go to a performance and that performance is touching or moves you, we want to know what brain processes and representations support those unique aesthetic moments. The more specific question we focused on in this study is a question about different aesthetic domains. In particular, what I'm referring to by a domain is something where there's a set of rules that describe how you interact with that domain and how you make judgments about that domain. So the domains we're focusing on here are artwork and architecture and natural landscapes. So the types of judgments that a person makes about a natural landscape might be quite different from the types of judgments they make about artwork. And not only that, but the way that the brain represents the relevant information is also quite different. Despite the fact that these different domains have very different properties and people engage with them in different ways and the brain represents them in different ways, it might still be possible that there's one brain system that can represent aesthetic appeal across all of these variety of differences. And we're focusing specifically on two brain networks. Because I'm interested in visual processes, we are investigating the visual system with a focus specifically on the ventral visual pathway, the part of the brain that represents what it is that you're looking at. So this is a brain network that is very extrinsically focused. It's a brain network that is active when you look at something out in the world. The second network we care about is a brain network that seems to be internally focused, and it's called the default mode network. This brain network is a brain network that is thought to be mostly involved in internally directed mentation. So for example, when a person recalls autobiographical memories, or when you are mind wandering and just thinking internally to yourself about what you are going to have for breakfast tomorrow. So typically this brain network does not become engaged when you pay attention to the external world. Therefore, we want to look in these two networks, the visual system and the default mode network, to see whether or not either of these brain networks contains a representation of aesthetic appeal that generalizes across all of these different visual domains. The primary method that we use in this study is called functional magnetic resonance imaging. This is a form of magnetic resonance imaging, or MRI, that can be used to measure a correlate of neural activity in the brain. What we do is we put people in an MRI scanner, and we use a projector and a mirror to show them images. In this experiment, we show them either images of artworks, or we show them images of architecture, or we show them images of natural landscapes. They view each image for four seconds, and then they use a trackball to respond and tell us whether or not they found that particular image to be aesthetically moving or not. So that is the basic behavioral data that we're going to be using to correlate with the brain data. Now, the complicated part of this experiment is the analysis. We take the brain signals that we measure from across the brain, and we pull out the brain signal from specific regions that we want to test. There's one set of regions from the visual parts of the brain. So in this particular case, the ventral occipitotemporal cortex. The second set of regions are from the default mode network. We take the pattern of data from these brain regions as a person is looking at, for example, an image of artwork, and we train a machine learning classifier to try to predict people's responses. If a part of the brain contains information that is relevant for aesthetic appeal, the machine learning classifier will be able to pick up on that information, and then when I try to test the classifier on a new set of trials, it will do better than chance. That's the basic method here. We train a classifier and we test the classifier on data from a specific brain region. In one type of test, we train on one domain, for example, artwork, and we test on that same domain, artwork, where we train on landscape and test on landscape. The second type of test is what I call a cross-domain test. In this case, we're training a classifier on landscapes, but then we're testing that classifier on architecture, for example, or we're training the classifier on artwork and testing it on landscapes. First, we investigated the visual regions of the brain. When we take signal from these regions and we try to train a classifier to predict people's responses, we find that classifiers are not able to do it very well based upon signal solely from these visual regions. On the other hand, when we look in the default mode regions of the brain, we find a very different picture. First of all, data from these regions is able to be used to predict people's preferences. Not only do we find a signal for aesthetic appreciation in these default mode network regions, but that signal is domain general. We can train a machine learning classifier on trials where a person was looking at artwork and we can actually predict their responses on trials where they're looking at landscapes. I think that this is really the surprising part of our finding. This brain network that is really thought to be involved in inwardly directed contemplation, a brain network that normally does not respond when a person engages with the external world. It's this brain work and not the visual parts of the brain per se that seem to really contain a domain general representation of aesthetic appeal. I think these findings are relevant in two different levels. First of all, they have some relevance within the field of cognitive neuroscience. Aesthetic experiences are important and powerful experiences. They're experiences that can really be life-changing in some cases. We think that by understanding these types of experiences that we might be able to also understand the brain dynamics of other kind of rare or peak moments of experience. Turning to the larger societal implications, we think that there could be implications both for learning and also for well-being and health. When you find something to be aesthetically appealing, these moments can really be teaching moments. They can be moments where you learn about yourself or learn about the world around you and the pleasure you get from those could potentially be harnessed to help people learn better. We're very interested in understanding whether or not the brain mechanisms of aesthetic experience can teach us anything about learning more generally. It's clear that aesthetic experiences are very important for people's well-being. The amount of money and time that we spend on aesthetic pursuits makes it clear that going to an art museum or looking at a landscape is not purely a pastime, but it's really an important key component of our lives. I think that there could also be some potential health outcomes and relevance for this work. The most immediate questions that this research raises are really mechanistic. How is it that information about your visual world then makes its way to this default mode network, to the internally directed DMN, and how is that information transformed from information about what it is that you're experiencing to then a representation of how you feel about it, of whether or not you find it to be beautiful or not? So we really need a better mechanistic understanding of how these networks talk to each other and how the information flows from one place to the next. Second, there's obviously the question of whether or not this applies to non-visual domains. So is it the case that the DMN also represents aesthetic appeal for music that you like, or when you go to a performance and you see someone dancing, or if you read a book and you find that book to be aesthetically appealing, is it really domain general in that sense, in that it generalizes across many different sensory domains? Beyond these more mechanistic questions, there are a few directions we also plan to take this research. First of all, given the importance of the DMN for internally directed thought, it's natural to ask whether or not its involvement in aesthetic experiences is related to one's sense of self, or to a sense of self-identity. And we're really interested in trying to better understand whether or not self-relevance is playing a role in these aesthetic judgments. The most moving aesthetic experiences you've had probably didn't occur in a lab, but they occurred in a museum or in a performance space. Well, we can't exactly measure brain imaging using fMRI when you are sitting in Carnegie Hall. But what we can do is try to look at bridging technologies that allow us to measure some of these same brain systems and brain processes in those naturalistic settings where people are more likely to actually have strong aesthetic experiences.


All right So I noticed I wasn't really using my arms I used a better arm swing felt more of a pop still look like I was leaning forwards Well, I regret regret it later, baby What is good today, I'm testing out the hamstring I haven't jumped or dunked in about two weeks three weeks So I've been really struggling with this hamstring. It's been really bugging me I can't really run or jump or anything like that So I've been trying to just do isometrics to help rehab it But I realized I wasn't really pushing it enough Try some hamstring curls to push through a little bit of pain. The pain was super minor So that told me I should start strength training it and then the next couple days it didn't feel worse It actually felt a little bit better just a tiny bit better Maybe a little bit more range still very painful, but the action the action of the exercise didn't hurt it during So that's a really good sign and it also showed me how weak my hamstrings are So I'm working on strength training and that's why I'm testing it today I'm gonna do some light light jumping hopefully some dunks and then get my cardio up I want to get that stimulus what I've been doing in the recent past has been swimming to get that explosive Stimulus I kind of sprint in the pool and also get my full body some cardio going because I need to stay in shape Welcome to the friggin dunk life and we're hoping to get back to dunking full strength in a few weeks And if today goes well and my strength training goes well It could be even sooner and if it doesn't go well, it could be even longer It's like the prairie dog thing the groundhog day if you see the shadow the sun shines more and then the winter may not come Other than that, I'm a comedian and I have my open mic tomorrow night. I don't know when you're seeing this So yeah, I dunk on life every single day with my podcast and today I actually dropped anyone can dunk And I truly believe anyone can it's just a matter if they can get stronger if they can get faster But go watch that for some motivation I Pretty sure that went in and I'm gonna do a light jump and maybe just swim after this keep it light I just swiss the lane Dammy did it again. I just flipped the pain stripping the dip it in base lab on everything Swimming is taking away cuz I got big rats coming. I put my long rats on it I ain't skip past losses. I have to get back off it See the fit lab on it until late with my coffee money clip I told that I heard it's big bags on big bags I'm big bags coming up coming in. Yeah I just wanna wear you know, so that actually hurt They went a little bit more aggressive So I'm only gonna do like one or two more But I just want to dunk one and I want it to be off the dribble I looked at the rim and I felt aggressive So that's a really good sign that my energy is high, but I just want to work on my technique get that hammered home So when I come back, I'm not super rusty Really happy with the way I feel today. Wow You're really happy with the way I feel today feel bouncy feel athletic The ball feels super light like I'm super strong technique is pretty garbage But I'm probably gonna swim and then lift my legs a little bit strength train Wrap out a ton of reps well pump out a ton of reps to just strengthen and really stimulate my hamstrings a lot Keep the pain super low So don't go above like a 2-3 on my internal pain scale I would hurt a little bit, but I took off way more explosive way more upright just way more poppy So I noticed I wasn't really using my arms. I use a better arm swing felt more of a pop still look like I was leaning forwards Let's correct it I want my dribble dunks to be crazy effortless and it's starting to get there. This feels good on an injured sore Worked day on a rusty Manufactured type of ordeal in this time and space.  What wild wild tic-tac is super cool


Welcome back everyone to day three of theCUBE's live coverage of MYs here in our nation's capital. I'm your host, Rebecca Knight, along with my co-host and analyst, John Furrier. We are joined by Sandra Joyce. She is the VP of Mandiant Intelligence, Google Cloud. Thank you so much for coming on the show. Thank you for having me. Yeah, we're excited to have you here. So there has been a marked shift in zero-day exploitation and cyber espionage tactics, especially from China. I'd love to have you talk to our viewers a little bit about what you're seeing and what you're observing now. Well, this transformation has really occurred over the last two years. And what we've been observing is this shift from China having, let's say, tier two or tier three level capabilities in the space, very noisy spearfishing emails. They have evolved to have the capability to take on operations that are very difficult to track, very difficult to understand and to mitigate. So they've really graduated into what I would consider a cyber superpower status at this stage. What are some of the tactics and strategies that they use for their attacks? And they're a state actor, but there's also off-state kind of activity where they enable, using open source, other tactics. What are some of the moves that they're making as a tier one or, as Kevin says, apex attacker? Varsity. They become the varsity team, pro ball, the speed of the game. What's their current moves? What are their plays? Right, so some of this has to do with really targeting what we call edge infrastructure, or those components or appliances that connect to the internet themselves, right? So there's one piece. There's also trying to evade EDR or the lateral movement technology we have in place to look at how endpoints are protected. So they're going to go after that, try to shut those things off or evade them completely. Another piece is they're issuing and exploiting zero days at a rate that already surpasses year to date. We've looked at about 60 or more, like 62, I think, where they've exploited zero days in the wild, not necessarily just China, but China's a big percentage of that. Last year was 55 for the whole year. So exploiting zero days, edge infrastructure, they're also looking at obfuscating obfuscation networks like routers from even home businesses and home offices. So they really are doing a lot of different things. Why now, what is it about this moment in time that has really, what's going on? I think that one axiom we always live by or once our rule is geopolitics begets cyber activity. And what we're seeing is the rising tensions between the US and China, and that's really changing the game in cyberspace. So we're seeing this very aggressive action on the part of Chinese threat actors, but it's really tied to these escalating tensions. We expect to see more of this type of thing when things are not going so well, because it is a way that you can do force or power projection with very little risk or repercussion. One of the things that Kevin talked about is keynote, the three things, he goes into the three things. I'm going to tell you three things and then tells them, then tells what you told them. Love that military kind of vibe there, but one of the things that was interesting was the public-private partnerships. So how do we, as in America and other countries, protect ourselves from premeditated moves?  They're digital, so they're digital troops. So how do we look at that as a country and how do companies protect themselves? I think one important principle to realize is that we have, for very important reasons, a delineation between what we allow our intelligence agencies to do domestically and what really belongs to the private sector. And this is to protect our civil liberties, our rights, our free speech and all of that. Well, this doesn't exist in other countries where, for example, the Chinese government can direct and can be very intrusive into the businesses within China. That's not how it works here. So if the people trying to protect us need insights into what threat actors are doing in the domestic space, in the private sector, they have to go ask the private sector. And that is why these public-private partnerships are so important because we need to be able to cover all of that ground. We need to be able to say, if they're abusing infrastructure in a company, we want to protect the privacy of those users, we want to protect the contracts that are in place, but can we talk about the threat actor activity and work together to bring them to justice? We have Space Force for Space, which is congested and contested, and more and more, it's obviously a fun topic as well. But is there going to be a military branch for cyber in the sense of offense, like to counter, strike or manage? You see recruitment going on for folks, FBI say, hey, work with us. Is there a future where there's digital soldiers? Well, the future is here. It's called Cyber Command, right? And the NSA being part of the Department of Defense is also conducting cyber operations. That is, their unclassified charter is that, in fact. And really, every branch of the military has a cyber force as well. So we do have a growing set of cyber expertise, second to none in the world. And so it's their role and also the private sector's role to help in the defense of our country. And the countries of allies and like-minded people who want a rule of law kind of environment. I always say gamers, I'll make a great candidate for potentially multiplayer fun. And actually the skills needed, what are some of the skills for folks watching out there, there are a lot of people who are passionate about what's happening. How do they know if they're a candidate for being a cyber engineer or a scientist or warrior or participant? There are so many jobs in cyber security. And so if you like solving problems, if you want to defend your nation, if you want to defend your organization, if you like to tell the stories of what happens in an investigation, if you're curious about things, that's really all it takes. And then after that, just see where you have expertise and where you have natural talent. So if you want to code, lots of open spaces for people who want to code. If you're not a coder, we still need analysts, people who speak different languages. We need people who know how to pull apart investigation. We need people who can communicate about it in our comms team, who can put the message out. So there's really a wide swath of attributes that are needed to really provide that collective defense. We had some great women on yesterday and other experts. They said, it's fun. Cyber security is actually fun. It's a fun job. So there's a lot of folks out there who are always interested in this. Talk about AI. Now, AI is coming around the corner. That's going to be an enabler for this next generation of defenders, okay? And we did a poll on Twitter with our audience that who wins with AI, the attackers or the defenders? Now, the votes were the attackers, but the most people initially, no, the defenders. So there's a shift of opportunity to get a leg up, so to speak, with AI. What's your view on that one? Definitely a defender's advantage. And there's a lot of reasons why. I mean, the technology that's in place right now for AI has actually been around for quite a while. So the development of it has come a long way. But these language models are going to help cybersecurity workers do the parts of their job that aren't that fun, right? Things like efficiency and what they're doing, helping to find anomalies in a bunch of alerts. It's that kind of 10xing of the analyst and 10xing of the researcher that is going to make a difference. Right now, we're looking at something like a 750,000 person cybersecurity workforce shortage. And we've been trying to do a lot to fix that. Let's graduate more people. Even Google's got a bunch of really great programs to certify and to teach and learn and get into that. But on the demand side of the jobs, the jobs are hard, they're fun, like you said, but they're really hard too. A lot of it is because there's a lot of manual tasks. That's where AI can come in and help. That's what Kevin Mandier was saying, that this is the solution to the burnout that so many cybersecurity teams face that AI can really help them with those road tasks. It'll be part of the solution, right? So there's never a magic pill, right? But what we're seeing is that it has the potential to really allow a cybersecurity worker to do so much more than they used to be able to do. So this whole leaderboard aspect fascinates me about the nation-states. Obviously, China's number one now. Russia kind of built a number two. North Korea, you could argue maybe in two, three. And then Iran and others. Is the Ukraine war, some say it was a test kitchen for Russia in a lot of their cyber? It's been talked about publicly in articles. Not sure if you agree with that or not, but now that you've got the conflict, has that forked and changed the power dynamics between Russia and China, or is China just surpassing them just on pure execution? It really depends on what we're asking about. Are we asking about just sheer numbers? Well, then China would be there. But if we're asking about true technical capabilities, we still have tremendous capability from the Russian threat actors that we track. And that's a really serious issue, is that the technological capability is very sophisticated. What we've learned, though, from the invasion into Ukraine is a lot of important lessons. We've seen that the Russians were able to exploit some, they were able to gain access because there had been placement in a network for years already. So they had done their homework right before going in. We've learned that when infantry battalions were moving through, we saw that they were being taken over, like networks were being taken over physically as they moved along, which means they had embedded cyber-action teams with their groups. We learned that they would use information operations together with their cyber-actions. So if there was anything good from years and years of Russian aggression, is that we have learned a lot about what they can do and what they're capable of. One of the things that, we were back and I had been talking a lot on theCUBE here and as well, other events is culture, is what's your vision on how cyber culture is very collaborative, obviously sharing's a big part of it. Yeah, share responsibility, there's some seams there, okay. But as the lights get turned on on some of these tactics that are state-sponsored, but not obviously their fingerprints aren't on it, whatever, however they're executing, but as it becomes well-known that they're involved, these state actors, what's the policy going to, what's the punishment, what's the effort? Is it collaborative, do we go more global? Is the opportunity with geopolitics to be more collaborative? What's your vision on how we solve this problem where we say, all right, enough's enough, stay in your lane, don't screw around anymore. This is an interesting time, it's not just a military response, the classic sense, but there needs to be a response. What's your vision on that? Well, the way I see it is, some of these cyber problems actually don't get solved with cyber means. Some of these are diplomatic issues, some of these are the geopolitical issues that need to be solved first, because a lot of, for example, cyber criminals and others are operating out of areas where there's no riskier repercussion for what they're doing. And it's going to take that host country to take action against them, or to stop the actions that they're doing. While I think that putting up a vigorous defense is an absolute must, it's a moral obligation to put up the best defense possible, if we want to solve the core of this, that's outside of the cyber domain. That's up in the, how can we deter these actions? How can we get engagement with countries where we need to come to a place of peaceful coexistence? Because as these tensions rise at the end of the day, what do we want the future to look like? And I think everybody wants a peaceful coexistence, right? It's hard to think about those things when you're in the middle of what feels like the back and forth of a cyber conflict. So in this delicate geopolitical environment, how are you, how should organizations be thinking about the rise of China through these espionage acts and other state actors? What are you advising companies to do? Well, the first piece is if private sector companies think they're not a part of this stuff, that it's all out there like a geopolitical mess, that's for the government to solve. What we're seeing is they're on the front lines of this. So I'll give you a couple of examples. North Korea is stealing cryptocurrency from individuals and businesses in the United States to fund their own cyber operations and fund their nuclear program. So we have to be cognizant of things like that. Jenny Sterly, the head of CISA at DHS, said that in the event of a conflict with Taiwan, she publicly said that critical infrastructure in the United States would be a target. Well, most of that is owned by private sector. So all of those organizations had to sit up and take notice that they're a part of this. So in cybersecurity, a lot of people say it's a team sport.  Individuals, businesses, organizations, and the government, all of us have a piece on this and we all have to work together. That's the culture piece too. That's changing a lot now. That's right. Is there anything that's jumping off the page in your mind that's new in cyber that wasn't a factor a few years ago relative to either culture, personnel, or technology, or just thinking? Well, one thing I've always liked about the security community is we all know who the bad guy is. We all know who the enemy is. And that has led to an industry like cybersecurity where we have competitors. We will compete vigorously with our competitors. However, we know each other. We all respect each other. And when tensions get high, if there is something that is truly wrong, we will call over and we will say, hey, are you seeing this because this is what we're seeing, it's serious. And in that way, that is one thing I really like about, especially in cyber intelligence, there is sort of a camaraderie amongst defenders and a defender community that's very strong. And without that, we wouldn't be where we are today. So we've talked a little bit about jobs in this industry. We've talked about burnout, the culture piece. I want to ask about your career because you are one of the best educated people we've ever had on theCUBE, many master's degrees and MBA, you're in a PhD program right now. So how are you thinking about the next generation, particularly of the next generation of women cyber defenders in this industry and making sure that they're getting the opportunities and they're rising to leadership positions and board positions? Well, academics only gets you so far. That to me is more, that's my hobby. That's what I do with my, that's my me time, right? But really it's about gaining experience where you can and making sure that you really take risks. When somebody says, hey, we need somebody to cover on this target, be the person that says, sure, I'll do that, I'll learn something new. And one of the reasons I like structured learning is because knowledge has a half-life. The things that we were talking about five years ago, they're not that relevant today. So where are the deep conversations happening that could be happening in a classroom? They're probably though happening in the middle of a cybersecurity conference where you can sit and you can talk to people who are going through a bunch of things. However you learn, however you educate yourself, just be a lifelong learner in whatever form that is, whether you're watching YouTube videos, you're taking courses on Coursera, you're going to conferences and talking to people, but always be learning. And if it happens to be at a grad school, fine. But that's not the only place to learn. The ability to level up too now, if you're coming into the industry, it could look scary from the outside. But to your point about technology shift and new things, people can come in and level up pretty quickly. Technology's changing so fast. Yeah, and there are a couple of things where I think that everybody needs to learn a little bit more of. AI is probably one of the first ones. If educate yourself, there's some great YouTube videos that Google's produced on what is AI, what does it mean, what are large language models. It really is anybody who wants to be serious in this industry really needs to understand those things. Another thing, geopolitically, tensions about things like semiconductors and chip technology, we need to know what those are. If we're in a situation where we might have a conflict over something like that, do we know a lot about it? And the more people that learn about it, maybe the more innovations we can come up with and alternative paths and other things. So this is a time where so much new technology is coming in, it's exciting, it's going to help us defend. So let's learn about it. As Kevin would say, we want to up our game. We want to up our game. Up our game here in the United States. Excellent, a great note to end on. Sandra Joyce, thank you so much for coming on theCUBE. Thank you so much for having me. I'm Rebecca Knight for John Furrier. Stay tuned for more of theCUBE's live coverage of MWISE.


What I'm looking forward to most in the new facility is just the opportunity to be in a new facility and to bring this kind of resource into Mount Pleasant close to home. Fast, friendly service, that's what we're really looking to do. We're looking to take care of patients in a friendly environment, in a state-of-the-art facility with all the bells and whistles that you can have in an ER and do it quickly and competently. It is a facility that is brand new, state-of-the-art, with excellent providers, it's attached to a name that is known for quality medical care throughout the state of Michigan. It's going to be a 24-hour emergency care facility. This means that any emergency that you have, we can treat and take care of. We can stabilize and ship you if you are very, very ill. We can treat your common emergencies very well and then send you home. We have all the tools, all the materials, we have the doctors, we have the staff, everything that we need to take care of them, I'm fully assured we can do. We have state-of-the-art CATS camp, x-ray and lab capabilities. We have a fully functioning blood bank. The staff that's coming into this facility, I would put them up against anybody in the state. There's a wide variety of experience and a wide variety of personalities. We have several RNs who have literally decades of experience. We have some great staff coming on. We have a former flight nurse that's coming to us. We have an OB nurse. We have paramedics that have been in the field for a very long time that bring another level of emergency care. So I'm very excited that all of us together are going to make this a fine place to come. And close-knit family, getting to know the patients in the community and taking good care of them. And I would trust Tamara with any, but she would be the nurse that I want to take care of in my family. We'll have a very comfortable waiting area, a very warm atmosphere with a fireplace, cafe nearby. All things that make an otherwise stressful event a little bit easier to deal with. We have the closest level two trauma center just in Midland. We have a very large cardiac care program. We have a plethora of other services that you just can't access in our community currently. Mid-Michigan has a long-standing tradition and culture of excellence and providing that level of care and that culture to the community I think is definitely going to be a benefit.  I think it's just exciting to get in on the ground floor and just watch it grow. So come grow with us. It's going to be an absolutely awesome experience.


Armored Lizard. Oh no guys, two packs left. Metal Raiders, why must you betray us? Bless us with something good, dwelling in the bottom. Oh no, tainted wisdom. We got blackling fire dragon, illusionist, faceless mage. Mystic Lamp, Crass Clown, Launcher Spider, Magician Defei, come on, foil please. Game Guardian, and that's how you do it. That is a foil, another secret rare.