Siwethaf. We begin business today with general questions. The first question is from Daniel Johnson. To ask the Scottish Government how many remand and how many sentence prisoners have been sent to HMYOI polemands since 2013 due to space being unavailable at secure care units. Cabinet Secretary, how many are you? In relation to solemn proceedings, there have been none. Local authorities are responsible for remand and somebody proceedings in the Scottish Government doesn't hold information on those particular cases? Thank you, Presiding Officer. I thank the cabinet secretary for that answer, but given that we are now a month on from the tragic circumstances of William Lindsay's death, I do find it surprising that the Scottish Government does not know the number in question, because I think that it is vital that we understand this so that we can put right what tragically went wrong. Can I ask what the Government is going to do to find out what the figure is, and then what it ultimately will do to put right the circumstances that surrounded that death? Ultimately, I think that that is what is required. Can I say a couple of things? In relation to his first question, my answer was that we don't hold that information on record because it is local authorities responsibility. It is something that, of course, I can approach local authorities to ask them about, but what I would say is that we have to be really careful when talking about any incident. If I take the case that the member referenced in relation to William Lindsay's own case, it would be incorrect that it would not be factual to say that there was not secure unit space available at the time of William Lindsay's case on the third and the fourth of October. My understanding, the information that I have, is that there was secure unit availability, and that would have been for the local authority and the social work department in particular, but the local authority to have found that out and to present that to the court at the time. In terms of what we are doing, the Deputy First Minister and I are working extremely closely, because there is an issue around secure unit availability, the fact that if that is not up to a certain level of capacity, then those secure units could potentially close, and none of us would want that. We are working on options. In fact, I have seen options presented to me and to the Deputy First Minister just this week. Of course, I will keep the member and others updated to when we get to what I would think is a more satisfactory position in this regard. Annie Wells It is estimated that 70 per cent of those in prison have a mental health problem. In a report by the Health and Sport Committee last year on healthcare in prisons, it was noted that there is a considerable variation across prisons in relation to mental health care available. What action has been taken by the Scottish Government to ensure that prisoners, no matter where they have been sentons, are able to access mental health support that best fits their needs? I thank Annie Wells for asking that question. It is hugely important. I have visited prisons across the prison estate and I will continue to visit more prisons in the prison estate. Mental health and the addressing of mental health is absolutely the core of what is provided, but I do not doubt at all that we can go further and that more can be done. This is in a variety of settings. We know that, for example, when it comes to female offenders, mental health issues present themselves even more than they do in amongst the male population. However, in amongst the male population, there are mental health issues. We have, of course, when it comes to young people to talk to me strategy. She will know from my answer that I gave previously that, looking at the issues in appellment, we have instructed a review of mental health services in amongst appellment, because, again, we are not satisfied that we are the best place possible. We will continue to work with SPS, with the NHS to provide services, but where we can learn best practice elsewhere, the Government is absolutely open-minded to make sure that we are tackling mental health issues, whether they are in the prison estate or, indeed, outwith. To ask the Scottish Government what its position is on a feasibility study being carried out to address congestion on the Edinburgh city bypass. The Scottish Government recognises the important role that the A720 plays for Edinburgh and its region and the national economy. Transport Scotland is currently monitoring the queuing on this particular route and investigating how it can be better managed. In addition, Transport Scotland is undertaking a second strategic transport project review. That will be a multimodal review and will consider the performance of the A720. We have committed to taking this forward in a collaborative fashion, which will provide a robust evidence base to support future decisions on investment in strategic transport infrastructure across Scotland for the next 20 years. Miles Briggs. I thank the cabinet secretary for that answer. It is clear that we need to see work commenced now to take forward a long-term solution and to address the constant gridlock on the A720. Can I therefore ask the minister, if he would be willing, for the Scottish Government also to commit to a feasibility study and will he agree to meet with representatives from across the area? As I know, there is a growing problem for all of us across this Parliament. Cabinet secretary. The President of the United States of America might be interested to know that the strategic transport project review will consider the entirety of the A720. That work will start next year, which will be informed by the national transport strategy, which is due to be published at the end of next year. The STPR2 will allow us to set out what the strategic investment decisions will be for our transport infrastructure over the course of the next 20 years. That will include making that assessment of the A720. The process that the member is making reference to is facilitated through the STPR process. I encourage those who have an interest in that matter to engage in that process once it has been undertaken by Transport Scotland. To ask the Scottish Government how many businesses in the Stirling constituency have been lifted out of paying non-domestic rates under the small business bonus scheme. Minister Kate Forbes. Information on the small business bonus scheme is not currently available by parliamentary constituency, but as at 1 June 2018, 2,670 business properties in the Stirling local authority area were lifted out of paying rates through the small business bonus scheme. Since the small business bonus scheme was introduced by this Government, it has saved premises in Stirling nearly £39 million. Bruce Crawford. That is very good information from the minister. In addition, can you tell us how much small businesses in my constituency will save next year as a result of the SNP Government's budget that delivers the best budget package for small businesses anywhere in the UK? A budget that, incredibly, the Tories have already said, including Dean Lockhart, who is here today, that they will vote against. I share the member's incredulity that the Tories might be considering to vote against something that saves businesses so much in hard cash. Spend on the small business bonus scheme was £5.8 million in 2018-19 in the Stirling local authority area, and since the scheme was introduced by the Government, it has saved premises of whopping £38.9 million in this area. Dean Lockhart. Scottish Government figures released two weeks ago show that more than 1,200 businesses large and small across the Stirling area have waited over 18 months for the outcome of their appeals against punishing rate increases. For many, the outcome of their appeal will be the difference between staying in business or being forced to close and lay off staff. If, like me, the minister finds this situation unacceptable, what measures will she take to address it? I thank the member for that question. On the first point on appeals, one of the recommendations in the Barclay review that we have accepted in full and which I am taking forward as part of primary legislation next year, as well as other guidance support, is to ensure that the appeals process works for businesses and that it puts justice at the heart of businesses and businesses that need access to justice can get it. However, what Dean Lockhart does not acknowledge is that, in the Stirling area, not only are more businesses in receipt of the small business bonus scheme but the overall value that that is ensuring that businesses save as part of the small business bonus scheme is directly contributing to business growth in that area. To ask the Scottish Government what progress it is making with developing a peer-to-peer mentorship scheme to boost exports alongside CBI Scotland. The minister launched the export challenge on 26 November this year, an event attended by around 100 businesses from across Scotland who have shown support and interest in the challenge. Good progress has been made in developing the detail of the programme and we are working closely with partners, including CBI Scotland and Scottish Development International, to ensure that it is a successful implementation. I would like to take this opportunity to encourage businesses to feel that they would benefit from being mentored or who are experienced exporters, and I would like to participate as a mentor to volunteer for consideration to take part in the programme. Gordon Lindhurst In a recent policy paper, CBI Scotland outlined a number of measures that the Scottish Government can take to support Scottish businesses to export. Some of those recommendations include addressing the following number of students passing foreign language exams, making up the shortfall in STEM subject uptake and looking at whether secondary, further or higher education could offer opportunities to study commercial international trade. Does the minister agree that improving our children's education in those areas is key to growing exports, and has he discussed those matters specifically with the education secretary? Ivan McKee I can understand the point that the member is making and I undertake to have a conversation and take those matters up with my colleagues, the education minister, to discuss that. Clearly, that is one aspect and that is part of the overall approach that we need to be looking at. Monica Lennon To ask the Scottish Government what its position is on the procedures used by the Public Defence Analysis Office and the Scottish Legal Aid Board to investigate workplace bullying and harassment. Ash Denham The Scottish Government has a zero tolerance to any form of bullying, harassment and discrimination from any source and where it occurs it is essential that it gets reported and tackled. It is for the Scottish Government in overseeing the work of public bodies to promote diversity and help create an open culture, which will increase the likelihood of individuals speaking up about any wrongdoing. As the Scottish Legal Aid Board is a non-departmental public body, staff are employed directly by the organisation. All public bodies must have their own robust grievance policies and procedures in place and the Scottish Government requires these grievance policies and procedures to comply with appropriate employment legislation, that they are accessible, that they are clearly understood by staff and, importantly, that staff know how to access and use them. The Scottish Government also provides a model code of conduct for staff of public bodies and SLAB has confirmed that it complies with this model. Monica Lennon I thank the minister for her reply. Kerry Evans is a lawyer in the Public Defence Analysis Office. Kerry is deeply unhappy with the way SLAB has handled her claims of bullying by her line manager. As reported in the Sunday Mail, the Scottish Legal Aid Board gave Kerry's personal diary about alleged incidents in her workplace to her line manager without her knowledge. The information commissioner has said that this was a breach of data protection obligations. I understand other concerns about bullying at this public agency have been raised. Will the minister take this seriously and request an independent investigation of the case and make sure that staff have full confidence in the policies and procedures that are in place? Monica Lennon Let me assure the chamber that, although Scottish ministers have no mechanism to intervene or to comment on any individual or current cases, the Scottish Government is working to tackle and to challenge the underlying attitudes and inequalities that perpetuate that kind of behaviour. I am sure that the member would accept that. On the particular case, the chief executive has confirmed that an independent and external organisation with expertise in employment law, HR and health and safety matters was commissioned specifically to review the circumstances and the organisations policies and procedures for handling such matters. The chief executive has confirmed that relevant policies and procedures will be reviewed and updated in light of the recommendations from the external review, and I expect to be kept updated on any developments by the chair of the board. The right to privacy is very important, and public bodies are responsible for ensuring that they adhere to data protection laws, and the information commissioner's office is responsible for that regulation. The Scottish Government, I am sure that the member will understand, cannot comment on this particular case that relates to an on-going grievance. Alex Cole-Hamilton To ask the Scottish Government what discussions it has had with the United Nations regarding proposals to raise the internationally advised minimum age of criminal responsibility to 14. Mr Murray Todd The UNCRC is consulting on its draft revised general comment number 10 to seek views on its proposal to advise a minimum age of criminal responsibility of 14. No final decision has been made, and we will of course consider the views of the UN committee once a final version of the revised general comment has been received. To date, we have had no discussions with the UN committee. We were contacted by the UK Government on 11 December 2018 regarding the response to the consultation, and we will provide our contribution in due course. Alex Cole-Hamilton I am grateful to the minister for that answer. Fewer than 712 and 13-year-olds are referred to the children's reporter on offence grounds each year. A further half dozen are referred to criminal courts. Those are not significant numbers, but the impact of a criminal record on life chances for any young person is significant. It is traumatic, and it is lifelong. It is why the children's reporter's administration told the human rights committee at stage 1 of the age of criminal responsibility bill that there was an imperative to go further than 12 in setting out our new ACR. Given that the UN will likely raise the internationally prescribed minimum age of criminal responsibility to 14 in February, does she share my concern that the bill will be out of date before its ink is even dry? Minister The Scottish Government absolutely recognises and respects the significance of the UN committee's general comments as an aid to interpreting the convention. We are committed to respecting and protecting human rights. We consider the recommendations by international organisations very closely in our policymaking, and we seek to uphold the very highest standards of children's rights in a responsible and in an appropriate way. In Scotland's case, the age of criminal responsibility has to be looked at within the context of our unique children's hearing system. The children's hearing system provides a distinct welfare-led alternative to criminal procedure for the vast majority of children under 16. Raising the age of criminal responsibility must be looked at in the wider context of current approaches. We should all acknowledge the Government's willingness, the Government's record in this area, and its willingness to bring forward further reform in Scotland. Oliver Mundell Thank you, Presiding Officer. Will we believe that 12 strikes the right balance? Can the minister confirm, if she was aware that the UN were considering raising the recommended age of criminal responsibility before she introduced the bill and gave evidence to the committee at stage 1? The Scottish Government was made aware of the consultation on 14 November 2018, the day after the Scottish Parliament's day 1 stage 1 debate on the age of criminal responsibility. Question 8, Liam Kerr. To ask the Scottish Government what the clear-up rate for housebreakings is. The Minister for Rural Affairs and the Constitution has said that the clear-up rate for housebreaking was 23.9 per cent in 2017-18. That was up from 22.5 per cent in the previous year. That has remained at similar levels over the last decade, since the advent of devolution, the number of housebreakings recorded by the police fell by 73 per cent to the lowest level since comparable records began. Liam Kerr. Thank you, the cabinet secretary for that answer, which, phrased a little more bluntly, confirms that over three quarters of housebreakings in Scotland go unsolved and unpunished under the SNP. That is a disgrace. When did the cabinet secretary last meet the chief constable specifically to discuss this issue? Cabinet secretary. Well, chief constable and I obviously meet on a regular occasion and discuss how we can improve safety. Of course, when it comes to issues of housebreaking again, that is something that I talk about regularly with my officials and with the police. However, on a serious point, of course, when it comes to clear-up rates, we want to work to ensure that they are better, they are higher. However, the member should not ignore the fact that housebreakings have dramatically fallen with the SNP. In fact, in the north-east region, the one that the member has an interest in, I am sure that they have fallen by 58 per cent between 2008 and 9 in 2017 and 2018. The clear-up for housebreaking in the north-east has increased by 5 per cent in the past year, so we are starting to improve. I agree with him that they should be higher, and we will continue to work with the police to do that. However, I am sure that he would welcome the fall in the housebreaking over the past decade. Kenneth Gibson Minister, can you tell us how clear-up figures for housebreaking in Scotland compare to England with the Tories and Government? I understand that it is less than 10 per cent. What I would say is that there are many comparisons to make with England and Wales. We have seen a reduction of housebreakings. In fact, in England and Wales, there has been an increase in housebreaking. That might be in part because, in Scotland, we have invested in our police officers and a police service. We have, for example, awarded a 6.5 per cent pay increase, while in England and Wales the police service are taking the UK Government to court because they will not pay them the appropriate amount. In Scotland, since the SNP has been in power, we have increased police numbers to record levels to 913 more than we inherited. In England and Wales, they have fallen by almost 20,000, a terrible indictment of course of the UK Tory Government. Of course, that is why we are seeing housebreakings reduced in Scotland, whereas we are seeing them increase in England and Wales. We will continue to invest in our police officers, continue to make sure that Scotland is kept safe and we will leave the Conservatives to cart from a sedentary position.


Ukrainian Armed Forces continue counter offensive in Bakhmut. Deputy Defense Minister Anna Maliar said that 10 Russian positions have been captured and the Ukrainian army is advancing in the direction of Bakhmut. We continue to advance in the direction of Bakhmut in the suburbs. Today our units captured more than a dozen enemy positions on the northern and southern edges of Bakhmut and cleared a significant part of the forest massive in the Ivanovo district. Maliar noted that Ukrainian Defense Forces have taken Russian soldiers as hostages. Everyone who knows the real situation and is now there understands the seriousness of the situation. Presently one meter is equal to ten kilometer on the frontline. Our soldiers continue to fight with determination, the official added.


One most recent experience that I can recall by launching leader wars, we worked very closely with the hot star team and because our sort of campaign idea was make way, right? So we said that how do you integrate or how do I hold all the make way moments in the entire space? So whether it is a new player entering on the page or whether there is a realize it or not, so we sort of make it smartly integrate with the custom skills of the model. So I think one of the things that people change would be the dumb FCT what or impression would be, right? How do you become part of that entire annotate? And you know when you was talking about context, was content, my view is that how do you choose content to bring context? I think that was the topic now, you will get content coming out of the context. And I think that's where as a much better view also goes on. And if you sort of look at it from that lens, you will realize that shows lie a long way up, shows lie on F1, right? It actually reinvented the nature of the sport as well. So content actually assisted the invention of sport and novel in the brand and brought in commerce along with it.


I'm Mark Sonnebaum, a technical consultant at Acquia, a Drush Co-Maintainer, and this is Moe Schweitzman, also at Acquia, and the Drush Maintainer. Today we're going to talk about a framework recently built called Drush Deploy that should help you to deploy Drupal apps. The first, not a lot of people, especially in the Drupal community, use deployment tools. Many that exist already, but basically it deploys your code. It also does some other stuff, but really the focus is it deploys your code. There's a lot of different things that go along with deployments, and I'll get to how you do those later, but the important thing is this gets your code on the server. Three popular frameworks, Capistrano, Capistrano is definitely probably the most popular, Fabric in the Python community, lots of Django, people use that. Pantheon actually uses that. Glad the deployer is another Ruby one. Is anybody here using any of these three? Okay, some, very few. All Capistrano, anybody not Capistrano? So more importantly, what doesn't a deployment framework do? It doesn't deploy content. If you were here a couple of sessions ago for the deploy module session, that deploys content, so that's where you'd want to look for that. It doesn't install packages or manage comps. There's a lot of overlap here with, say, configuration management tools, like Puppet, Chef, Deconfig. Some of them will allow you to also deploy applications. Some people do that. It's a little more overhead than a lot of people need for deploying applications. I personally like to keep those two things separate. It doesn't manage submodules. I say that because there's also a little bit of overlap here with Dog. There's an asterisk on that one, but it doesn't do anything automatically to say any of your submodules for you. So yeah, I say sort of because you can kind of do all of these things in the framework if you want, but it's not really the main focus. So why use a deployment tool? Using the techniques here, you can get near instant no downtime deploys. I put a big asterisk on that, and especially as a near instant because it's impossible to do instant, right? But the idea is you do a new deploy, and you switch over from the old one to the new one as the site's live. Some sites can do that. Not all can't. You might be in a situation where you have some tasks that need to run that are going to take a while, and you might need to go into maintenance mode. I do that as I need to, but if you don't need to do that, like if you know you're pushing a deploy out that doesn't have, you don't have to run update DB, or you don't have to revert features, anything, most of my deploys happen live with no maintenance mode. Now rollback is another really important feature, and I should say first, a lot of these concepts are in all the other deployment tools I talked about before, but having the ability to instantly rollback a deployment if anything fails is very valuable. And version control is not a deployment tool. So that may seem like a silly statement, but right now, if you say clone your Git repository into your doc root, and then your deployment is Git pull, that's not, I wouldn't suggest that as a deployment strategy. It's not made for deployment, so things can happen because it's a version control system. It can do its job and say show you merge conflicts, and then you can end up with a broken site. There are probably semastrics around that, but in general, I would just say it's not really a good idea, and you shouldn't do it. Now a little bit about Capistrano. This is actually what I use most of the time. It's awesome. I don't really have anything bad to say about it. There are some Ruby on Rails assumptions. It was made specifically for Rails by one of the guys at 37 Signals. Many years ago. And so with using it with a non-rails application, you just have to override some of their tasks so that it doesn't say, try to, one of the tasks is restart.  So we have to then override those so they don't do anything, which is a little silly. And it's a hard system to get going for non-rails apps sometimes because those things aren't obvious. There is a gem called RailsListDeploy that does that stuff for you, but it still doesn't exactly make it that much better. It's a DrushDeploy. It's a deployment framework built on Drush as a Drush extension. When I say it's heavily influenced by Capistrano, I definitely mean it. Basically all of the functionality that I thought was relevant from Capistrano, I built into this using nearly identical methods because like I said, I don't really have a problem with Capistrano. It's really nice. And I think the default merge strategy that it uses is really smart and works for the vast majority of sites out there. You might ask if Capistrano is so great, why should we do this? The number of hands that went up when I asked about deployment tools were pretty low. And so although Capistrano has been out there forever and it's stable and it works, none of you are using it. So I think there's something there. And we have a lot of tools. Nowadays if you have to know Apache, Varnish, Memcache, Solar, the list sort of goes on and on and on. Adding one more like Capistrano is sort of the breaking point for a lot of people. So we already use Drush. And also a lot of the concepts within Capistrano we already have in Drush. So we get a lot of things for free. We just have to build the deployment part on top of it. Now so what a deployment framework does is actually really simple. And right now, I mean, it's not that hard to deploy a Drupal site, but everyone pretty much does whatever they do from scratch. They come up with their own batch scripts. And it's not something that you should have to stumble over and then find all the problems with yourself. There are definitely a couple different ways to deploy a site that work for many, many people. And so we should have a way to simply do that. Now a little on how it's built, it's PHP 5.3 only. Is anybody here still on 5.2 and unable to move? All right, that's a surprisingly small number if everyone's being honest. Yeah, it's 5.3 only. We aren't really part of Drupal, so we don't really have to adhere to the PHP version we're using. And we used a lot of kind of need 5.3 features that helped along the way. Because converting a lot of the what was in Coptrono and Ruby to PHP was hard enough. And some of the things in 5.3 made it a little bit easier. Right now, it's only Git. I did that in the beginning just to make things simpler, but in hindsight, that was probably not that smart. Because I'm sure many of you are still deploying from non-Git sources. So that's something that's not in there now, but the source control will be swappable soon. And I would love help. Once I make it swappable, I would just have to have some help with, say, subversion backends if anyone is still doing that. And so site alias groups. Who uses site aliases right now? Okay, great. How many of you know about site alias groups? Many or, yeah, fewer? So this is another one of those features in Drush that no one uses that's really cool. You can actually have multiple aliases in the same file. And then when you specify that alias, you actually are calling all of them at once. And that's sort of an essential feature here, because when we're deploying, we could do deploying across multiple servers. It also makes heavy use of Drush options. So if you haven't used it yet, there's this really, really handy file called DrushRC. If you haven't copied the example in, it's in home.drush, drushrc.php. Deploy uses its own. So you need to make a deploy.drushrc.php, and you put all of your deployment configuration in there. Or you can actually put some of it in your site aliases file in the command-specific part, if you've used that. Now, this is the basic idea of how this deployment strategy works. Here's the, you set where it actually deploys to on your server, and right here it's saying it deploys to deploy, right? It sets up releases and shared. Shared is where you put things like, you put your files directory there, you can put settings.php. That's where it's gonna, that's where you have resources that are gonna apply to every release that don't necessarily change. Releases, you can see, has timestamped directories of every release, right? So when you deploy, it creates a new copy of your site in a timestamped directory. And you can see current is pointed to the last one. Now, the idea is you point your Apache v-host or whatever v-host to current all the time. So then when we deploy, if everything goes okay, we change that sim link to point to the next one, so it flips over automatically and you don't have to do anything. And then it's still there if you need to actually revert back to the old one. So, in the interest of showing things actually happen, let's demo this. So just to give you an example, if you have not used Drush aliases before, this is all the information I need in my alias. So just pay attention to the first one. Basically, I'm just saying there's two here. This is where Drupal is deployed to. This is the user to SSHN as, and that's the host. And this is identical, I just changed the host. So I'm deploying the two EC2 instances right now. So first, I would do drush deploy setup. And then you tell it at, is the name of that aliases file? You can see right there. And that references both at once. If I wanted to do one, I would do a C app one, but I wanna do both. And so you can see the commands that ran, it just set up those directories that I showed you before. And there's also a drush check, or I mean deploy check. And that'll go through the, go through the current dependencies to make sure that everything is in place so that you can deploy. So it checked that those directories existed, it checked that they were writable, and it checked that git exists. The git check was done by the strategy, the deployment strategy, which is a class that is swappable. The one I'm using uses git, and so it added the dependency to check for that. So whatever strategy you use, you can add your own dependencies to check to make sure that everything will work. And let's do a deploy deploy. So right now it should deploy here, and there's obviously nothing there. And hopefully there will be a website here now. Yay. Okay. And so now, actually, I mean just stage back into that machine. Okay, so this is what I've shown you before. Current is now pointing to that, and there's releases, and there's one thing in releases. There's actually nothing in shared. But let's go ahead and do it one more time so we have another one. So say something went wrong with that one, and you want to actually go back to the other one. You can do deploy rollback, and now current is pointing to the previous deploy. So that you would use if something happened after, I actually explained the, you can have tasks that run before or after different events in the deploy. One of the events is the sim link. When you tell something to run after sim link, that means run it after the deploy is successful. So at that point, the flush deploy cannot rollback for you. It wouldn't detect an error because you've already actually deployed it out there. And so if you say a ran update DB or something after that that failed, that's when you probably just want to manually rollback. But if anything happened before sim link, and if any of that failed, it would actually automatically roll that back and never finish the deploy, which is kind of a nice feature. Oh, and also, after a while you can end up with a lot of these releases in here. I'll show the configuration file real quick. One of the configs here is keep releases. And so I'll change that to one. And then after a while you can do clean up. And that'll basically get rid of however many releases are in there that, yeah, no old releases to clean up because we already rolled that back. It'll get rid of however many and to where you only have whatever number you specified there at a current at a given time. It's unlikely you'll want to have all of them there forever. And if for the few Capistrano users in here, this probably looks very, very familiar. All of those commands are directly from Capistrano. So a little bit about how this works is a Drush extension. How many people here have written custom Drush commands? Not necessarily like contrib, but just for yourself. Okay, great. So part of doing this was, it was an idea I've had for a while and I wanted to see how we could do this in Drush. And but I also need, there was a couple of things that we needed for it that were gonna potentially require changes to Drush Core, that things that we could send upstream that would make writing extensions easier. So it was a bit of an experiment in how to write this kind of an extension and what we can do to Drush to make it better. So one example is the idea of an alias as an argument. So for those of you who have used aliases, the first way there is how you'd normally do it. It's Drush, alias, then a command. What that does is it SSH's into that machine and then calls Drush to see all. There's no way with how those aliases work to just send it a command. And so in my case, most of the time I'm making directories, I'm checking if they're writable, I'm doing git clones. I don't wanna have to use Drush to do those things on the other end, that doesn't really make sense. Really all I wanna do is get the information from the site alias so that I know how to SSH into that machine, then do whatever I need to do. So the second example is how that works. The only example of this in core is SQL sync, right? Yeah, and so if you've ever used SQL sync, it's like Drush SQL sync, alias, alias. That's an example of a alias as an argument. But right now when you have a command that takes an alias as an argument, you sort of have to do a lot yourself. You have to do the parsing of the aliases yourself and then you have to figure out what to do with them. And in deploy there's sort of a framework built inside to take all those aliases and then whatever commands are given to it, it just runs them on all of them unless it's specified to run on only one of them. Another issue is, as I explained before, you have group aliases and then you can execute something across a bunch of group aliases, but right now we do them one after another. So that's a bit of an issue in a deployment because if you have say 10 or 20 nodes, I shouldn't say nodes at a triple conference, application servers, Apache servers, whatever. When it gets to the last step to flip the sim link, you have to essentially SSH into all of those machines one after another and then you have this weird rolling deploy thing going on. So one of the things we had to do was add concurrent command execution.  We did a lot in the back end part of Drush, especially with now we have the ability to see command output as it happens. So that patch doesn't really apply anymore. So I recently refactored into this. So it exists in deploy and then that's intended to go upstream, but it does do this now. It executes all these commands in parallel. Now here's what the configuration file looks like. So the application name, all that really does is specify a directory to deploy it to so that you can potentially have more than one deploy on the same box. Deploy repository, you just tell it where your repository is. Keep releases, I was showing branch. Branch master just means no matter what you are, every deploy is just gonna take whatever is in master. So for every group of aliases you'd have, if it's QA production, you just change that to whatever it is. You can also put a tag in there if you need to, although there will probably be an option seemed to just specify a tag on the command line since you're more likely to do that in production. Deploy via is which strategy you want to use. Right now, the only strategies are remote cache and checkout, which the only difference really, there's no functional difference, it's just one's faster because it caches the Git repository. I'll talk about those a little bit more in a second. Deploy to tells it where to deploy the application to. This after stuff, I'll show you how that actually works in a second, but what that's telling it to do is after deploy Simlink, it runs the task called Simlink shared. And then after deploy setup, set up files. This is the way that you can attach your own custom functionality to the existing deploys since what deploy actually does by default is very, very simple and everyone's gonna have different things they need to do, so this is the way you attach events to this. And here's an example of a task. Now this is a concept very familiar to people who have used rake or especially fabric. It's not in Drush right now and I developed this in a bubble and without the other Drush maintainers input, so this isn't exactly gonna go into Drush, but if we can convince Moosh, maybe it will. It's sort of in between a Drush command and say just a script that you'd use with Drush SCR. Any function you put in your RC file and you put task in the doc block above it, I parse those and then make those available as tasks. It may seem really dirty to put say meta information like that in the doc block, but we're using PHP. So if you haven't accepted the dirtiness yet, you should. This concept comes pretty directly from languages like Python that actually you can have that at whatever and it's a decorator. It's a really elegant way of doing this and in PHP we just have to do it in a getaway and I'm okay with that. You should be too. And so you can see each one of these gets an actual copy of the deploy object and then you just run whatever you need to on that. And so this is an example. We'll set up files as an exciting, but SimLink shared. So you can see after the deploy happens, after the SimLink happens, this now also SimLinks the settings.php file and then SimLinks the files. Since those are likely if you have multiple Apache servers, you're gonna want to have a shared files directory, so that's probably on NFS or something or some kind of mount and then that's where you SimLink it. And I have, on the one I just showed, I also have SimLink Dockroot in there. Yeah, because my current or actually, my repo actually has Dockroot. The source is in Dockroot not in the root of the repository. Basically, that doesn't matter but the point is you can do whatever you need to do in these. So if you do say wanna install some packages, I guess, you could do that. You can do whatever you could do normally over SSH. And now before I showed like the before, after stuff in Dresch's RC, you can also do it in the dock block there which makes it a little bit easier. And so aside from custom tasks, you can also do Dresch tasks, right? So it's really common to do say like update DB or features revert all after a deployment.  So this makes one for update DB. And you'll notice it also says run once. Any task or any part of the deployment you do is gonna run on all the servers. You don't wanna run update DB on all the servers, right? Or if you have features revert all or basically anything that touches the database you only want it to run on one. And so if you specify run once, it'll only run on the first of the set of servers. Capostrano, if you know does support actually specifying like roles of servers or like a specific host there. I may support that if there is need for it. I've never really had a need for that. So I briefly mentioned strategies before. So the checkout and remote cache for there. Remote cache just keeps a cached copy of the repository. So every time you do a deploy it does a get pull on that. And then it just copies that into that new directory which is way, way faster than just cloning every single time, especially if you have a big repository. That's what checkout does. Now those are all, they essentially do the exact same thing, right? But because that's completely swappable and without the strategy class deploy does very, very little, almost nothing, right?  Once they have APIs to say do what you normally do in their UI to do deployments you could also plug it into here so you could have a command line way to do the deployment on those platforms since you may want to script that anyways. And if you just wanted to have, if you were doing something with get or you just really didn't like what deploy was doing you could just make your own. They're relatively simple. So, any questions? Yes? Question is, does it only deploy full sites or does it also deploy multi sites? Right? So that's something that you would set up you would set up in your custom tasks. Like it depends what your repository looked like, right? So say one example would be you might have, if it's a typical multi site setup say you have, your repository is just that sites directory for that other site. Then you would just change the deploy to directory to deploy within the sites directory of your parent repo and then you'd have it make the sim link for that in a task. So you could actually have the sites site name be a sim link back to the deploy directory so that you could deploy one site at a time that way. I think that, yeah, cool. Anything else? Yes? Great, great question. So, yeah, how does this integrate with continuous integration servers like Hudson? So as I said, there's a lot of overlap here with like configuration management. There's also some overlap with tools like Hudson but a lot of people use tools like Hudson Jenkins to do things like this. I personally like, I mean, I use Jenkins for many, many, many things. I like to keep my Jenkins configurations as dumb, as simple as possible. And so what I do is I actually run Capistrano. I have Hudson run Capistrano. And so because Hudson just runs tasks, you can essentially do whatever you would do normally in there. And then you could even have, I mean, say the tasks that I showed is like attaching before and after in the deploy framework. You could actually just have those as separate Hudson tasks that run if the main deploy command exited zero. So you could totally bypass it with Hudson if you wanted. Cool. So no question, this just perfectly fits everybody's needs. Schedule it. That's definitely not there now. It's an interesting idea. I had to have necessarily had that need but yeah, that's worthwhile. Yeah. Yeah, something to look at. I'm happy to look at a feature request. Okay, yeah, good question. I think I just assumed that everybody uses code. Oh, sorry. How do you do database updates and configuration changes? I made the assumption that everybody updates their configuration through code because everybody should. So when I said after you do the deploy, you do say like update DB features revert all. Generally, anytime I need to make a change on a Drupal site and that say with a modules configuration that doesn't support features, I put that in an update hook. I have a, actually I make an install file in one of my main features and then I put update hooks in there so that when I run update DB, that gets executed. If you're doing that, then all you have to do is then just attach the update DB task to run after Simlink. And if you're not doing it in code, I mean, there's really nothing you can do. Just sync that up. Excuse me? Yeah, okay, yeah, so that introduces some complexity and now it's, that's sort of, what? Repeat the question. What do you do if you have to roll back in that situation? So that's the situation I was talking about earlier where there are cases where you do want to go into maintenance mode. So ideally, you've tested things. I generally, like before this happens, bring in the database and the QA and then run all these updates to make sure they'll all work. There definitely are situations though that you can run into where this will happen. What I would do, I would put the site in maintenance mode. I would make a task for that, which really there will be a task for that soon. I would then make another task that does a drush SQL dump and I would put that to run before deploy. So that's the first thing that happens. And then I would, in the rollback hook, I would say on rollback restore that. So, and that's the idea. It's like everyone's situation's gonna be different. Everyone's gonna have different needs there, so pretty much any customization you do, you do in tasks. Except for the crazy scheduling thing, you can't do that. Anything else? Yes. You could maybe add checks for that as a dependency that would run and that maybe, are you saying this would be after a deployment ran? So in that situation, I think I would deploy to, not the whole group, say like one, and then I would comment out like the after tasks I had to do, the updates. I would check those things and then if that was okay, I would do the whole thing. Does that not work or am I missing something? Yeah, I'm not sure. I mean, we should talk about that. Any other questions? We have a few more minutes. So if there's like more generic drush questions, we can probably take a few of those. It was hard to hear. Could you speak up a bit? Sorry, that was a long question. So this was a question about, so let's see if I got it right. You want to execute a set of drush commands against a set of sites in a multi-site. And right now, all that drush provides is you execute one command and you say against a target of sites and you want to execute a series of commands against each site in a row. The solution that drush provides for that right now is to make your own command that encompasses the three or four or five commands that you wanna run and then target that against a site alias list. One other thing though, in drush five, we introduced the concept of shell aliases. And so instead of having to go through the trouble of making your own command, you can actually just in your options file do a shell alias that has those three commands together. I often do that for like, updateDB, features, revert, CCL. Yeah, I'm having trouble hearing the question. Could you speak up? Yeah, yeah, please. Is it possible to publish multiple database servers? So can you publish it to multiple servers? Updating to multiple database servers. And then what's happening on the multiple database servers? I missed the second part. If you have a server for user data and servers for content to... Yeah, so yeah, update source code, not data unless you do the data in your tasks, which in that case you can do anything you need to do. So I guess I'll answer a generic version of what I think that question is and that say if you're using press flow and you have masters and slaves set up. Actually, yeah, so say you wanna do the SQL dump off the slave, you would just do that in your tasks like you normally would in Drush. Question? Let's wait for the mic. I can't really hear. You said it was very easy to write your own strategy like remote cache or checkout. Could you show the code and quickly outline how to do that? Sure. And if you'll notice Drush Deploy uses the PSR zero namespace auto loader, if you're familiar with that. The checkout is really simple. All it implements is command, which then, yeah, which then calls the git class, which would later be just the SCM class and the checkout method. So the method of actually checking out is subtracted into that. And then you just give it the config revision, which Deploy automatically generates for you and then the release path, which is gonna be the timestamped directory that Deploy gives you. So that's a very simple example. Remote cache is a bit more. Actually, all the strategy class has to do is implement the deploy method. The other one didn't have a deploy method because the class that extended had one. So the deploy method here, all it is, is update repository cache and then copy it. And then it adds a check. Like I said before, remote or strategies can add their own dependencies. So that checks that the git binary exists. That gives you the path of repository cache. So update, all it is, is basically seeing that directory and then doing a git pull that I lie about that. Oh yeah, so git sync. Sync is a generic term that means pull in this context. And then it does the, yeah, and then it checks out the tag or whatever, actually whatever the tip is, right? Whatever you're gonna deploy. And then it checks that out before the copy happens and it just copies it into the directory. I think that's relatively simple. Another quick question. I was thinking about writing a deploy module for FTP. I know it's not the most used hosting environment, but it happens to come up again and again and I would like to have one deploy solution for all. Is it possible now in Drush to run Drush commands via PHP instead of the command line? Like remote execution? Are you saying Drush, run Drush commands through the browser? Yes. No. Short answer is no. Longer answer is Drush needs to do things that your web server should not have access to do. So if that works in your web browser, then you have a misconfigured and insecure web server. So I would say the best answer is no, you don't wanna do that. The point is the files could be deployed via FTP, but SQL, but up to be, and for example features with Word could still run directly from a web server. You wouldn't need to shell access for that. I missed that something about features revert. I mean features revert isn't actually doing anything to the file system, it just updates the database. Yes, that's what I meant. I could run this Drush command through a web server without it having access it shouldn't have. Well, so, okay, take those examples. So feature revert you don't even need a Drush command for because the features module provides you that functionality within the UI and then update DB is update PHP. So any of those things there already is a UI component for anything else that Drush is doing like downloading or whatever else you can't really do through a web server. So was there another question up there? Yeah. I did deployments for a year with examiner and I wish we had this, this looks very good. The only thing that I think that I'm not sure that you can solve is frequently one of the post deployment tasks. We'd have to write a Drush script that might run for 12 hours. For a long time and so we'd start that in a screen session. And that's the root of Kevin's question, right? Yeah. Okay, so it's already been asked and you're thinking about it. No, I think, but I could use more explanation. You might have a long running post deploy tasks that you wanna see status updates on.  And I'm not sure how you would handle that through this. Maybe somewhat related, but one of the things we did fix in core in five is as you run remote commands you actually see the output live. So while the deploy was running you would see the output from that task. I don't know if that would help. And then you could, the percentage is hard to do but if you implemented that percentage logic yourself you could just print that to standard out and then you'd see it. Maybe that's good enough. Otherwise, yeah, I mean, I'd love to look at that more and see if it can be accommodated. Any other questions? Right now it's actually not only for Dresch Five. The question was, is this only for Dresch Five? Yeah, so it's not only for Dresch Five, mainly because the things that I needed to fix in Dresch Core are not in Dresch Core yet, they're still in here. So if and when a lot of these things do go into core I'll still probably keep them here so that it'll work on for and then default back to core because I would like for it to last a little more. Although, yeah, this and like I should say this everything I showed you works. There was no magic there. But there's still gonna be a lot of changes and this is not nearly 1.0. And I apologize if you go to the project page right now there's zero information, no releases and no example of the configuration file. The code is there. In the next couple days I will fill that out and have something there so that you can test but I would not use this right now. I would probably wait until it matures a little bit and we get a release out there but if you like all this stuff and you need this right now you might look at Capistrano, it works. Anything else? Okay, thank you.


And the next talk is on generalized non-linear invariant attacks and a new design criterion for our constants by Wei Yong-Juan, Ye Tao, Wu Wang-Ling, and Enes Pasalik. And the talk will be given by somebody else, namely by René Rodriguez. Well, thanks for the introduction. Thanks to the organizers for giving me the opportunity to give this talk tonight, today. I'm Enes's PhD student, and well, they decided to send me to give this talk and let's see what happened. Okay, so first of all, the title is generalized non-linear invariant attack and a new design criterion for run constants. Well, we have seen so far two different works and these invariants and nice presentations by Gregor Landa and Christoph Weierle. And we'll give, well, we'll see. I'll explain you. This is the summary of the talk. First, an overview, a quick overview of the talk because, well, we now know a bit about this invariance. And then I'll talk about this generalized non-linear invariance. After that, a concept of closed loop invariance and some conclusions. Well, the overview. As already pointed out by Landa, this attack was introduced by Todo, Landa and Saki in 2016 in the Asia Crip. And, well, the core idea is considering an end date block cipher whose encryption function is a key. And you're looking for a non-linear Boolean function such that this relation holds, which means that you're looking for symmetries in the block cipher. Okay, we call this G a non-linear invariant. And when fixing a key, we're looking for an invariant. So those keys which admit this kind of invariance are called weak keys. And why are they important? Because commonly induced distinguishing attacks on block ciphers, especially in lightweight block ciphers, because these lightweight block ciphers are designed specifically with a simple key scheduling algorithm. So these lightweight block ciphers are susceptible to this kind of cryptanalysis. And, well, this is an example of non-linear function defined like this. And the point here is that if the addition of the key after that, the rank constants, in certain cases, you can have this relation, for instance, and you'll have an invariant. But some cases, well, it doesn't work that well. And we'll see how to use this to generalize this invariance. Okay, there are some vulnerable lightweight block ciphers already mentioned before. And this is print cipher, ice cream, Robin, Zorro, Midori 64, ice cream, Scream, Midori 64 again. And, well, it's kind of vulnerable, this Midori 64. And Sempera, Haraca, and Orcs, and different other works that probably I'm missing here. And after that, Bayerle, Cantor, Leander, and Rotella proved in 2017. And, well, they started certain structural properties of the linear layer to protect the block cipher to this kind of tax. And, well, this is the main theorem of the work. And it says that if you have an invariant of the permutation layer, the substitution layer, and from the linear part, then the linear structures, the space of the linear structure must be subspace invariant under L, and it has to contain all the differences of the keys. So this is a really nice characterization, well, it's not a characterization, but it's a really nice condition to protect the cipher. And, well, also this WLS is the minimal invariant subspace containing Z. So as this is, as the linear structure space is invariant under L, and it contains all the differences, then this set must be contained in the linear structures of an invariant. So, as mentioned before, if we have a large dimension of this space, then the only possible invariance will be trivial. Okay, I think this is the result. And in some other cases, when you have the differences, the difference of this, of the total space with respect to this space, they found certain structure of the S layer, which allows you to protect the ciphers again, while using certain cosets and so on, but they prove that those three lightweight ciphers are resistant against this kind of invariant attacks. Okay, so this nonlinear invariant attacks can lead not only to a distinguishing attack, but also you can have different kind of attacks under different scenarios or different modes of operation, and it depends exactly on the cipher and the mode. And two natural questions arising here are, if there are more attacks similar to this, and how can we protect the ciphers against them? Just a moment ago, my brother did, well, presented a work in which there is a unified framework to probably protect the ciphers. Okay, the goal of the paper is to provide useful generalization of these invariants, and of course, as Gregor mentioned before, this generalization has to be useful because you need to have a target, something to attack because otherwise are just theoretical contributions, and that's the main goal of the paper, to provide these generalizations and to give some targets. So the main idea is pretty straightforward. It's the same idea. You look for a nonlinear Boolean function, but you also look for a pair, a pair of vectors which in this equation has to hold. And it's like you're just looking for an invariant of the whole encryption algorithm, but linear shifts of the encryption algorithm. So those are called generalized nonlinear invariants, and we denote the set of those invariants with UfA1A2, and, aha, oh, I think I can use this, okay. So in the tags performed by Gregor Leanda, you have to have certain relation with the rank constants in the linear part of the invariants in order to extend the tag to the whole cipher, but here. So here in the generalized nonlinear invariant tag, you also need to have certain, under certain circumstances, you can apply the tag, and those are the circumstances that you need in order to perform the tag. So I won't explain this too much, and here is the proof. How can you extend to the whole cipher? So you just do some technical details here, which I'll skip. But the main idea is the same as before. Just this allows you, the linear relation with this allows you to expand and to go forward to the next round, and under the key assumption, the weak key assumption scenario, you can extend to the whole cipher and then recover, well, recover this equation for the plain text and the cipher text, and you can perform a distinguishing attack. Okay, this is the second case, and it's pretty much the same. And after that, you can perform a distinguishing attack using this generalized nonlinear invariant text, this nonlinear invariance, and, well, just, aha, it's important, well, at the end. So the standard procedure is as follows. You're looking for invariance of the whole round, but the complexity of looking for those invariance is really hard. It's impossible if anything grows bigger. So the main point is to find invariance for the components of the round function. For instance, you start with an invariant for the S-box, and then you extend it to the X-box layer, and then under certain circumstances you can extend it to an invariant of the L layer, and then you can perform, then you have an invariant of the S-layer and then you have an invariant for the whole round. And, well, this is one technical property that you have that in the paper of Lander, in the classic attack of an invariant attack, you have this property. If L can be viewed as an orthogonal matrix in the degree, and you have a quadratic nonlinear invariant, then you can extend it to an invariant of the linear layer. So this generalized nonlinear invariant, as their name suggests, is that indeed you can have this also for this kind of invariance. So you can extend them to the S-box layer in the same fashion as the classic ones, and also if the, we are here working with the SPN network under this assumption, and if the linear layer, well, the linear function is an orthogonal matrix, then under the assumption of quadratic invariance, you also have the generalized nonlinear invariance can be extended to the whole round function. And, well, the natural question is, are journalists invariant useful? And in the paper they proved that they lead to an efficient, distinguishing attack on ice cream, obviously under the wiki assumption, and those wikis are different from the works before. That's the important thing, because otherwise they're just classical invariance. But here is, the point is that generalized nonlinear invariance are just translates of standard invariance. So in order to protect the block cipher, you need also to extinguish all the invariance for the translations of the S-box. I mean, obviously under certain circumstances, you can perform this attack, and this is those additional vectors that adds up to the invariance can be helpful to perform this distinguishing attack, even though the classical attack depends on the linear part, and, well, here those constants can be helpful for eliminating this impact. And, well, this is the first part of the talk. Now, the second part of the talk is another generalization of this invariance, and, well, of course, I'll explain you why they're useful also. And as mentioned before in the paper of, I will call it BCLR for reducing time, the question is if this criterion is optimal. Well, it turns out that a large dimension of this WLD could prevent from some invariant attacks, regardless of the S-layer when the dimension is large enough. But here we're going to sketch why this is not optimal. So we consider the following set. We're taking two Boolean functions which satisfy this. It's like an invariant but alternating. So you need that G1 and G2 satisfy this, and G2 and G1 are constants in the input and the output. So it's a really straightforward generalization of the classical invariance, and we can prove that they form a linear subspace. And also for every invariant, every standard invariant, this is trivial, the GG, the diagonal is on this subspace, and, of course, also you have the invariant and the complement are here in the same space. Those are pretty trivial results, but this is the important fact that usually you have more elements in this CLI than those induced by standard invariance. So you can have more than this diagonal and this complement thing. So as a proof of the efficiency of this CLI as invariant attack, the authors of the paper provided a slightly modified version of Midori 64. And I'll explain you a little bit quickly how Midori 64 works, and it uses an SPN structure, so it uses S-box layer, linear layer, and adding constants and constant rounds and the key schedule. Well, we'll go through it in a second. We perform here in the S layer, we perform a sub-cell, which is a permutation, and this is a shuffle-cell, and then a max-column, which is part of the linear layer, and then adding the constants, and well, this is more or less the structure of Midori. And the variant of Midori, it's the same round function, just the key schedule is a bit modified. This is just the selection of round constants, it's a bit different. Well, you just need to satisfy this property, and other round constants can be selected randomly. So it's just a bit modified version of Midori 64. Okay, so by using computer simulations, they found that those two functions are a closed loop invariant for Midori 64, for this version of Midori 64, and using the same ideas as before, we can extend them to a closed loop invariant of the whole cipher. And the important thing is that they can be used to perform a distinguishing attack to this variant of Midori 64. Well, here, even though the degree of G1 is 2 and the degree of G2 is 1, we can still do something, it's not that restrictive here in the Li attack. So this gives rise to distinguishing attack, as mentioned, but even though we have the dimension of this WLD is large, which means that the criterion of BCLR is not optimal at all. I mean, under this new framework of attacks. So here's a bit of explanation why these, the rank keys repeat just each second round, and you can prove that this has dimension 64. So I have to mention that the random constants are selected, not like just some random constants, and that's it, they're selected properly to avoid obvious weaknesses of the cipher. So this is the main conclusion that it appears that this criterion is not optimal. And one strong or strict design criterion is this one, but it's a really strong criterion because you just need to make sure that every rank constant is selected outside the linear structure of all the closed loop invariants. Well, even though probably we can relax this criterion a bit, but we need to work more on it. And using computer simulations, one can verify that press and prints, L block, all of them are resistant against this kind of attack. So to finish the talk, because I'm running out of time, and in the paper they introduced these two new frameworks of generalized invariant attacks and works of Vane, Vane proposed a unified study within the framework of correlation matrices and, well, this gives more structure about the classical invariant and also with the previous talk of Bayerle showed the nice proposal to study the actual mathematical nature of these invariants and the framework of linear approximations. And what we could ask is if we can plug this generalization into these frameworks and how to employ this structure to avoid attacks. And, well, there's a lot of open questions here and we need to further generalize these concepts and to give deeper theoretical analysis. And, well, thank you. Do you have some questions for me? Maybe I have a quick question. So you mentioned that there were some results on the security of certain tweakable blocks like skinny or mantis that they are resistant to the other attacks. Did you have a look at how your criterion applies to tweakable block ciphers and whether you can find anything there? Well, so you mean here in the paper of this block cipher, right? Those three. You mean this criterion applied to those? It's hard to say because the criterion is like a really strong criterion. So it's just like the straightforward thing to do is just avoid linear structures. Why? Because we want to avoid slight attacks or linear cryptanalysis, so just avoid them. So I couldn't say anything more about those specific cases. Okay, then thanks again. Thank you.


Live from Orlando, Florida, it's theCUBE. Covering Microsoft Ignite, brought to you by Cohesity. Welcome back everyone to theCUBE's live coverage of Microsoft Ignite. I'm your host, Rebecca Knight, co-hosting alongside of Stu Miniman. We are joined by Frank Artali, the managing partner at Prime 4A. Thank you so much for coming on theCUBE, Frank. Glad to be here. So before the cameras are rolling, we were talking about the energy of this place. You've been to many, many an Ignite, way back before it was even called Ignite. Oh yeah, so Ignite is the evolution of something that Microsoft used to call TechEd. So it was like back in, when I was at Microsoft, so even back in the 90s, we had to figure out a way to educate the technical community and we decided to start this thing. And interestingly enough, the first one ever was here in Orlando, much smaller venue, I think at this one in the Dolphin, but I've been coming to them on and off for the past 26 years or so. So tell us a little bit about what you're doing now at Prime 4A, what is Prime 4A? So we're a boutique and advisory consulting company and we do work with what I call ISVs, so basically someone that makes software. But we engage with folks who are at some point on a journey to cloud and that means both from a business and technical perspective, whether they're just getting started, thinking about moving products that maybe they had from on-premises and to a cloud platform or maybe they're well on their way and they're really looking to just amplify and accelerate that. And so we're a team of people that have experience from product, business development, sales and marketing to really get those companies to the place that they want to be relative to cloud because as we know, cloud is still the future and everyone wants to get there. All right, so Frank, bring us inside. Without giving away state secrets, dealing with Microsoft today is very different from the company that we grew up with of Windows and Office. So what's it like working with Microsoft? Give a little bit of where some of the key enablers are. Yeah, so in the early days, if you think about it, Microsoft is always great with evangelizing to an independent software vendor around building to the platform. So back in the day, so much of the Microsoft actual market cap was dependent upon the ISVs building to the APIs and the APIs were sort of the lock until the ISVs were locked. But there never was really, let's say a great channel program for someone that was an ISV. The channel programs were largely structured for people that sold stuff. And so what you're really seeing now for the first time, and this is not exclusive to Microsoft, but other cloud partners, but of course, since we're at a Microsoft show, we can highlight some of the things that Microsoft is doing here. It really is creating super incentives for ISVs to come to the platform, such that the ISVs feel like they are selling side-by-side with Microsoft. There are some great incentives around that. They provide some great access to technology and tools, really great credits to get onto the platform. And so they focus as much on the business, like they always, more on the business now than on the access to the technology. And to the extent that they can work side-by-side with the company in building their business, well, the folks that are the business owners really like that. The tech guys always like bits and bytes wherever they can go. So describe how the partnership works. I mean, as you are now holding hands with companies that are going through a digital transformation and some working closely with Microsoft, some maybe just on the fringes of working with Microsoft, describe how the partnership is working. Yeah, so I would call it, I'd like to say that it's really in some ways an evolution of the way Microsoft started working with ISVs a number of years ago. And so at the core, the way Microsoft thinks about them, thinks about the ISVs is really an extension of their own product line. So a platform is only as good as the things that stand to top it, right?  And one of the key things that Microsoft has done has really enabled the ISVs to become connected with the Microsoft sales organization without having intermediaries. So a lot of ways, when you're an ISV and you go work with a larger company that you want to have a partnership with, you have to find somebody that knows somebody that's the account manager for some large account. What Microsoft has done is they've automated that once you pass through a series of hurdles and certifications, you can actually enter into a program where you're opening leads into Microsoft and that partner gets connected with the Microsoft sales team on the other side. So whenever I talk to people about things that they're doing, that's what I think the ISVs are most proud of. You'll hear them say things like, well, we are in X amount of accounts together with Microsoft. And from a business perspective, why ever enter into a partnership if you were not going to sell stuff? Again, you can do bits and bytes all day, it's a lot of fun for people like me, but at the end of the day, revenue has to come out the other side. I think from a partner perspective, they've done a better than good job at that. All right, so Frank, when you look back to when you were inside Microsoft, give us a little bit about how the roles have been changing as we've gone into this world of cloud and AI. Right, how the world has changed. And the roles inside of Microsoft specifically to fit the world. Right, right. So when I was there, you know, long ago, we were, obviously it was a much smaller place. And you basically had, inside the house, you had product development. And outside the house, you had channel development. And then you had direct sales.  But the linkage between sales and channel wasn't really there back then. And sometimes, like even the role that I had in program management, in times we had to be glue for that. I think in a sense now, with the roles have changed in such a way that you have people inside the house now that are really responsible for not just ensuring that a partner feels good about what they're doing, but that the partners are actually selling side by side with folks in the field. And that would have been an impossible thing, really impossible thing to do at the time. And so the other thing that's really changed is now that you have an overlay sales organization called Worldwide Commercial, and also a direct sales organization. So direct sales organization are people that carry the bag and have quota right on the accounts. But then you have another organization that looks after the 500 largest accounts. And there are a lot of specialists in that organization that by definition work with partners to move both the Microsoft products and the partners products together in there. And so those are large organizations that plain and simply just didn't exist. And they may have not even made sense at the time because at the time, a lot of what we were doing in the 90s, we were still distributed computing with still really a technical curiosity. And then it became trust and infrastructure. And it's really only in the last few years that cloud computing has moved beyond that from being a technical curiosity to trust and infrastructure. And the way it's taken to market is so much different because we took finished goods to market. We relied on people to carry boxes of stuff. We relied on people to do inventory. It's no more inventory. I mean, it's just there. You turn it on and you go. So I think what you'll see also from again, from where the commerce engines are set up and the kind of people that are deployed are really being tooled for that kind of go to market, which is significantly different. So we're really just scratching the surface when it comes to cloud. As you said, so many of these companies are only at the beginning of their journeys. What do you think the future holds in terms of trends in the marketplace and what companies are going to continue to want?  Right. So today was an interesting one to see Arc announced. And it shows a natural evolution of the way we think about a platform. So if we go back to even like the late 80s, we had a build servers. So you got a network operating system and there was a set of network adapters and a set of hardware it worked on and you had to pay a systems integrator to go put it all together and then you kind of hope it worked. Well, then we got this stuff called plug and play in the early 90s and it flattened the playing field and you can take an operating system like Windows NT, the one that I worked on and as long as it adhered to a plug and play standard, it generally worked on that platform. But the operating system then grew to become a collection of services. So file server was an identity server, eventually things like transaction processing, networking was always in there. Now, if you look at what's something like Arc or any of the services that are available on other clouds, they're really services on which applications are built. So now it's just natural to see that these services like from the cloud vendors are being taken onto other cloud infrastructure. So today we're here at Microsoft. You see Arc, which is a set of Azure services which are being made available and useful on other platforms like on premises as an example. To me, that's no surprise for Microsoft. They kind of led the way with that with their IoT technology, how you see Azure services moving on to there. So now, from an opportunity perspective as someone who's building applications, you could say, okay, I can now go look at services that I know will be available on all clouds. So I have a, let's just say I can snap to that and now I can go to my customer and also talk about a flexible opportunity about where and why you might want to deploy. So more opportunities around that though, what gets complex? Management gets complex, security gets complex. We're sounding like the 90s again, right? Where whole industries grew up around things like performance and security and systems management around that. And so I think just strictly from an opportunity perspective, there'll be companies here that see that and go take advantage of it to get out in front and there'll be ones that are already incumbents and hang on for dear life saying, things have to be different on each cloud. But I think as you see companies that embrace the notion of sets of services that'll be running across clouds, those are really the opportunities will be. Just like we saw in the 90s folks that said, hey, I'll run my application on Windows NT on any piece of hardware, right? They didn't tie themselves to, I'll just say like compact or tandem folks that don't exist anymore. I don't think that the folks we have here today. All right, so Frank, you know you can't get through an interview with theCUBE without getting a question from John Furrier. Okay, is he on? So John's been watching and he wants to know how's the restaurant scene's doing in Seattle? Okay, so yeah, Seattle restaurant scene to second to none. Obviously a unique cuisine. Two restaurants that I'm personally involved with, one in downtown Seattle and one in Bellevue, Washington. Both completely different cuisines, one heavy on steak, one heavy on plants. And we'd like to say we're up and to the right on both of those, John, so thanks for asking. Great, excellent. Frank Artali, always a pleasure having you on. Thanks so much. Great, thank you. I'm Rebecca Knight for Stu Miniman. Stay tuned for more of theCUBE's live coverage of Microsoft Ignite.


Good morning all together. My name is Thomas Bremer. I'm from Germany. I'm a software developer as free as I'm working as a freelancer mainly in the area of embedded systems and Well, Geo science or geospatial science is kind of my hobby Which on the one hand gives me lots of fun entertainment hopefully useful results But I don't have have much time for it And with with this this thing I'm going to present here. I've hit well some in In some some big bubble Which might explode some at some time so he's not the AV guy. Okay Yeah, okay, I expected that Yeah Yeah So you added the camouflage Yeah, well For the remainder I need the the slides Well, the first slide I can start I can I can try to stop my presentation without the slides because the first stuff I can simply tell you I Started with with a presentation or the idea of Thomas Eva Edison Who well rumor has it that he has invented the light bulb, which isn't true. He hasn't done it it was a German called Heinrich Gübel and Edison made it use Usable for the public this this light bulb and This this crew mount which you know or which maybe The the elder people of you know from when when we had this incandescent light bulbs to plug or to screw in They have different sizes e 10 e 14 e 27 and this e Stands for Edison so that's where his name has remained until today But he's also famous for certain quotes he made and one of it. This is genius is 1% inspirations and 99% perspiration This also well, this also holds for me because I'm more on the 1% side I have to say and last year I've been here and there was a talk about this web server Three geo names dot org. I have to correct the the slides. I see there some typos on it on them This this web server had the feature that You you give it some some geo coordinates interactively by clicking or that it also has had an API and You get back combination of three three city names worldwide Which represent this dislocation It's well, it's not a kind of compression compression, but it's kind of a mental compression because you three three words with Meaning or you maybe know them Have they are more easily more easily to remember than two Two long decimal numbers and here. Yeah, I try Yeah And he also had on this website or he has on this website the feature that you can encode the The these two geo names and these two-dimensional geo coordinates into a one-dimensional so to say hash string of 11 characters And he the presenter also told about a Hilbert curve, which was Hey, you you you're binding me He also told about the Hilbert curve we he used for this for this mapping or for this conversation and to To reduce the To reduce the borders now. He's also taking me waiter They take yeah, no, it's okay.  Yeah, I've already used it to watch TV And stuff like that Okay, let's see Okay So what I did then after because I found the the idea rather interesting Was I analyzed the website and I had a closer look at it so to say and I saw that The mapping really works in both directions You can can enter geo coordinates and get the the word combination or back Already totally that there's an API where you can which you can use There's a link to the source code, which is also appreciatable in terms of open source and there's also a map In the user interface, but it's rather small It's improvable so to say and also the user interface around it. It's also improvable So I had a closer look at the code. It has been written in in pearl it's the code Is working as expected and but it's not not easily readable Then in the code there are some while some Obstacles so to say or almost obstacles It's tweakable because Some big integer representation is used for arbitrary size integers, which are not needed There's a bit shuffling code in it which is In the which is done in the the most standard way Which is which is heavily tunable and Also the the hashes I told you about this 11 letter string is done off or it consists of 26 characters All alphabetic characters and the 10 digits There are other representation which only used 32 characters and digits per letter to make it Well to avoid some some rude words, which which might create With such a mechanism so So to say This this free geo names dot org website represents Very good idea It works But it's still improvable in in terms of UI and also coding style and I would say it's maybe in the area of 50% if you if you use this Hilbert's there's this Edison scale As I called it, but then they came there was the idea of the Hilbert curve and This this now is was was the 1% inspiration for me Because when you look when you do some research on it, then you find out you could do the following You could just take one Hilbert curve or take several take take four of them connect them to a psychic more curve Put them on on the map You can use the for the whole world. You can use this This level zero OSM style with a mercato Mapping with the mercato projection then What you can do is that you can take a point on this map map it to the distance it has on this on this curve from fixed origin you have to define and then if you have several points you can map all of them and You can sort them according to this distance on the on the curve And the result is that this this order you you find is is an approximation to the traveling statesman problem It's it's a rather reasonable not optimal, but reasonable route you find This has already been studied in the past There are you find examples where mills on wheels have been using it and they really improved their their driving times with that you can also can also use it again for packet delivery for geocaching or for home care Wherever you have to to visit many many positions So imagine that you have you use this this system as an addressing system for postal services You simply have this you give it this unique address and the postman simply has to to sort his his letters according to the to this index and travels them and Well, he can do it rather rather fast so The regarding the perspiration as I said, I'm more on the this 1% side Yeah, what I did or what I'm working on now is another proof of concept I would like to make it a complete complete Complete system, but as I said I'm I don't have the perspiration on the one hand and since it's only a hobby I I can't find the time for that And There's even more inspiration Just to improve the the user interface Regarding the routing this This TSP as approximation only is according to the distance on on the map If you have small areas then you get well you get no or almost no distortion on projection And you you get good results, but you can also use or you can even you can further improve if improve the results if you use routing algorithms according to or using the the roads and highways And you can also use this the result as an input for other optimization or algorithms like the two opt algorithm algorithm, which run much faster than than before They don't give better results, but they they are they finish much earlier Yeah, basically that that was everything I wanted to tell you without Without maybe we could make a little bridge. What is your question to the room? My question to the room Could you imagine to use such such system which very easily gives you a short round trip route for Whatever purpose and I already said geocaching if you want to to find ten caches on a day or so then you have to well, if you are visiting a firm place or For instance if you get to a Brussels you find several ten geocaches on the map and then Have to sort have to order them according to your to your Have to find the visit order. So that's what I wanted to say Something like that or if you know someone who does home care or works for DPD or is Recharge a e-scooter research recharger Anybody interested in this or could see Somewhere Is there anybody yeah, sorry could you Yeah With different port rooms in the airport it's quite interesting because we they need to go through security filters and other things to go somewhere I'm finished now Okay But then even this algorithm I just presented it would probably could help you if you if you put another algorithm on it Which also? considers the the waiting times at the security filters To get well to quickly get a result because those algorithms if you have ten or several ten Locations they usually they have certain they have immense run times They are rather slow because the struggling salesman program is one of the the most complicated Or most complex sort of the problems in computer science It could help. Yes Yeah Yeah Yeah, so these addresses you have you can have a look but They are also at the currently at a low level of implementation, but Well, not really because they are doing this little optimization and then you can't stop it before that they are doing a two-opt optimization to find even shorter route so Unfortunately, you have not been able to show your algorithms like last year. Yeah, oh the other hand It sort of flew at the time of my head, but I'm not a mathematician. Okay


So I'm going to talk in this video about the biggest lie in modern society That's a big one, right? But it is so profoundly big and all pervasive That unless you're aware of it It's going to lead to Emotional pain in your life. So let's get into it So what is the biggest lie in modern society? we live in a capitalist society here in the West, okay and This is not going to be an anti-capitalist video Capitalism has lifted more people out of poverty than anywhere and it it's associated with individual freedom and liberty You know, you can vote with your which are money every time you go into a shop, right? And we know that central governments who plan, you know socialist economies Generally tend to become tyrannical and lead to social unrest and poverty, right? So this is not anti-capitalist, but There is something that needs to be said For the psychological well-being of people particularly people living in the West That is often not talked about enough, right? So When we hear terms like Retail therapy, you know when a person goes to the store to buy clothes or whatever it is buy anything and It makes them feel good about themselves, right? That is an indication of what I'm talking about. That's what I'm driving at here. Okay, the problem we have or the big lie is that corporations You know, they know a secret about people and They know it because of research with theories by Freud, but other people that came after Freud Edward Bernays the father of public relations, okay? He was the guy to kind of spearheaded all this stuff madmen, you know advertisers of Madison Avenue that make millions of dollars a year and Corporations invest huge money into this advertising that goes on to sell their products. It all shifted based on Freud's theories It used to be that we would buy things because we needed them and Capitalism was great for that, right? It it set prices so that there was never a shortage of bread in the shop and never too much bread in the shop Okay, it was perfect but The corporations they know from psychoanalysts that People are not always driven by necessity or rationality or logic they're driven by deep fears and And there is a void in most people a perceived void in themselves and That can be used to control people that can be used to make people do things that they wouldn't otherwise do rationally right things that are not in their own best interests so what they do is think about all advertisement you see right they get very Attractive celebrities, okay, and there's always an association with a happy life if you buy this product, right or The perfect relationship if you buy this item of jewelry or you buy this item of clothes clothing or whatever so what corporations are trying to do is that they had a fear after After After the Second World War basically that the production line Was churning out all this stuff Economic growth would stop if people stopped buying things So they were terrified that once people's needs their their basic needs had been met Consumption would go down So they came up with a strategy. We're going to change it from a needs-based economy to a desires-based economy So then everything all advertisement was You're not going to buy this because you need it.  It's going to make you more than you are and It will give you this life this perfect pic, you know picture of a life that we that you know Hollywood and you know culture Promises people and it will complete you So the problem I mean that's like a pretty low-down thing to do right but At the same time corporations are their purposes to make money So they're going to use whatever strategy they can use so I'm not even I Think it's pretty pretty sick, but I'm not really blaming corporations Well, I'm trying to talk about here. It's how you can free your mind from this needless Obsession with consumption Because it's in you They identified an issue in people in us Right that can be preyed upon So if we take responsibility for it and we get in touch with that feeling inside of Incompleteness, I'm not enough as I am. I need all my fantasies desires and Wishes to come true and I can do that by going into some store and buying something that I don't need Right, we can take responsibility for that Okay, it's not the corporations waiting for the corporations to change is never going to happen Right what we can do is get in touch with ourselves and realize why am I buying this? What is the fantasy I've been sold in all the advertising? Right that I'm going to meet somebody special and my life is going to be perfect Big question mark and how damaging is that because all of this stuff all of these advertisements it? Reinforces the belief that I'm not enough Right, there's always something new to buy There's always something else on the horizon, you know, and you'll buy one thing and two days later. You're sick of it But you realize you know what that didn't really help it helped me for a day or two But now there's something else I want because there's a bombardment of stuff coming at you through the media That's what it's all about. That's how TV shows run TV shows are not designed to entertain you They're designed to get you sitting down in front of a TV so that you can be subjected to advertising That's the entire financial model of television is to pitch you things The more for the most part you don't need at all at all and it's to play on this Fantasy we have About this perfect life when I'm good enough Now it's dangerous because as I said it reinforces the idea the more you seek for these things these buy these Products that you don't need the more you do that The more it reinforces the idea that I am not enough and that's why particularly I love the United States I've been there and There's more people in anti-depressants in the United States than there are anywhere in the world particularly in women People are hugely unhappy there now. It has everything. It's it's the richest company or country in the world You know, I'm taking aside the massive debt they have but Which all European countries have to by the way but Older basic needs have been met a long time ago, but unhappiness is Getting worse It's getting worse not better, right more and more people now on medication. It's because of this So so susceptibility we have to buy into this fake Consumer-based happiness That's what that's where the happiness and the reason it's getting worse is the more you buy into it the more Reinforces that you are not whole as you are That's the truth That's the truth of the matter. That's why unhappiness is getting worse. There are a lot of reasons But that's one of the main ones, right? That's why you know You would think looking at it logically all their needs are met there in the West generally all our needs are met for more for the most part I mean everybody, you know Bar people who are you know suffering with mental illness and have addiction problems, you know for the most part People's needs are met and they can be met quite easily their survival needs But there's this underlying sense through advertising that you need to buy this buy this buy this and if you buy into that That's when things get bad. Okay.  You don't need right simple as that don't blame corporations Don't blame anybody Don't blame yourself either But take charge of this right do you need this stuff? Just look at the credit card debt in America Most of that stuff is for like needless things People are they're they're playing they're they're playing on your fears and irrationality to an extent where you're putting your financial future in Jeopardy That's how irrational this is It's putting the lives of your loved ones if you're in the family In Jeopardy their future in Jeopardy because there's this constant need to buy a bigger TV set or buy a new pair of Nikes Okay, because we've seen some celebrity or Kim Kardashian wears them Right, and we associate the perfect life With that now we think That we don't fall for it. We think that we're above that. I'm not really buying it because Kim Kardashian wears them or because Kanye West likes them, you know, we think we're above it. We're not And they know we're not because we're not ruled by the conscious mind. It's the unconscious irrational drives That are in charge and if you think they're not think again look around Okay But take responsibility for it. Maybe it doesn't apply to you if you're if you're honestly, you know, you're not buying stuff You don't need Okay, but if you if you've got huge credit card debt Why? Why do you buy all the stuff and Another interesting thing is you you've probably asked yourself that question a million times. Why do I keep doing this? Why do I keep buying this stuff? Why can't I save any money? Why am I living paycheck to paycheck? There are a lot of reasons for it, but this is one you can take control of Stop buying stuff. You don't need because you don't need it It will do nothing for you. It will hurt you Okay, so that's my message stop buying stuff. You don't need and watch yourself heal When you do that you will start to feel better about yourself The products won't help you. They're not going to help you make you make yourself feel better about yourself Right.  Okay, so bear that in mind guys