Welcome to a new video. This video is going to cover the process for collecting and reporting student savings data from the use of OER, as well as other free or affordable course materials. I'd like to thank Jeff Galant, Program Director for Affordable Learning Georgia, for inspiring this video and providing a base for me to work from. So let's get into it. There are three major steps to OER data collection. Collecting data, synthesizing and organizing data, and presenting and sharing your results. The first piece of this is, obviously, collecting the student savings data. However, this data doesn't have one standard format or process for collection. Depending on your institution, you might partner with your campus store to get textbook adoption information. You may work with an Office of Institutional Research to get information like student enrollment numbers, or you may solicit this information through department chairs or faculty directly. But your process may differ based on who you have access to and how your OER work is perceived across campus. The most important part of this information gathering phase is to get accurate and comprehensive course adoption data. This can be difficult, particularly if you don't have a close relationship with your campus store or administration. Still, you should do all that you can to ensure that your data is complete. Here are some tips for getting accurate data. First, leverage collaborators across campus. One reason why I know I have fairly accurate course adoptions data is because I have a close partnership with Iowa State's campus store. However, you can leverage other partners on your campus to similar effect. Integrating reporting into existing workflows like textbook adoption reporting can be incredibly impactful. Second, you can look at multiple means of reporting. This might mean partnering with multiple groups across campus or just providing a fail-safe for faculty. Which brings me to number three. You can provide additional options for faculty to report their OER adoptions to catch anyone who might have fallen through the cracks near other processes. What I do is provide a standing survey form where instructors can send in their OER adoption information directly. That was a lot of information, so let's look at something a little to the side of this question. What kind of data should you track? Of course, you want to get an idea of how many courses are using OER, but maybe there are other types of affordable course materials you're interested in learning about as well. For example, you may be interested in learning about the use of other no-cost course materials like library-licensed ebooks or low-cost course materials like course packs. As you approach this work, it's worthwhile to ask yourself, which of these types of content do you want to gather data on and how can you do that effectively? Like I said before, the how will depend on your circumstances, so I'll leave that question open-ended for this video. Once you have your data, you need to synthesize and organize it. You can use a standard number, base savings on historical course costs or base savings on estimated current course material costs when you're estimating student savings for the use of OER and other no-cost course materials. Personally, I use a standard number at my institution. There are pros and cons of using a standard number to estimate savings. Pros include that it simplifies and streamlines your data synthesis and that it fixes cases where equivalent texts are not available. Cons are that it over or under inflates actual savings, though a true average should even out once you have a high adoption number and deciding on what number to use as your standard savings numbers can be contentious. Here are a few examples of estimated average saving numbers. $100 used by Oregon in the OAN, $116.94 put together by Spark with the help of David Wiley and $134 estimated by U.S. Pergs in 2018. Each of these are supposed to approximate an average textbook cost, though their data sources vary. The links to additional information are provided in the description below. When you're using a standard number, collecting and reporting savings is as easy as getting student enrollment numbers and multiplying them by the cost of the average textbook cost your institution uses. The formula here checks if you've verified that a course uses OER before multiplying the student enrollment numbers by estimated savings. This sort of formula is particularly useful for long-running OER initiatives where you expect the same course to be using OER each year, and you need to verify with the instructor that this is, in fact, true. Besides student saving numbers generally, there are other data points to consider collecting for your OER initiative. Other data to collect might include the number of students supported by no-cost course materials, the total number of no or low-cost courses in place, and percent of all courses, student retention and academic achievement in no and low-cost courses, and average cost for degree completion in various majors. Reporting in this sort of extra data, particularly learning outcomes, can become even more useful when you disaggregate data to showcase the impact of no-cost course materials on students from different socioeconomic backgrounds. For example, do students who qualify for Pell Grants have the same or more positive responses to OER than their peers on average? Research like the 2018 Colvard Watson and Park study out of Georgia have used data like this to great effect. Which brings us to our final section, reporting data. Once you've pulled together your data into some semblance of normalcy, you have to report it somehow. You can report in a few ways. You can use internal reports, public reports and websites, and course-marking initiatives, or other living markers of impact. These are all options available to you. A good example of a website showcasing OER is Penn State Berks OER Dashboard, set up by Corey Weatherington as part of his Spark Open Education Leadership Capstone in 2019. This site captures the impact and number of OER courses that cross his campus and features them in a live Tableau dashboard. Another option might be to utilize course markings or public markings for class sections using no-cost and low-cost course materials. These are becoming a common way of improving cost transparency for students in higher ed. You can learn more about the hows and whys of course markings in the book featured here and linked in the description of the video. Course markings can be as simple or as complex as your technical systems allow. In some cases, as in this example from UT Erlington, you can select courses with free educational materials from a drop-down menu. In other examples, institutions include a visual marker or icon on sections using OER. There are a lot of options for highlighting and sharing the impact of OER and other no-cost course materials on your campus. Collecting this data can be incredibly useful, but reporting it responsibly is just as, if not more important. Sometimes in an effort to showcase and promote our work, we can be a bit lax in the privacy and support for our students. Ensure that if you are sharing any sort of de-identified or anonymized student data, you're sharing this data with a purpose and it is not an easy matter to re-identify these students. Only share what you need to to get across your point. Remember, we're doing this work for our students, not the sake of showcasing ourselves and our work. Their needs should be at the heart of what we do. Thanks for watching. This video has not covered everything about collecting and reporting student savings data, but I hope it's been useful for you and the region's conversation more in the comments below or elsewhere online.


Alright it's time to leave Helsinki in Finland and go to Talan Estonia. So you're driving to the port now to get the ferry. Arrived at the terminal, probably taking that boat over there if you can see it. So it's a two-hour trip is that right? Yes. From here and I'm taking the fat big boat there apparently. You want to see what's on a ship like this? Let's go inside and I'll show you. Gambling with a view. Shopping. What boat wouldn't be complete without a shopping mall? So a lot of people have been asking me what I'm doing over here. Well I came over to go to the biohacking summit in Helsinki Finland but now I'm taking a week of travel. So when I knew I was going to Helsinki for the work event I looked on the map and I saw that Estonia, Latvia, Lithuania and Belarus was right underneath it. So now I'm on this ferry which is only two hours between Helsinki and Talan in Estonia and I'm going to spend a couple days here and then just keep going south. And yes I love to travel abroad alone because it forces me to meet new people. Otherwise I'm just being lonely right so I start conversations and meet new people. I met dozens of people in the week that I was in Helsinki and I'll probably stay in touch with like three or four of them. So I've made three or four new friends just from being alone. When you travel with someone like a partner it might be fun, it could be great but you tend to stick together and you don't really get out and meet new people. There are pros and cons to both of those things. Anyway, going to Talan I'm actually going to meet up with an old school friend of mine who I haven't seen in 24 years, a guy called Daniel McCormack. And then after a couple days in Talan I'm going to continue south to Latvia, Lithuania and Belarus. I don't know anyone in those places so if you know someone there let me know. The cool thing is when you're an entrepreneur and you have a lifestyle business you can actually take a week off, you can just travel and do some work while you're traveling. So my two main businesses, the 30 day no alcohol challenge and my Swanee's blue light blocking glasses give me the opportunity to travel and work at the same time. And I talk a lot about how to build a business and how to create wealth and how to travel the world while working on my podcast. Here's the link. This is where I am right now on a ferry between Helsinki and Talan. You can see outside there's the water and that's where I am right there. This is where I'm going, Talan in the country of Estonia. And then I'm going to go down to Latvia, Lithuania, Belarus and old schoolmate of mine Dan McCormack showing me around Talan Estonia. It's the Orthodox Church is it? So this is Kifa which I'm about to drink and what is it Dan? It's something that's halfway between milk and yogurt I guess. This is where I'm going for dinner tonight, traditional Estonia. Am I dieting here tonight? Oh well you are very welcome Milord. So what am I going to have this one? What's in it? It's a triphilis white blood and it's about 250 grams.


That literally changed my life. I worked so hard for so many years, went to college, had two jobs, took the bus in Los Angeles for like 12 years and I worked as a receptionist in Beverly Hills for many years as I was going to college. And one of the clients, this beautiful lady, her name is Rochelle Newman, and I told her I was working on this crazy idea to create a bilingual luxury magazine and she's like, show it to me. And I didn't know she was like the head of marketing for Lexus USA at the time. Like a month later, having this meeting with the whole team and they're actually launched my publication, we like a five year contract.


A linear feedback shift register is a special type of recurrence relation where the preceding terms are not raised to powers, that's where the linear comes from, and there are no added constants. Mathematicians would say that these are homogeneous recurrence relations. For example, a recurrence sequence where every term is dependent on the term before plus one is not a LFSR because of the added constant. Meanwhile, a recurrence relationship which is based on the preceding term plus the fourth term before plus the fifth term before is a LFSR because the preceding terms are not raised to powers and there are no added constants. And because this does depend on the fifth term before it, we would say this is a fifth order recurrence relation, at least if we're a mathematician. If we're a computer scientist, we would refer to the order as the number of registers. So this would be a five register LFSR. Because there's no added constant, a seed value of all zeros will produce nothing but zeros. Conversely, if the registers ever fill with all zeros, the output will always be zeros ever after. And because of this, we will only consider LFSRs that never produce a sequence of zeros. And what this means, if our output consists of ones and zeros, then the period of an LFSR with k registers is at most 2 to power k minus one. And that minus one is because of the sequence that we can never get. For example, let's take our LFSR as Sn, congruent to the sum of the two preceding values, mod two. And let's find the first few terms of the sequence starting with seed values of one and one. So we can write down the first two terms, S zero is one, and S one is one. S two is going to be the sum of the two preceding values, one and one, which will give us zero, mod two. S three will be the sum of the two preceding values, one and zero, which will be one mod two. S four will be the sum of the two preceding values, zero plus one, or one. S five will be the sum of the two preceding values, one plus one, or zero. And at this point, it's worth noting that to compute S five, we had to use the values one and one, which were the same as our initial seed values. And so starting with S five, we're just going to repeat all of our values. So we'll get zero, one, one, zero, and so on. Or let's take this LFSR. So we can set up our coefficients and input our seed one, one, one, one, and compute the next few terms. And if we do that, we get the sequence. And notice that at this point, we're back to our starting seed value, all ones. And so that means the recurrent sequence will just repeat itself after this. And because of that, we no longer need to compute further terms in our sequence. Now since the sequence goes through 15 terms before it repeats, and the maximum possible period for a fourth-order recurrence relationship is two to the fourth minus one, which is 15, this recurrence relationship gives us the longest possible period. And on a final note, if we only needed a string of ones and zeros for avernum cipher, we can stop here. If we want to convert these into an actual random or pseudo random number, then since we can get numbers from one through 15, we can take our bits forward at a time and convert them into a number between one and 15.


being gun shy. I thought they both did some nice things in the second half we obviously got to protect the ball better than we did tonight and that give us a chance to win. Coach Frabel does such an awesome job of setting the culture around here. There's a foundation and the expectation. We say it doesn't matter what players are out on the field it shouldn't matter what coaches are on the field either there's an expectation around here that he set very clearly and we got to live up to that. How good was it to see to get Taylor little on some game action before the regular season just to get him a couple of series to get back out there?  Obviously got Dylan a lot of work in all these games in different spots. I know both those right spots but where do you see him right now and where do you see right tackle? Yeah I won't get any predictions or projections there. I just will credit Dylan for playing multiple positions for being able to handle the workload we threw at him. He's a resilient guy he's a high character player and you know he's got a long way to go but I think he's made the right stuff. Does this drop in the end zone that a concentration lapse there or what do you think when you saw it on the pool? Yeah I think I'd have to see it you know replay to see exactly what happened. Looked like a pretty good ball looked like some separation there so I'm not sure how it wound up on the ground be honest with you I was on to the next call as soon as I heard that it was incomplete so you know we expect guys to go up and make plays in one-on-one contested situations and that certainly was one of them. Still some time before the first game how concerning is it to you that you have gotten Tana Hill Hulio AJ on the field that much this whole preseason really? Yeah you know I prefer to focus on the stuff that we have accomplished instead of worrying about the things are out of my control and I think that the offense is taking strides each week in finding our identity doing things our way and you know we haven't been consistent enough at this point but we've laid the foundation of what we expect this thing to look like and regardless of who's in there how much practice time we get together that standards been set so we'll we'll take advantage of the time that we have between now and the opener and we've got a lot of work to do but I believe we'll accomplish it a lot of burst you know some good lateral quickness I thought he ran the ball tough you know he took care of the football so those are all really good things to say or to see he was in a similar system down there with Arthur before he came here so I think there was some carryover and verbiage there which helped you know but he's certainly got some talent and some good physical traits yeah I certainly have never written cam off I think he's made of the right stuff you know he's got that competitive spirit and that grit that toughness you know we have a talented receiver group and there's some depth there and obviously powers above me have some tough decisions to make but you know cam's gonna give you everything he has every time he lines up and we appreciate that you know I feel fortunate to work for people that will take my opinion into account you know but that's all I can do is give my opinion they'll do what's best for this team and you know I think history has shown that they've made some pretty good decisions it's nice to be in a in a spot where there is competitive roster battles and there are some tough decisions to make and I think that that's a testament to how hard all these guys have worked guys talked about how important it is for the backup quarterback you know to keep the ball to keep possession and so forth bark we had the one pick and there was one or two maybe that could have been picked as well could that hurt him in this in this competition here you know I think anytime you put the ball in harm's way it certainly is a demerit you know I'll have to look at the tape and get a full evaluation how both of them played and how often we did put the ball in harm's way you know but we're gonna hold those quarterbacks to a high standard and we expect that ball to be protected at all times particularly down there in the red zone when we have points on the board so you know red zone non-scores are unacceptable around here let alone turn over so yeah and I think you know stretches had so many conversations with Coach Brable over the course of the last few years that they think very much alike the communication is very streamlined and I was given a heads up that we might be in four down territory you know like to convert more of those four downs as we go there and certainly would you know like to not get the fourth down but you know it will stay aggressive as as we're given the opportunities and try to stay aggressive with the play calls as well we saw Elijah Molden doing a lot of directing and traffic cop kind of a roll there before before the snap so what can you say about how he's settling in and being able to do that yeah I think he's getting adjusted like kind of what we expect from that position the different things we asked that guy to do I think it's slowing down for him after last week again there's always going to be stuff that he's going to learn as we go you know new things are going to show up two weeks from now that we haven't really seen yet and that would probably continue throughout the season but I'm pleased with players that right now I think he's doing a good job being committed consistent learning every day out there any of them distinguishing themselves you feel like you've got some real competition yeah we brought those guys in I mean shoot they've been here two weeks now and they kind of fit right in they pick stuff up pretty quickly I mean it's been competitive like after the first two like it's been competitive and we're gonna have some tough decisions to make as this thing goes John and Mike just to kind of see where this thing's at but I mean right now it's a it's a pretty competitive group and it's going to be interesting how it plays out how much do you fight for guys as you as you knew your roster cut and what are those conversations like with you and Mike and maybe John try to make some of them yeah I mean they they do a good job of including us and asking our opinions on guys obviously it comes down to John and Mike and their vision for as this thing goes um but we did we have opinions as a DC as a position coach we kind of have a feel for these guys how they're going to fit the unit right like that's a big part of it not just necessarily the best player but how they're going to fit the unit the the piece that we need who might have some more versatility but might not be as talented right that all that stuff comes into play so it'll be interesting to see here in the next couple days call against borders kind of set what personal foul is there you think maybe a little hard yeah no I think I think that's the rules like you can't have unnecessary contact sling the guy down we've seen that called a lot throughout the past couple years yeah I mean I I think as the game when it kind of was what it was we we had an idea of how much we want to play him along with everybody else right and he got in got his work done and then we put some other guys in there how confident are you and how confident are you in the progress that Caleb is made yeah I think he's learning every day I do like these games are extremely valuable to him right going out there and actually doing it being able to take it from practice to the game and again he's a rookie we've talked about this before just he's learning every day he's trying to refine his techniques and fundamentals where he's not just going out there and trying to play ball I got this cat like it don't work that way here like they comes out in the technique fundamentals your eyes all those little details of doing your job and I think he's improving but it's an everyday thing how much pride had you taken in no touchdowns allowed and disappointed that you gave up a couple tonight yeah I mean I was encouraged with the way we've been playing not not necessarily the point points aspect of it but the way we've been playing the energy the flying around I was disappointed with a two-minute drive there at the end didn't think we execute very well and you get penalties in two minute it kills you we had two big penalties there stop the clock and chunk plays right so we gotta improve that it's good to get in that situation but it's got to be better but I've been encouraged up to this point with guys momentum that we're kind of starting to build confidence everything that goes with it yeah so we had a staff meeting this morning and it was status quo kind of go through the same deal make sure we're good operationally with everything with the adjustments we made I mean he's been engaged throughout the week with everything going on obviously just he wasn't here tonight and that was probably the biggest thing prior to the night is just making sure everybody's on the same page with kind of how things were going to operate with stretch and Ock and I'm sure he was watching like I'm sure I might have some text messages when I go back in the locker room but I'm sure he was watching so we'll see I mean he does a lot of that stuff him and Mike communicate a lot during the game anyway just in terms of game management and situations and all that type of stuff so I mean he's been involved in that throughout his time here so it was good to see him down there and kind of doing it better maybe not so much tonight but in general preseason it's been pretty good for you guys do you feel like that there's you know an increased sense of confidence going into the regular season after you know what happened last year yeah I hope so I hope so I mean that's what we've been preaching getting these guys to fly around play with confidence challenge right expect to win their one-on-ones across the board whatever it is any any call that's made like expect to execute and I think they're taking hold of it right I think they're accepting the challenge I think they're embracing it we just continue to do that continue to find success and hopefully it continues the bill for us yeah I think he's had a good camp I do I mean he's done some things I think he's grown up I think he's become more of a pro this year than he has been in the past and part of that maturity I mean they're young guys when they come out of college and now they're getting adjusted first time on their own all that stuff so I think it's been a process for him but I think he's he's matured right and I think it carries over in his day-to-day how he practices and then obviously that carries over to game day impressions of fields and was it good to be able to get some work against the mobile quarterback before the season starts yeah absolutely I mean you guys saw how Atlanta went wasn't great like we talked about that going into the game like we got to be better more disciplined more coordinated when we rush those types of players so I think it was good I think he made some plays with his legs he threw some balls up there guys did a good job playing back for it right so it was a good test for us it especially going into week one guy like Tyler similar skill set right so man I was glad we had the opportunity tonight thanks Shane real fast you have any idea who gave stretch the the challenge info from the booth you know who did that tonight no okay that was a really good try but the odds of an answer were below one percent open to have with side artfully that's right thank you Cal thank you Cal appreciate it it was not very well not a very little tick-tock buzzed in little tag get buck run a hole for him


So while folks are getting logged on, I'm looking for two scribes to take notes. Today we have a presentation. So the notes for today will be particularly useful for making sure that everyone in security has the context of what's going on. And as someone who is cloud person that works at Vintec, birds. All right, still don't have any new scribes. Hey, Dan Mark here. I'll try to do it today. Thank you, Mark. Appreciate it. All right, I need one more individual to help Mark out. And then I think we can get started.  Do you have a sense of how much of the hour we have together I should be allocating? I plan on prioritizing. I've not run through them in a continuous manner. But it's fairly short. It's just 11 slides. So I don't know, 20 minutes with discussion should be fine, if that's OK. I can do it. You obviously never discuss with this crew. We will have a discussion. Awesome. So 10 minutes of presentation. I'm going to pad your estimate on discussion especially the interest. There are a number of us on the members here that are actually in FinServe and really interested in that. So we're also going to be very interested in that context sharing for non-SIG related interests. Perfect. All right, do we have someone supporting Mark as a scribe? I need one more scribe today. And then Michael Ducey is driving, so it cannot be Michael. I can scribe. Thank you, just appreciate it. Let's go ahead and get started. Because I do think that, like I was just saying, I think we're going to get into some interesting discussions. And then we have some ongoing efforts that I'd like to get check-ins to. But since we've been a bit sort of keeping the trains running and working on our work focused in the last three months, and we're beginning just to restart some of our presentations, I want to make sure we get that in at the time it deserves. All right. So we had our second follow-up with our TOC liaisons. Scheduled for today, unfortunately, Joe Beta is out this week. And we will be reconvening there in one week. So next week we'll have a little bit more news in the ongoing coordination and alignment with our TOC liaisons. Their top priority right now is normalizing the ingest process and how those things are flowing through the TOC. We're looking for alignment and further insight on the security assessment and security assessment prioritization process. But we've had expectations managed to us that that process is likely to be influenced by the outcomes of the rest of the effort. So that's something that I'm tracking closely. Hello, this is Emily Fox, National Security Agency. We talked yesterday about the SIG Security Day. I've updated the tickets with the notes from that meeting, as well as linked in the Trello board. So if anybody's interested in understanding where we're at and what things are going on, you could check out issue, I believe it's 209. Right now I'm waiting to hear back from Amy and Emily Ruff concerning website content for that event. That's about it. Excellent. Christian? RXM, we are just trying to make sure that we're in the loop when it comes to the developments with the SIG Security's work. We actually did read your, well, the white paper that you guys published was distributed internally. So we're going through reading and reviewing that. So I'm sitting in. Awesome. Christian, is that specifically the policy, the white paper that's in progress? Yes, yes. Awesome. Thank you. Thank you. Abhinav? Hi, guys, this is Abhinav. This is my first meeting. So yeah, I'm a VPN head of information security at Frames, Iowa, a New York City startup. We are just moving to Kubernetes. But we have been using Falco for quite some time. And I met Michael Dushy last week when he was in New York. He told me about this meeting. So that's why I joined. Excellent. Welcome. Thank you. Hey, Mark here. Nothing new to report. I wanted to mention briefly that the NIST Big Data Working Group, which is wrapping up their work, it's still in review, like it's on three of reviews at NIST before the official final report comes out. The leader there is interested in working on a framework that the University of Indiana, and I'll put this in notes for the other note taker. Don't try to catch this, to build a reusable set of APIs, which they're calling the Big Data Cloud Mesh kind of thing, which is what's interesting in the sponsor in having a set of use cases around analytics that would exploit this set of APIs. I'd like to hook them up with other people with that interest. So if anybody on this group is interested, I'll put them in touch with the professor at the University of Indiana who's working on this. There's a GitHub project around NIST with some of the artifacts in there that you can poke around and look at. But it's pretty much TBD to see where it's going to go from here. That's it for me. Thank you, Mark. Is the University of Indiana and Indiana University the same thing? Yes, they are, sir. OK. There are some previous Linux Foundation efforts that have been tied to that. And let me see if I can pull that up because that might connect some of the resources that are working on this, to that, and so driving that forward. You're right. IU is the normal way of referring to it. OK. Got it. Michael, which is permute. You're still muted, Michael, if you're talking about this. Did we lose Michael Ducey? I'll come back around. Yeah, I don't see him on the list anymore either. So come back around to Michael Ducey. If he shows up, call it out in chat. Justin. Yeah, so I've been mainly reading the Kubernetes Security Review, which is long and interesting, and trying to work out which bits of it are actually being implemented and so on. There's some of the... I was actually expecting the recommendations to be kind of... I mean, I was kind of expecting the recommendations to be to have CVEs and to be actioned, but actually they have internal code numbers and some of them have been actioned and some of them haven't, and it's kind of... But some of them are quite long-term things to fix and some of them are quite short-term things. So it's quite a mix. And I haven't finished reading all the supporting docs yet, either, so yeah, there's a lot of stuff there. Is it worth sharing out in, you know, carving out 10, 20 minutes in a meeting to share that context? We kind of had a small overview from the authors last week, I think, which was helpful, but I think that was just... That was just before it had been released, so there's a lot of it digest. So it may definitely make sense to... Yeah, and this would be much more our synthesis of security, more synthesis of this rather than what others think. So I'd like to... Yeah, I think it definitely makes sense. I think there's a lot of quite interesting things in it, and there's some discussion that some of us have been having about community threat models and things that I think, because there's a whole threat model document now and things that I think will be interesting to pass. Definitely give people a bit of time to read it all, because there's a lot of it. Right, I'll make a note that we're going to slot in that agenda item at some point in the future, and we'll just check back in when the right time, especially if we can get a couple different perspectives that have gone through and digested it all, that would be really nice. Craig? Hi, Craig Ingram from the Security Audit Working Group. So yeah, I definitely appreciate the feedback, Justin, and I've been enjoying watching the community response to a lot of the reports as it's come out and a lot of action being taken on issues that have been opened already, too, and things being closed out pretty quickly. So it's been cool to see folks kind of rally around that and fix some bugs. As far as the CVEs and stuff, yeah, totally get that, and that definitely makes sense. That was kind of left up to the PSC as far as making that decision. So the Product Security Council Committee, whatever their current acronym is. So they had, obviously, a preview beforehand of the report and the finding just to make sure, hey, do we need to embargo anything? And we ended up being, no, we can work on these out in the open. So if there are missing CVEs or things that seem CVE worthy, then I think that's totally up for making a request to Mitre and getting that designated for sure. Well, the one I particularly mentioned today was that there was a, I think, fix just got merged today, was for high-scuzzy passwords in logs, which is the sort of thing you'd expect a CVE for because it's a straightforward, you know, credential leak that people may need to be aware of to take action on. Some of them, yeah, less, but that one was a very, seemed a very clear-cut case for CVE. Yeah, and I think there's another similar one about, you know, things showing up in logs that shouldn't, that would probably fall in the same category. Sorry for the notes, this is related to the trail project, right? Yep, yeah, got it. Excellent, let's... Yeah, hi, my name's Lutz Pinker. I work for Figo as it's still called, name will change, and everything else I do, you'll see in a couple of minutes. Wei? Hello, everyone. So I'm from Alibaba, so I want to introduce myself first. We use Kubernetes a lot in our company, and we care a lot about the security. So this is the first meeting I'm joining, so I'm trying to follow your steps, and I'll appreciate if you can give me some guide, how to start my journey on the Kubernetes security. Yeah, thank you. Great. You know, at a high level, I recommend, you know, kind of watching the work stream, you know, maybe for a couple meetings, and then we have a few major work streams around security assessments, policy, and some other initiatives that we are always looking for support on.  I look, I think I have read some files that I looked through the GitHub issues. There is a label named Help Wanted, but I think the list is almost empty. So, yeah, I would like to help, but... Nice, nice. Well, we'll do some trios there. We, you know, after we got ratified and went through, you know, CubeCon Europe, we've doubled our regular attendance and, you know, have gotten a lot more help. So, great. The fact that our Help Wanted queue is getting burnt down is good news. Okay, okay. Great, well, nice to have you on board. Yeah, nice to meet you all. Julia? Hello. Hi, everyone. This is my first meeting as well. I'm working on implementation of security for Network Service Mesh, and I'm just curious what happens here, so I just want to listen. Welcome. Thank you. Is there anyone else who I've missed? I'd like to check in. If you're new and or don't want to check in, that's perfectly fine. I do invite you to sign in to our minutes, which I've just dropped into the chat. Hello, Dan. Hello, Dan. Hi, Yang. Yeah, yeah, yeah, I'm new to this group, and I'm working for Entrepreneurial. And, yeah, yeah, Entrepreneurial, we just want to improve the security of our infrastructure, and that's including committees issue and other cognitive components. So I'm just joining this group and just want to know what is the next step of the cognitive security, and want to keep each other up to date. Great. Welcome. Did Michael Ducey reconnect? Robert, great to see you. I'm going to transition from check-ins to kicking off our presentation with Lutz for the sake of time. So welcome. Anyone who's just joining, please do sign in. That way we can record your attendance. So today we have a presentation on fintech Kubernetes, and Lutz, you're welcome to take over. Are you familiar with the presenting via Zoom? I guess we'll find out. First, the document for the slides is in the chat, and now I will try to find the right window to share. Please give me a couple of seconds. Yeah, you should see just a single slide. Yeah, okay. Hi. I would like to, sorry. I would like to give you a quick insight into who we are, what we do with Kubernetes, and then some ideas of how we see the world as far as security is concerned, what we implement. And the major part on the last couple of slides will be something that we run into, some hurdles, some obstacles, and basically a wish list that in a perfect world, Kubernetes and the cloud-native landscape would provide for us in order to get more security, whatever that specifically means. We are a German fintech. We've been, we are actually in the process of moving the last customers to our Kubernetes-based platform, and we provide an API for banking as a service. That automatically means we are heavily regulated industry. So there's another things we can't do. We cannot use public cloud providers. It's possibly now, but it's very difficult because it's always a question of who gets to audit whom. Auditors in general are our biggest pain because they ask the same questions over and over again, slightly differently each time, and we have to find out what they actually are asking, not what the text of the question actually means. We are, we have customers that are banks themselves as well as other fintechs and mid-sized companies that simply use our license as a service. Because we are licensed, we can have them do financial transactions across our platform. We also serve some APIs to mainly mobile tools and thus interact with account holders and users directly. We're in Hamburg and Berlin and we're currently merging and that's what I said the name will probably change. So don't be surprised if I give you a different name of whom I work for in the next couple of weeks. As far as Kubernetes is concerned, we are pretty small compared to others. We just have 50 mid-sized nodes. The most specific thing is we do everything on bare metal running CoreOS and we've built a automatic deployment mechanism that takes all the applications directly from a Git repository and from configuration from a Git repository and the actual applications via Helm. Currently we do soft multi-tenancy because we deploy the same application in multiple namespaces to isolate but we are gearing up for hard multi-tenancy where partners and customers would actually get access to some form of Kubernetes API. How much and how filtered and how this is done is still a subject of research and discussion but the requirement is visible on the horizon and we are gearing up for that. As far as security goals and design principles is concerned, we do zero trust even though we think that nobody should be in our cluster, we still don't assume that. And we have a fairly straightforward sense of requirements because the thing that we most have to protect is the user credentials of the online customers. Then the other things are the usual stuff, it should work. What we're trying to achieve and this is mainly one of the things that I'll get into in my obstacles list is to never have a human actually working within our production cluster. There shouldn't be an admin. Everything should be via Git controls, via GitOps and that has been surprisingly hard to do mainly because we don't write everything ourselves where it would be simple to do so but we use a lot of third-party components and I'll get into that in a bit more detail. And we also try to do defensive in depth and so far we have been, I think we have been successful in that because there were CVEs that everybody got really up in arms about where we thought that it would not be as problematic for us. Okay, the next is just the usual stuff we do MTLS of course, because we aim for zero trust. We basically have everything encrypted addressed and what our secret sauce to a certain extent at this is that we don't create secrets by hand. They're all automatically by this deployment mechanism created from a hashacop vault and put into Kubernetes secrets and we are in the process of getting ready to do better workload at the station so that we can eliminate a lot of these secrets which are only there for one component identifying or authenticating to another. As I said, we do bare metal and then we do everything that Kubernetes provides to a certain extent more or less you see the usual acronyms there. In addition to that, we deploy an IDS from NeuVector which basically gives us an insight and a fairly nice UI to see whom is trying to talking to whom and we can intercept that if we want to but at the moment we use it more as a detection than as a policy enforcement tool. Okay, now the other part of our secret sauce is DeployD it's a solution written in-house that takes a configuration and deploys it based on a trigger. That is set or that is called by our CI pipeline and it only will take fixed white listed list of branches. If one of those is triggered by the event then it pulls the help charts and renders them out to the cluster. We do not use tiller and it will also automatically populate all the secrets from the HashiCorp vault. As I said, the goal here is to have no human intervention in the cluster. This is very helpful in having a development environment that looks very much like the production environment where the devs can have all the secrets they want. They can set them themselves, they can put them in the development vault fairly easy to work with but they will automatically be replaced with actual production values by DeployD. And therefore there is nothing that can be accidentally put into the source repo. There is nothing that a dev can leak. And we hope at one point to reach a point where even an admin that we still have to have for certain corner cases is not able to leak anything because they can't know. But now the next from here on in this is basically a laundry list of things that don't really work, that are hard to do. And I'm very aware of the fact that I'm probably barking up the wrong tree and I'm maybe even preaching to the choir here. And this is in no way to detract from the good work and very helpful work that has been done on security in Kubernetes. But some of these things are really hard to do for a small organization. We have to be very aware about developer productivity. For instance, using Spiffy makes it hard to work offline. It may not be impossible, but it makes it harder. And also we are working with banks and most of the banks are very conservative. And the most conservative of the representatives of these banks are their auditors because they see the world in a certain way. And if you come with new ideas, then they often understand things, as you can see from these quotes, that they're actual quotes that happened in discussions with auditors. See the world in a certain way. And if what you're doing does not fit this world, the answer is no. And it's hard to work around that. The biggest obstacle to more security for us is actually managing the supply chain, the software supply chain security, because we have an incredible complexity of direct and more indirect dependencies as we are not Google or other large organizations that can write or at least review everything, every single line of code that we put into our system. We don't, for that reason, we don't use signed images. I would love to do that. But what's the point? It would be just signing something that I cannot control completely because of the complexity of dependencies or the sheer number of dependencies. And this is even a problem with the IDS wheel, had a number of cases where an image, a base image was reported as containing a code that has a CVE. And after a lot of manual investigation, we found out that, yes, or not chorus, CentOS version XYZ has a CVE that's active against that, but only in a component or in a package that is not installed by default and definitely not in the stripped down version that was the base image for some tool that we're using. So any tooling that or any concerted effort or standard procedure that would allow us to easier identify who wrote what and what's the quality and the input to all these components, all these dependencies would go a long way toward improving supply chain security. The next thing is, as I said, we are trying to eliminate the admin, but sometimes that's fairly hard because components assume that there is an admin. They will even ask for money for their fantastic UI, which is nice to look at and it often gives good insights into what's going on, but also they require you to configure the system once it's running down to even closing ports or setting security controls. Now the network side isn't that bad if you run it in Kubernetes as it would be by running it straight into the internet or available to the internet, but there are a number of things, for instance, that in Elasticsearch are very hard to do in an upfront manner or in a declarative configuration way. Some components have that as a stated design goal. Ambassador is one example and not the only one, but one that's dear to me because we're using that quite a lot and I think it would be very helpful to identify CNCF landscape product or projects that have this design goal or this feature that they are completely configurable in a declarative manner. Even turning off or dumbing down the UI would be very helpful and I think this group could work to state such design goals that are conductive to security. Hopefully some projects will adopt them. The next thing is how do components authenticate to each other? It is for me and it is hard to define or show what the benefits of something like Spiffy compared to Kubernetes onboard secrets are, especially in an environment where I have to find a good reason for the effort that it would take to implement workload attestation. I seem to have been somewhat successful because we have that on the agenda now. The next really big pain point with all the MTLS is the certificate management. Every single component has its own or every single project has its own way of doing CERC management. It is not easy to find out what certificates are currently deployed and actually running in or being used and Kubernetes itself isn't any better. The root certificate rotation is painful. There is no easy way to find out what the exact certificate is and for instance, which certificates within the whole cluster should be rotated next or should be replaced next because there is no auto rotation. All that gets even harder if certificate management is one of the regulated areas because we have to do it in a certain way and not doing that is not an option. The next thing I should have, whatever. Overall, the security management is difficult to maintain in an ongoing manner. I have not yet found a tool or a process to generate the documents that the auditors would require. So having some standardized way of generating standardized documents would go a long way even if semi-manually but ideally automatically because we are a small company. This takes up a lot of manpower for jobs that are basically not fun, so it probably would help. There's been some efforts with the secured CNCF financial users group and we are an active in that as well. Not me personally, but a colleague of mine. So we hope to see some movement there. Okay, from now on there's my personal, wouldn't it be nice wish list? Some of this may not even be possible to solve, but as a user presentation, I thought I'd give you some of my pain points. The declarative configuration we covered. Actually, we covered that in totals, I'm sorry for that. But MTLS is not the standard or does not seem to be the standard and the normal way to do things with a number of components. Yes, they can be turned on, but it's some obscure, often badly documented configuration and the projects don't have a feeling for the complex certificate and key management issues and details that quickly arise if you use MTLS everywhere. The next is to have more security by default. That might increase the learning curve to start with Kubernetes, but the simple things as the non-secured API interface, that's the default, why? I know some of these points have been covered in the white paper and the security analysis. I can only agree fully heartedly. And more steps towards the fantasy land is please, let's have unmovable key support everywhere where I can keep my keys in an HSM or maybe even a hashicob vault that would be a start and general understanding that keys cannot be copied where you need them, but they have to be requested or their use has to be requested from somewhere else. Some components start with that, but it's really hard. And my last wish, and this is definitely something in the fantasy land with unicorns and everything would be a measurement of how many layers of defense are left. Somehow, even if I have to, if this is just a form of documentation or modeling or anything like that, together with a threat model, that tells me, well, if this barrier has been compromised by CVEX, then you have still, and more layers that protect your vital data, which are the customer credentials in our case. So at least we have the advantage of being able to identify what we want to protect. And if there is any research on doing such a defensive depth meter, I'd be very interested in that. And with that, I'm done. Thank you very much. Let's thank you. That was great. I'm sure I have tons of questions. I'm sure others do too. So let's see. You left such delicious candy there at the end. I wanna try to avoid rabbit-holing on the fantasy land. And let me scroll back to the previous slide where you tee up the interesting challenge of basically doing the organizational handshake between a vendor and a large organization. Do you have any potential strategies around exploring that? As a former vendor who now works at PayPal, large financial services company that tends to be a bit more progressive and works closely with vendors, I've seen that particular challenge from both sides of the aisle. And honestly, it's painful on both sides. And if there was a mechanism or a coalition to move that forward on the end user, the customer side of things, there would definitely be interest in aligning with that. Okay. It's interesting for me to understand that the paint, no, it's actually not that surprising, but I have to continuously make myself remember that, that it's a pain point on both sides. And I think, and this has been the, I think common theme with financial services user group as well is to have a common framework if only of documents or audit questions, procedures, things like that, that everybody can agree to. If you say, we do it like that or we do it like that, but differently in point A, B, C, it would go a long step forward to reducing the manual work of understanding and generating documents that will only be weighed but never read. So that would probably be helpful. The question then is who accepts that as a base? For instance, in Germany, we have had a federal agency generating documents like these for a long time. Of course, there are requirement or required to use for federal agencies, but other than that, it's a lot of that is yes, the normal things, lock the door kind of stuff, but it's a lot of paper and it's, I'm not sure if another framework like these will help, but we need something. So it's, I don't have the magic bullet there either, no. But having this agreed upon framework probably would help a lot. Even just by weight of community. Great. Hi, this is Abhinav. So one question, did you face any challenges when you deploy pod security policies or network security policies? So for example, network security policies, you need to know how your services are communicating, right? I mean, if you deploy blanket policies, they can understand the services or if you deploy overly broad policies that don't serve the purpose that they intend to serve. So how did, did you guys face any challenges around that? And if yes, how did you solve that? For understanding who talks to whom, the NeuVector IDS was very helpful because you can run it in a learning mode where it'll just list who talks to whom and we have this development environment that reflects the actual production environment to a sufficient degree. Other than that, especially network policies and pod security policies, it's just grunt work. We are moving to a point where we say, you can't communicate, if you want to change that, come to me and state exactly what you have. And if other than that, you can't, it's forbidden. Everything's forbidden and it's a discussion. It's an ongoing discussion and I think there's no real, there's no secure way around having this ongoing discussion. It's easier than old school firewall rules because there is not this, or there's not this context switch from components talking to each other to network numbers and port numbers, but rather I can describe it in a declarative manner of the lang, or of the names of the components that are talking to each other. So maybe we just got lucky with the way we designed our namespaces. So it's just grunt work. Go ahead, thanks. So it's Mark under here. So I also work in financial services. So we got several of us here that are mired in that space. I'm wondering if the Germany federal regulators accept any of your automated artifacts at all? I'm not sure is the honest, complete answer. But in the end, it's often generating documentation that makes them assume that you are doing it thoroughly, more than anything else, that you basically have a plan and follow that. There's also the BSI specifications that generally follow this idea that yes, there are certain simple controls, as I said, like lock the door and have a metal cage around your computers, but other than that, it's having a plan. And having a plan and automatically documenting that you're following it actually does help a lot. Last year, they wanted us to do some screenshots of some tool that controls some network component in order to document that we were following or we were doing something along the lines of the plan. For us, that's a lot or too much manual work to take screenshots. But if they accept screenshots, then the assumption is they'll accept automated reports any day. So just a placeholder for a future discussion, the OCC, who's the main regulator in the US, convened a meeting with our DevOps standard in IEEE in which they tried to talk about reverse engineering DevOps from the regulator's point of view, IEE deconstruct the artifacts that were coming out of DevOps so that they could consume them in a DevOps methodology as a regulator. Seems to me that's kind of where we need to get with the whole reg tech space in order to make this happen because it's not just the problem with the tool of Kubernetes or the things that are coming out of the open source community, it's broader than that and they need to be part of the solution in some specific ways. I couldn't agree more. Do you have any docs or standards that you can point me to? I've seen the... Sure, it was an abandoned conversation. We had five or six meetings with them. They seemed very interested and then they concluded it with no artifacts. So I don't know if that means they have a plan they're gonna announce to us or if somebody inside the OCC killed the project, I just don't know. But that would be under the DevOps IEEE umbrella, right? Right, it's the 2675 working group. I see. Up in the chat. Yep, cool. Any other topics that we have just a few more minutes? Any other topics that folks would like to jump into? Well, I just put on the agenda to just highlight the recent CVE cluster for Envoy which coincidentally was on our list of things we wanted to maybe reassess. And I think the underlying point I wanted to make was this notion that security audit is point-in-time artifact and that this notion that you can just say something has a security audit, that's not suitable. Clearly. The Envoy security issues are the same ones as the gay ones and therefore apply to everything building gay as well. They're the general HTTP2 vulnerabilities. So they apply to all HTTP implementations. So it also applies to Kubernetes and anything else that's using, potentially using HTTP2, you say? Well, got it. And Nginx has the same vulnerability as well. Most people who are talking HTTP are vulnerable. Nobody does that. Wow. That's quite the impact. Justin, is that something you expect to see? And Robert, excuse me. Is that something you expect to see more things pop up? Like this is just the beginning and, you know. I don't know, I think it looks to me like no one had looked really hard at the kind of resource allocation issues with HTTP2. We went through the whole thing with HTTP decades ago with Slowloris and there was a bunch of them around then about the same kind of attacks. And the HTTP2 spec wasn't very specific about how to deal with resource allocation issues. And so Netflix spent a bit of time on it recently. And hopefully they found most of the issues. I mean, I think they're relatively understandable. They were quite a few of them. But they, and they did a coordinated disclosure with all the major implementations that, so. Hopefully this is most of them, but yeah. People that, I mean, resource allocation issues are kind of rife through everything. It's just easy to make things leak resources in general because it's not a threat model people think about much. Right.  Well, it's got more types of resource because it's got multiple channels. So you can leak channels or you can send things down multiple channels in small amounts and all the other kinds of types of thing because it's not just a single channel anymore. It's managed a few other pieces around header compression and things like that that are also resource allocation issues. And the groups using HTTP2 tend to be very T-shaped where like the one thing that you actually, you know, find that you're really needing HTTP2, you go really deep into it. And, you know, HTTP2 as a spec is much broader and in the capabilities it's introducing to the protocol. So, you know, one use case may differ in what it's tapping into. Well, also I think a lot of people have just opted into it without really realizing because software is just updating and supporting it and it just works. Yeah, yep, yep, and just works. Interesting, great. Well, Robert, thanks for highlighting that. Do you think that we need to carve out more time to dive in more deeply or does that sort of awareness balloon there cover the topic specifically? I just want to give you some feedback on the lifecycle PR that I've put up there and noting that it's still a work in progress but I thought I'd throw up what I had just to keep the momentum going and in line with these CDs. But I think, again, my meta point is that I think the security assessment shouldn't be thought of as a single point in time. It's a commitment. People are serious about getting a security assessment. It should be a commitment to ongoing resource and allocation of time and review. And I mean, that might be onerous, especially for a critical component like an envoy but I think those are table six. Right, yep. So trade off we have in the collective reliance on open source components, absolutely. So I did drop Robert's agenda item into the chat and it is specifically issue 152, right? Robert that you're looking for. Yeah, that's it. And that should be linked to the pull request as well. And PR is 1.5, great. All right, thanks for the heads up. That brings us to the end of today's meeting. If you have anything specifically that you'd like to tee up for the next August for the first meeting, please add them to the top of our meeting notes. Thanks everyone, have a good week. Thanks Dan. Thanks. Thank you. Have a good day.


from the campus of MIT in Cambridge, Massachusetts. It's theCUBE, covering the MIT Chief Data Officer and Information Quality Symposium. Now, here's your host, Stu Miniman. Welcome back to theCUBE, SiliconANGLE Media's flagship program. We go out to all the shows, help extract the signal from the noise. Here our fourth year at the MIT CDOIQ, which is the Chief Data Officer in Information Quality. In the time that we've been covering this event, it's really the mash-up of a lot of trends we've been seeing, talk about data itself, analytics, big data, happy to have on the program. First, I've got George Gilbert, who's part of the analyst team at Wikibon, and first time guest on the program, Steve Todd, who's an EMC fellow, of course with EMC and somebody I've known for years. Steve, welcome to the program. Thanks, Stu, reunited and it feels so good. Yeah, absolutely. So, Steve, for our audience that doesn't know you, just give us a little bit about your background and what your role is at EMC. Sure, well, actually last month, Stu, was my 30-year anniversary with EMC. That includes 14 years with Data General, where I was one of the founders of the Clarion storage subsystem. So, 25 years as a software engineer, working on building EMC's products in the last five years in the CTO office, working on innovation, strategy, and research objectives. All right, so help us connect the dots, going from storage to, now we're talking about data and data governance, and all of these pieces. How does that connect to what you're doing today? So, I would say when you look at storage, the trend is just continue to move up the stack, right? We move storage systems, we move towards switches, and then we moved up into the server, and we moved up into consumption models, and now we're seeing these trends about the volume of data are driving these new digital business models, and it's hard to get a handle on what exactly is the value of data, which is why EMC, as one of the largest vendors, storing data would love to figure this problem out. All right, so George, let's pull you into the conversation here. You know, you cover analytics for many years, and that before we called it big data on this side. What about data itself? Where is the value in data? How does that fit into kind of your research? Well, it's actually interesting because it's very hard to draw a line between data and analytics in the sense that what we've learned over the last few years, what seeped into the mainstream is that data by itself has value, analytics by itself in terms of the algorithm has value, but it's, the magic comes when you fuse the two because when you have a natural sort of boundary between two sort of categories of value, no one really makes money at the intersection. It's only when it's really hard to put the two together, like with the weather channel, that, not the channel, but the weather company that IBM bought. That's a huge amount of data, that's really sophisticated models, putting it together, no one else could do it. All right, so Steve, you inside EMC have been looking at this data value piece. Talk a little bit about what kind of spurred that initiative and what is the initiative Sure, two years ago, EMC joined together with Cap Gemini and we did a survey on big data. And one of the surprising results that came out of that is two thirds of the respondents said, they believe within a few years, the revenues they'll get from data will equal or exceed the revenues that they get from selling their own products. So we looked at that and said, well, is that true? And if it is, how can we help our customers and help the industry cross over to that type of model where they're actually getting revenue off of data in addition to the revenue they're currently getting from their products? So that's why we reached out to one of the experts in academia, Dr. Jim Short, from the San Diego Supercomputer Center. And we joined with him about a year and a half ago to validate that statement and then to plan about how we would reach that result. Yeah, we had a conversation earlier today with SAP who talked about moving data from just being part of the application to really getting value out of data, how the business owners do it. I mean, George, did you look at the application stack? How's that migration? How's that change happening about data ownership and data value? Well, this, it's a really good question because for essentially 40 years, maybe more, ever since we started building apps, whether by hand or in packages, you do this thing called schema design, which is, think of it as a bucket brigade where you put exactly, you designed exactly where the data was going to go for an application and then you put these forms across it which drove the workflow or the business processes and we couldn't have changed more in an era of big data where essentially you put the data in this repository without any upfront or very minimal design and the data, as we were talking about before, when you fuse it with the analytics, out of that fusion sort of bubbles up the application and it's the data that informs how the application works and since that data is always changing, you're adding new stuff, not just variations on what you have, but new sources, the data, the application is always evolving. Yeah, so Steve, I know you've seen, both at Wikibon and through the video coverage we've been doing with theCUBE, this is a topic that's kind of interesting and crossing a number of domains. So we cover both the infrastructure, kind of cloud, the analytics, and as you wrote in your first book, some of those Venn diagram innovations where you cross some of the boundaries and re-exuse some of the existing pieces, you get some interesting ideas. So we've had some conversations. What have you seen, kind of what we're doing, what we're covering, what we're kind of unearthing in the industry? So one of the things I've noticed from the Wikibon coverage is, I noticed you interviewed Stephen Manley from our data protection division and asked him the question about data value. And as the industry comes to understand the true value of their data and as that value goes up, the need for protection goes up. So that's one of the first insights that we've seen is helping our customers or helping the industry categorize and understand the value in terms of let's keep a metadata repository that tracks value and watch that value move up and down and make placement decision or protection decisions based on that value changing. Yeah, so what does that mean as data becomes more dispersed? So it used to be, I built a data temple, now it's, data's everywhere, things like IoT are going to spread things even further out there, public cloud. What does that mean? How does EMC look at that holistically in that space? So in order to track value holistically, again, you have to keep a metadata repository that tracks that value and the only way to scale that globally is to use the same technology that you use to globally scale data, which is object-based approaches. So as we think about attaching valuation metadata to content, we think about associating that directly with the content and using the same techniques to scale that valuation metadata that you do with the content itself. Okay, so are you saying there needs to be some tie with the infrastructure because that almost goes a little bit counter to money with things that I've seen that we should be able to kind of abstract away from the infrastructure? So I think if you abstract away from the infrastructure, then you're keeping your metadata about valuation separate from your content and the orchestration of that becomes more complicated. So it's possible, but by understanding a little bit about the underlying technology, you can actually leverage some of the benefits of it. Yeah, George, I'm curious your thoughts. Metadata is something I know when I joined Wikibon six years ago, David Fleurer had been talking about it for years. It's one of those gnarly challenges that we've had in the industry. Hey, how do you see that discussion evolving? Well, so far I've seen, and I've spent more of my time up on the analytics and apps layer, but from what I've seen, the two broad choices are you have a data value chain that starts all the way back in the operational apps and it moves the data moves over to your sort of analytic repository, increasing the data lake, but also data warehouse and then operationalizing those insights. And they're not a lot of metadata solutions that we've come across that take you through that data life cycle from birth to death. And at the same time, if you have metadata solutions that do a good job of sort of slicing that up, then stitching them together is very difficult. So, and then one other wrinkle, which is that the sort of buying power for how to consume data in business intelligence and analytics is shifting into the line of business. And they, IT and the line of business have yet to come to terms with how does IT provide guardrails so that line of business doesn't sort of take the data and mangle it in a way that no one knows where it came from. Right. Can you comment on that, Steve? So I, one of the things I'm learning in this conference is chief data officers who I thought before today don't care too much about the infrastructure. I just went to a session with a CDO and a CEO sitting side by side, collaborating very closely on new types of data platforms that can support things like valuation. So I think the abstraction away from the infrastructure and the industry is happening. Maybe we over rotate it a little bit and there's reason to bring it back and have the CDO and the CIO work more closely together. Yeah, I know we've seen the last few years on this. They need to work together. I think many said the CDO probably shouldn't report to the CIO, but they will said, as George said, the kind of the guardrails send some of the operational pieces, but the CIO is going to be the one involved with the technology and the tools for that. So does that seem a decent kind of separation of power? Well, I think that the separation of power that you specified is accurate. There's also separation of power with the CISO, right? So it's the three working together and the CDO doesn't want to get too much into the infrastructure, doesn't want to get too much in the security and privacy, but needs to make sure that all three are working together. Okay, so Steve, you're going to be coming back to speak with us tomorrow for people that want to find out more about kind of the data value research that you have that aren't here at the show. Of course they can watch the other segments we're doing but where else can they go find some more information on this? Well, certainly as we learn more from the research with Dr. Short in San Diego, we're publishing everything we find on my own personal blog and other EMC related blogs, but in a nutshell, Dr. Short is focusing on what are some of the new processes and new roles that organizations are going to need to roll out in order to value data appropriately? Well, I'm looking at what is the impact of the IT architectures? And again, all of this is rolled out on my blog or on my Twitter handle. Okay, great. And we've also got a website that we're going to help pull this information together. If you go to thecube365.com slash MIT CDOIQ and have a collection of the videos we're doing here, have a link to some of the stuff that Steve's talking to. And we'll be back here with lots more coverage from the MIT CDOIQ 2016. You've been watching The Cube.


AI isn't here to take your job. AI is here to help you get your job done better and achieve more impactful outcomes faster. I use AI as well. When I think about in our marketing materials, the generative design that is in our models, which is about solving complex problems and having algorithms that can help with providing precision, accuracy, and meaning. It helps us think about what if. It helps us consider alternative possibilities. I have to say, some of the AI designs aren't as easy to spot. This'll be fun. I believe this is an outfit that he actually wore on a red carpet. I'm not sure who this is. This is generated by AI. He looked too cool. He's not rocking that. It's off brand for the Pope to be rocking that.


My name is Aaron Edwards I am the CTO for Incza, which is the parent company of WPMU dev edgy blogs in campus press WPMU dev We have more than a hundred premium plugins and themes and support services lots of cool stuff there edgy blogs It's one of the largest multi-site installs online with hosting more than three million wordpress blogs Which is pretty crazy in campus press, which is a VIP like hosting service for education So we have a lot of experience with dynamic websites hosting all that stuff One size doesn't fit all Normally when you do or go to a performance talk like this at a word camp they'll be talking more about the front end of your site and speeding that up and Caching plugins configuring all that kind of stuff and a big focus goes to full-page caching The problem is if you have a dynamic site like you run BB press e-commerce wordpress multi-site buddy press Membership sites pretty much any site where a lot of your visitors are going to be logged in They're going to be skipping that full-page cache almost all the time, which means it's not helping you out at all So today we're going to be talking about fixing the page generation time that part of that stack Now if you look at a normal request to your website when you're logged in it might look something like this You'll see this big bar Where it's waiting for your page to be generated and sent to you and then after that your browser can download all the Assets and things like that So just talking about this page generation time and how we can improve that can make a huge impact on your site Especially when inside that dynamic site now Google recommends Maximum 200 milliseconds for your page generation time and really you want to get that much lower than that as much as possible But that can be a huge challenge when you have a large Plug-in a lot of large plugins and themes that are running code all the time can be a big challenge to meet that mark Now when I first started this presentation I thought I'd be talking more about scaling out to multiple servers and different architectures like that But I realized from my own experience that doing that does not actually solve your performance issues All it's going to do is multiply that multiply that if you don't fix those underlying performance issues that you're having So to look at how to fix that if you look at that normal page Generation time you can divide it up in a few chunks that you see right here The biggest chunk is usually your database. That's the big bottleneck that you run into on your site To fix the database problems is you want to optimize things as much as possible So you want to look at your queries? There's an awesome plugin called query monitor that you can install and it allows you to analyze the queries That all your plugins are making and see where the problem areas are where you can add an index where you can get rid of that Plug-in completely because it's terrible Also optimizing your MySQL configuration so query cache is a big thing It's surprising how many people don't have the query cache enabled in MySQL But that can be a big help if you have a lot of read-only tables Also, MySQL tuner is a little script that you can run and that just analyzes your config and gives you advice for how you can improve your database also Converting tables to NODB. I say high-write tables only and not all tables because if you're running a large WordPress multi-site install Like we are on edgy blogs Converting all your tables to NODB can cause some major headaches trust me We've experienced that so we focus more on the tables that have a lot of right requests going to them So like the global tables and a multi-site install Also, MariaDB is an alternative to MySQL. It was actually a fork of it with newer code You can get about 10 to 20 percent performance boost by switching to that And if you're lucky enough to be hosting on Amazon Aurora is a new service or alternative for MySQL that has two to three times better benchmarks and speed which is pretty amazing But ultimately the best way to optimize your time spent in the database is never letting the queries get there in the first place And that's where the WordPress object cache comes in So normally PHP is talking to MySQL directly which is disk based and slow But if you have an object cache configured you can be caching a lot of those queries and requests in memory Which is so much faster a few object caching plugins are memcache and redis Those are the ones I recommend because they're memory based and if you scale out to multiple servers They can share the same cache they can work in that aspect if you try to do file based or APC Final base is just sometimes slower than not using one at all. So I highly recommend against that Alright The other thing you need to look at is that PHP chunk of the page load generation time One of the most important thing is optimizing the code that's running the PHP code for beginners There's a cool plugin called p3 and allows you to basically see is this plug-in causing this amount of resources And you can say oh this plug-in is a hog. I don't really need it. I'll get rid of it Very easy for beginners to use if you're more advanced You can use X debug and PHP and you can analyze the cache grind files and actually Profile the code and say this function is bad This loop is running too many times etc etc and on a production site Or you're getting a lot of traffic new relic is an awesome service that you can use as a paid service But it does wonders and helping you analyze and profile your PHP code Some of the things that I've run into when analyzing PHP code These are the worst offenders that I've seen First of all unnecessary unoptimized queries You can cache a lot of them into the object cache and that will save you a lot of times on WPMU dev We run a lot of our own plugins on our own sites high-skill sites So we spend a lot of time trying to optimize those plugins with the object cache Also look out for plugins like stats plugins redirection logging. I've seen oftentimes They try to write to the database on every page load. That is a big no-no It's gonna slow down your site incredibly when you have a high traffic site Watching out for remote requests So when PHP has to call like an external API like Google or what Facebook whatever it is It has to wait for response for them before it can finish generating your page And if that other API service is running slow, it's gonna slow down your site incredibly Could even crash it if that service goes down So you want to make sure you use low timeouts there that you cash them as long as possible and do not cash them in Transients even though the codex says that's what they're for Because if that transit runs out and the API service goes down It's gonna be making an external call every single time the page loads and that will crash your site like it's done to edgy bugs before So watch out for that. Also some plugins. They'll try to flush the rewrite rules every single page load Still a problem out there watch out for that and anything that tries to write to your file system directly That'll slow down your site too Also part of increasing the PHP speed is to work on that architecture directly So using engine access highly recommend it I haven't used Apache for five years because Apache has to load PHP for every single page load even for loading CSS JavaScript that kind of stuff in Gen X that's only gonna pass your dynamic requests over to PHP So that gives you a lot of headroom if you're running multi-site Make sure you're using a CDN or varnish cache in front of your media files because many people don't know this But your uploads are actually rewritten through PHP and multi-site It's a weird thing that they do but that will give you a lot of headroom if you can keep those requests from hitting PHP for media Also, make sure you're using the latest versions of PHP because you can get five five five six You can get ten to twenty percent more speed by using that than if you're back on some older version of five two And finally if you're not using the op-cache You're crazy because that is built into PHP You just got to enable it and it will speed up your request by two times at least usually and there's a few rules here That I don't have time to cover for how you can optimize that op-cache to Finally think about switching to PHP 7 so exciting on Thursday PHP 7 was released And I'm very excited to be rolling it out in edgy blogs and dev and some of the sites that we host soon It's showing two to three times higher speed than the previous version of PHP. That's a huge thing And it's very exciting. I'm excited about that. So look at switching your server to using the latest versions of PHP if possible Another thing that you need to look at once you have a live site that's going and it's at scale and running a lot of requests Is how do you monitor that site? For our sites we use stats D. It's a awesome open-source project from Etsy And we use it with the WordPress plug plug in that I've written you can see the link to that plug in if you Want to use it and it allows you without causing into any latency on your site to be able to analyze your code Analyze what's going on in your WordPress site and for our developers They can just put in a one-line piece of code anywhere in our stack and they can see oh, how long does this query take? Oh, how many times does this query fire all that kind of stuff to help optimize the code So I highly recommend looking into that if you're able to roll that your own if you're not new relic is a great service again That I talked about before it's a paid service and It's good But if you have multiple servers you can start getting expensive really fast But something to look into and if all this sounds too technical for you And you don't have the ability to hire some experienced sys admin that can take care of this for you Check out some of these managed hosts that are out here in the hallway today A lot of them implement a lot of these suggestions already like object cash using engine x etc most of them support HHVM in certain plans and A lot of them that I've talked to you are getting ready to release PHP 7 supports very soon too So talk to them about that. They can help you out with a lot of these things So thank you so much for being here the link to the slides is on here And feel free to catch up with me after anywhere today if you want to pick my brain ask questions Or check out WPMU dev where you can bug me every single day to get more knowledge about this stuff. Thank you


Alave, the only receiver to the right, two to the left. Play fake Winston, here comes Atlanta, trying to get around Jameson. Down he goes, you shall not pass. And I wanna tell you, he took more than one white shirt with him to get to the quarterback. Seven at the Saints, 36 for New Orleans, quick snap to Winston. Did they catch Atlanta sleeping? I don't know. And guess who goes down again? Arnold Ebacate gets his first career sack in his first game. And wants to throw Atlanta, trying to get there. Jameson go down for the third time in the half. Single back Camaro with Winston, pressure coming, Michael Walker. Drops Winston, fourth Atlanta sack of the New Orleans quarterback. Takes it back to the 41 yard line, lost a dime.


I have created with the Kidney Cancer Association, it's about Kidney Cancer Association, I've grown without kidney cancer. This part is about my journey and my dad's journey with kidney cancer. He died seven months ago. This is Kim Chema and that's my mission for life. The focus is a mission for life inspired by the infinity power of love. That's what I have been doing since he was diagnosed and during all his illness. And now that he's not here, I'm fighting back for him with him and with all this amazing community, learning and getting back to them with everything I learned, sharing and globalizing the amazing resources of Kidney Cancer Association. This is an amazing opportunity and I'm very happy and looking forward to share all of this knowledge with our community.


Hey guys the day today is gonna be a bit different a few months ago We offered our ad me and my brother a voucher to try out to deck our bike So we're here in Libre-Saint near Marques-Nevels in Bianchi-Pratas compound to try it out And then meanwhile we actually found out he had some some tracks an extreme tracking across Track so we came tall together. We brought our bikes and we're gonna try everything and we're gonna see how it is Check it out Well, this is a cross Fun because of your body The course itself Different setting That's it for today is a pretty fun day today. So it's really good to actually get some endurance going on and train some new tracks That's always a good a good thing and The compound is really good It's really worth actually they you have like seven euros the morning or afternoon or ten euros the whole day So it's pretty good price for what you get and what you have what you can write so in that aspect I would recommend and For the rest of it, tell me what you think about my videos and whatever The other thing that you want to see on my videos, okay? Bye


Thank you very much. I'll be presenting our work on the dynamics of multidimensional chronic poverty that we did with Rocío Garcia Diaz from Tech of Monterey in Mexico. Just as a motivation, it has been vastly mentioned in the literature about the importance to distinguish between transient and chronic poor because as we know, public policies needed to tackle each one of them can be different. Now more specifically for the chronic poor, the longer a person spends in poverty, the harder it is for that person to go out from poverty. So assistance and the greater the need for assistance and so we know that chronic poverty is important. Now among since the theoretical work of San and since the proposal of Ocurian Foster, among practitioners there has been a tendency to approach poverty as a multidimensional phenomenon and although this trend is also true for chronic poverty, to tackle chronic poverty as a multidimensional phenomenon is in its earliest stages. So that's one of the things that we want to do here. So talking a little bit about the literature and how to include time on poverty, broadly if you separate the measures I think first if we consider the intertemporal poverty measures, these measures are sensible to the experience of poverty of the individual but as a measure in itself they don't formally distinguish between the transition poor and the chronic poor. And we want to focus just on chronic poor. So in the second category I think we can mention just chronic poverty. That's the one we will focus on. And within this category you can further divide them I think in permanent income approach and the spelt approach or counting approach and we'll be using the later. Okay. Now in this paper what we're doing is we are taking one of the multidimensional chronic poverty measure proposed just recently by Alquire, Chacabarty, Pavla, San Janolet and Lonecki. We're changing it a little bit you will see. And what we're doing is we're applying sharply decomposition to it. Now well the compositions are vastly used to disentangle the driving forces of change in poverty and there are many decompositions in the literature but broadly sometimes the marginal impact of each factor of the composition sometimes it's not intuitively. It's not intuitively. Sorry. And since there are some other problems like path dependence and I think in the sharply decomposition deals with some of these problems that's why we're taking it. It also adds the advantage that is exact additive. So before we go to the decomposition I'll check I'll just revise the index. So if we see the multidimensional index as a product of the head of the headcount sensor headcount and the here and the matrix of intensity of poverty what we have in this index is that in the headcount we have a dual cutoff of dimensions and of tau so a person is considered chronically multidimensional poor if it's poor in more than k dimensions more than tau times so you need a pane of data. And what we have here in the matrix A it's it represents the average deprivation share among the chronic poor through time. Okay so just to so when we apply the sharply decomposition what we're really doing is we're computing the marginal impact of each of the factors and as they are eliminated in succession and then average in these marginal effects over all the possible elimination sequences. And when we in one of the applications of this decomposition as proposed by Schrocks is that we can divide we can have the exact additive of the between group effect and the within group effect by subgroups. So that's what we have here and the between group effect and the within group effect. So now in the within in the change in M we know that by construction this index it can be decomposed by subgroups so that's something that we will take in consideration. Bear in mind that and then when when we have the multidimensional as we mentioned it is the product H and A and when we apply the sharply decomposition we have we can decompose it to see what portion of the change in M is due to incidence and what portion it's due to intensity. And if we go back to the to the to the the previous formula and we just substitute by subgroups we we can have this broad decomposition of the demographic effect and the within group effect we can divide it in incidence and intensity. This work for the cross section was done by Roche and we're expanding it to to chronic to a chronic framework. Okay so we applied this to a penal data in Argentina. This penal data has a format of 2-2-2 which is they they sample the the individuals two quarters they they don't sample them for two and then they sample the following two so we have a panel of three of four observations during a year and a half just some and we will manage groups household groups depending on the presence of children and of elderly in the household so we'll have with it yeah we'll have those four for groups and broadly with the 2004 the of the total multi-dimensional chronic poverty the household two which is the house was with only children where they the most deprived but by 2012 they they improved a lot and in household three which is which are the households that only have elder elderly population perform the worst okay so just revising some some general know that the index and in itself in the proposition of Korea when when they propose a multi-dimensional chronic poverty they don't do it with data from Chile and and they manage and they use these dimensions so for the case of Argentina similar country we use the same and same cut-offs because just the choice of dimensions and cut-off is a big big task so that's where we did notice one of the problems that we had with income well we suspect that there was a under estimation of inflation in Argentina but we had a hard time finding an official measure of inflation but we just we someone mentioned to us that somewhat international organizations are starting to use another a private inflation index and so we will do the exercises again with with this inflation measure but just to let you know we we did this all exercise with and without income and although the coefficients of the results change the order the relative importance of the dimensions and groups don't change okay so this again general results at least 63% of the population had incidents in poverty in at least one dimension through but in the fourth period and we'll take the cut-off of three and as you can see when we are talking about chronic poverty there the the percentages are very very low so we'll we'll be decomposing an already low percentage of population so that's something to bear in mind okay so when we apply the decomposition these are the results so again the group the household group that performed the most the best was the household group two and the worst the household group three okay to see which one which group draw drove the change as it's clear group household two with responsible for 77% of the total change and household three just for the four four four percent and of this change the within group effect was the most important it's almost all of the effect was to to the within group effect as you can see 97% and with further decompose it we see that the the change was driven by incidents and not not so much of the intensity and further more by construction when you see the decomposition of a when you when you want to see the most important variables it's well it's not shocking that income is driving the change but and although the overall picture is very optimistic as you can see it is not so much for the for the for when you when you see the details okay there was something else that we did as we we have a rotating panel data so you have it interposed panels so you what you can do is you can through time you can you can follow the you can do the the sharply decomposition multiple times over time so this is this is comparing panel one with panel two this is 2003 2004 and so forth so this is how the sharply decomposition behave through time how the driving forces are changing through time and when we do that we see that there is a there is a pattern we identify a pattern of the households and we see that the household too was driving the change all the time but when we try to identify a pattern of the indicators it's much much harder to to identify a pattern so one of the I think possible implications of this is is that to use the household groups it's more informative at least for the case of Argentina and chronic poverty in Argentina to manage household groups is more informative than then analyzing indicators so these are the conclusions I think I already I said them through the through the presentation and yep that would be it thank you thanks very much


I'm really excited, it's a great opportunity for me and I didn't think I'd get this chance this early on in the season but no, it's a rose now and I'm looking forward to it and try to prepare in the best way as possible. That's going to be a packed house and I think it's going to be another feeling a bit like Cardiff so no, I'm looking forward to it, I like that kind of atmosphere and yeah, just try and soak it up and do what I can on the track. You know I'm racing the highest league in Poland, Sweden and also in the UK so you know I just want to try and hit it as another meeting and try not to emphasise the fact that it's a Grand Prix. I think that's where I went wrong in Cardiff last year and yeah, just go there, enjoy it and race my bike and yeah, try and do the best I can as I do in every meeting.


welcome again, my name is Yion Lapa, I work for Hachambo school in Amesmur, I'm a teacher at Campiliu Rika Kufu Shikon Sabasi. Ya, Itadi kiyota suon. Blend it, Patsu Pick Chu Kusini, Patsun Bikramizu, Patsun Dena Korey, Bikramizu, Bikramizu, Bikramizu, Hatsun Sumik Foto Uchuki, Kako uchuki. Tengi!