Let's see, that's right, yeah, yeah, I will, I don't have my name on it, but yeah, you've got it right, yeah, uh-huh, yeah, Ryan from Red Hat, that's good enough, yeah. Oh, thank you. Oh, very helpful. It goes to this. I get it, interesting. Yeah, it does not really fit like completely well, so hopefully, if not, flip it the other way. Okay, looks good. No, this is my first time in Prague, yeah, or in Czech Republic, first time, yeah. Yeah, yeah, a little bit cooler, yeah, yeah, not bad though. Yeah, yeah, okay, yeah, sounds good. Yeah, I got, uh, Steve at the same time? Right now? Yeah. Oh, okay. This or will the, probably not be, she would take this off. Okay, got it. I have HDMI on this side. Does the projector do more than 1080p? No, it does. So, what, one, maybe, you know, pretty little, one 1024. Oh, it's a square. Oh, okay, well, let's see what this digital does. Okay, yeah. Try another one. Yeah. Okay, probably, still a little bit different. Let's get, uh, this, no, it's 168 here, okay. Okay, yeah. Guys, thank you for coming to the presentation. Please don't forget to leave us feedback on the official website. You can also tweet and blog about the event. We really appreciate your feedback. There's also Wi-Fi. So, hello, everyone. We have the next presentation ready. So, please welcome Ryan Jarvin and from Red Hat. So, I'm Ryan from the, from Red Hat's OpenShift team. We'll be talking about securing containers on OpenShift. How many people here are using OpenShift today? Anybody? Ooh, all right, good, good. Well, hopefully this has good information for you. There's also a lot of links in the slide deck. So, I've made a URL to make this easier for you to follow along and for take-home notes, right? So, bit.ly-dev-conf-container-sec has all the links. I'll have this URL up again at the very end of the slides. But feel free to follow along on your laptop if you like. So, like I said, I'm Ryan Jarvin and I work on the OpenShift team, specifically focusing on Node.js development. And here's the broad overview of a couple of concepts we'll try to cover today. So, I'll start with a general introduction to OpenShift for folks who are new to the topic, new to containers and new to Kubernetes as well. We'll cover a brief glossary of terms. I'm going to try to speed through it very quickly so we have more time for container security topics. The first real security topic we have is creating images, establishing consistency for these images from the operational side. Then we'll go into runtime security for containers. Part of that is going to be the networking that's available to the container, setting up network isolation, or at least links to how you might set up network isolation. We'll talk a bit about SE Linux, about how OpenShift handles user IDs within the container. We'll talk a bit about image composing multiple images together using Kubernetes template. And we'll talk about a couple, briefly, some advanced topics that you will most likely want to follow up on if you're really interested in getting security done right. So, to start off with the overview, this is a little bit coming into all this terminology with Kubernetes. You may feel quite lost at first. There's a lot going on. So this is why I have links so you could come back as a future reference to what I have here in the following. So I'll start off with the stack. What are we composed of with OpenShift? OpenShift runs with a rel base. You can also use CentOS. One of the projects we're especially working on is something called... Oops, did my network drop? Oh, not a good sign. Okay, reconnected. Or not. Thank you. Old link in my slides. So this display resolution is a little bit awkward. It'll look better on your laptop or mobile device. Maybe it looks like this on your mobile. So you could learn more about Project Atomic and what Red Hat is doing to streamline the OS distribution specifically for running containers. So Project Atomic is generally a stripped-down version of rel or CentOS, similar to rel minimal. But then we add in Docker and Kubernetes, everything you'd need for running containers. And if you need to bring in, let's say MySQL, you bring that in as a container. And we've really followed all the way down this rabbit hole. OpenShift is itself running in a container that manages your other containers. So anything we add from Atomic, it's containers all the way up. Instead of turtles all the way down, containers all the way up. So Docker, of course, is our primary container runtime. We also, like looking into CoreOS's rocket spec as a way to achieve greater density within the cluster. So both good topics to look into. Kubernetes is what we use for container lifecycle management. This will automatically restart containers as needed if they crash or if a node fails. And of course, we've got links to OpenShift itself. Here's some more details about OpenShift. If you want to track the project on GitHub or if you'd like to participate in the community, github.com slash OpenShift slash origin has a lot of great information. I'll open this up really quick. There's also a releases tab here that has a lot of information about what's new in this particular release along with binaries for the command line tools. So if you have a developer who wants to contact a remote OpenShift environment or if you would like to contact your local self-hosted OpenShift environment, these are the command line tools that you might want to access. Okay, so terminology. Here's the main glossary of terms that I'll quickly loop through. First, we have a node. A node is basically a host machine for our purposes. An image, very similar to a VM image, but we're using container images instead. The main difference is with container images. The host OS is going to share the kernel as a guest container, so you only have one kernel per node, usually. Containers basically is a running image. A pod is a Kubernetes term. Let's skip down to his image. Another thing about images, there's an abstraction in OpenShift called image streams. An image stream gives you a way to, it fires events anytime a new image is added to your repository, and you can add automation based on these image stream events that fire. That's how we automate our deployments. A pod is basically one or more containers that are physically co-located. Ask me more about this topic if needed, but I'll try to get to the security stuff right away. This is basically a software load balancer. I like referring to my web services as services, so this is a little confusing for me, but for the purposes of this talk, when I say service, I'm talking about a load balancer. A route is something that allows a service to be exposed externally. If I have a load balancer for my web applications and another load balancer for a set of DB resources, I would probably want to expose the front end but not the back end, so I would give the front end a route and leave the back end for internal addressing. Replication controller helps really control the life cycle of these containers and guarantee that if you ask for a minimum of three to be running at all times, Kubernetes will help offer some guarantees around the availability of your pods. Deployment config helps automate the distribution of images onto nodes. And our build config is related to our first security topic here, how we're going to help standardize the container images that are available inside your OpenShift cluster. So here's a couple of those terms linked together in a relational diagram. The blue pieces here are core Kubernetes abstractions. All of the orange pieces are Kubernetes objects that are not part of the base terminology, but they're extended terms that OpenShift has added. Some of these features are becoming available as upstream features in Kubernetes. For example, the deployment configuration is being contributed upstream to Kubernetes. I'm not sure if it will be called deployment configuration after they merge it in. We may have to rebase around whatever changes that Google asks for on that, but a lot of development that the Red Hat team is doing is really going directly into the Kubernetes project to help add multi-tenancy and security features and advanced deployments and other automations, as well as securing the Docker runtime environment. It's not just our open source, it's the community's open source, and we contribute across the board to all of these projects. So builds. This is a link to... This is a link to the OpenShift documentation that will introduce you to builds. This will go into how we use a variety of build strategies. You could see there's three listed here. So our first build strategy is Docker build. If you have a repository with a Docker file inside of it, you could run Docker build locally and then push the resulting image into the OpenShift registry. You could also do this as part of your CI suite if you're already using Jenkins to run builds. You can have it do an extra step of running Docker build and then pushing the result into OpenShift. Running Docker build has some inherent security risks. Inside a Docker file, you'll see things like apt-get install this package or yum install this other package, depending on which base OS you're extending. In order to carry out those actions, the build script needs to have root permissions in order to successfully carry out the yum install. So there's additional risk. You're handing out basically root access during the build life cycle. So for this reason, when OpenShift updates all of their code on OpenShift Online, on our hosted service, it's quite likely that we will disable the Docker build strategy since we're not comfortable handing out root permission to random people from the Internet. It's something that if you're running your own OpenShift, you can definitely have enabled. It depends on how much you trust your developers and with random users from the Internet, we can't afford to trust our developers. So hopefully with our base assumption of don't trust anybody, we can prove that whether you trust your developers or not, you should be able to do things safely. So a safer build strategy or an alternate build strategy is custom builds. This is another option that's available in OpenShift. But source to image is the main one that we will have available with OpenShift Online when that relaunches with Docker support. So let's do a quick example if my machine holds up here. Let's see, it looks like pages loading. So I can go into one of my projects here and I'll click on Add to Project and we could show how a typical build and deploy looks. So for this particular example, I'm going to name the service or the thing I'm deploying, I'll name it www and I'm going to deploy some code that I have from GitHub. This is a Node.js project. So when you're running your build, if you're onboarding new users, it can really be this simple. Type in a repository, name it, and hit Create. Very simple to get started. If you want to see some of the advanced options, we could start someone on a dev branch or a particular feature or even enter a commit hash in here to build something specific. So very easy to customize this. Here's the route that we'll be exposing. Since this is a web service, I'll leave this box selected and we'll say, yes, go ahead and expose this publicly. For databases, we definitely unselect this box and say leave it behind internal to the Kubernetes network. So I'll leave that selected. We can also do additional automation via webhooks from GitHub, GitHub Enterprise, Bitbucket, a variety of revision control systems that have webhook support and that webhook will fire in, trigger a new build, and possibly a new deploy based on your deployment config. And in each stage of your release pipeline, you'd have a different deployment config that might encapsulate any differences between your dev environment, your staging environment. You may want to do high availability in production, but maybe not for casual developers. So you can encode all of that, some of those details in the deployment config and the templates per stage. So I'll leave this on auto deploy any time a new image is available and you could also see that I'm going to automatically rebuild any time the operations team updates the base image that I depend on. On the previous page, I selected a Node.js base, which already includes rel and Node.js is maintained by the operations team and so any time there's an exploit, let's say shell shock or heart bleed, one of these issues comes up, you shouldn't have your Node.js developers be responsible for closing that bug and saying, oh, hey, we think we have it fixed. You want to have someone from your operations team who's responsible for standardizing the base images across your enterprise and this allows you to automatically rebuild any of the application containers when its base image dependency has a change to it. So if the ops team pushes an update that closes that heart bleed bug or shell shock, we'll rebuild the application container as well automatically. We could also inject a couple environment variables here. Here's an easy way to, let's say you had a database that was outside of your OpenShift cluster. You could give it a reference via an environment variable and allow your application to then contact a MongoDB at a specific URL or something like that. So I'll hit create. That's basically what I wanted to cover. We could watch this build as it happens. This should be streaming logs as the build processes. Since Docker is a layered file system, we have the base image and now this is adding more layers on top. Once that build is complete, we'll upload the application image back into our internal registry and then deploy it across the nodes in our cluster. Let's see if I could get back to overview. I should be able to catch the deploy here. As soon as that push to the registry is done, we should automatically see, since I selected auto deploy, it should show up right here. We'll check back on it in a minute. Securing builds. There's more documentation on this topic. If you want to dig in deeper, here's another good link in our OpenShift docs. Also, since we're submitting this image into our internal OpenShift registry, if we want to have an external service, Jenkins or something else like that interact with our Docker registry, we have some notes on how to set secrets and secure that registry. Another good topic that the Red Hat team has been actively developing and has contributed to is Notary. This is a feature for Docker that helps with image signing so that you know internal to the registry. I have a certain checksum or a certain hash, a SHA value that I can identify this image. We want to know when we download the image that we can check the signature and verify that no code has changed in transit. That I got the image that I asked for. Notary goes into that topic. Here's a link for more information. My build didn't work, unfortunately. I should have kept the tab hidden. Let's see. I'll rebuild and see if it recovers. Runtime security. Now that we have theoretically, now we have an open shift container up and running, let's see what we can do. Now that we have an image built and we're ready to deploy, let's see what we can do to help secure the runtime environment. We actually have one of our Red Hat engineers who works specifically on the networking backplane is Rajat Chopra. He has a talk at, I believe, four o'clock called Networking in a Container World. We know a lot more about how to guarantee network isolation or how the internal software-defined networking works for the cluster. This is a good talk to look into. There's also videos on our software-defined networking model and some notes on how to set up SSL or TSL certificates with the route that's established into your container. These are good notes on network security. This one particularly, the software-defined networking portion. Let's see if I can find... We have a topological diagram that should have a link right about here and I think this display resolution is not going to allow me to show it. Browse? Yeah, that's not it. That should be... Where? I can't... I'm not sure where you're pointing. Oh, okay, yeah, yeah, yeah, thank you. All right, so here we can see a couple objects that have been deployed. This represents the route or the host name for my application. This works similarly to Apache virtual hosts. So anytime we have incoming traffic with a certain host header that matches the name of this route, we can pass that along to the service or the load balancer which will then pass this into the containers that will be part of a scaled set. So let me scale up the... Looks like the second build completed and was able to successfully deploy. So here's our dub-dub-dub service and I can then scale this up to four containers. We should see those containers coming online and we should see similar information on this diagram as these containers come online and OpenShift provides a flat networking space across each of these containers. So if I click on each one, we'll see more information in the right-hand pane and I could see the IP address of each of these containers. So we'll have a flat networking space within this particular project. There's a variety of project scopes here, but these pods can communicate directly IP to IP if needed. Ideally, you'll communicate via the service or the load balancer in order to spread traffic across your pods. And if you want to add additional networking isolation, we have a feature you can enable on our OpenVSwitch network which basically does a private VXLAN per project. That would prevent you from communicating across projects. So it depends on how you want to architect your solution, whether that's needed or not, depends on the way you deploy your code. But we do have additional support for network isolation per project using a private VXLAN. SCLinux is an important topic. How many of you are familiar with SCLinux? How many have it running on your laptop? All right, good for you. So I'm using Fedora on my laptop and it's pretty solid. I think Red Hat has a lot of experience with this topic in particular. There's been some pain over the years, but it's working pretty well now. And this is one of the tools we use to help lock down these container environments and create a security context. Dan Walsh had a talk, I believe, earlier in the day or somewhere on the schedule. He can go into more detail on this topic if you like. But we basically create a security context that's bound to a specific user scope. And what we try to do is run every container with a random user ID. What this helps is if we have an SCLinux policy for user number 2030 and we start up two containers with the same user ID, there's a potential risk that someone could break out of one container across to the other container with the same user ID. So we assign random user IDs to the containers to help accommodate for this potential risk. So here, if you want to see more about inside the container, we use this must run as range, and we have a range of UIDs, and we'll select one, feed it into the container. So when you're building containers, whether it's via the source to image, this should work automatically, but if you're building images externally to OpenShift, make sure you don't run as user. That's the primary thing to remember. Never allow the container to run as root. You don't want your containers running as root, and they should allow random UIDs to be assigned if you really want them to work well with OpenShift Online. OC is our command line tool. If you run OC get SCC, you should see a... My terminal is not available. OC get SCC should give me a list of some of the security contexts that have been set up across my OpenShift cluster. Next topic we'll go into is composition. Now that we have one service, one web service running, I shouldn't say the word service. Now that we have, you know what I mean, one web service, one application that I've deployed, we may want to add a database. We may want to have multiple services that compose multiple microservices that compose a larger application. So you can help compose multiple containers together using templates, and then configure these images to talk to each other or to be aware of each other using environment variables. So if I wanted to set an environment variable, I guess first I'm going to go into one of the containers we have here. This isn't the one I deployed. Here's a container we deployed. I should be able to check the logs and get a live terminal. I could see that inside this container, ProcessID1, well, if I could scroll here, ProcessID1 is actually npm. So I'm clearly inside a container. It's not an init script or something like that. And here's a random user ID that I've been assigned inside the container. Also, I set a generic key value, right? So if I grep for key... Oops. Here's the key and value, the generic key and value that I configured during our build phase. So this could be a connection string to a database or something else that my application needs to be aware of. If I wanted to set a new environment variable, I can update the deployment config or the build config using a command like this. And this will go update the Kubernetes configuration file and automatically redeploy my containers with the new configuration. Templates. This is one of my favorite topics. I almost think that these would be better named as maybe installers. This really encompasses everything that your application is comprised of. So let's look at an example here. I've got a project on GitHub that includes a template. So this project uses Node.js with a RESTify framework. It uses MongoDB as the back-end environment. And on the client side, it uses leaflet.js. So I have a file in here we could look at. Here's the template file that I'll be deploying. So there's a couple things that are unique to templates. They all have a template name. You can set an icon in here and then make this template easy to install to developers. If I install this template in OpenShift, I'll get a one-click launcher in the web interface. So I'll install this and we'll see what it looks like after I install. A template will also include a list of Kubernetes objects that will then be posted to the API as the template is processed. So the processing for the template is to substitute in variables. So you'll have a parameterized injection of config into the template. We'll see an example of what this looks like as well. So this is generally what some of the data might look like that's being fed into Kubernetes. Here's our deployment config object and it's going to get a particular database service name. It has a list of triggers or change events so anytime the image changes, we'll deploy. We could set a default number of replicas here and set up ports and environment variables that will be used. So for this MongoDB environment, injecting a MongoDB user, a password, a database name and a couple other details, we'll also inject the exact same configuration into our front-end environment, the Node.js web server. That should be, here's the front-end environment. We're passing in the same credentials. So let's see if I can spin up this application really quickly. Actually, I think I'll flip through the rest of these slides and then close with the demo. A couple other topics. Other things you might add into a template. If your application requires a persistent volume or any kind of disk, your containers are meant to be stateless, easily destroyed, easily recreated. So if you need storage in the template, identify a volume or a persistent volume claim and then basically detail that in the template and make it available to your application. Other advanced topics that you're going to want to look into for security is there's something called Secrets. If you wanted, let's say, your SSL configuration, I'm not going to publish all of that via an environment variable. What I'll do instead is create something called a secret. That secret will then be mounted as a file into my container. So that's how I would put in things like SSL config or other details that might need to be injected into a container. Service accounts are a way to delegate authorization into a cluster. So this is another good topic to follow up on. And finally, if you want to validate your containers or do security auditing, this open SCAP project will help validate and review the container content, check for vulnerabilities, and possibly reject a deploy if it doesn't pass the test. So there's a couple ways to try OpenShift. You could sign up for OpenShift Enterprise. We've also have a hosted environment called OpenShift Dedicated. Please feel free to sign up for either of these environments. If you're just interested in the upstream code, I showed you the origin releases earlier. We also have an all-in-one VM. If you'd like to run the whole cluster locally, just with vagrant up, this OpenShift.org slash VM has a virtual box image in a vagrant file. Also, if you'd like to deploy a large cluster, the OpenShift Ansible repo has playbooks for deploying OpenShift to Amazon, to Google Compute, to raw machines. If you have raw machines anywhere you like, Ansible is our deployment tool for large environments. The environment that I am using today, I set up using this particular Ansible playbook, this one command. One command 20 minutes later, I had a cluster of 10 machines. It should be very easy to set up. Feel free to file bugs or issues if you've run into any problems along in the process. More great links for you. If you'd like some free eBooks courtesy of Red Hat, we've got an eBook on Kubernetes, an eBook on Docker security, and more great documentation online, official training courses from Red Hat, and more information. If I have a minute left, I will risk running this project. Let's see if I can do a quick deploy here. I am in the demo project. Switch to demo. I will run oc create on our template file. This will install the template locally into the project that I am using. Now when I run add to project, I should be able to find on this page a parks, should be a project here with my parks application. Anyway, parks should show up as a one-click, kind of like this, with a Node.js MongoDB example. I'll click on this because this will have a similar example here. We can substitute the repository URL. We can add in the database user, database password, and database name. The result that we'll end up with has the front end and the back end fully configured. It will end up looking... Let's see if I have a backup. Yeah, I don't have a backup of it. But if you'd like to see this demo in the Red Hat booth just outside the door, I'd be happy to show you out there. Thank you. That's all I got. Hi, Pep. Test. I'm going to the... workshop. Yeah, it should be interesting. I don't know what this will be in the open stack of the second containers. That sounds quite weird. That sounds interesting as well. Open stack in containers. I don't like to say that. What could go wrong? Yeah, yeah, yeah. That sounds like a really good idea. So where is the open? A113, but I don't know where it is. A113. What is this? D. I think you know where it is. Okay, if something... Bye, Pep. Hello. Hello, everyone. Just a reminder. Please, if you like the sessions or you don't like them, which I hope won't happen, leave some feedback on our official website. Please also tweet and blog about the events. We have a competition for the best blog post, so you can win some prizes. Basically, that's it. Thank you very much. Look at the swing for the speakers, like the hoodie and the bag. Is this your first time here? Yeah. Cool.  I am, yeah. Sorry? What's this monitor to? I think we can actually switch them here. No, it doesn't matter. I'm not sure. Hello. Sorry? I'm searching for an organizer. For Jan Blecha, you mean? No. David Kaspar? Someone from the technical team. Nobody here. Is there a time around? I don't know. Maybe. But don't worry, we'll time you, and we'll be showing signs when it's 10 minutes left, 5 minutes left, no minutes left. No, I didn't think so. All right. So, we have the next presentation ready. Please welcome Ryan Halisey. Thank you. Okay, perfect. Thank you, Jay. So, hi, my name is Ryan Halisey. I'm a software engineer at Red Hat. I've been at Red Hat for about a year and a half now. And my specific focus at Red Hat has been around OpenStack. I've been working at OpenStack for that entire time. I've specifically been working on containers for about a year now. The container technology really has become a hit within OpenStack, and it's something that's really been growing. There's been some projects around it, and it's really started to take off and be successful. So, today I'm going to cover...


Y ddweud I'n caelwstynnych because getting a few... I've been a long time gym trainer, always into my support. I just gain every day after work hitting the gym, hitting the weights. It's an usual thing that you do from 18 through the 30. Getting a little bit older now? Getting a few... Some pains. Wanting something a bit different. Just didn't want to hammer my body every night anymore. Focus has changed as I get older. It's a bit more health and longevity. Calythenics was an ideal fit for me. Benefits of Calythenics for me Just lots more fun Grinding out workouts week after week Same split routine over and over again Just the variety It's helped me to maintain my body Good shape, the strength and the flexibility Also the fringe benefits as well So I've got two young children I love to get out and explore the world with those Literally just in the playground Swinging around on the monkey bars With the good of two kids Just fantastic fun Feel more alive Get to just the experienced life Much more at a different level Where the school of calythenics have helped me the most I think literally just getting that initial Foot onto calythenics in the first place Two guys come across really Just really transparent and honest Content is kind of Fantastic It's just so easy to follow I've recently become a member of the virtual classroom as well Really bringing that kind of community spirit So that was one of the main reasons I joined I've done a couple of workshops with the guys as well Just easy to follow There's some great people attending the workshops as well Some in the UK, some abroad Just had a great time So since I've started with the guys School of Calythenics The first thing I progressed to was backleaver That was perhaps one of the easiest ones to come to me Which I found quite surprising Because it's a sad desk all day So my job working at a computer Always kind of hunch forward Needed to do a lot of work To get into the right positions To pull off that move But backleaver is the first thing Progress the backleaver on the bar in the rings Then I kind of wanted to do something a bit more exotic Aiming for the kind of handstands Kind of getting there Still has still a lot of work to do But yeah, human flag was another one I've got quite a lot of strength from my background But yeah, just getting into the right positions Can do a very basic human flag Need some further progression But yeah, got so much into it Recently that I've built my own rig In the back garden now as well And yeah, something progressed further Into my ring muscle up, my bar muscle up So yeah, got three or four things bubbling away Couple of those nailed Couple need a lot more work But yeah, just fun going through the process


Welcome to the AI for Good Global Summit. I'm now going to be talking to Erica Martins and Dr. Johnny Drain in front of me about AI and food ethics. So I'm going to be talking to you first. You're with Studio of Martins. Tell me about this. Erica and I are working on a project, a platform that we're building called Gaia. And what we're really interested in is the ethics of AI as they apply to food systems. Food systems are complex. AI can help distill some of that complexity and make food systems better, more circular, more regenerative, better for the planet, better for its people. But we need to make sure we're having conversations around the ethics and the biases within the data sets and Erica and I are on a mission to nurture that conversation. It's really interesting because we haven't heard much about that in terms of food. We can't do without it, right? So we need. And what are the kind of ethical issues that are at stake? Exactly. Erica and I started talking about these issues about three years ago because we felt no one else was talking about them. When we look at the amazing ideas in the conference center today, we see a lot of technology and it's brilliant, made for or by people who often are white, they're men, they're old, they're from developed countries, and they're familiar with urban areas rather than rural areas. They're also human and there's lots of brilliant technology and we're not knocking that, but when we think about food systems, there's lots of other important voices that aren't those things that we need to make sure are represented in any of the technology we use to improve food systems. And the last point is quite interesting about human. When we think about food systems, we're reliance on animals, on forests, on networks of fungi that nourish the root structures. And we want to make sure that there is not just human-centered design or human-centered AI, but that we account for and incorporate, include all of these non-human, important agents that support the food system and the worst ability to feed itself. So as you've been talking around the conference about this, what's the feedback? Feedback's good. The feedback is largely that people are not thinking about this, but when we explain to them what we're doing and why we want to do it, they say, ah, yes, that's really important. How can we help? And that's what Gaia is. It's a platform we're building in its early stages where we're gathering support, nurturing the conversation, looking for money also to support our work. Fantastic. We're interesting. Thanks very much. Thanks. So picking up on our conversation on food, ethics, and AI, I'm now joined by Erika Muthins, also from Studio Muthins. We're an interesting subject your colleague was talking about. So why is this important? So I think it's really important when we talk about the future of AI that we are creating guidelines, that we are also bringing in diverse interdisciplinary team in these discussions, that we have creatives, that we have people from the food industry, technologies, and ethics to really build these guidelines because these are really setting the basis of our future to come. And when we talk about food system, it's a very complex system. And we need to bring transparency to the consumer for everyone to actually make better decisions. I really believe that everyone wants to make the right choice and not only for yourself, but also for the planet. So that's why we are really looking into how we can create a more Earth-centered design principle and not really looking from a human-centered design perspective, but really bringing in kind of a different holistic mindset to these discussions. And with a specific issue of hunger, how can you help there? So hunger is, you know, if you kind of look at it, there are actually enough food being produced in the world today. But it's actually the problem of the distribution. So we truly believe that AI can help, you know, optimizing these food systems and also the distribution. Give me an example of how. So, you know, if you look at the whole food supply chain, it's a very complex kind of opaque system. And if we can really optimize it and kind of augment and see all these different, you know, what's being wasted in the whole food supply chain, I think that can really help companies, but also individuals to better understand where their food is coming from, who is producing it, what are the ethics behind it, and how we can make, you know, informed-based decisions out of this. Great, Erika Muthins, thank you very much for your time on that. We'll be talking about this, I'm sure, a lot more in the future. Thank you very much. And we'll have much more on AI for Goods Global Summit coming up right here.


All gather does the same, but then all the processes get the information. So all gather is like gather, but instead of the information going to the single processor, all of them has it. And all to all is basically a matrix transpose. So if at the beginning each process has one row of data, after the all to all, each process will have one column of the original data. So this row here is actually a column here. And this is the one that takes all to all is the collective call that actually is squared based on the number of communication. That the one that the number of messages grows as the square of the number of participants. So what do you need to know about MPI? MPI is the most important thing that you need to look into and it's something that you will have to work with every time you sit on the HPC. It's available on all kinds of hardware, including laptops, not limited to HPC systems. And all compute nodes in the HPC system are close to participate in a pool. And MPI decides which copy of the processor, which nodes and core to send. So the each copy of the process identified by its by a number is called the MPI rank. And the rank is usually written in the log file, so it may help trace some kind of faults. And similar to thread affinity, the MPI system may have a way for you to specify process feed. So which rank goes to which column, which node.  We'll see you later in action. On the HPC system, this is usually not the case because it happens for job scheduler like slow, but yeah, in any case, this command will appear somewhere. Now the course of a node can also be used to API tasks instead of open MP threads. So if we have four nodes with 16 cores each, we can do the following. Let's say I want 16 threads on four processes, so I only have four distinct processes, but each of them runs 16 different threads. Or the other way around, I have 64 different processes, each one of them running one single thread. These are both possible as well as all the intermediate like two by 34, 32 or four by 16 or something else. And usually the first one is more beneficial. The rule of the term here is try first with running as much MPI processes as there are nodes, and inside each node run as much threads as there are cores. That's usually the most beneficial, but not always. You have to try. So what you need to know? You need to know the number of nodes available again and the core socket configuration. You need to know how to run MPI jobs, particularly for the HPC system that you're using, the batch scheduler syntax. And how to query the scheduler for the status of your jobs. You need to know your software. Does it support multi-threading? And if yes, what is more beneficial to make? As I said, the number of ranks equals to the number of nodes and the number of threads equal to the number of cores. If it doesn't support multi-threading, then just the number of ranks is the total number of cores. And lastly, you have to know the limitations of your software and the scalability, how it scales. So you don't have to waste any resources. Because that's not really what happens. Also, as I said previously, there are GPUs sometimes on some of the machines and the compute node may have quantum accelerators. The main problem with GPUs is that they don't have access to the same RAM as the CPUs. So if they need to work on a task, you have to transfer the data from the CPU to the GPU. And that piles up on top of the MPI transfers that is already needed between the nodes. And some systems support direct GPU to GPU transfers, which might be faster, but not always. Still, you need to ask for it. If you're on a system that has multiple GPUs or multiple nodes, you need to make sure that the software does or does not support direct GPU to GPU transfer because that can be faster sometimes. Now, this last question, the limitation of the software and its scalability. This is a very important question and I will now turn my attention to the last part of this lecture, which regards strong in weight scaling. So let's first say that a algorithm of steps not much different from a cookie. And some of the steps are independent of one another, so can be executed in power. By independent, step I is independent of step B, if step B cannot influence step A's input in any way. There is no data dependency between them. Now, the portions of the algorithm that can be parallelized is called the parallel regions and the rest are called the serial regions. So some things just cannot be parallelized. Like a blunt example is that if you take several pregnant women, they cannot deliver a baby for one month, no matter what you do. Now, the more time an algorithm spends in parallel regions, the better it is suited for HPC because, at the end, that makes it more scalable. When we're talking about scalability, we usually introduce something called speedup. And the speedup is 21 over Tn, which T1 is the time for running the one processor, and Tn is the time for running it on end processors. So let's say something that when I run it on one processor, one core, let's say, it takes 10 seconds, but if I run it on cores, it takes one second. Then the speedup is, and this is the ideal situation when s equals n. So independent much n is, if this is equal to the number of processes, then we have so-called linear scaling, and this is the best we can hope for. But this is really a shift in practice. It happens for some small n sometimes, but s is actually bigger than n, so speedup is, let's say, 110%. This is due to some kind of caching here and there, and it's fun, but as I said, this usually happens for very small n, too, or something like that. Now, Amdahl's law is something that says what speedup can we expect from a program in which p is the portion of the parallel regions. Let's say that 70% of the program is parallel, then the speedup that we can expect is this. And as you can see, it depends on p and on the number of processes. Now this is valid for fixed workloads, so the thing here is we have a task, we have a problem that we keep fixed, and we try to throw more processes at it. So we try it on one processor, then we try the same problem on two processors, on four, on eight, and so on and so on. The dependence of the speedup from the number of processes and the fixed load, so for the same problem we are trying to solve, is called strong scaling.  And I want to point your attention to the green line. Now the green line says that the parallel portion of the program is 95%. And even if the parallel portion of the program is 95%, so only 5% of the program is not parallel, but it's serial instead. We can see that soon we don't have a speedup that can go above 20%. And even if we run it on 65,000 processors, it will still be 20%. So it will be a huge waste of resources to try to run it on 65,000 processors. I think this one, let's say for eight processors, it has a speedup of 6, which is okay. For 60 processors, it has a speedup of 11, which is again more or less okay. For 32 it has 13, for 64 it has, well, 15. So now somewhere around here it's just not beneficial to do this anymore. You just need to stick with 60 processors and not try it on a bigger number. And for even Starker example, I want to show you this is something that I have generated with myself. This is the portion of parallel regions here is 99.9%. So only 1,000% serial regions and this cannot go above 1,000, sorry. The speedup cannot go above 1,000 no matter what we do. So even on 30,000 processors, it's still 1,000. And it's the same on 25,000 processors basically. And this is because when n goes to infinity, s goes to 1 over 1 minus p. And so, yeah, it's easy to just do the math yourself and you will see that in that particular case if p is 99.9%, s goes to 1,000. So this looks very helpless and discouraging. And it is. And the communication time, which is most notably counts towards the serial regions. So if you have any communication in the program that is not hidden behind some kind of computation overlapped, there is no hope for strong scalability. And I can see we're almost out of time, but I will just say this. I need to also say about Gustavsson's law and the weak scaling. And as I said, I'm not always when there is a fixed workload, so we don't change the problem size, just throw more work at it. There's another way to utilize the resources and that is to solve bigger problems. And this is where Gustavsson's law coming to play. And this is valid for a fixed time, but the workload and the number of processors vary. So we have a fixed problem size per processor. So if we started with, let's say a problem that is one unit big and run it on one processor. But then we have a problem which is two units big, but run it on two processors. Then we might expect to have the same to finish in the same time. And if we have a problem that is 128 times bigger, but we run it on 128 processors, we might as well expect to have more or less the same time. Again, this depends on the amount of parallel regions in the program. P is the same as before and N is the number of processors. And this works, this seems a little bit better. So if we have 90, this red line here at the top says that if we have 90% of program is parallel regions, then on 120 processors, we should expect a speed up about 110, which is more or less good enough. So, yeah, weak scaling is generally easier to achieve. But then if the software uses some kind of naked collective MPI, Alt-All, for example, weak scaling will be great as well. Also, not all algorithms are created equal. If an algorithm is complexities and to the third, then we only get 26% of speed up upon doubling the resources. So not all algorithms behave well. Usually the ones you will need to do behave well. So at some point it becomes worthless to throw resources at a given problem. And it's up to you to be able to judge that limit. And you will need to perform scalability tests. Run your simulation, but with only a limited number of time steps, like if your simulation requires 50 million steps, don't run it with 50 million steps. Run it with 100 steps or 1000. But then run it in different configurations. Different number of threads and MPI tasks. Increase the number of cores and nodes. Find out that it doesn't make any sense to increase them anymore. And when you have this scalability data, then you know how much resources you will need. So don't waste any resources. And then that's how much resources you will request for your final simulation. Well, that was for me. Thank you for your attention. If you have any questions and I'm sorry I'm a little bit above the time limit, but yeah, it was a big topic. Thank you. Thank you very much for the systematic and nice explanation, thanks for the good advice. A little bit over the time limit, but on the other hand, facing the lunch break. So I guess we have some time for questions. Here is the first one. And using open MP and or I on a workstation on the Linux to optimize performance for instance using Roman. EG C on core with N CPUs and GPUs. Or are they only beneficial for use in supercomputers. Yes, sure. If your workstation or a laptop or whatever. Supports yes multiple cores. Why not. That's totally acceptable. And that's what you do that's what gets done usually because. Well for for the limited number of course you have. For example, when we do some kind of programming in Gromax, because we did that previously. At least up. For a rate for a rate PI tasks or for a rate threads. We kind of perform this. Scalability. The laptop them on the workstation themselves, but when we need to place the scalability for a larger number. We just need to go to an HPC machine because they're just not enough course. Definitely use MP and open MP and laptops. Just don't go over the number of course you have. Okay. Then the next question from our attendees. When would you recommend close or. By the. Bends on the software. I cannot recommend one over the other, but sometimes. If you just have to try which one works better software at hand, because you don't know. What the programmer did when. When he rolled that region. So it's sometimes some software work better with close other we spread, but it just depends on how the code was written. So unless unless you have some kind of. A documentation from the developers that says use that credit. Or the other you have to experiment. Okay, thanks. I don't see any other. In the chat. So. Thank you once again.


And welcome to the 2pm update with me David White on TFNN. So we're down about 3 tenths of a percent on the S&P about 2 tenths on the NASDAQ, dials off a little more than 6 tenths, rustle about the same, crude oil down about 1.2 and let's call it 1.25%. Gold rather flat at 181780 is the last tick I have up here. So what do we have going on in this market right now? Well certainly the highlight of the day is Jay Powell, his higher and longer tour hitting 50 cities across the nation. He also used some words that I thought very interesting. Generally when you're talking about interest rates I think a better word could be used than terminal. Man, the terminal rates, I know that he means the highest but I think it also kind of means the death of the economy. I think I would use some better words than that but well we've had a little bit of a dip here. We really don't have much in the way of support in this market. It acts a lot more like one of the little paper cut that just won't quit bleeding when it's kind of been the market so far today. Everybody thinks that they found some kind of low. Actually the next logical support has been around $395 on the SPYs but that is kind of faded throughout the day back down to about $394. I thought we'd hit maybe $395 today but not so much. Now of course today is options expiration, the delta neutral day for expiration. So expect the unexpected but I think we're going to continue to probably just have kind of a slow market bleed here for a while. Hang on for the really big show in a few minutes.


What's up guys we're back with another epic viewer mail video this one's going to be pretty fun We have a lot of different things so before we get started the giveaway I'll be giving away these three two magicians force cards and one dark crisis So three potential original print cards All you have to do is like this video be subscribed and let me know your favorite piece of mail and let's get into it All right, we're gonna we have a ton of different envelopes So I usually wait for a bigger package before I open them up So we have a lot of little ones a lot of little ones showed up By the way, you can send me mail with the po box in the description Just click the description and you'll see where you can send the mail Whatever you want if it's something you want to be opened if it's a note if it's something like that You guys will see a lot of examples here So if you guys are interested in doing that just check out the description down below and let's go ahead And open this thing up. Let's see what you guys have sent us Usually there is a note included to kind of describe, you know, who's it from? What's if like reason they sent it all that stuff? All right, we have what in the world happened here It's burnt ruckson 34. He sent it on 4 13. Okay. What's up, bro? Hope all is well with you. I hope you enjoyed the two cards that I pulled from for Yu-Gi-Oh restful boxes. Cool Even though they are commons This card was one of the ones that isn't most likely to be pulled as a common. Oh, okay, cool Uh-oh. Uh-oh. Oh no, we're gonna lose it Don't rip it off. Okay. Wait, maybe we can see if we go like this. There we go They are in korean because as you know, I am in korea due to me being in the us army I will be back in the states in july of this year continue Congrats on how far you have come within the community. I'm very proud of you Keep up bro and never stop chasing the dreams. Hope these cards make it on a male video on your channel You did it. You made it so I can see your reaction Take care ruckson and keep up with the amazing work the one and only master of blue eyes white dragon Okay, he sent us two cards. He says they're commons. They're in korean. What could they be first card? Oh the legendary rush dual korean pakenio moth Absolutely epic. That is awesome. Is there a chance? Is it possible? Do they have a chigalates? Oh, it's another pakenio moth. Okay. I was like that'd be crazy if they had chigalates already to korean This is a version. I don't have pakenio moth very awesome. Thank you master of blue eyes white dragon. That is so cool Okay, next envelope. We have this one's thicker a little thicker here. You know what I'm saying? All right, here we go What is inside? What will we pull from this envelope? And hopefully yeah, there is a note. Okay. Okay. We have what is this? Cut this. Okay. Look at that instructions. I like it. I like it Nice and easy. I wasn't sure what to do and I just followed the instructions. I saw that works Inside of this packet. I have a very rare card. Please reveal last if possible. Wait, okay reveal last Okay, so that that means to go till later Well, I think I can read this first, right? Hey rucks 34. I hope that you Are having a good day so far inside or some cards for my collection. Okay first We're gonna read these or look at these from this collection And this I think is is this a card shop or something that address. I'm pretty sure it is Yeah, go to cards or something like that. All right, cool And he sent us some cards from this collection. Let's see what it's like a mystery pack. This is exciting We got the bickery box Ooh, that is nice. Okay Ooh, pankret tops All right, what is this? I can't remember what this is Oh, there's another version of it These armageddon knight or something like that. I don't know that guy Green maju day isa invasion of chaos awesome red archery girl from spell ruler falling down. We got some classics in here dust tornado Mystic tomato. It's a nice card from DASA Ooh, the brother of the fire first ram Petit dragon two mouth dark ruler. Okay. All right Awesome mystery little pack there. That's pretty cool. Okay. Let's reveal what the uh, it says a very rare card Do not reveal to the end Okay, wait I got a peek of it. It looks like a normal monster. I have a guess. What could it be? I'm guessing that we have another legendary pecanium off Oh That's a dark beginning one. This one has been through the ringer. It's seen mini duels Many mini duels were used with this 300 attack pecanium off. They definitely I mean this is just like a mirage It's just you think it says 300 it really says 3 million just letting you guys know So thank you very much. Did he ever say his name never said his name, but go-to cards is on the bottom So I guess check out go-to cards never said the name though. So I'm not sure who it was. Okay Next envelope we have This one is from a fellow yugi tuber. So let's see what is in here What did they send us I assume there will be a note. Oh, yeah, here we go cuya gold link on youtube Go ahead and check him out guys. He has a pretty cool channel. He goes over some collections that he finds on ebay It's pretty interesting. He has definitely sent me some funny videos before Okay, oh wow, this is it. This is a note right here. Okay, let's oh, we got a booster pack in here Let's let's not mess around with that yet ruxent. I've been watching your channel for a while now and really enjoy your vintage content That's how we do it here vintage content. I'm putting a few items that speak my message for you to share One is a repack of ots pack. Okay This is so everyone knows not to buy single packs in ebay unless you know trust the seller That is usually a good idea occasionally. You can get some lucky some lucky breaks to get something good But single packs are pretty risky two is a hollow no name that I made with acetone at home This is one so everyone knows not to buy no name hollows online 99.999 of the time They're not misprints just a seller wanting to boost prices three is pot agree because no one knows what this card does Good point. Good point. I'm wondering what it does Please check out my channel so you can learn about buying and selling you your collections and avoiding scams like these online Your fan cuya gold link appreciate you brother. I also left a little hollow on the no name so you could tell I did it Okay Awesome, so you guys can go ahead and check out his channel. That is his name on youtube the same name He uses here, which is cuya gold link Let's go ahead and see what he's saying. I mean he told us kind of but we're definitely gonna you know Check it out now. So it's gonna be more fun. All right Let's start off with these single cards, which are the misprint that he created so you can see he Removed it from there. So as you can see you see kind of there's that circle around That's where he obviously was rubbing it off or whatever So if you see someone ebay and you just see oh a no name card, you know It might may or may not be real But if you can get to get in the light you can sort of tell that it's oh, okay It's something something's messed up there. All right, then we have the pot of greed. Who knows what it does I'm not sure very it's just complicated text very complicated I'm not sure what it does guys, but you guys can let me know in the comments if you guys know what it does I I'd be surprised. You have to be really smart, but uh next let's open this repack OTS. What is this 11? All right, let's see what we were repacked We have the token stampy. It is a three pack three pack pack spiritual forest And a thunder of rulers. See check that out These are not even from the same set. We've been scammed No, I'm just kidding. I Title of this video should be scanned by a viewer. That would be pretty funny actually I'm debating doing that. It depends on what happens in the rest of this video But that's funny. So thank you cooie gold link. Let's move to the next one. All right next one up. We have This one seems like it might have a note. That's all the way across so we don't want to cut it Here we go. This one's from fredrick. I believe this is fredrick from discord. So we're going to find out Ruxen epic videos bro. It inspired me to start a channel pulled this card. I know I had to send it your way I know it's not your favorite card, but you know, you don't appreciate. What does that mean? What what card is it? Keep doing what you do and look forward to future videos Hope to do a box battle with you fredrick. All right. What did he send? All right, what did he send that uh my not my favorite card? Okay, we got a guess. All right. There's a few cards. There's a few options here first um What card do that we pull like all the time or something? And we keep pulling it I've for some reason my first my go-to is coach soldier wolf bark. I'm thinking of that susan no woes one That we pulled a ton. Um Oh, maybe like uh, maybe like uh The cyber the roid ufo roid maybe that something like that. That's what i'm thinking right now I'm trying to think what else I don't like. I don't know it seems like okay. Let's see if we can guess from the back all right Let's take this out and let's see if we can tell if it's a newer older card This seems like a newer card so I don't know This is my favorite card. What do you mean? Did I read that wrong time out? He did say was my favorite card. This is my favorite card. It's the medocé Finally someone sent in chica lattes so many bicanho moth fans But someone repping the chica lattes. You gotta love to see it. Okay, so it is one of my favorite cards very interesting Thank you. Frederick. I appreciate it. Next up. We have a legendary package from the one and only the man himself I don't I doubt he put anything in here besides the card, but uh If he did we'll just we'll just make sure he didn't first Okay, we have a card. Let's let's make sure we don't ruin it. All right. Okay. There we go This is from the legend himself gauge so gauge He's doing a video where he's doing trades with people and he asked me if I wanted to do one and I was like, sure dude Let's make a trade and he needed the pankratops collector rare that I pulled from ancient guardians So he showed me some cards he had and I was like, you know what this card looks amazing, man. Hit me up with it Summon skull from retro pack. So this is pretty cool. It's just a super rare, but it's from retro pack one Let's check out the condition on it. Okay, so the front looks pretty good pretty natural for retro pack The backs are what really kill you. So oh, yeah the back definitely not in great shape, but you know, it's retro pack That's how it goes Pretty awesome card though. He traded me this for the collector rare pankratops pretty awesome He's gonna do a video about it with multiple people doing the trade So I guess I'll be in there for a little bit. So make sure you guys go check out that video I'm excited for when he posts it pretty awesome trade with gauge a wish him luck team gauge is going to beat cmo Eventually, but here pretty nice awesome trade. I've never owned this retro pack one card Okay, and we have and here's an actual package not envelope. It's a package. We're serious here All right We have inside Ooh, what is this are these card sleeves card sleeves Wow, these are amazing. Look at these Did they not put anything in here? I thought they were supposed to put something in here Because I'm pretty sure that there's this is goes with a website or something I'm gonna try and pop this up on the screen. I think they emailed me But why is there only the sleeves in here? Why is there no, uh, there's nothing there's no like business car There's nothing so I I'm gonna try and show what it is. So you guys can check it out I think I have a discount code and everything. I'm pretty sure that's what this is So they sent me these epic sleeves, which are like really cool of these yugio size All right, we got these magical hats from uh champion pack six And oh look at that yugio size sleeves. Oh, this is epic These look so good. They look so good, but But they didn't uh, they didn't send me anything. They didn't I guess I don't know I they didn't send me like I thought I was just supposed to open it up and they would be there, but apparently not Wow, I mean these are really cool. That's tons of awesome sleeves So, uh, yeah, I'm gonna pop that up on the screen if I can figure out who these were from I'm pretty sure I know, but Uh, check them out in the link in the description. I guess if we figure it out You guys can buy some epic sleeves, but kind of weird that they didn't send me a business card or anything. All right Here we go. We have another note here. It's another package. I opened this up a while back and I just hadn't, uh, put in a video yet Thank you for staying consistent on uploads. It makes you the best you youtuber. Thank you very much Keep it up. I've included several new top loaders. I recently bought from shipping shield. Awesome. That's great Figured you could use it for shipping cards. Yeah, I do that every day And one of the shipping shields is a lost art promotion card for you to add to your collection And in the other one has several cards to be included in the video giveaway on the road to 100k subs That's awesome. Looking forward to it. KD. Kevin Durant sent these in Epic Kevin Durant is supporting the channel. No, I'm just kidding. Okay All right, KD. Let's see So shipping shield sleeves and I'm not sure what these are. So, uh, that's what this is, I guess This it looks crazy. This is awesome. It's like a top loader, but it's made out of cardboard Interesting. I've never seen these before Can you just like ship these like this like envelopes just Ship it. Hmm. All right. So, uh It's supposed to be what is this? Oh, so shipping shield. I guess is where you got it from So that's what those are inside of one of them He's like, please find this needle in this haystack. Oh, look at this Inside of one of them. There's a promotional card. All right, not in there. Not in there. All right. Where is it? Where is it? Is he just saying this watch is just a big meme. He didn't actually send anything He just said that so I looked through all the different ones We're what in the world? Oh this one. Maybe this one Oh, there we go. Okay. I found it. It was at the bottom Which I guess was the top for him But the bottom for me because I went, you know from the opposite direction very confusing, but there we go Okay, we have a giveaway For you guys. We'll add it to the giveaway What is it? How do you even open these? Oh, okay. There you go. All right. These are some uh, oh ts tournament pack 11 cards We've got super rares. Nice Sit at a whale. Ooh, secret rare. That's pretty cool Nidhog Generator boss of ice So there is your potential giveaway for this video as well So make sure you guys like the video and of course be subscribed Let me know in the comments what you think about this mail. All right, and the one for me Lost our promotional card. There's a lot of good ones. What if it's like dark magician girl or something? That one That would be big Ooh offerings to the doom. That's pretty cool. That's that looks a lot different than the the english one I'll say the real one, but this is I guess the real one. Okay. There we go. We got it out. All right That's really really cool offerings to the doom. Thank you very much kd. All right. That's it for this mail video I hope you guys enjoyed it. There's a lot of really cool stuff I appreciate all the stuff that you guys sent in if you guys want to send something in check out my po box Down in the description. You can send stuff there. You can send packs You can send single cards like this you can send notes Please probably send a note. I want to know who it came from if you just send it to me It's great But like I kind of want to know who sent it, you know Even if it's anonymous just write something and put like anonymous or whatever that'd be great. So thank you guys for watching I'll see you guys later


I think that most reasonable people acknowledge that things right now in the United States are really, really bad. Things are bad because everyone knows that we have a government that is corrupt to its core and is fundamentally incapable of delivering even the bare minimum for its citizens. So things are bad and as a result people are losing faith in the American system. They're losing faith in democracy because they feel as if democracy itself is no longer an effective way to affect political change. So sentiment towards democracy logically is going to shift. Support for democracy will break down as people feel as if it's not working for them because at the end of the day people care about putting food on the table. They care about themselves more so than the political system that has failed them. Now I knew that this was the case but I didn't know how bad it was until I saw it quantify. So a new poll that just came out, it really does a temperature check of where Americans are at with regard to their support for democracy. And wow is this a wake up call or should this be a wake up call? Because we know that when things are bad, when times are tough, people are going to be desperate and that desperation leads them to be susceptible to radicalization and to be prone to think in conspiratorial ways. But to see how bad it's gotten, which this poll conveys, it's honestly just, it's shocking and it really spells doom for American democracy and if this holds and things don't change soon, American democracy is not long for this world and that's not hyperbole. So as Reid Wilson of The Hill explains, the poll found about 3 in 10 Americans, 31% believe the 2020 election was stolen from Trump, including two thirds of Republicans and a whopping 82% of those who trust Fox News more than any other media outlet. Among those who trust far-right outlets like One America News Network and Newsmax, 97% say they believe the election, which even Trump's own cybersecurity and election security officials agreed was the safest and most secure ever conducted in the United States was stolen. One in five Americans believe in the core tenant of the QAnon conspiracy that there was a storm coming soon, while one in six believe the United States government is controlled by a group of Satan worshipping pedophiles who run a global child sex trafficking ring. The same share 18% say they agree with the statement that America has gotten so far off track that true American patriots may have to resort to violence in order to save our country. The poll found 30% of Republicans agree that violence might be warranted compared with 17% of independents and 11% of Democrats. Those who buy into the farthest right media outlets are even more likely to contemplate violence. Among those people, 40% agree, quote, I'm not an alarmist by nature but I'm deeply disturbed by these numbers. I think that we really have to take them seriously as a threat to democracy. Sid Robert Jones, the founder and chief executive of the Public Religion Research Institute. Now the PRRI, the Public Religion Research Institute, they're the company that conducted this poll. And like I suspected the numbers to be pretty startling. But to see how many people are contemplating violence, how many people believe absurd conspiracy theories, how many people believe that the last election was stolen. It's just, we're getting really close to the point of no return where faith in democracy can't be restored. And you have an entire group of people in America, a substantial portion of the population saying we don't support democracy, we support a military coup. We want regime change, literally. Not just a turnover between administrations. We want regime change. And that's incredibly, incredibly horrifying. So this is depressing but I do want to give you a little bit of hope because we were here before where Americans were very desperate and they started to become fascistic, literally. They supported Nazis and things were turned around and the way that that happened was the government restored trust in American democracy and American institutions by delivering to these people. If you deliver and improve the lives of these people materially, that's not going to solve all of the problems. They're not just going to suddenly stop thinking conspiratorily like that. But it is the bare minimum that we can do to address the situation. But really, we have evidence that if we deliver, it works. The problem is that Democrats aren't using this limited window that they have to deliver and actually turn things around. Now in an article for The Daily Poster, David Zurota explains how the last time things actually were turned around for the better when American democracy was experiencing a legitimacy crisis. So this is what he writes. The first democratic parabola began almost 90 years ago when America's economy was ravaged by rampant speculation and then a stock market crash throwing tens of millions of people into abject poverty. As fascism rose in America through the growth of local Nazi groups, Father Coughlin and other conservative media voices, Franklin Roosevelt cast his progressive economic initiatives as both a weapon to fight the economic crisis and a shield against right wing authoritarianism. The year before a fulminating Nazi rally in a packed Madison Square Garden in New York, FDR warned that the global rise of fascism was the result of democratic governments doing the opposite of the new deal and protecting an economic status quo, enriching a tiny handful at the expense of everyone else. Democracy has disappeared in several other great nations, not because the people of those nations disliked democracy, but because they had grown tired of unemployment and insecurity of seeing their children hungry while they sat helpless in the face of government confusion and government weakness through lack of leadership, he said in a 1938 radio address. Finally, in desperation, they chose to sacrifice liberty in the hope of getting something to eat. Now, to be honest, the reforms that FDR implemented were not perfect, in fact, far from it. They excluded black and brown people. They didn't go nearly far enough, but they were enough to save democracy, to literally restore faith back in democracy. And on top of that, it saved capitalism from collapsing in on itself. Now, I think that Joe Biden understands the gravity of the situation. He knows we're in a similar situation, which is why we got these weird puff pieces talking about how Joe Biden wants to be the next FDR. But the problem is that he's not and he's very clearly not even trying to deliver to the extent that FDR delivered. The answer is to go further than FDR, complete his vision and include everyone in these new deal reforms. But that's not happening. And the result will be catastrophic. In fact, if things aren't turned around, this is likely going to be the outcome of the Democratic Party's failures. If Americans keep using Democratic institutions to try to fix the country and those institutions keep ignoring them and prioritizing big donors, many voters may simply stop believing in democracy. At minimum protecting democracy might not be much of a motivating force compelling people to turn out at the polls. So what we're seeing right now is a breakdown of American democracy and Democrats aren't doing what they need to do to address that threat. And the scary part is that they're not gonna likely have another opportunity to fix the failures and the deficiencies in our democracy for a really long time. They haven't passed voting rights reform. They haven't done electoral reform. And at a minimum, stop gerrymandering, allow nonpartisan groups to draw district lines. They haven't done that. And so the result is possibly catastrophic. We're heading off of a cliff and we desperately need intervention and Democrats aren't doing that. And yes, it's Republicans who are working their voters into a frenzy and they're the ones that have disproportionately lost faith in American democracy because they've been led astray by a charlatans like Donald Trump and right wing media. But young people, they're also going to start losing faith in democracy if they don't think their government is going to address the needs that will give them a future. Climate change is not being addressed in a meaningful way.  So they may be another group that checks out. And here's the thing. You hear me talk about this and it sounds like I'm catastrophizing and I am catastrophizing. I think this is important, but some people might think, you know what? I actually think this is a good thing. I believe in this accelerationist theory that out of the rubble of the American empire, something new and possibly better can emerge. And sure, maybe that's possible. But given the population in America, knowing how manipulated we are as a society, what do you think is more likely to happen if American democracy collapses and we actually have regime change in the United States? Do you think we're going to have this compassionate social society where we finally take care of people? Or do you think that we're going to become a reactionary fascistic authoritarian society? I think the latter is much more probable than the former, unfortunately. So what we have to do is save democracy. And it seems like Democrats aren't up for the challenge. Things might just be too bad to fix. And we see the result of that. So I don't really have a rosy takeaway here, but things have got to change. And if they don't, people will continue to lose faith in American democracy and the situation will get even worse than it is right now. The humanist report is fake news. Mike only cares about crazy Bernie and his wacky socialist ideas. Sad, very sad. I'm unsubscribing.


Mae'r bwysig yng nghymru yw'r Wonderful Slam is General Questions, a at question number one, I call Megan Gallacher. To ask the Scottish Government whether it produces guidance for local government on how allegations of sexual misconduct against councillors should be handled. Minister Ben Macpherson. The guidance on handling such complaints is produced by the independent Ethical Standards Commissioner. Allegations of sexual misconduct against the councillor whilst performing their duties should be dealt with by the Ethical Standards Commissioner As a breach of the councillor's code of conduct. Moreover, if a criminal offence may have taken place, then that should of course be dealt with by Police Scotland. Sexual misconduct is an issue which all parties shouldn't do take very seriously, which is why the Scottish Government is currently taking forward measures to prevent individuals on the sexual offenders register from being councillors. Megan Gallacher. Last week an SNP councillor who claims to have been sexually assaulted by former North Lanarkshire Council leader demanded reform over how the SNP handles sex complaints. This is the third claim of sexually inappropriate behaviour made against this individual. Instead of supporting victims, North Lanarkshire SNP closed ranks. One councillor even claimed that Mr Linden had done nothing wrong and the only thing he was guilty of was being young. So can I ask the minister if he agrees with me that victims should be protected by political parties and do you think that councils should have additional measures in place for councillors should political parties fail to support them? Thank you minister on matters for which the Scottish Government has general ministerial responsibility. Thank you, Presiding Officer. As you have alluded to, I cannot comment with regard to political parties. However, I would refer to the member to my first answer. It is unacceptable that people—and considerations about how we move forward—is unacceptable that people who are potential predators could be councillors. That is why we are undertaking measures to improve matters. That is why we are taking forward a review of section 31 of the local government Scotland Act 1973 to bar individuals who are on the sex offender's register from being councillors and continuing to consider matters within the code of conduct. Has the Scottish Government, whether it will provide an update on what its initial assessment is of the potential impact of the Windsor framework on Scotland's economy? We welcome the Windsor framework, which offers an opportunity for the UK to reset its relationship with the European Union. However, the Prime Minister, by setting out his view that the framework puts Northern Ireland in an unbelievably special position, has accepted that Scotland is not a major competitive disadvantage and has made crystal clear the immense damage that the UK Government's hard Brexit deal is causing to Scotland. Despite voting overwhelmingly to remain, Scotland has been forced out of the EU at the single market at the customs union, and we have lost freedom of movement rights, which was so important to the Scottish economy. The Office for Budget Responsibility confirmed last week that, as a result of Brexit, that long-run UK productivity will fall by 4 per cent, which is the equivalent to a loss in annual national income of around £100 billion compared with continued EU membership. Given that hard Brexit is supported not just by the current UK Government but also by the Labour Party, it is clearer than ever that it is only by becoming an independent country that Scotland can regain the huge economic benefits of EU membership. I thank the minister for his answer and concur with my concerns over the Office of Budget Responsibility report. Can he give any comfort to Scottish businesses right now who will continue to suffer by a damaging hard Tory Brexit and what he can give them in terms of comfort as they look across to Northern Ireland and see the advantages that Northern Ireland will have over Scottish businesses with access to the free market? Of course, we recognise, as I said earlier, the damage that this can do to the prospects of Scottish businesses. Of course, the Scottish Government will continue to work with businesses in Scotland to support them as best we can, given the damage that the UK Government is doing by these steps. The people in Scotland are given a clear mandate for a referendum on Scotland's future. Scotland, of course, has huge economic potential, but the UK economy, particularly post-Brexit, will be lagging behind many EU and international comparators. Should the people of Scotland vote for independence when given a choice, Scotland will get the full range of powers and the ability to rejoin the EU to build a country that is wealthier, more successful and fairer than the UK. To ask the Scottish Government when it will begin to set out its proposals for the NHS Scotland infrastructure investment plan post 2026 in relation to new-build hospitals. Cabinet Secretary, Humza Yousaf. An exact timeline has not been agreed for when the next Scottish Government infrastructure investment plan for 2026 and the following five years will be published, but in line with previous iterations in the plan, it is expected to be published in late 2025. Edward Mountain. I thank the cabinet secretary for that answer, and I wrote to him and all other SNP leadership candidates last week, asking if he would support a new acute general hospital for the Highlands and Islands to replace Reg Moore. I know that you have been very busy and have been unable to give me an answer, so now is your opportunity, cabinet secretary. Do you support my call? I am replying back to Conservative MSPs. They should have been my priority. Forgive me that I had not got round to Edward Mountain, but let me say to him that I am very proud of the Scottish Government. He might want to listen to the answer. I am very proud of the Scottish Government investment in our Highlands and Islands. Of course, we are supporting the Scottish Government, and I announced £5 million of capital investment in upgrading maternity services at Reg Moore. At our Highland national treatment centre, there is an investment of £48.5 million. I have had the pleasure, as cabinet secretary, for health and social care to open two new community hospitals, one in Avymor and one in Skye in September 2021 and March 2022, respectively. In terms of Reg Moore, there is no doubt at all that Reg Moore will require significant investment either through a full refurbishment or indeed replacement, and of course we will work closely with the NHS Highland to identify the best we fork. Can the cabinet secretary advise as to when we are like to see construction of a new cross-house hospital in Ayrshire? The UK Government promised 14 new hospitals in England, the construction of which has been hampered by a lack of cash, is years behind schedule and moving at a glacial pace to quote Saffron Corddery interim chief executive of NHS providers. We do not want to follow the Tory's appalling example. Cabinet secretary? Indeed, and of course investment in our infrastructure, investment in health and social care is challenging because of the Conservatives economic vandalism, which means that at peak inflation our budget is worth health and social care. A budget alone is worth less by £1.2 billion, the Scottish Government budget is worth less by the amount of £1.7 billion. NHS Ayrshire and An are working on their caring for Ayrshire programme, which is an exciting and ambitious programme that will transform health and care services right across Ayrshire. Arun's vision is that care shall be delivered as close to home as possible, supported by a network of community services with safe, effective and timely access to specialist services. As part of that programme, NHS Ayrshire and Arun are considering their acute healthcare estate, which of course includes cross-house hospital and what that will look like in the future. The Government will be fully supportive of that approach, and we look forward to discussing its plans with the board when they are ready. Earlier this week, the health committee heard evidence from health boards regarding external pressures on their service delivery, including the impact of inflation and increased utility costs. Can the cabinet secretary confirm if the Government has considered how to reduce revenue energy costs as part of the infrastructure investment plan proposals, for example through capital investment in systems such as district heat networks, which could increase sustainability of the hospital estates and support-surrounded communities? There are examples of where we are introducing such efficient systems. We have an ambition, and I am happy to make sure that the strategy is forwarded on to Pulse. We need to make sure that we decarbonise our entire health and social care estate. I would also point out to the fact that we have increased investment in the health service—or will be increasing investment in the health service—and next year's budget to a record of £19 billion. Question 4, Colin Smyth. To ask the Scottish Government what action it has taken to tackle the reported exodus of dentists from NHS dentistry. Can we have the minister's microphone? The Cabinet Secretary for Health and Social Care wrote to all NHS dental teams on 7 February confirming the continuation of the bridging payment to 31 October 2023, while we prepare for the implementation of payment reform. Payment reform will comprise a new modernised system that will provide NHS dental teams with greater clinical discretion and transparency for NHS patients. It is our intention for payment reform to maintain the confidence of NHS dental teams by ensuring the future viability of NHS dentistry in Scotland. Colin Smyth. The minister referred to the confidence, but the reality is that, as she will know from the crisis in Dumfries and Galloway, no one can actually currently register with an NHS dentist. As practices in Dumfries and in Castle Douglas-Thonhill have deregistered 20,000 patients, crucially those that are registered, half of them haven't seen an NHS dentist for over two years. Given that the research from the British Dental Association who warned about this exodus shows that well over half of dentists have actually reduced their NHS work, what assessment has the Government actually made to changes to the whole-time equivalent NHS dentist workforce since lockdown? What guarantee will the minister give that my constituents will actually get to see an NHS dentist? There is no doubt that there are strong existential forces working on the dental workforce at the moment in Scotland. We are working through the backdrop of a pandemic, which prevented work in dentistry for nearly a year and impacted on it for quite a period after that. We had a whole year of dental students not qualify and we had Brexit happen. In the area that you mentioned, Dumfries and Galloway, one in two of the dentists were European. The Scottish Government has put in place a framework of support to encourage more dentists to work in remote and rural areas, including in areas south of Scotland. That includes the Scottish Dental Access Initiative, which provides capital funding of up to £100,000 for the first surgery, £25,000 per additional surgery to dental providers setting up a new practice. We have also enhanced recruitment and retention allowance of up to £37,500 for newly qualified training. We have put in place that framework to help mitigate the worst effects of Brexit on the reducing supply of dentists to Scotland. Since Brexit, the rate of EU and EFTA dentists joining the register has halved, even though the Opposition would deny that. Given that, can the Minister provide an update on the steps that the Scottish Government is taking to improve access to NHS dental services in those areas that are particularly affected by those challenges? The member is absolutely correct that the consequences of Brexit are invariably having a disproportionate impact on NHS dental services in many areas. That includes the area of Dumfries and Galloway, as I can hear the member to this side of me shouting from a sedentary position. We have already seen improvements from the framework that we have put in place. We have seen a positive impact. I have already heard that Dumfries and Galloway have received expressions of interest for potential grant funding, for opening new dental practices, which the Scottish Government will absolutely be in a position to fund applications that are successful. As well as that, it is our intention to make formal representation to the UK Government for dentistry to be included in the shortage occupation list. We have also the CDO in active discussions with the General Dental Council to support them in speeding up the application process to clear the General Dental Council backlog. To ask the Scottish Government when it last assessed access to GP services in rural areas. The Scottish Government published the health and care experience survey 2021-22 in relation to people's experience of GP services last year. Health boards and health and social care partnerships are responsible for planning and delivering primary care medical services. The Scottish Government would expect them to make use of the health and care experience survey to identify any particular issues with access, including rural areas. I thank the cabinet secretary for that answer. Twecker, in my constituency, has been without a GP surgery since 2019. The ever-growing village is in a semi-rural area on the border between Eastern Barchonshire and North Lanarkshire. The only option for residents is to register in one practice in Cosyth or between two practices in Kirkntill of both some miles away. Does the cabinet secretary agree that residents deserve a better service than this and that the HSCPs and health boards in the two local authority areas should work together to find an acceptable solution? Yes, I agree that they should work together. There are obviously options available to the health and social care partnership and the health board there. If there are discussions that are needed with my primary care team and primary care officials, then I will make sure that they make themselves available to the health and social care partnerships and local authorities involved and the health board. The cabinet secretary's failure to deliver the new GP contract is the real reason why the British medical journal is saying that there is a decline in the reported quality of some respects of care in Scotland with rural areas hit hardest. It is not the fault of overwork practices, but the cabinet secretary's failure compounded the error by cutting £65 million from the primary care budget. Will the cabinet secretary commit to reinstating the crucial £65 million to primary care? What a brass neck, Presiding Officer. The reason we had to re-profile our money was because of the economic vandalism of the Conservative Party, which meant that our Government budget was worth less by the amount of £1.7 billion. That is a brass neck and a half. So what are we doing, Presiding Officer? More GPs per head in Scotland than any other part of the UK. 3,220 multidisciplinary team staff members recruited here in Scotland. We will continue, the SNP Government will continue the record investment in health and social care, and I will leave it to the Conservatives to moan from the sidelines. To ask the Scottish Government whether it will provide an update on the status of NHS 4th valley since its escalation to stage 4 of NHS Scotland's national performance framework. There are some signs of improvement in performance within NHS 4th valley. An example in children and adolescent mental health services. We have seen some improvements in terms of waiting lists, not where we want it to be, but certainly there have been some improvements. This and other work has been taken forward by the Assurance Board and the external support team chaired by Christine McLaughlin. That role, she has engaged with a wide range of stakeholders, including local authority chief execs, the area partnership forum, compromising of local trade union representatives. Stephen Cack. The RCN and Unison reported very serious concerns over unsafe practices and a culture of intimidation, and an independent review found a culture of fear. The BBC Scotland disclosure programme on the NHS was grim-viewing, a trade union representative at 4th valley said that staff were watching patients die and did not feel they had been able to provide a decent high-quality care. Clinical teams have spoken out about wards short of staff and unsupported, patient safety at risk, and staff on duty pushed to breaking point. In November, vacancies were over 10 per cent of registered nurses and nearly 14 per cent for doctors. Can the cabinet secretary honestly say that he believes that the culture at 4th valley has changed, and what are today's vacancy rates at 4th valley for doctors and nurses? Stephen Cack does raise some really important points. It is precisely the reason why I took the decision to escalate 4th valley to the second highest level of escalation, and one of the reasons for that escalation was culture. He is absolutely right to raise those issues. 4th valley has brought forward an improvement plan. If he wishes, I am happy to arrange a meeting between himself and Christine McLaughlin, who is leading that oversight board. There have been some improvements. I have also met the whistleblowing champion at 4th valley to reiterate the Government's commitment to whistleblowing and to ensure that staff's concerns and anxieties are raised through the appropriate channels. However, if it is helpful to Mr Kerr, I am happy to arrange a discussion between Mr Kerr and Christine McLaughlin. 8. Colin Beattie To ask the Scottish Government what plans are in place to eliminate any spillages of sewage from the sewage network into rivers and locks. As I have reported previously to Parliament, the river basin management plan set out our long-term aims for improving water environment. The plans are supported by Scottish Waters, improving urban waters route map, which commits to £0.5 billion of investment to improve wastewater treatment works, address unsatisfactory discharges and increase monitoring. Scottish Water has published its first annual report on progress against the route map in December 2022, and it is on its website. Colin Beattie I thank the minister for her response. I understand that Scottish Water has committed to installing a further 10,000 spill monitors by the end of 2024. Can the minister advise what support the Scottish Government is providing Scottish Water to achieve this? Yes, in line with its improving urban waters route map, Scottish Water has identified the priority locations for 1,000 UCSO monitors, and installation will be completed by the end of 2024. Scottish Water's investment programme is supported by up to £1.3 billion of lending from Scottish Government across 2021 to 2027 period. As it is this week, we mark World Water Day and Scotland's role as a hydro nation, I should like to put on record my thanks to everybody who works in Scotland's water industry, who have seen our overall water quality at 66 per cent, compared with the equivalent figure of just 16 per cent in England, who have 99 per cent of bathing waters now classified as sufficient or better, and for the up to £147 million that is to be invested in further wastewater improvements by 2027.