All right. Good morning cyber traders. Welcome back. Hopefully we're nobody's hung over from yesterday's election because guess what it doesn't look like it's over. But we are getting a little bit of a rally in the market. You can see the future is doing pretty well. I think there is one election that obviously is clear is that the Republicans will own the Senate so there won't be a majority. So I think the market likes that. You know regarding about that. So I think that was one of the big things. So I think when you get some crazy volatility next several days I mean Pennsylvania is not going to be coming up with their results until Friday looks like. And I don't even think that even matters. There's the other states that are big concerns Wisconsin and you know and Michigan. But but other than this we got we have a lot of stuff that's going to probably make the market go up and down. But one thing I do want to point out I mean I know there was a big referendum that was being offered in California. I think it was prop 230 that had a lot to do with Lyft and Uber and you know what they were doing great. I mean you can see these stocks have really really rallied lately in in the market. So they've been picking up from yesterday from a couple of days looks like they were leading the way and you can see that they're doing pretty good. So guess what they are on the watch list this morning now. But before we get through the watch list like I said it looks like the legend is not over. So we're going to have some great volatility is going to be kicking in for a while. I really thought one thing I was pretty cool yesterday that I saw a few guys watching it. But the betting line was just so interesting to see how all of a sudden it was like Biden was winning out was was winning up forever. And then all of a sudden Trump was not going to win. And all of a sudden it just like around 12 o'clock it just went zigzag. And then it was minus eight hundred. I don't know if you guys follow betting lines. But let me tell you something. There's a lot of money that's on the line when it comes to bets. And I think they really have an inside scoop because they have so much money. A betting is a huge huge business. So there's a lot of money that that's out there people that are gambling on it. And you know what guess what we're no different as traders. We're no different as traders. I mean listen we're trading stock market and we're betting on one. You know Canada versus the other that's going to affect certain certain stocks. So you know but unfortunately we're not I don't think we're there yet. But we do know that it looks like the Republicans will retain the House. We've retained the Senate. So you won't have you know a three three a three party owning of all each party of certain institutions of government. So let's go look about what's moving this morning. And let's look at some stocks. It was a prop 22 right. Is that what it was Norman would I say prop 30. I don't know I'm not from California. But I'm just seeing in just what I'm seeing on TV and I'm seeing how these stocks reacting. But listen they are doing pretty well. But anyway let's look at some of the stocks that we did trade yesterday. I personally don't think yesterday was a good day at all. There was a couple of stocks that made some last minute moves. But to me personally I didn't really want to do anything. I honestly I kind of broke even yesterday.  And I had a lot of shares of it and it kind of reversed on me. And then I was like trickling away. The problem is that when you when when you're down big you know and well I wasn't big but you and you got to like chip away and every every minute that goes by at the open you make less and less and less the volatility is not there as much. So that has obviously you know I had to chip away a little by little and then obviously you know we're done at 10 30. So I don't want to be doing anything more than that. But that but that one actually moved pretty well. We're going to talk about Neo. This thing is just an animal. Neo is obviously doing great. All these electric stocks are companies doing great. You know I do want to bring up one stock. I give credit to the Chinese leave it up to them. So remember JKS. We were talking about it. Nice solar stocks as if I didn't stock whatever it is. The news that came out on this stock was so bad. It was one of the reasons why the stock dropped from 90 to 60 something that they would you know they had like slaves that were working in China building these things Muslims. I don't know something you got to look at the news.  It just literally just crushed the stock. But we've made a lot of money on it. You know what I mean. Made a lot of money on it. And that's why you got to be careful on the news. So people take it very personal and you know you could see what happened there. But these stocks are this JKS. I mean it was bad. It was really.  You know. So anyway I just wanted to kind of bring it up because it just came across my radar. I got we got out I think around like 78. I mean we didn't max out on it. We did really well on it on the swing trade. But you know when I found out the news I was like I'm not interested. Anyway a couple of the stocks that did pretty well. We looked at L.I. Just look at that. That stock is obviously doing great still. That thing is back on the watch list is following side by side by Neo. That was also you could see it's up 7 percent. That one's doing good. All these battery stocks and everything plug you could see had a nice run yesterday. You could see they went from 16 to almost like 17. That one did well. And then blank B.L. B.L. N.K. That was another one that did really well too. So all these charging stocks these battery stocks all that stuff were actually moving. All right. So let's talk about what's moving this morning actually. And listen the market like I said it's up. I mean we're getting looks like it's backing off a little bit. But we'll see how when the thing that when the election results start coming a little by little. And I think we could see a dramatic volatility in the market. But there are a couple of stocks that we did found this morning. There was just one stock D.R. D.R. A. D. that one was pretty nice early in pre market. And all of a sudden she kind of backed off. I don't know what happened with the stock but she was looking pretty good for us this morning. And all of a sudden she started out making lower lows. I tell you I almost got suckered into buying that stock. It was doing a triple top. There's a big iceberg order that's been sitting there right above around 335. Obviously he wasn't he wasn't in executed in the stock. You can see his trending down. But it's going to it's not going to go on my A list. It's going to go on my B list. Another stock I want to put on my list is the BLRX. So we're talking a little bit about that one about 7% half million shares traded spread looks a little big right now. I mean for for for the price that it's at which has got a little bit of a trend. I mean listen if you look at the biggest percentage gain list on the left hand side you're not seeing 50 70 200 500% winners so far. But you know with that said that's why you know that's why I think things get a little cautious. I tell you I think a lot has to do with the election because a lot of these big companies are going to benefit depending on which president gets in there. Obviously has not affected it yet. Oh what happened Ferrari race had a big run and see that. Yeah Ferrari just literally gapped up big time right there. Wow. That's that's pretty big right there for Ferrari race put that in a watch list.  Looks like that looks like that could be a good swing trade. That was one of our big winners that we had at like at 60 bucks. So unfortunately I sold it at 160. I might consider looking at getting back into it. I want to keep an eye on that one. So we got Lyft Lyft. You know Lyft Lyft. You could see it. Look it's starting to creep up nicely.  You could see some buyers coming in. Just be careful. Lyft is a very fast moving stock. This is not your category one stock. I give this probably already in the three category but it can get worse. I think Uber sometimes is not as volatile as bad as Lyft but Lyft is obviously doing pretty well. I mean Lyft took a huge hit. Lyft the biggest mistake Lyft made is they started you know I mean Uber came at right after Lyft when it went public and Lyft started just way way way too high on their price. I think they went public around $78. You can see it then got crushed and obviously Uber did not want to do that even though Uber I think was a bigger company than Lyft at the time but Uber is obviously catching up. It's been holding here pretty strong for a while. It's got this big major resistance levels right around 42. Let's see how that breaks out but that's a major major resistance levels right there. Lyft is one of the other stocks at which we were watching pretty closely in pre-market. That's trading very similar with NEO. You can see NEO it's just been an animal lately. Very fast moving stock. By the way this is a very difficult stock to day trade. The stock just goes up goes down. If you are going to trade it. Cyber traders you know this very well. If you've done your journals correctly. I know Josh did traders talk yesterday. We talked a lot about going over some of your some of the traders in the room regarding some of your trades. Just be very careful because the stock you know depending on how many shares you trade you can get it will shake you out.  Just don't trade too many shares of it. Stock is very very fast. Most stock we trade a while ago that I want to keep an eye on stock SAVA. We did pretty well with the stock a long time ago. You could see it went from $2 up to about 10. It was a little bit of a you know short squeeze right there. Went right back to 3 went right back to 10 gap down. This thing is just one hell of a roller coaster. She's got these major resistance levels right here going back in January and in June. So keep an eye on that. But if it does break it you could see it could test the highs right around 13. So keep an eye on that. So SAVA popped. Yeah well I didn't pop too much right now Norman but we will keep an eye on it and see it from there. But that's pretty much it. Not a big big day. You know the day after the election and we could see how that's obviously kind of reacting to the market other than some of these you know these these referendums that came out with Lyft and that's about it. But but we always find something new. So don't get too crazy right now in pre market. Let's let's let's hold off. Remember the best trade is not to trade. OK. Let let the stock come to you. We talked about that in the cybergroup room. Try to get those limit orders. Try to stay away from those market orders because you're going to end up losing you know the spread. And remember when we talk about that in class in phase one lesson one remember you talk about the three T's tradeable trend and trap you break that first T you don't look at the trade you don't look at the trend you don't just the dumb indicator but it's that first T that will change everything in that stock. And if you're not in if you're not in that level that category stay away from it. All right. Eli is tanking. Yeah I see that grant is definitely taking it. That's I'm saying let that stand aside and let's see what happens. See how things work out because it's like the market obviously kind of like reversing a little bit right here. All right. What lesson row we talk about traps you talk about in my in my lesson phase three. OK. All right cyber traders and everybody you to Facebook live and everybody in the cybergroup room and trial members don't forget tomorrow open house here Thursday I hear Cybertrain University. So I look forward to seeing you all there. It's a perfect time because you excuse not to trade. And if you do want to register if you're online just kind of click on the bottom and we'll get you registered for that. And then in the meantime everybody will be back here at 2 30 we see how the afternoon goes. Just always remember don't trade the first five minutes let all this chaos and all the smoke clear and then we'll find out what goes on. And remember a lot of these stocks that we find you always find new ones.  Good luck everyone happy trading and be safe.


Okay, welcome everyone to our TechSoup webinar, Apped Up. We're very excited to have you all here with us today and to welcome our speakers as well. So we'll go ahead and start with hearing a little bit from them. So we have Ariel Gilbert-Knight and Sean Michael. Ariel, will you go ahead and introduce yourself? Hi, everyone. I am Ariel Gilbert-Knight. I'm a technology analyst here at TechSoup, and I've been working on the Apped Up project for the past couple of months, and I'm really excited to share what we've learned so far. Wonderful. Thank you so much. And Sean, can you introduce yourself? I'm Sean Michael. I've been with the Empower Network for a little over 10 years and recently as a senior technology manager at Empower Northwest. And we've developed a school batch, and I'm going to be talking about how we get through the thought process and development process. Wonderful. Thank you. So we've got great speakers today that can help us learn a little bit more about what after out there and available, and also how to create your own app as well. So I'm the facilitator. I'm Stephanie Girning, and I'm the training and outreach manager for the TechSoup for Libraries program. And also assisting with chat today, we have Kyla Hunt, who's our webinar manager. So thank you all for joining us. And just a little bit more about what we're covering today. We're going to start off by talking just a little bit about who is TechSoup. And then we will go into talking more about the Apped Up project, what we've learned, and then Sean will share some app-appropriate strategies for creating your own app. And then we will have time for questions and answers at the end as well. So just so you know a little bit about TechSoup, if you're not familiar already, we are a 501c3 nonprofit organization, and we serve a lot of organizations distributing technology donations, over $6.3 million, and help nonprofits save money, more than $1.8 million, in 33 countries around the world. What we're really working towards is a time when every library and nonprofit and social benefit organization on the planet really has the technology, resources, and knowledge that they need to operate at their full potential. So we're really glad to have you join us today. And if you don't know much about TechSoup or would like to learn more, please visit our website, TechSoup.org, where you'll find a lot of additional information and resources, including technology, articles, products that are a donation that nonprofits and public libraries do qualify for. And we also have a very active blog, a lot of good information there for you. And at this point, I'll go ahead and turn it over to Ariel, so that she can tell us a little bit more about the AcidApp project and what we've learned as a result of it. Sorry, I think I was muted. Hi. So I'm going to talk a little bit about TechSoup's app and app project. But before we get into that, I'm going to talk about a couple of definitions. First, what is an app? An app is short for application, which basically just means an app is a kind of software. But generally, there are smaller applications that have this limited or targeted functionality. So we're not talking about a full, big Microsoft Office suite type application, but just a little bit of software that does something interesting. Some of the examples of apps we have on this slide are mobile apps, which are, I think, what most of us think of when we think of apps. These are the standalone apps that you download onto your mobile device. So something like the Foursquare app that we show here or a search app like Bing. But apps can also be plug-ins that add on to an existing tool's functionality. So something like a browser toolbar plug-in like the example we have here is a delicious browser plug-in. Or an add-on to another system, something like Dynamic CRM, for example, has an app store or exchange that allows you to do these add-ons that allow you to customize and really expand on the existing tool's functionality. Apps can also be widgets, things like a widget that shows your organization's Twitter feed on the side of your website. They're these things that are fairly easy to just plug into your existing website without a lot of sophisticated coding or technical knowledge. Apps can also be templates that make doing your daily work easier. The example we have here is SharePoint templates that make creating and maintaining your website content easier. The next thing I wanted to talk about is an app exchange. An app exchange is just a place where people can go to search for, learn about, and find apps. The example we have here is the Windows app marketplace for Windows phones. But app exchanges can also be collections of apps that are created by a certain company or organization or that meet a certain kind of need. One of my favorite examples of this is Random Hacks of Kindness. They're an organization that hosts a hacking and coding events to create apps that help meet identified community needs. And then they make these solutions that have been developed publicly available. App exchanges can also be collections of apps that are targeted at certain groups. The app gallery from an organization called Hacking Autism is a nice example of collecting apps that are useful for certain groups. In this case, they've gathered up apps that children with autism respond to. So they didn't create these apps, but they've gathered them up and shared a little bit about them that they think would be useful to their community. There are plenty of other examples of collections of interesting apps. Librarians actually are especially good about gathering and sharing mobile resources. This is just to give you an idea of the kinds of ways that apps can be gathered up and shared. And I mention all of this because these are the things we spent months talking about and researching and writing about in the App it Up project. So what is App it Up? App it Up is a tech suit project that was generously funded by Microsoft that asked the question, which is, what does it take for a nonprofit to download and use an app they didn't develop themselves? And this turned out to be a pretty big question. We had to figure out what apps are out there, what apps organizations are using, what they want an app to do, and what the barriers to creating and using apps are. So what we did to try and answer this question was we engaged with US based nonprofits and libraries to identify the apps that are out there, what they want from apps and why they aren't using apps if they're not using them. We did this through a series of surveys and interviews and then a lot of just research and reading on our own. Longer term, we want to figure out how TechSoup with Microsoft support can best support the use of apps by nonprofits and libraries and we're still figuring this out. What would be most useful for TechSoup to do? Should we be just highlighting and showcasing the relevant apps that are already out there? Or building an app exchange, kind of a central place that people can find nonprofit and library relevant apps? Or just highlighting the needs that are out there that aren't being met and encouraging developers to help meet those needs? We're working on refining that goal over the coming year. That said, we've learned a lot already. One of the things we did, as I mentioned, is a number of surveys and take the survey data with a grain of salt or a few caveats. It wasn't a very scientific survey. It was pretty self-selecting, meaning anybody who wasn't interested in apps at all probably wouldn't answer an app survey in the first place. And we didn't make a real effort to do a representative sample of different kinds and types and sizes of organizations. So keep that in mind when I talk about these statistics. One of the interesting things was that organizations are already using apps. Almost 70% of our respondents said yes, they are using apps at their nonprofit or library. And they're using apps for everyday stuff, mostly the largest number of respondents said to do their daily work, but also to engage with patrons to a lesser extent to allow patrons to access their services. So there's the engage with patrons as a more outreach-oriented and engaging with the services to be more having people access their organization services. But the really interesting thing I found here was the answers to the question, if you don't use apps, why don't you use them? And only 17% of the respondents said they weren't using apps because they were just not interested at all. The main barrier was not having the resources to support it, 55% of respondents said that. And there's also a sense that there isn't always an app that meets their needs. So what this tells us is that organizations are using apps and if they felt they were apps that were a good fit or had the resources to support them, they would probably be using them even more. The comments in the surveys and from our interviews support what we found in this survey data itself. I'm not going to read through each of these quotes, but they're just samples that illustrate some key learnings, which are that organizations do find apps valuable and useful, and we obviously agree here at TechSoup, we love apps. The apps are not just useful, but they're also fun and exciting and kind of cool. They're very interested in the possibilities presented by apps. But, and there is a but, there's a sense that there isn't always an app that meets an organization's needs and that creating an app would be complicated and expensive. So one of the things we want to do through app it up is to help change that perception, both by highlighting and sharing the great apps that are already out there, but also by helping to get some wish list apps built. We really want to make it easy to find the apps that will help nonprofits and libraries do their work and to provide enough information to be able to put those apps to good use. So one of the ways we're thinking about doing this is trying to get some of the wish list app needs addressed. So one of the questions we asked in our surveys was if you could build an app, what would it do? And we got an amazingly broad range of answers. These are just a couple of examples. So for example, apps that would provide direct aid access and information. So the ability to search for open beds in a particular region for domestic violence victims. Or in the area of volunteer management, a way to easily track volunteer hours and time on the go. And for libraries, I love this one, app-based games that help people better understand the library resources and layout to like a mobile device-based scavenger hunt that taught people how to use the library. So one of the ways we could or thinking about helping to meet those needs is through app for good type events and organizations like Random Hats of Kindness that I mentioned earlier. Code for America is another good example of this sort of organization. They're a nonprofit that helps identify projects that could benefit from web-based technology solutions and then they recruit a development team to provide those solutions. And Challenge.gov is another one that people submit ideas, social problems that need fixing. And the Challenge.gov encourages and rewards those who come up with solutions. So there are all of these coding for good kind of organizations and efforts. And one of the things that TechSoup will be doing is working with our partners to hopefully see if we can get some of these identified nonprofit and library wish list apps into these kind of challenge events to maybe get some of these apps actually built. Another way I'm thinking of helping is increasing the reach of apps that are already out there that were created by capacity-building organizations that are relevant to nonprofits and libraries. The examples on here are StoryWell, which is based on Microsoft technologies, I think primarily Silverlight, that allows people to easily tell their stories digitally so they can post videos and pictures about how they're engaging with their communities and Microsoft's working with N-Power to make this technology available to the nonprofit community. Aid Matrix is another one. It's a set of web-based fundraising and donation management tools and it was created by a nonprofit for nonprofits so TechSoup can help identify these resources that are out there and to share them with the nonprofit community. So what are we doing with all of this information that we've gathered up? We are sharing it with the nonprofit library community, of course. So we've launched an app showcase page on TechSoup.org and one of the things we're doing there is surfacing and highlighting apps that are useful and relevant to the nonprofit library community or just cool and interesting and might inspire you to think about apps in new and different ways. We're also getting your feedback. How are you using them? What other apps are out there? What kind of additional information do you need in order to start using or more efficiently use apps at your organization? One of the reasons I think this is really great is that there are so many apps out there it's hard to figure out what the good ones are or how they might be relevant in a nonprofit or library context. And so we're providing that context in the app it up showcase. So we're sharing the good apps that we've found and telling you why and how they're being used by organizations. So it's really deeply embedded in the nonprofit and library context like what is relevant to those types of organizations. One thing I wanted to highlight about this page is the list of resources around the right circle. And here we've gathered up the additional content that we've developed through the app it up project. So we've done a number of cool app roundups on the TechSoup blog. For example, we've had green apps and office apps for mobile devices and disaster relief apps. All of those roundups are included there as well as additional content such as mobile device policies for your organization, mobile device security and other related topics. And this page is evolving over time and the content is changing. So check back. There's very cool stuff on there. And I have a reminder that there was a library cool app roundup too recently. So this is a great place to just check and see what interesting stuff we're discovering through the project. So one of the questions we asked in our survey was what kind of apps are you using right now? And there were a lot of interesting answers. A lot of the apps that people were using are the big apps that I think most people use, the Facebook, LinkedIn, Twitter type apps. But there were a couple of, there were many kind of interesting things that surfaced through this process. One of which is a notification app called JRescue. It was developed in response to the earthquake tsunami in Japan. And it allows people in a disaster area to provide notifications, updates and a GPS based location. And then concerned parties can search JRescue site to find dates about the person. Locavor is another interesting app.  So Locavor allows you to find what's in season in your area. It's pretty cool. Another interesting thing we discovered through the project is that organizations are creating their own apps. One example of this is the Humane Society of Whitley County mentioned that they had developed their own app, which shows shelter and adoption information that shows adoptable animals, news, upcoming events and links for giving donations. So it's a fairly simple app that really provides a lot of information about their organization. Another interesting example was from Public Art Omaha and they developed their own Public Art Discovery app. So there's a web-based database of public art in the Omaha area that you can search using your mobile device. Just a web-enabled mobile device and they also have downloadable apps so you can use your GPS on your device in order to see what cool, interesting public art is near your location. The really interesting thing about Public Art Omaha is that they created their app. Their app was created by their local college's computer science department. So it allowed the students to get real world experience in creating an app and help their community and I thought that was a really great example of how you can get apps built without having to have the expertise in how they're necessarily spend a huge amount of money to do it. A couple of other interesting apps that surfaced in our discussions about the Appadop project. One is Dropbox and this was mentioned frequently and much loved by nonprofits and libraries. Dropbox is a file sharing app that allows you to easily transfer content, files of various kinds and it's available in an online web version and for most smart devices. So it's pretty cool, it's not device specific. TweetDeck is an app that allows you to centrally manage your organization's Twitter and Facebook accounts and the nice thing about that is if you have multiple Twitter feeds and a Facebook account you can centrally manage all of that and it lets you build a clear picture of your followers and supporters across various social media channels as well as have consistent messaging across those channels. TweetDeck is a Twitter integrated photo sharing app which allows you to easily share photos with your followers via Twitter. The next one is my personal favorite, Evernote. It's a note taking app. It allows you to save your ideas and notes and links and more importantly organize them. You can search your notes by keywords, tags, text and it works with nearly every computer and mobile device so for example I can use the desktop version on my work laptop and I have access to all the same information on my mobile phone and my laptop at home. A couple of other apps that came up through our investigation of our cool app roundup on disaster release or the FEMA app which contains disaster preparedness information for a variety of potential disasters and the Relief Central free disaster. It's a free disaster relief information resource. It includes a lot of downloaded information so even if you don't actually have Internet access or cell phone service you can still access some basic information as well as if you do happen to have that kind of access it does news updates and alerts about disaster information. So I think that was it for my section. I'm going to hand it over to Stephanie. Great, thank you so much. That was a lot of great information to share and I just have a few library apps that I wanted to share as well. If any of you have used these yourself it would be great to hear from you all but a lot of library vendors are offering apps now as part of their products which I've seen a lot of libraries that have been able to make their resources available through apps which is a great thing to do. Also the New York Public Library created their own app and actually won the Apple Education app of the year in 2011 for their Vibion which archived the 1939 World Fair. So a really gorgeous example of an app that you might want to check out. Also in the UK there are some apps that they're using in London and Newcastle City to make their library services known so you can find the library branches or find news and events and activities but also access their online catalog as well. And then Orange County Library System has an app that I find really fun that's called Shake It. And so you can search within their catalog and you can do it by genre or by types of materials or you can just randomly have it suggest something by shaking the app to have it come up for you. So we would love to know beyond these apps as well which ones that you really enjoy and we can share those out as well so if you want to use your chat to type those in that would be really great. And then now that we've talked about apps that are available already if you are wanting to create your own we're going to hear from Shawn Michael who's going to tell us more about that. Again for being a part of today's presentation I think that what TechSoup is providing in this webinar and this program is just fantastic. I know what confusion nonprofits and libraries can go through in trying to figure out what apps work, what are good apps as opposed to phishing or other malware apps and so I'm really supportive of this program. Thank you Shawn. And Shawn you might want to check and see if you can turn up your audio. We are getting some comments that it's a little hard to hear you so if you could do that that would be really great. Okay how's that? Is that better? Yeah that's good for me. Great okay. So what I just want to talk a little bit about is that MPAL has been around for about 10 years working with nonprofits who are a nonprofit itself and have been really focusing on making sure that nonprofits have the technology that they need to succeed in their mission and going forward what we would like to do is really move into that innovative space. How can we help nonprofits improve and increase their impact in the world? And so apps ended up being, the timing of it was really great. The apps ended up being a way that we were moving forward. I'm going to go ahead and start talking to you a little bit about how we thought about apps and how we decided to move forward to the ones that we are developing now. I saw in a number of the interest points in building this webinar that folks were interested in the idea of how to determine that we're going to develop an app and what resources we need to be able to develop one and successfully distribute it. So when we were thinking of a new app the first thing that we did was get input from our potential audiences. And we are really, as I said, focusing on the nonprofit sector. So we've heard a lot from nonprofits that they had existing systems that they needed just a little bit more functionality out of or that they needed to integrate with other systems. And so the two apps that we've been working on and have delivered one of them CRM 2 QuickBooks link on the App it Up page. And Storywall, which will be coming shortly, which is an integration with an existing website to display content. We defined the value proposition to nonprofits we sent to them. You will be able to do this and tested that proposition to determine if the value really was what we expected it to be for them. We had to identify partners. When you develop an application, whether it's big or small, you really have to think about distribution, marketing, how you're going to provide ongoing support, and then who are your pilots at early adopters going to be? Who can talk about the app and let others know about them? We needed to determine the fiscal sustainability of an app if applicable. Sometimes apps are developed and put out there and people can use them freely, and there is not an expectation of ongoing support or ongoing development. In other cases, there is a need for ongoing support and development. So how do you fund that? Is there a funder that's going to provide that funding? Do you need to charge a fee that type of thing? And then you need to define the support offer. Do you just provide the app as is? Is there a phone number that somebody can call? Is there an email address? Is there a web form? Is there a community of development professionals that can help provide support? And last but not least was determining the licensing model. Again, is it the free open source app? Is it something that actually is a proprietary app that you're going to provide for free? Is it the licensing based on an organization or is it based on individual users? I want to talk a little bit about the distribution model. There really are two primary models that are available. One is request and deliver, and the other is request and download. So in the first, request and deliver, you have an organization or an individual request the app. And then there is some process that you as the source for the app go through to fulfill that request, and it is delivered. The other is to request and download, which is a much more popular method of distribution at this point in time. But either method can work. It really depends on how much control or how many pieces or parts might be included in the app. In thinking about the licensing model, there are a few points I want to go over. One is the end user licensing agreement. Other folks may call these ULIF. That is common term in the software development world. But this is a legal document, and often when you're installing an app, whether it be on your phone, on the computer, or other device, it's that long legalese document that you just go ahead and click the I accept without reading it usually. But it really is very important that you think about what that end user licensing agreement says. I don't believe that it is a common thing, but it is a common enough thing that folks feel that it is necessary to have a really good type end user licensing agreement for any app that you're distributing. You can say things that says I'm not responsible for anything that you do with the app that you use it. It's at your own risk. You can go to the other extreme and provide support for service level agreements within the licensing agreement. Also in the licensing model, as I mentioned earlier, you have to think about if the license is printed to an organization or to an individual. And where this comes into play is if you have individuals who are downloading apps for use for their organization. Does the data that they gather with that app, if it collects data, does that belong to the organization or does that belong to the individual? Also the authentication that is used for the app. Yes, there is one. Sometimes it is only an email address that is the registered user of the app. In that case, it is generally an individual. However, if there is a fee being charged for the app, again, the ownership of that license needs to be identified either with the organization or the individual. And last but certainly not least is if there is link relicensing and it is based on users, then you have to determine if the license is for named users, meaning it is for each user that may use it, or concurrent users, the number of users who could be using it at any given moment. And I'm happy to answer questions along the way if there's anything that comes up that seems relevant. Or after, I believe that we have a forum set up to ask and answer questions. In talking about the payment model, I want to process it with not all apps are for fee. Many apps are available for free. And many apps in the commercial world are available to nonprofits, libraries, or educational organizations at a discounted price. It always was asking if you are looking at an app and thinking that it fits your needs. But it looks a little spendy to talk to the supplier of the app to determine if there's a discount. If you're developing the app and distributing it, however, and you are going to charge a fee for it, you have to determine how you're going to collect that fee. And this goes back somewhat to the distribution model. If you are going to invoice the organization, so there's going to be a limited number of folks that you're going to be distributing the application to, you may want to set up an invoice, you may want to set up a test receivable in your accounting system, and collect payment using those. This may happen if your primary audience through your app are people that you already know, or people that are already paying these have come forward. Pre-pay would be an example of someone requesting an app, providing payment up front, and then you making the app available to them, either for download or by delivering it to them. And then certainly there are the online payment options. Online payment options entail a lot of moving pieces, most of you are probably aware to some extent or have used online shopping carts in your daily life, whether personal or working. And the online payment options really are pretty numerous. I would highly recommend, however, if you are not familiar with the implementation of a shopping cart on your website to consult with a technology professional who is very familiar with online shopping carts. There are also many prepackaged options that are available through organizations, whether it be your bank, several online options are available. You have your operator.net, you have IS, you have PayPal, and many, many more. You may also decide that you don't want to deal with the online payment options at all. And there are organizations that will take on the full responsibility of creating a web form and collecting a payment, and then passing that payment form to you. So that is yet another option. So you absolutely need to think about support on an ongoing basis. And this is what actually is, at least from my experience, one of the biggest barriers to really skilled and talented developers providing apps to other organizations is the expectation that there will be support. You have to figure out the financial sustainability of providing that support and what level you should provide. So in thinking about a support model, one option is to think about a help desk. Is there a phone number that people can call or email that will answer questions or help them through issues if they have any issues with the app? For many apps, the help desk is at email almost or supported by a community of developers that just answer each other's questions as they're working through continuing to develop an app. In other cases, there is an actual phone number for a company. These are usually apps that have a C. And many times that C, even though it's small, is helping to support that help desk. There are initial configuration services that you may want to offer depending on the app. So for example, in our CRM to QuickBooks link app, we offer some initial configuration services so that that are included in the licensing fee so that we ensure that people get the app set up correctly at the beginning. Extended professional services may be applicable. They may not. If the app is configured and set to go and there really is not any accessibility to the app, so it does not need or have the capability of being extended to have additional features or functionality, you may not need to provide additional professional services. However, if it may be extended, changed, customized, et cetera, you may want to consider offering professional services or partnering with an organization who may offer those professional services. Another option for support is a customer forum. For example, if you buy Microsoft Office, you know that there is a customer forum for Microsoft Office in addition to their support that they offer internally so that people can answer each other's questions. Do you provide that? What are the options for providing that? Do you have the resources to provide that internally? There are also some external tools that you may use to set up customer forums so that you can provide support in that way. And last but not least, in the support model, what I wanted to talk about was the update distribution. So this is only applicable if you continue to develop the app. For example, if Facebook were to just have developed Facebook version 1 printed out there as listed, this would not be a problem. However, as they continue to update their app, they need to figure out how they distribute that update. Do you distribute it automatically? Do you give people the option to take the new update? Do you over time require people to take the update within a certain period of time? Do people have the option to select certain features that they want to update and other features that they don't? And that was just in the planning. And then, of course, you get the fun part of designing and developing the app, at least from a technologist standpoint. This is the fun part. You have the planning. Yes, there is more planning. And the planning includes deciding what features you're going to actually include in the app. You want to talk about the application framework, what platforms, what tools and languages you're going to use, etc. What is available on a Windows PC versus a Mac? What is available on a mobile device versus a Mac or PC? What features do you want? Do you want to be able to send notifications? Do you want to gather data and send it back to another system, that type of thing? Where are you going to store your data? Is that going to be in a hosted platform? Is it going to be on an on-premise server in some locations? Then you get to develop the app. And, of course, there are still been talented folks out there that can develop an app. And you want to test it. And it's best to test it without the developers testing it. And I'm sure if I could give those, I could hear a few chuckles. But testing should be done by less techy folks than developers, so that they can break it and provide feedback about the usability. There is always a revision step in the development process. You're making changes based on your testing feedback. And then, of course, you have documentation. Documentation can be at different levels. At what level it can be for the user, how to use the app. Another level may be for installation and configuration. And yet another level may be for the technical structure. And again, depending upon how you're going to distribute and license the app, you may need more or less of any of those types of documentation. The last thing that I want to talk about is piloting your app. Piloting an app, I believe, is absolutely integral to the successful launch of an app. You need to know that it works. You need to know that it works with an organization that is not your organization if you are the developer. A pilot would generally include installing and configuring the app, training users, again, non-tech users, testing the app with live data or live communications, reporting the results. Did it work? Did it not work? Was there something that the user thought they could do but they couldn't do? Was it not intuitive, that type of thing? And again, after the pilot, there's generally a revision to the app based on the feedback. And revision to documentation, associated with the app. And we've got the end of my slide. Yes, thank you so much, Sean. That was really wonderful. Thank you for sharing all of your experiences in creating apps. There's definitely a lot more involved than I was even aware of. So thank you for that. We do have some time now for questions. And we have gotten a few of those already submitted. And go ahead and fill out those in the chat. And to start with, we've got someone asked if all the apps were free. And I think some of them are definitely one piece to pay for. Some of them are ones that vendors offer when you have their products. But there were some that were free. But someone else also wanted the list of library apps. So what I'll definitely do is a follow-up log post that I'll put on TechSoup for libraries with a list of all those library apps. And I'll show you which ones are free and which ones there are charged for. And we also were asked how many organizations were surveyed. And Ariel, I don't know if you know that offhand. I think we had around 230 responses to our surveys. We slightly more slightly less. And all of the details are in the, there's a blog post that I can post a link to in the chat that has the full details of the survey results. Okay, wonderful. Thank you. And Beth asked what the difference is between a plug-in and a widget. So who wants to answer that one? I may give the wrong answer. But from my perspective, they're basically the same thing. There may be more technical uses of them that differentiate between them. But they're basically the same thing. They're just something you can add on to an existing tool to make it better and customize it. Okay, great. Thank you. And Brandy asked if anyone knew anything about Bootsy for libraries. I don't know about that. Does anyone else? Definitely look into it. Bootsy is an app development company, I believe, that has actually been, as far as I know, the basis for a number of particular library apps. But beyond the fact that libraries have used Bootsy to develop their library apps, they don't know that much about it. Okay, wonderful. Great. We'll definitely look into that as another tool. And again, if any of you have experience with that, feel free to add that in the chat and let us know if you've used it before. And then Elaine asked any advice for those of us who are contemplating the use of third-party software for building a simple app. Sean, what do you say? Do you have any advice? Using third-party software to build the app. Right. Well, I would probably need to know what third-party software. There's many different options that are available. And depending on the option that's selected, it could be a really good fit with the systems that they have or it could not play well with the systems that they have. And so it's worth looking into what development tools that they would be using and how well those play with their systems or the systems they want to plug into. Okay, great. How about video editing apps? Anyone have any information on those? Any you would recommend? I don't think I've used any video editing apps. I would say that there are a lot of video editing apps that are out there. Again, depending on the internal IT expertise and systems of the user and what you're using, whether it's MAC or PC, will help to determine the results or down what tools are appropriate for you. And also, I would throw out there that there are video editing apps that are available through TechSoupStock at a very, very low price that are full business class applications that may be useful to those. Great, thank you. And someone added to our discussion about the widgets and add-ons and B.J. said he thinks those widgets as something you can embed on a web page and add-ons as something you would add to a program. That's kind of an interesting distinction there. Maybe like adding on to a web browser. Yeah, and actually Anna, one of our fellow TechSoupers and ad-appers added a similar note that plugins are used by the end user and widgets are for a website. So widgets can be seen by anyone who visits the website. So thank you for clarifying. And Sean, what do you use for development? I actually use a variety of tools. I will use the Visual Studio product from Microsoft to do .NET or Windows based programming. I will also use some open source tools such as PHP or MySQL to do some cross-platform development. There are a variety of tools that are available. Wonderful, thank you. Any experience with BizApps for mobile phone app building? Was that a question to me? Sorry. Sure. You did that. With my little phone app, one of the cool things that has kind of developed over the last few years and others might be able to chime in on this a bit is that the ability to develop for the mobile platform has become much much easier. So if you go into pretty much any kind of interactive development environment tool, whether it be Visual Studio or other tools that are out there, you have the ability to develop for the mobile device within the same tools that you're developing apps for full PCs or larger devices. I think the tricksy thing there is just to remember how much realistic you have on a phone, especially smaller phones depending on your audience, and the capability of the enormous range of quality of phone technology needs to be taken into account. Sure, definitely. And any free survey apps that either of you have used? I have primarily used SurveyMonkey, and they do have nonprofit pricing that is available. I've not used one that is completely free. Okay. Great. And I think that's about all of our questions. Misty asked, what was the mobile phone app BizMap? Sure. Have you used a BizMap, maybe? I'm not certain. Sorry. Okay. Okay. Well, thank you all. And definitely, I learned a lot. And definitely appreciate the apps that I use more now as well, knowing all of them, everything that goes into developing them and sustaining them. Oh, thank you all very much for sharing. And we would love to continue this discussion as well. So if you do have additional questions, you can post them in our community forum. You just go to the app it up forum. You'll see that there is one developed for you already that you can ask your questions, and we can get back to you on that. We also have an evaluation form for this webinar if you could take it so that we can improve how we offer webinars to you. That would be appreciated as well. And now, and Tyler has shared that out in the chat box as well. So thank you so much to both of our speakers for letting us know about what's out there and what we can do to develop new apps ourselves as well, or maybe to be cautioned about everything that needed and to be able to make that happen successfully. We do want to thank our webinar sponsors, and we do have a lot of tips and tricks online for contributing to the software of this program. Go to webinar. And again, thank you all for attending, and thank you to our speakers. Please keep up with our app it up project, and we'll be sharing more information as we learn more from all of you. Thank you. And a big thank you to Microsoft as well for their support of the app it up project. We'll receive a recording and archive of this webinar as well.


You should never sneak up to this backroom's entity unless you enjoy getting attacked with acid. The entity in question are called bursters, and they can be found typically on level 3 or levels like it. They almost look humanoid, but they crawl on all fours and have dark wrinkly gray skin, and they smell terrible.  Most of the time, these creatures are docile, and they kinda just walk around and chill, but if you sneak up on one and scare it, the calluses and blisters on their backs will burst open and spray a gross, acidic substance all over you. That's where they get the name bursters from, obviously. Anyways, these things were originally thought to be subspecies of the Hound entity, but now we're not so sure. Let me know your theories on this in the comments below.


Studying Frankenstein, let's look at key quotes relating to the creature. When the creature meets Victor Frankenstein, he says, You my created, test and spurn me. The pronoun you emphasises the creature's disgust at basically Frankenstein as his father abandoning him. This pronoun contrasts to the possessive pronoun why, where the creature shows that he's actually embracing his father, he wants to be loved. Yet the verbs to test and spurn show how heartless Victor Frankenstein is in his treatment of the creature. The creature also says, these bleak skies are hell, for they are kinder to me than your fellow beings.   Also, the juxtaposition between the pronouns me and your show how the creature is actually really good, even if he looks really horrible and ugly, whilst human beings who look perfect are actually quite frail and unkind in their hearts.


Right, in best LSF tradition, I don't have slides. So as this is more designed, or the intention was to have it more as a discussion topic. So what happened was that, or still happens, that there are patch sets which have been proposed and for some reason really have not been applied or have been rejected. Occasionally, at a really late stage, meaning after, say, revision 14, suddenly we'll decide, oh no, the patch set itself is, no, we're not going to do this. Whereas others, which are nearly as intrusive, will be accepted without any problems. And that makes it really hard for companies who are not that involved in the entire development process to figure out, right, we are going to propose this, what will happen? Are we going to spend lots and lots and lots of manpower trying to implement something which at the end of the day will be rejected? And so I really haven't been able to come to a consensus or some guidelines, so which award is accepted, what is not acceptable. Occasionally, it seems to me really, I mean, if you happen to, well, get in touch with them at the main time at the wrong time, you'll be rejected and if you're lucky, you get your patches in. So really, some more discussion topics. Is there anything we can do to improve this process such that maybe if there's something which we are not ready to accept, we really should put in the brakes rather early such as not to spend lots and lots and lots of development manpower. So I cared very deeply about this subject and this is something that we've tried really hard to address inside of ButterFS specifically and if you look at our patch counts, like pretty consistently, 300, 400 patches every six months, we're up to like 800 now because we got really, really good at this addressing how and when patches go and this really takes a concerted effort on the communities part, the maintainer and the tech leads in that community to give signal really early on that like, okay, this idea itself is worth doing. We are going to put effort into making sure that you can shepherd it along and I find that in having worked in this area for too long, this isn't the case, right? Like a lot of maintainers just sort of like view it as their own fiefdom and that is like, this is the thing that they get to do and they don't care, they're not bothered, they don't, like if it's not what they're working on, they don't care and so by the time you actually get their attention, like they're just gonna shit on it or whatever or you have like random drive-bys, especially for new people, they don't know who they're supposed to pay attention to or who they're not supposed to pay attention to so you get drive-bys and then you go and re-architect your thing and for a suggestion that should have just been ignored because the person who said it didn't talk about, like didn't know what they were talking about, this to me is a fundamental problem in this community that the way maintainers behave is erratic and inconsistent. Like we, this is like, we are all grown ass adults in this room, we ought to be able to work together a lot better than we have been and I think that starts with having a more clear definition of the role of a maintainer. It's not just I take patches, it is I give clear indications of like newcomers or whatever or I give clear, descriptive like feedback of like this idea itself is okay and you need to get reviews or I give clear feedback of this idea is not good for these reasons, right? Instead of it, you know, you get to this point where you're 15, 16 reviews in and suddenly somebody comes out of the woodwork and is like, oh no, this is terrible. Now there's other cases where this happens that are different, I think Willie can attest to this where it's like, you're doing something that's very core and touches a lot of things and some of the people aren't paying attention, right? That I don't have a good answer for, right? I think that for ButterFS, again, this is a smaller part, one of the things that we did was just talk to each other more, right? Like we get, we just had one an hour ago, we get in the same room, we say, okay, this is the patch that I'm working on, this is what I need or this is what I'm doing, this is where I'm going and then I can say, Christoph, I need you to look at this part or you know, whoever I need you to look at this and so it's easier to merge these things that are like a little bit bigger. We don't have that for the big things. I don't know what the answer is for that but I think that those are the two core problems that I see. This is actually very related to something we're doing in the tab. I'm leading an effort right now, I've had help with Dan Williams and others on the tab we're coming up with a communication style documents. There's only two of them. Well, one of the communication style documents is basically how maintainers are to talk to other people and it's just, it's not gonna be like, it's not gonna be like telling you, it's basically here's guidelines and it's mostly about getting a point of views of what the other person's doing. There's also going to be another document that's gonna be how contributors talk to maintainers and a lot of it, like Linus is- All of this, sorry to interrupt you. All of this sort of implies that they talk and that is the main problem we're having. The thing is here is that the reason why we want to make a document and put it into like the tree is that when something happens you could say, please read this document. So when something breaks out. So we try to get away from the, so we want to document everything of the issues that we see. So I would want to talk to you about this because this is exactly the type of thing that we're trying to address. So I just want to bring that up. And I think this is a good thing and it's not only like communication, right? Cause like you guys know me, I swear a whole lot but you'll have noticed that on mailing lists I purposely don't do that because in mailing list I don't know how I'm going to be perceived. Here I can be pretty sure that you guys understand that I'm not angry or upset with your calling you names but on list that you may not, right? And also there's other people on list that haven't been in this room with me that don't know me and that is can be very off-putting and very like aggressive and it can make people not want to join. So the way I conduct myself on list is very different from what I'm standing up here, right? And I think this is sort of what I'm getting at, right? Is that it's not just the small group of people that we see all of the time. There are more and more people coming into this community all the time and it may seem silly but the smallest things can turn people away. Me being me on list can turn people away and I have recognized that and I have changed my behavior. If I can do it, all of us can do it. And then I think that's really good for the communication style but the next part is like the actual responsibility of a maintainer, like you're maintaining code. What I really, really, really, really hate is like we still complain and arbitrate topics that are settled. BPF, system D. You will see snide shitty remarks from maintainers about technologies that are in the kernel, currently being used as if they're still up for debate. We are all in this together. We're all trying to move in the same direction. Let's try to pretend like we like each other and pretend like we are actually all in this together and not just fighting with each other and maintainers need to take that more collaborative, more like understanding of, okay, I see what you're trying to do here. It's not the right way. Here's how you do it. Or, you know, it's not like every idea's good, right? Straight up rejection and why? And alternatives, that sort of thing. Sorry, I didn't mean to hijack your shot. No, no, no, that's perfectly fine. But then my key objection to that one is that this whole of this entire thing is more due to a lack of communication. If they react, then we can get started. Then we have some idea of what's going on. But typically what happens is that relevant parties get involved rather late and then say, all right, no, I'm not going to do it. Oh, thank you. You could have said that earlier. Or rather, having a flat refusal for just because is also not really going to help. Because that sort of leaves you with no middle ground. Right, okay, so we don't like it, but what is it exactly that you don't like? So is there, or rather, is there anything I can do to change, to get to a similar result, allowing me to further my use case or is the entire use case completely bonkers? Exactly. Constructive criticism, as Jeff Layton just said. Right, and this is the thing, is like maintainers, your job isn't just to take patches, your job is to steer the direction of your projects.  But I take my role as kind of guiding people very seriously. And if you're going to be a maintainer, especially for a core part of the kernel, like your job, unfortunately, is to look at the random patch set from somebody that you may not recognize and give some sort of feedback. And the flat refusal thing that I see a lot is just not helpful. Again, we are all trying to make this thing better.  This isn't fun, right? This is a job. And so if they're trying to accomplish something, the least a maintainer should be able to do is understand why and if it's bonkers, fine, it's bonkers, but understand the use case and provide some sort of way forward. I think part of your responsibility as a maintainer too is to offer timely review, like you're saying. The last thing you want to do is churn out a dozen sets of patches only to find it rejection later. It's incumbent upon a maintainer to step in and at least have a look at what someone's trying to do and steer the direction. I think you're out. I think it's really important to consider that this needs to be a team effort because if you make it be the statement that the maintainer is responsible for a timely review, you're just gonna burn out maintainers, right? I cannot review every single patch that goes across the list. I am very, very dependent on other senior members of the community stepping in and doing the reviews. So for example, in EECS-D4, Yon Cara has just done amazing works in reviewing other patches. And so I think we can talk about maintainers trying to help recruit people to do that review, but I think we need to be a little bit careful about demanding SLA agreements that all patches must be reviewed within a week or responded to within three days, right? Now, if I'm at work and I have a P1 bug, I have SLA requirements. And I think we need to also be understanding of the fact that very few maintainers actually are privileged enough to do it as a full-time job or even are allowed by their employer, 50% of their time to do that work. And so, yes, long-term, the maintainer should be trying to recruit more people into the community so that they're not overloaded. But I think this is why I think one of the reasons why it's been so hard to make categorical statements that are accepted of the form, it's the maintainer's responsibility to do X, it's the maintainer's responsibility to do Y, because the reality is, if you try to pile that all on the maintainer, you're just gonna burn them out. It's just not possible. And by the way, one of the things I actually choose to do is if I see a newcomer, I may actually spend more time with them, but that burns a huge amount of time, right? There are certain companies that bring, ask their new engineers to fix syspot bugs, and the amount of time I need to spend trying to bring them up to speed is a huge time suck. And what I generally tend to do is I will make judgments about whether this person is someone who will become a long-term part of the community. And after a couple of tries, I may give up on the person, right?  I think one of the, there's code review and then there's code review. What people are asking for is early feedback, but I see a lot of maintainers or code reviewers who take the attitude that all code review has to be super detailed, check every T and cross every I code review. And if you're not getting any feedback until you get that, then that is gonna end up waiting a week, two weeks, because that is mentally intensive and demanding. And then that's what gets people frustrated if they don't get anything before that. One of the things I do in BcashFS is I try to make myself available to everyone to at least discuss patches and ideas before people are working on them. And as soon as people have code that they can throw up and get, I will glance at it and say, does this, is this the right approach or not? Before we do the detailed code review and before it goes through CI. Taking a more conversational approach, I feel it always helps. I think that's a good point. Oftentimes it feels like we do, there are some patch sets where you really need to do deep code review because it's just so complicated. It takes a very long time, but I think that just doesn't scale. Like you don't, you won't have a bunch of, 10, 20 experts that can review all the code in sufficient detail. So I think the consequences that sometimes we need to be fine with accepting code that isn't perfect. Yeah, it's like, you will hear the bell. It's, it's real fun, it's very odd. One thing I'll say too is I think it's, the Linux community has evolved over time and perhaps it's a bit more difficult for folks who have been in companies where maintainers have been something that's, they've been doing this for a long time, but perhaps now as new companies are starting to hire maintainers, it's important for companies to realize that this is becoming a challenge and also that they need to consider this as part of that role when they are hiring maintainers. So I will say for instance, I think that Samsung does give me good leeway to understand that this is part of my job, you know. I will do my best to try to take time to review patches very carefully from new maintainers as you were saying. I mean, sorry, new contributors, but perhaps it's much more difficult in companies where this is already an instant student thing where they already have maintainers, but if new employers start thinking about these things and come to these conferences, they might get it. So it's important that when companies hiring new maintainers, they consider that into their workflow for the future. And I think this is, you know, this is a miscommunication on my part, right? Like so clearly like Sturba is the maintainer of ButterFS, but Sturba is not the one that does all the reviewing, right? The entire community is reviewing. And Sturba and I and Chris and the other core developers, we collaboratively decide what's going to happen like on big changes and that sort of thing. So I like, I keep saying maintainer and that's a misnomer, right? Clearly I'm not expecting one guy to do all of this stuff. It's a community. And the other thing is like, there's a big difference between Ted, me, Christian, and like random one-off things, right? So like obviously the load for smaller projects is gonna be different. But I think like we're all talking about big subsystems that touch a lot of things. And this is a problem for the bigger subsystems. Now I think that most of the people in this room don't have that problem generally, because I mean, you know, Jens is really good with Blocklayer. I feel like ButterFS is pretty good. EXT4 is pretty good. Like I think we've have a, most of the people in this room have maintainers that they flow to that are better about this, but we're not the only part, right? I feel we've, what would be nice for example, if for a start we would see more act and reviewed buys on patches. Like if people see a patch and think, okay, this looks same to me and I have a rough understanding what this is about, it's fine to act. But I feel there's a certain restraint in doing this because people are afraid that it might look bad if later on someone comes in, reviews it and finds a bug report. And, but that's totally fine I think. You know, it's totally fine for someone to later to show up and it's like, oh, here's something that you missed, that doesn't mean like you didn't do your job as a reviewer, you might have missed something. That's fine in my opinion. But I feel like that's a lot why we don't see acts and reviewed buys on patches. And that's annoying. Yeah, but I think we're all managing our reputations to some degree and that makes people hesitant. I do agree, violently agree with you about maintainers need to engage. But there's definitely a role to play for contributors giving maintainers grace. But also maintainers giving them self grace. Like one of the kind of interesting conversations we had in the tab, we just happened to start talking about maintainer issues. And I think it was, Jakob said like, why don't we talk more as maintainers between each other? It's kind of like we're all on our own fiefdoms. Like if I feel like I'm drowning in my substance, I can't really like raise the bat signal, say, hey other maintainers please come help me. Like I don't think we, I think there's more room for us to help each other. And another thing I would say that has seen it start to work really well is these subsystems that have regular phone calls where you can get on and say, hey, did you see my patch? Or hey, what do you think about this idea? Because sometimes, because the list is permanent, public and that reduces some communication. So part of this is like, hey, can we have other channels to get like, I think all experienced maintainers on the route where people developers, they have their back channels. They have their way to be like, hey, but like contributors are coming and they don't have that network. So I think, yeah, I think there's things we can do here. I think, well, I also wanna go back to, there's one thing about the newcomers, but I think there's another piece, which is the company developers who have put together a 10 patch series, they're actually trying to solve a real business reason. Business, there's a real business justification for that effort and they may not know when is the best time to approach the list. But the other thing which I think is really important is very often I find that I end up having to push them on why are you doing this, right? And that's actually a really, really good question to ask. People may have noticed I did that one or time here. It's like, what's the business case? Why are you doing this? Because if I understand the reason why, I can often give them a better way of solving the actual underlying problem as opposed to this mysterious 10 patch series that is making a whole bunch of changes without any explanation of what the high level goal is.  But understanding what that reason is to the extent that they are willing to disclose it can very often help with that conversation. So that's a tip to maintainers. Feel free to ask why are you doing this thing? And this may be the other part of, if we write these documents with the tab about giving suggestions for people who are trying to approach an open source community, tell them, give advice to those companies, tell them what it is that they're trying to achieve. And very often, if those companies can also give an assurance that this is not a drive-by patch, they will actually stick around, then it's a lot easier for the community to work with them as opposed to, you know, hi, I'm a company, I wanna solve this business problem. I'm going to drive by a set of patches and then I will never be seen from again. And again, making that on the community because we have to support this work because we are maintainers, right? I think there really is a two-way street here and setting expectations in both directions is probably a really good idea. The question I'd like to put to the room is do you think we don't encourage reviews enough? Because I remember back 10 years ago, we used to have huge problems with people who reviewed code wrongly and they'd give the wrong advice and we spent ages trying to climb down on this. But now the big problem is we don't have enough reviewers and is it because we've overcorrected from the previous problem of all of the bad reviewers? So perhaps one of the things we should be doing is actually trying to build up a stable of reviewers. I think you only actually get reviewers if you see someone, this is my experience, at least if you see someone who's doing good work, who's commented on patches a couple of times really well, you write them, maybe off-list. It's what I tend to do and tell them, it's really good what you're doing, keep it up. If you need any help, I can try and give you some advice and that's how you keep people. It's really crucial, I think, sometimes to just point out, hey, what you're doing is good, you're doing good. We're really good at saying, this is wrong, this is not great, but we rarely say stuff like, oh, this is a great patch, this is a good idea, this is a nifty change, whatever. If you tell this, I think encouraging people is usually the best way to get them involved into the community for a long time, in my experience. Maybe even adding those people to the maintainers, as official reviewers, would put a little bit more skin in the game for those people. Maybe you can have several layers of reviewers, like experienced reviewers and junior reviewers. Yeah, I think that a wholeheartedly agree, Christian, this is something that we've kind of worked on at Butterfest, like encouraging people, thanking people, because it makes them feel good and it makes them feel included, right? As for the reviewer thing, I think that's really important, right? For me, I'm the worst at this, right? I don't look at FSDevel unless I absolutely have to, right? I'm stuck inside Butterfest, but I know that I could review stuff if I had the time, and Willie sent me stuff specifically, like hey, Joseph, will you look at this? Yes, of course, I will look at it, right? But that's basically the only way that I will step outside of Butterfest, is like if I'm purposefully asked to go do it. Right, and that's also part of the maintainer's job, as Christian just said, is that to reach out to people that they think would be reasonable to review the thing. Personally, I find, this is a whole other topic, but I find part of the problem is just tooling, right? Like we only have so much bandwidth for stuff and I only have so much bandwidth to look at stuff. I'm gonna look at the Butterfest list, I'm not gonna look at anything else. If we had better ways to be like, okay, this is our outstanding patch sets, or these are things that, whatever, but I think that's a whole other. One question. So, we do have this R tag in the maintainer's file. What is the pathway for each of your subsystems to getting a new person than that? Do you even know what it is? I have no idea what it is. No? What? What is the question? What was the question? The question is, for each of your subsystems, we now in the maintainer's file have the R tag for reviewers. How does somebody get an R tag in your subsystem? What do they have to do? You know, so you were talking about. I reviewed, I was reviewing. So, do you ever go up to anybody and say, could I put your name in this, or do they have to ask as in? I know one person was reviewing FNOTify and he requested to be in the maintainer's reviewer and John merged that patch. Right, but perhaps we should be more proactive in tapping people on the shoulder and saying, hey, you've reviewed these patches three times. Can I add your name to the R list? Yeah, okay, you just said it. You basically just said it. I think one good way of dealing with this is if someone is around for longer amounts of time, is providing consistent review and is interested, then why couldn't you just go to them and ask like, hey, do you want to be added as a reviewer? Do you see yourself having time for this in the long run? That's part of it. It's basically the same thing as saying, thank you, you're doing good work. It's also a plus. It's really hard. You want some responsibility. And it's really hard to keep track on infrastructure changes within the kernel, especially the tooling changes because as you've said here, one has only so much bandwidth and most of that is eaten up by the actual work and following the maintenance which you care about. Linux kernel is not one of those. We tooling is definitely a part of this. If you're dealing with larger amounts of patch series, then keeping track of them in some way is really crucial. And for example, we lack infrastructure for this pretty much. So it's easy to just get lost in the amounts of patches even with all of the new tooling that we have. I just wanted to come from the other side as someone who recently became a reviewer. To say it was a very encouraging to take that step and I did end up asking for it. But you really feel like a part of the subsystem a lot more once you're here. But it still requires you to ask for it. Yeah. It would be nice to have a clarity on that. You first have to have the guts to actually ask it. Yeah. We should definitely be more proactive about this. One thing I wanted to raise as well is that sometimes with the patch series that kind of falls down the gaps. You put it forward and no one responds to it. It can be hard to know the polite way of pushing that forward. And then I guess that comes into the whole humans talking to each other thing. But it'd be good if there's like clarity on, I mean obviously maintainers you can't have an SLA on that but how to push it forward politely or the procedure would be pretty helpful. Yeah.  And so like I just forget about it sometimes and then I come back to like guy just saying ping and for me that's completely fine.  I let it go. I'll review it and push it along. But like other people I would probably be really upset about that. So like having some sort of like way to encourage. Yeah. I don't want to talk. Maybe the exact thing about the maintainer guy. Yeah. We do actually have in our kernel documentation. We do have kernel documentation by the way. They maintain our profile section where you can actually put in the description of your subsystem including things like expectations for patch response times and that sort of stuff. Very few subsystems have done this. But it would be I think very helpful if more of them did. Yeah. Absolutely. Yeah. One of the expectations when we started this was like herding cast trying to get maintainers to agree. So we said, okay, we're not going to try to get people to agree. Everybody kind of write their own document. But now we do have two good documents. We have X86 and NetDev. And we're like, hey, maybe it's time to start up leveling to have the common set. But yeah, but that's the place to put your expectations about yeah, ping me every 48 hours or no, ping me once a week. Like that's where that information can go. Okay. All right, we're running over guys. Appreciate it.


Hello, my name is Boris Tsipot and I'm the Senior Security Engineer at Synopsys. Today I will tell you something about how to recognize and fix the risks that come in during your software development and how to recognize those during the testing phase. We will talk about problems in today's software development and how to reduce the operational security and license compliance risks that come into your software during your development lifecycle. So we will be talking about the software development or better to say secure software development and testing. First of all, we will start with the challenge. So what is today's software development and testing look like? And to go into this, we will start in where it was in the beginning. So in the past, software development was mostly done on proprietary source code. The complexity of the software was still low and this is mostly due to the point that there were not too much third parties involved. You did not have or had limited connection to internal networks or internet and you had few platforms to support. And to this, you still had pretty long development cycles, right? Well the world changed and today the modern software recipe looks actually like you put some proprietary code that you write yourself. But to avoid developing hot water, you use open source components to add the functionalities that are already there, you're just using them to express your functionalities better. You add API usage to the whole mix to get more connectivity, better configuration, software behavior to apply it to more platforms to make it more integratable. And all this mixed today, make sure that the software development actually is using today proprietary and third party source code, the software is becoming really complex and as we look now to our software development cycles, they get quite short, right? We are talking about two weeks or one week cycles. We have connection to the internet that is today almost mandatory. Nobody can think about an application almost that is not connected to the internet and we have many platforms to support. If we go only to the mobile site, we have already many contestants there, but now there are still PCs and server connections back ends. Then we have IoT devices with their free RTOs and such things. So many, many platforms that we can support. So if we look at the problem a little bit more closer. So we have the underlying systems on which we then build up our software, right? We add our proprietary code as we said, but how can we be sure that this proprietary code doesn't have our mistakes in it, right? That we did not program in some vulnerabilities that can then be exploited. When we start adding frameworks, we start adding open source components as said to extend our functionality or not develop hot water again if it's already there. Although then we have to see how we manage open source from the perspective of operational risks, license compliance risks and yes, open source is also software. So from that perspective, it has also possible vulnerabilities that come with it. Then we add the VAB UI application behavior. So how can we be sure that all those exploitable vulnerabilities that are now in our source code will not be deployed with the software, right? How can we find them? How can we disallow the abuse of those? And of course, how can we be sure that the APIs we intended for better integratability and better service don't get exploited for malicious use? And then we need to see how to now automate all of this because doing this by hand is not possible. So today's software development is about more code, more complexity, more speed and of course unfortunately more risk. Therefore we have to look also at the risk exposure through time, right? How does this all develop? So if we think about a vulnerability when it was introduced, it could be already quite a while, right? From the point when it was introduced to the point when it was found, there can be days, months or even years before this comes to a database of vulnerabilities where you could find it, right? Because this happened when this vulnerability is known, it will get released and this means that then also all the exploits start being published, key hackers start hacking away trying to see if they are good enough and of course also professional hackers start hacking away. Now think about this point. When do you find this vulnerability? How do you find it? Do you spend a lot of men hours just looking for this vulnerability? How do you know that you have this vulnerable component or this vulnerability in your source code? How do you find it? So the race is on, right? Between the time when the vulnerability has been found to the time when you fix the vulnerability, you are open for attacks and this is the highest security risk for you. So we have to do a lot of things, right? We are all aware of this and we have our whole software development life cycle to do this, right? So we have points where we define security requirements and risk analysis. We create secure configuration packaging for deployment, operational protection, malicious code detection even, right? The ongoing assessments with monitoring. But the important things are mostly code, build and test parts. And why are those mostly the problematic sites? Because we tend in the code to only code in the build, we only build and in the testing phase. We try to pick up everything that is wrong with our source code. And that's mostly the bottleneck. Here the most problems start because we are pushing the findings to the last stage and then it becomes a bottleneck. So we are trying to patch bullet holes, right? We see that there is a problem in the testing phase because we have to now repair all the found vulnerabilities and then we try to patch only some bullet holes so that water doesn't leak. And we then try to think about this legend of one tool to rule them all, right? We have this fantasy in our heads that we will put source code in and out will come the perfect software that we can give to our customers that we can use internally or even externally in our companies. Well the problem is that the reality is a little bit different. There is no tool to rule them all. There is no tool that can help you in every aspect of your work. So you have to do source code analysis to analyze the source code and find the vulnerabilities. As we said on your proprietary code, you have to do software composition analysis to find open source component and with its connected risks like licenses, vulnerabilities and operational risks and then it's best to do also a test on your running applications to see if there are any possible findings of misconfiguration, authentication issues or exposed security vulnerabilities that we did not find in the static code, right? So as we see already here, we divided the process into three toolings and now you will say okay this is too much, now we have to use three tools and we already don't have enough time. Well first of all we need to see what we want to achieve and for this we look closer at the code build test environment. We start already at the code phase and we scan the code and triage results throughout the whole development cycle. We remove false positive from the whole finding so that we don't get noise out of everything that we scan and then we can automate the SAS tool to give us the things that we need to be faster. To do this three steps already will improve our quality of the software and the software development process really big. Then we can merge subsequent scan results and customize the rule sets so that we can reuse everything the next time we go into the next version development. And if we do this, we are already there to uncover potential violation of coding standards, right? We can see if there are any things that we are violating that we are not doing right. And this already really fast so we hear a lot about shift, left, principle, right? However, I would like to mention here one other point that shifting left is good. However, you have to think also about shifting to everywhere because now if you go only left and this is your only verification or checkpoint for your source code, then again, you are not following the code through its development process. However, the static analysis that we now did is a set good for proprietary code. We would not like to look for open source vulnerabilities in your code with this tooling. Many will now say, why not? Open source is also source code, right? Open source also has vulnerabilities which can be found by static code analysis or SUST tooling. And I can say yes. But also, let me ask you this, what do all of those vulnerabilities have in common? So we know Heartbleed, Freak, Ghost, they were all found by researchers. The problem is that a researcher will go in and try to find vulnerabilities in a certain open source component in a certain software that is there. And for this, it will have to look for a lot of things, why? SUST tools are mostly affected for proprietary code, the code that you know, the code that you own, whereas open source vulnerabilities are usually complex. They are deeply seeded somewhere. They have many dependencies that are either direct or even trans-transitive. And with those comes even more complexity. So by doing this analysis, of course, it's possible, however, unneeded because you're spending too much time on this with using SUST tools. To make it better, think about open source components, realize that vulnerabilities are introduced to them, and then you're introducing those also to your software. And think about the three dimensions of the risks with open source and apply the right tool that will give you the legal risk assessment, security risk assessment, and quality risk assessment of each tool that you use in your software development. So at Synopsys, we have a research team that focuses on finding risks in known open source components. This is our mission. And we want to help our customers to identify open source components, identify the risk associated with those, and help them to mitigate those risks fast during the development cycle. As we see is that there are almost no code bases anymore that don't contain any open source. So open source is everywhere, be it a copy paste of a functionality up to using the whole open source component with a few hundred megabytes, right? And as we see, the average percentage of this code, the open source code base in the normal code base is up to 70% average, which means that some code bases go even up to 90 or more. So the proprietary part is really small. Also what we see is that license compliance with those components remains really critical. There are some markets there that already could take care of license compliance risks, but not everybody. We also see that many of the components used in software are there with vulnerabilities, which means that if you have one vulnerability in your source code that a hacker found, this hacker could then try to find other software that also have this vulnerability. And usually there is a high percentage of reshared open source components, which means also reshared vulnerabilities. So we see that the compliance part is not up to the task with the usage part, right? We see that there is more and more code bases consuming open source, but we see also that not all are going making sure that the security in those code bases is up to the task. So what do you need to do to get everything solved? Well, the first rule is you can't patch what you don't know is there. Therefore you need to identify open source components in your code. Then you need to think about how to reuse those components or where to take the components you want to use. Think about repositories that are coming from the community and not some forums or any other places. And then think about this. There is no vendor called open source. You can use open source, but in this case you are a part of the community and therefore you need to take care of following the open source. You need to take care of the point that you need to know when there is a patch available and you also need to apply those patches to be secure with the provided open source code. So we were now talking a lot about problems, but what is the solution? So first of all, don't limit yourself to one solution. As we said, we have different tools for different tasks. We have the static code analysis. We have the dynamic code analysis, interactive code analysis, software composition analysis and runtime analysis that are all at our disposal. But tools are not all. Think also about training the teams and individuals about secure development, about designing security in your software. And think about using services, managed or professional, to get your teams up to speed, to get your development up to speed and to get your testing up to speed with what you want to achieve. So if we now fill in the missing parts before, as said, moving just to the left will not solve your problems. Moving everywhere is something that can help you. So think about already starting testing while you're coding. You can do this with integration into your IDE, integration into your built environments and integration into your repositories. And then you have covered all places where your code can be and can deploy even more gates, security gates or quality gates as you go along. Take on the challenge. Start planning. Be aware of what's happening and gather the information of the used open source components and other tools and software that you're using. Identify out of those all the untrustworthy parts and replace them with something that you can trust. Define procedures that will help you to handle problems. One thing is to realize you have a vulnerability or a vulnerable component. Other thing is to deal with this problem. So define those procedures and then things will be easier to be solved. Call it as you want. So here I get mostly laughs, right? But really call it as you like. Sack devops, devops, devopsack. I know each one has its own meaning. However, don't be fooled. Please just think about that security is paramount to your devops culture. And therefore integrate the procedures of security into every step of your development process. And don't hang up on semantics. Just think about this, integrate those procedures and go on with this. And then in the end, you will benefit from open source usage. You will get strength, you will get speed, you will have competitiveness in your market. Because open source will power your innovation. The other thing is you need to know that everything starts with your developers. You need to give the developers the tools to inventory all the software that they are binding into software development. That they can define a patch strategy and they can understand what implications come to them, either legal or security. And engage with the communities. As said, if you're using open source, you are a part of an open source community. And therefore, don't just use the source code, but also contribute to it. Make it better, make it your goal that the open source that you're using is at the highest quality possible for you and for everybody else. So thank you. This was all from me and have a nice day.