Welcome everyone to Looking at the East. Thank you for tuning in and watching our show. We have a special presentation today. We're doing our semiannual roundtable looking at issues that are affecting Japan, China, and the Asia region. I have with us three very special guests, repeat guests from previous shows. We'll be starting with Jiri Miseki, who's a partner at Kitahama Law Firm in Osaka. Jiri is a regular on the show. Thank you very much, Jiri, for participating. Jiri is very interested in the topic today, which is the impact of the Ukraine invasion on Asia. We also have Robert Eldridge, who was on my show just a month ago. So Robert, you're doing overtime officially in terms of your participation in the show. Robert's the head of his own think tank and has a very illustrious career in political science with Osaka University and other institutions in the Kansai area. And then Paul, who I think is our returning champion, Paul has been on my show I think more than anybody else. Paul is a professor emeritus from Kansai Gaida University. He is also now professor at the Catholic University of Lille. Did I say that right, Paul? That's correct. Okay, and he lives in Paris. So he's going to give us an overview of how this war is being perceived in Europe. So that's what I want to start with, guys, is taking a look at the impact of this war on the various regions that you guys are familiar with. One reason I want to do this is that my class last week, I was doing a Zoom class and I have several students from Austria. And they began to text to each other and I think that they thought that they were just texting among themselves, but they were actually texting openly. And they were making many comments about the war. And so I brought it up as a subject. And even though, of course, this issue is reported daily in Japan, I could tell those students were taking it much more personally, that there was an emotional element to it, almost to the point where one student was in tears about this issue. So Paul, why don't I start with you since you're in Europe. How is this war being perceived? Well, it's an interesting question. If I were to drive from Paris to Kiev, it would take 25 hours. It's almost exactly the distance between New York and Miami, about 2000 something miles. And the war in Europe has been a shock. Europe at war again, although not an EU country. And it certainly did absolutely the opposite of what Mr. Putin could have dreamed that would happen. And that is Germany, which has always underspent its military budget, and has been criticized for that as well, that the new government has pledged 113 billion this year alone to modernize its country's weapons. There is some debate muted about whether the Europeans want to see Germany rearm. And Germany, a lot like Japan, has, it's a very, very, very long German word, about 17 letters, which is not uncommon in German. They have a public debate about what they call the problematic period of its recent history. That is, of course, a national socialism, Nazism. And basically, within the Japanese contest, it would be to become normal, whatever that means. France, and Mr. Macron, who is up for a reelection, has been a lead in this. And his approval ratings, or at least the polling for April, is that he will sweep in two election, in part because of his handling of this. And maybe if I can make one comment, Europe, as we all know, is heavily dependent on Russia for its oil and gas. Two-fifths of the gas Europeans burn come from Russia. So Europe is really dependent on Russia, extraordinarily so. And maybe one more point I don't want to, is that I asked my class this the other day, who has a bigger economy, Italy or Russia? And the answer is Italy. So when we talk about a powerful Russia, we have to look at really how strong that economy is. Absolutely energy dependent. Most likely, 60% of its GDP is energy related. There is a lot of debate about strengthening NATO. I think there's not as much hysteria, if I could use that, as in the United States, at least the commentary on BBC and on France 24, and on Deutsche Welle, and all these things that I watched. And the newspapers has been, they talk about total war, and they talk about a war in World War III, which it's not, the Russian army is not going to go through the full de-gap, and be it in the English channel in two weeks. This is hysteria. So that's less, it's more muted here, because it's so close. Thank you, Paul. Excuse me, Jerry. So you're an American living in Japan? Yes. I want to point out that you are also a Czech citizen. I am, yeah. And an official representative of the Czech government, are you still? Well, I know, I am not an official representative of the Czech government, but I have been involved here in Japan with the Czech community and the European community, members of various chambers of commerce, French chamber, German chamber. So yeah, I come at this from a number of angles, as you said, as sort of the American angle, the European angle, as a Czech and European, and also living here in Japan. And it's very interesting that each of the different sort of strands that I just mentioned, and perspectives are different. Japan looks at this different than many in the United States, than many in Europe, and particularly Central and Eastern Europe, which as you noted, Steve, is where your Austrian students were also located, and for people there, it really is. And even more than Austrians, Czechs, Poles, Romanians, who were once part of the Soviet Empire, if you will, do have a very, very emotional reaction to also having been dominated. Czechs in particular, before it was the Czech Republic, it was Czechoslovakia, and Czechoslovakia has been mentioned sort of in two major contexts in this conflict. The first is what happened in 1938, when Hitler was basically the Munich conference, and Hitler was allowed to take Zudetman, which is a land where I think Germans lived around the Czech lands, and that led to the total annexation and overtaking the Nazis coming into Prague. And then in 1968, the Czechoslovakia was invaded by the Russians as well as other Soviet countries. So particularly for Czechs, it is a very sort of emotional issue to the point that I think you probably saw in the news that the three prime ministers, the Polish Prime Minister, Slovenian Prime Minister, and the Czech Prime Minister went to Kiev during the recent hostilities. Last month, I believe it was to show solidarity for Zelenski. So yes, it is coming at it from these three different directions. It is extremely troubling conflict. If I could add, I had Polish students, and you're completely right, Giddy, that if we can talk about the Eastern Europe, their experience with Russia is much, much different than here in France. So a lot of emotion, completely correct, the Polish students. And no matter how much people would criticize, and with good cause, NATO expansion, the Poles really wanted it. And so did the Baltic states. They really, really wanted that. So there's no debate there. Yeah, Czechs too. Absolutely. That's exactly my point. Yeah, exactly right. I'm sorry. Hey, Robert, why don't we turn to you as our representative in terms of the impact of this invasion on Japan, from your perspective.  And I know you have contacts everywhere. It's remarkable, your network. I'm always amazed at the people that you know. What are you picking up in terms of how this invasion is being perceived in Japan, and also the subsequent change in relationship potentially between Japan and Russia, which historically has not been so good after World War Two anyway. Right. And I would invite our listeners to view our show last month that you alluded to before. We went into a great discussion, I think, on the impact on Russian Japanese relations. But I'd like to thank you for inviting me again today. It's great to see Paul Scott, with whom I was extremely close in Kansai. And Paul and I worked on a book about 20 years ago on another war. And the co-editors, a different Paul. But our Paul Scott contributed a chapter to this book. It's on public opinion during the war on terrorism, and particularly from 2001, and then again with the invasion of Iraq. So it's great to be working with him on another project again right now, this series. And also, Jerry was a classmate at Colby University at the same time. Different offices, different faculty members who were studying under, but this show is allowing us to reunite. And I appreciate that. With regard to Japan, I think Japan really had no choice but to join the Western alliance against Russia, particularly joining the sanctions. Also, the foreign minister recently visited the region, particularly meeting with Polish leaders about accepting Ukrainian refugees to Japan, and they mobilized a government aircraft to help relocate Ukrainian citizens to Japan. So I was kind of relieved to see Japan step up quickly. As we know in the past, it's usually been somewhat slow in making decisions of such consequence. Although after the war on terrorism, the then prime minister very quickly relayed his sympathy to the United States, for example. So Japan over the past 20 years at least has been kind of more and more in step with the international community. Here in Japan, I think the real concerns have been about what does this mean for China? With China's intentions vis-a-vis Taiwan, as well as the territorial dispute it has with Japan in the form of the Senkaku Islands. So many people are in Japan are watching it from that angle. What are the lessons that China is drawing from Ukraine's or Russia's invasion of Ukraine? Another thing that, and we talked about the last show about how this will affect Russian-Japanese relations, and shortly after we did our show together, Russia basically announced its discontinuation of peace talks with Japan on a peace treaty, which it hasn't signed with Japan. And a couple days after that, Ukraine's President Zelensky addressed the parliament, the diet here in Japan. There are a couple of other things that I've noticed. So there is a great deal of distrust in the media reporting of the war. There's a tendency to be all in on Ukraine and not giving a more balanced perspective about the background to the conflict and what's really going on in Russian decision making. So I think it's increased the distrust that many in the general public in Japan have towards the media. And I think we see that in other countries as well. And then on a final note, since we're talking about the larger Indo-Pacific region, I think it's important to mention India in this discussion. And there's a lot of criticism about India's stance on this issue. And but there's a sort of a double standard that when China is, you know, acts neutral in this, it's given a pass. But when India does, it's not given a pass. But I would argue that India, because of its long standing relations with Russia, is in a much more delicate position in some ways. You know, for example, 85 percent of Indian weapons come from Russia. And roughly the same percent of oil that India imports also comes from Russia. And also foreign policy wise, roughly 100 percent of Russia and the former Soviet Union's voting in the United Nations has been in favor of India. So that country is really, really dependent on Russia. And yet we've been extremely, you know, critical of India's stance on this. And I think one of the aspects of this conflict is that I think we all need to be more aware of where certain countries are coming from. And it's not necessarily in the response, but in the day to day interactions where we build that trust. And I don't think we've done a good job with building trust with India over the past, you know, 75 years. And that's an area that we need to learn from. Interesting. We do have a question from viewers that came in. And it actually, it's to the point that Robert was making about what China will take away from this invasion of Ukraine vis-a-vis its relationship with Taiwan. So Paul, maybe you have some thoughts about that? Obviously, the invasion has not succeeded, at least on the terms of what it seemed like Putin wanted to accomplish initially. And to your point, Europe has moved dramatically against Russia. So there's been that ramification as well. Do you think that this invasion would make China less likely to engage in a conflict with Taiwan, maybe over the next five to 10 years? Or does it make no difference at all? I think it makes a great difference. And I think one great takeaway from this is China has zero experience in conducting military operations at sea. The United States certainly has great experience. And the invasion of Ukraine planned by the Russians was inept, logistic support, all of these things. So crossing 100 miles or crossing the Taiwan straits and invading Taiwan, it is extraordinarily much more complicated military operation. And if I were China, I would think about that a little more carefully than believing the propaganda, their own propaganda, about how weak the US military is. And by the way, the US military is not as strong, especially at sea as it should be. But it is incredibly capable. Robert knows this, and I know this as well. So that would be one takeaway. Jerry, do you have any thoughts on this? No, I totally agree. Of course, the question of the impact of our on Taiwan of what the West and other countries doing against China, I will also be interested to see what impact it has on Chinese expansionism in other ways. For example, the artificial islands and the much more aggressive military operations that they're doing in the South China Sea. I'm wondering if they're going to pause before they keep doing that, because over the years that China has become much more aggressive and blatant, and not just toward Taiwan, toward the Philippines, towards other countries as well. And I'm wondering if they're going to think about doing that. I'm also wondering whether or not other countries, again in the region, themselves get a little bit more aggressive and tell China that if they do continue with the closing off of certain trade routes or sea routes and also with the artificial islands, whether or not they're going to threaten consequences for that sort of expansionism. Robert, what are your comments about this? I'm sure you could ask this question many times. Yes, I do agree with both comments, but I can't help but play the devil's advocate and having served as the political advisor in the Marine Corps and interacting with the other services and throughout our government as a whole. I can't help but be worried about the ability to mitigate an attempt by China to invade Taiwan. I kind of think that we believe our own propaganda too. And there's a tendency when we look at this China-Taiwan issue that a lot of the peaceniks will say, yeah, China has no intention to invade Taiwan, so they dismiss it that way. And on the right, there's a tendency to dismiss Chinese capabilities. And so both of those views are, I think, are incorrect. We need to be aware of China's will or intention, which they've called for for the entire period of their existence, the PRC, and their capabilities have grown dramatically over the past 20-some years. Essentially, as of 2015, they were militarily capable of cease in Taiwan if they wanted to. In the interim, the past seven years, their fusion of civilian and military capabilities has only grown dramatically, as have their military capabilities. The Trump administration tried to stop that, but there's been a long decay over the years. We also have the US has the tyranny of distance it has to solve. Taiwan is much, much closer to China than it is to Hawaii, Guam, Hawaii, or continental US. And I think a Chinese attack is going to be sooner rather than later. It doesn't mean that the Ukraine situation hasn't given China pause about its planning or its concept of operations. If anything, I think it's allowed China to see what's gone well for Russia and what hasn't gone well. And the reason I say it's going to be sooner rather than later, if you remember exactly a year ago, a year and a month ago, Admiral Davidson from Hawaii from the Indo-Pacific command said that China would likely take Taiwan or try to take Taiwan anywhere from 10 or maybe even six years. And it was unclear why he mentioned six years. But in my research, I think the reason is because China has an advantage in attacking satellites. And the US and its allies won't have the true capability to defend the satellites for another five years or so. So last year, he said six years, I think it's because of the plans to introduce the satellite defense system in, and that's not the official name, but the satellite defense system in 2026, which I think is probably behind schedule because of COVID and the supply chain issues, particularly with semiconductors. So it might not be until 2027. My point is, I think China is going to move more quickly rather than later down the road. That's interesting. So to the extent that the Japanese government agrees, Robert, with your premise, I don't know if they do or not. The Japanese government had been even prior to the invasion, maybe in the last couple of years or so, attempting to build a stronger relationship diplomatically and otherwise with Taiwan as a part of a counter to the expansionist policies of China. Do you think that that will accelerate now, if indeed what you say is correct or high Japanese government officials agree with your perspective on this? I hope it proceeds. I've been calling for a Taiwan Relations Act for Japan since 2018, and they haven't done that. A lot of the pronouncements are basically political and diplomatic, but the best way to defend Taiwan, the best way to defend Taiwan is to end its diplomatic isolation. Interesting. Paul, do you have any thoughts on that? Absolutely. The messaging from the United States has to be unambiguous. It has to be clarity, and I agree with Robert completely. If China does decide to attack, it is the tyranny of distance as well for the Americans. There's only one aircraft carrier in the Pacific, home ported in Japan. I would recommend at least one more, and absolutely sanctions are not going to be an effective deterrent, and there has to be, like I said, absolute clear messaging from the United States. There is some talk, some chatter as far as Ukraine, to raise this, that really some people are saying that they don't want Putin to lose. In other words, they're not giving Ukraine the type of weapons it needs, and it's asking and begging for more offensive weapons, and really they want a negotiated settlement, and they do not want to turn Russia. We don't want this to be a Versailles peace treaty, so to speak, with Russia coming back even stronger and more vengeful, so of an equivalent of a giant North Korea, distrustful and vengeful and isolated. Those messages and the emotion, especially in parts of Europe and in the United States, on Ukraine, whether that can be, it's very, very high, high, whether that can be transferred to Taiwan would be an interesting question that I have no answer for. I think there's one interesting parallel between Russia and Ukraine and China and Taiwan. Both Russia believes that Ukraine isn't a separate state, right? It's a part of Russia, and China, of course, believes exactly the same thing. So Jerry, we're running out of time, but I want to give you the last word if you want to comment about this at all. Yes, I agree with the previous comments about, you know, maybe the challenges. The other thing I think to remember is there, in East Asia, we don't have an EU equivalent. We don't have a NATO equivalent. And if there were to be military action, it would really be interesting to see which countries would, you know, align. Would there be this forceful response that you have in Europe? And I don't know that that would be the case. That's a fascinating observation, Jerry, and maybe a topic for another show. Fortunately, guys, we've run out of time. I wish I had another half hour. I have more questions I want to pose here. But I do want to end on this one positive note. Robert talked about the initiative on the part of Japanese government to host Ukrainians. I was contacted a few days ago by an agency that's working with ICU, International Christian University up in Tokyo, and they're hosting Ukrainian students. So I'm starting that initiative now for Konsei Gaidai. And potentially we're going to have some Ukrainian students on our campus to offer them a safe place to be while things are sorted out for them, hopefully soon. We'll have to see how this all goes. Robert, Paul, Jerry, thank you so much for participating. I think I'm going to have to petition for more time when I get the three of you guys together again. Maybe we'll do an hour long special show, because half an hour is just not enough time to cover these issues. Very, very interesting conversation and insights by all of you. Actually, Jerry, I'm thinking maybe contacting Andrew in Taiwan and do a show with him. Andrew's a friend of ours who heads the Chamber of Commerce in Taiwan. Might be interesting to do a show on that. Thanks guys for participating, enjoyed it. Thank you for our viewers. If you have any comments, please send them to Think Tank Hawaii. Or even better than that, there's a fundraising campaign going on right now with Think Tank. If you like this show or shows like this, the 30-some-odd shows on Think Tank, please contribute to the cause. And I'll see you again in two weeks. Thank you, everyone. Thanks again, guys. Thank you so much for watching Think Tank Hawaii. If you like what we do, please like us and click the subscribe button on YouTube and the follow button on Vimeo. You can also follow us on Facebook, Instagram, Twitter, and LinkedIn, and donate to us at ThinkTankHawaii.com. Mahalo.


It is 11, I'm sorry, oh, you mean I have to talk into this thing? Hi, everybody. It is, I want to say 145 because my computer is in Eastern, but people can do the conversion to 1045. This is a session on updates from the Drupal security team. If you have questions during this, you can go to slido.com and enter code SECTEAM and just put your questions in there and we will address them as we go through this. My name is Michael. I am a member of the security working group, I'm sorry, I don't use the term, but yes. I'm a member of the security working group. Next to me I have David Snowpeck and Cache, there's another David out there. Are there any other, nobody else is wearing their hat, so I can't quickly scan the audience and see. We're members of the Drupal security team.  We are all, we're mostly a group of volunteers who do work to keep Drupal secure. You probably know us most from the emails we send out on Wednesday in the form of security advisories. We come from lots of continents, lots of countries and lots of different types of day jobs. Some of us work for hosting companies, some of us work for the education space, some of us work for Drupal service providers, we've got some non-profits in there. We are a pretty diverse group from our backgrounds. So we do a variety of different things as a security team. We triage reported security issues. That's probably like our primary job of what we do. We help with security related Drupal initiatives which I will show off in a second. We coordinate with other open source security teams. Drupal has a large number of third party dependencies. Go look in the vendor directory. And so we coordinate with those other security teams to help do coordinated disclosure around their security releases. We read and respond to messages that are sent to us either through email or through our issue tracker and we track the trends of hacked sites. So we don't actually help with hacked sites but we like to hear about how sites are getting compromised because it helps us with some metrics around that. There's a couple things that we don't do. We do not proactively find vulnerabilities. Now that's not to say there aren't members of the security team who don't go out and try to proactively find vulnerabilities. Sam is not here but he is one of the more prolific people who go out and actually look for vulnerabilities in code. But as a team we don't go out and proactively find vulnerabilities. If you want to, you don't have to. You don't have to. We don't review maintainers code and we don't help fixed hacked sites. Joining us is XJM and she is a security team member and I introduced everybody. And a release manager for Drupal 8. An overview of the flow chart of how work happens within the team is we'll get a vulnerability reported to us. There will be some initial triage that's done to make sure it's a valid vulnerability. Once we've confirmed it's a valid vulnerability, we'll actually include the maintainers of the responsible code. So if it's a contrib module, the maintainers of the contrib module, if it's a part of core, the appropriate subsystem maintainers. And then there's kind of, it doesn't show it on that chart, but there's kind of a loop in fixing the vulnerability. We'll get a patch ready to go. Once there's a patch ready to go and signed off on, we'll coordinate on drafting the email, the security advisor that goes out on Wednesday. We'll choose a Wednesday to handle that release. And we then send that out to the community and hopefully people update their sites. We release security updates on Wednesday. Our window starts at about 4pm, I'm sorry, noon Eastern, 4pm UTC, and goes until about 5pm Eastern. With security advisories, we encourage maintainers and in core, we make sure that the advisories contain the minimum amount needed to fix the release. We don't want to actually fix bugs in a security advisory. We want to make these easy to update your sites with as least dependencies as required and as least. And to minimize the chance that one of those bug fixes will actually accidentally break your site, which would then disincentivize you from updating to the security release. We want you to update to the security release all the time immediately. You can follow us, that's very loud and feeding back on me. You can follow us. The best way to follow us is on your Drupal.org profile. Click the edit page and under newsletters click the security release. There's also Twitter, there's also RSS feeds. There is also Slack. The security team is involved with a large number of other Drupal ecosystem programs. The Drupal 7 extended support program, Drupal Stewart, the automatic updates initiative and Drupal 6 long-term support. If you're interested in joining the security team, if you go to security.drupal.org, forward slash join, it'll actually give you another link to click on that is much too long to put on the bottom of a slide and these are some of the requirements in joining. As some of you may be aware, Drupal 7 is reaching end of life. Once Drupal 7 reaches end of life, the security team will no longer be providing security advisories for it. There will be no more core patches made on the core repo and it will no longer be supported by the community at large. There are some solutions for this though. Drupal 7 extended support vendors will be, Drupal 7 extended support will be provided by vendors. If you're interested in becoming a vendor, here is a link you can go to and as of now, we luckily have two vendors who have already been approved. That's my Drop Wizard and Tag 1. Okay, we're doing great on time. One of the things I want to talk about briefly are some security best practices. There's a large number of sessions here at Drupal Con that go over this material, but I'm going to quickly go over these and I'm going to use a metaphor to do these in just a quick show of hands. How many people brushed their teeth in the last 24 hours? How many people would just out of curiosity think it would be okay to just brush their teeth like once a month or once a year? No one? Oh, maybe I should put my hand down. Brushing your teeth is a best practice. We all agree this. We all brush our teeth for a variety of reasons. It prevents bad breath. It prevents cavities. It's good hygiene. We would never think it would be okay to occasionally brush our teeth. Security isn't a checklist. You can't just check the box and be done. You have to continually work at security. It should be part of your weekly, monthly process. When you deploy new code, when you make changes to your system, you are potentially changing your site's risk factor. As a result, you should evaluate what that change is. Within my day job, I have security auditors that knock on my door, I don't know, maybe once every nine months or so. They ask questions and I answer them, but if all I did was pay attention to them once every nine months, I'd probably have a lot more sites compromised than I do. Automatic updates is upcoming. There is an initiative on that. If you're interested in automatic updates, please join us on Friday. We will be sprinting on automatic updates in core. There was a session yesterday on that that was recorded, I think it was recorded. Covering that, I'm not going to go into too much details on that now. Drupal Stewart is a new service from the Drupal Association and the security team. I'm going to briefly go through what Drupal Stewart is, and then I'd like to just turn this over to questions for everybody to ask. It's really the point of the session is to ask questions of us. Drupal Stewart is a web application firewall that protects sites from certain vulnerabilities before the vulnerability is disclosed and the update is released. There's often this gap. The security team publishes a fix, say 1 p.m. eastern on a Wednesday, but 1 p.m. eastern in your local time zone is 3 a.m. And so either you have to wake up and patch your site, or you have to take the risk and wait till 9 a.m. the next morning to patch your site. Drupal Stewart attempts to solve some of that with a web application firewall. A web application firewall works by filtering requests before they hit your server. So you have the internet, people making requests to your website, which is kind of where cash is sitting. And as the request comes through, the web application firewall in the middle looks at those requests and decides whether or not they should pass or not pass. Maybe if they should pass it lets them through and if they shouldn't pass, it basically blocks the request and sends a message back to the user. This doing this in this way lets us prevent sites from having to be on Red Alert for like waiting for that patch, as I mentioned earlier. There's unfortunately a couple limitations with this. This only is going to apply to highly critical core vulnerabilities at least to start with. There are some types of vulnerabilities that actually cannot be mitigated with a WAF. And so this won't actually help them. So how does this work? And before I get into this, please do not take pictures of this panel without asking first. And well, actually let me just rephrase that. Please do not take pictures of this panel. The slides will be posted on the session note at the end of the session today. So how does this work? Security team identifies that a reported vulnerability is a highly critical and mass exploitable. It has to meet both of those requirements. For example, SA core 2018-002 was highly critical and mass exploitable. The security team determines whether or not this vulnerability can be mitigated by a WAF as not all vulnerabilities can be. And it could have been mitigated by a WAF in this instance. And the security team will release a PSA, which we typically do for all highly critical mass exploitable vulnerabilities, and it will indicate on the PSA whether or not the vulnerability will be covered by Drupal Stewart. The Drupal Stewart WAF rules will be communicated to our vendor partners and put into monitor only mode. And so what that will mean is that it won't actually block any traffic, but we'll get hits on what would have been blocked that helps us refine our understanding of vulnerability but also make sure that the rules that we're going to push out don't break sites because that would be bad. Security team and the partners review these rules. We make refinements and prior to the release the WAF rules get switched into an enforcing mode so that we will actually start enforcing those rules as they come through. And the security team and partners then push that out. The pricing on this is broken down into three tiers. These three tiers will likely be renamed. There is a community tier where we're targeting between 100 and 250 a year. This is for smaller sites. There's a standard tier, which is for non-enterprise hosted sites that will be available through a trusted partner. And then there's the enterprise tier, which are for your hosting companies. They're all a little bit different. The enterprise tier actually can do a little bit more than a typical WAF because they're hosting companies. They can actually inspect the PHP request. They can do other things with the vulnerability itself. Why isn't this free? This is a great question we get. Code is free and always will be free. Drupal is licensed under the GPL. Code is free. But this is not code. This is a service that's provided by vendors. And there's costs to running this service. The patch is always the best way to mitigate all risk.  It's better than nothing, but it is not a complete mitigation. The patch is. Why can't we share this with everybody? Well, unfortunately, the nature of those WAF rules actually might disclose exploit paths on the vulnerability, which is why we can't just share the rule with everyone. However, once this starts to get mass exploited and is publicly reported, we absolutely can share it with other people. And probably through, there's a, I'm not quite sure how to pronounce that, S-I-W-E-C-O-S is a hosting platform that is designed to share, among other things, firewall rules for known vulnerabilities. If you wanted to be a partner, there are some requirements in this. There is a URL to get more information on this. And if you'd like to be added to the potential partner list, there's a list there to be emailed. But I'd like to take the last 15 minutes of the session and see if there's any questions from the audience. You're free to submit these through the Slido platform, as well as just come up to the microphone and ask questions, of course. Since I was pressured into coming and sitting up here, I thought I would add one update that Michael did not include in his presentation. Another thing that the Drupal security team has improved in the past year is that minor releases for Drupal 8 core now receive a full year of security coverage instead of only six months. So if any of you have had a Drupal 8 site for a couple of years now, you might have encountered a problem where on some random date, like October 4th, Drupal 8.4 is scheduled to be released, and you know that Drupal 8.3 is going to lose security coverage almost as soon as this comes out. So suddenly you have to scramble to get your site updated, and then maybe there were things in Drupal 8.4 that were disruptive and breaking. I'm using that as an example because we actually broke Drush with that release. So after our experiences with that, we changed the policy so that there's two minors that have security coverage at the same time. There's the actively supported bug fix minor release, which right now is Drupal 8.6, and then we're also at the same time providing security releases for Drupal 8.5. So you have a, instead of it being like you have to get your update done on a specific date, you now have six months in which your business can plan ahead and schedule, okay, we're going to do our minor version update for Drupal core. And this time we know that makes sense in our businesses. Practices, our university schedule, whatever. And so I encourage you if you're doing your update to Drupal 8.7, coming up on May 1st, just keep in mind also that you can continue to run Drupal 8.6 safely until December 2020, and just plan to do the Drupal 8.7 update at some time that works for you between now and then, so. Thank you. Yeah, hi. Question about the Drupal Stewart. How is the traffic routing handled that you are protected by the WAF? I'm still kind of confused by that point. So we are looking, we've currently sat on RFPs on that to determine what the community tier is and the individual tier, but you will likely route your traffic through a CDN provider. And so that CDN provider will take care of it. For the hosting companies who become the enterprise partners, they will direct you on how to route their traffic, where they may just take care of it for you as I look over to one of those. So it'll be, it'll be, you know, it'll be fine in that way. So the idea would be you'd go with one of these companies. If you're part of Drupal Stewart, you'd stay with this company and continually have your traffic passing and then, okay, gotcha. Thank you. You could route your traffic when the PSA comes out and stop routing it afterwards, but that's a lot of work to do potentially. Sure. Okay, thank you, I cleared it up. We did get a question through Slido. There's a lot of questions through Slido. I just wanted to say to you and the team, you are awesome, nice work. Thank you. So appreciate the security team, sets Drupal apart security. What, I'm assuming this is what security module should we all be using? TFA is one of them. There's a security review module that comes to mind. There's the content security policy module that helps protect against cross-site scripting, set kit, paranoia in Drupal 7 is a great module, not really needed as much in Drupal 8 because we removed the ability to run PHP code in Drupal 8. Thank you to whoever did that. How does a contrib module maintainer get security coverage? That is a great question. There is an outdated project application queue mechanism that is there. It actually is still being reviewed. There are still people who follow that queue. If you feel your project though has stalled for now, you can email the security team and we can help bump that project along. Our long-term goal is to replace that with a more interactive format such as code examples and a quiz and it's an automated process as opposed to what's there now. How does the security team work when there's a vulnerability on softwares that are powering Drupal like PHP and Apache and third-party tools? Security team doesn't really get into the scope of what you're running on your web server. I've got another slide that I didn't give here that if hosting is not really your business, you shouldn't be hosting your own site. I realize that might be a somewhat controversial thing to say, but we all choose our lines of work and for most of us, we are not hosting providers and so if you are trying to host your own site, you have to worry about maintaining the security status of your servers, you have to worry about the updates of all that software availability and it's most oftentimes more economical to find someone to host that site for you. I will say though sometimes when there is a particular kind of vulnerability that's discovered in PHP and the whole PHP community has to respond to it, we have done security releases in those situations to add support to Drupal that protects Drupal from the kind of exploit that's there that's happened a couple times in the past and I think there was also a question about third-party tools there. That could have been referring to third-party dependencies. So for example, Drupal 7 depends on jQuery, Drupal 8 depends on a lot of stuff including symphony, jQuery, guzzle, there's lots of Zen framework components and stuff that we have dependencies on. So when upstream projects have a security release, if the security release is directly exploitable in Drupal, then we will try to do a coordinated release with them and do a new release of Drupal Core at the same time that updates to the fixed version of the dependency. If the dependency does not, is not directly exploitable in Drupal, then we don't do a Drupal Core update for it. So I'm not sure, in case that was the question, I just want to make sure we get the answer for that too. Thanks. Quick question about modules that are covered by security advisory and that aren't. So I know that stable releases are covered, but often there are cases where an alpha release is there or a dev release and has patches that are working. I guess my question is, how frequently are those modules checked to see, okay, now it's covered or is it just kind of semantic versioning to say, okay, this version works, we scanned it and now it's covered by the policy? How does that work and what is not covered? So the security team doesn't proactively review modules. The project application queue was an attempt to somewhat do that as it flowed through. But for the most part, when you click on the report security vulnerability link on the side of project pages, we direct you where you should post that vulnerability based on both is the project covered and is there a stable release? There's probably some improvements we could do around there. We also don't allow projects to opt into coverage if there's an open tag release or an open tag issue with a security flag on it. It's really a question of whether something goes through the security team's process or just happens in the public, right? That's really the only thing that's different. But if you don't find any... It's on the module maintainer to just mark a stable release. I think that's exactly. So someone has to actively say, wait a minute, we're not really vulnerable. Here's exactly. And at that point, well, they may or may not have security vulnerabilities, but by tagging their stable release, if they've been eligible or to and opted into security coverage, at that point, all of their stuff will be considered a security issue if it's reported and handled in private according to our process. Yeah. Something saying that it's covered by the security team does not mean that it doesn't have vulnerabilities. I think it's probably safe to make the complete opposite assumption that every module has security vulnerability rights. Like, if you just look at the vulnerabilities that the team publishes, we're publishing vulnerabilities primarily for the most commonly used things, right? Like, you know, you could say, like, well, views has been around forever and tons of people have looked at that code and everyone depends on it. But like, we're still going to keep finding security vulnerabilities and views, right? But so I guess the question is, I understand in court, you're going to actively monitor it. But for those other modules, you said, you don't actively. You know, unless a vulnerability is reported, you won't actively audit those other modules. So that's not the job of the security team. Our job is to maintain this process. Other people in the community are constantly checking, contriving, core, and looking for security vulnerabilities. And when they find them, they come to us and then it goes through the process. Great. Thank you. While you're coming over to the microphone, is there a good method for assessing the vulnerabilities of custom modules? There are some tools that try to automate this process. But honestly, the best method is to do a code review. Find someone to help you do a code review. Read over your own code. I typically will do the thing where I'll go through and explain my module to a fictitious person who's not in the room and just walk through what I'm doing out loud and why I'm doing it. And I will often find a lot of things that way. But doing a code review, especially doing a code review of code you didn't personally write, is really the best way to find security vulnerabilities. Peter and I just got done with a session that did not get recorded, but the slides are available entitled Cracking Herple that shows a lot of the common patterns that introduce security vulnerabilities. And so that's a great place to start. I think I'll just throw in there, if you're not familiar with a coder module, it has some rules for PHP's code sniffer. And it will help find some of the very, very basic security vulnerabilities which are more just misuse of the API. So I would consider it a very, very low bar, but you can run it against your code just to kind of get started. I'm going to add a little bit more to the gray area of what your charge is, in addition to what he was saying was that when Drupal 8 was first released, the encrypt module was actually really far from actually being ready. It remained in beta I think for almost about a year and stuff like that. For my organization, which has to remain strictly HIPAA compliant, we had a lot of problems actually trying to use it. And there was a lot of questions whether Drupal was secure and secure between people who are not familiar with open source learning community. It just seems to me, I understand this is probably gray area for many of us to understand and you guys are very clear what your charge is. But it also seems to me that you have actually have a great deal of influence. So actually make sure that these things are actually maybe up to snuff, or at least for release. I would point out that there are tens of thousands of contributed modules for Drupal Core and we have a volunteer team of 30 some people. Like the scope of work is enormous. I guess the question is, are you, we try to, I think that we try to influence by communicating best practices and sharing with the community what things are. But any, so is your concern about this specific module, which was a security improvement that was important? Well, it's an encrypt module which is used for security and security of data. But also at the same time, it wasn't necessarily ready. I understand kind of what's in there. That's on those project maintenance really. That's a very big gray area for a lot of people to understand. But it would actually make things actually a lot more assuring for a lot of people. I think the best thing to do in that situation is to get involved in that project queue, find out. From the maintainer, just simply ask the question, what's holding you back from creating a triple aid version of this module? And then if it's something that's important to your organization, see if there's a way you can help them. Do they need money? Do they need developer time? What kind of support do they need? Contributed module authors, they're volunteers, a lot of the time doing things in their spare time. And the best thing to do is find out if you can help. I want to use this module in Drupal 8, what will it take? OK. Then just a quick follow, are you guys involved also with from security aspect of the release of Drupal 9? Well, so Drupal 9 is going to be basically exactly the same as Drupal 8 with deprecated cold layers removed. Starting with Drupal 8, we've adopted a process called the continuous upgrade path, which is a concept and practice that we have borrowed from, learned from, symphony. In essentially, Drupal 9 is not a complete rewrite of code. Drupal 9 is Drupal 8 with deprecated code removed and updates to core dependencies. And I will say that the Drupal core product, like new code, we do try to, we take into account security when we add new code and features to the module. It's not to say that there's not vulnerabilities. There always will be. But it's an ongoing process to find and report them. But it's not going to be something or it's going to be like Drupal 9 is an entirely new thing. In fact, Drupal 9 is probably going to be the safest release of Drupal 8 because it will have no new features in it. It will be exactly the same as Drupal 8, 9, with just accept that APIs that were deprecated will be gone. And so hopefully, we'll also have less of the problem that you described, where a module you needed was not available at first in the Drupal 7 to 8 update because of this continuous upgrade path deprecation process. It makes it a lot easier for modular developers to write code that's compatible with both Drupal 8 and 9 at the same time. And so that means it's less work for them to be compatible with the next branch of Drupal. They can do the work at a time that works for them in their lives and their schedules rather than having to be, oh no, Drupal 9 is going to be released now. Let's all rush. And I have to find time for this volunteer thing that I posted on the internet a while ago. Get it upgraded to Drupal 9. And it should be a lot easier for them too. So hopefully, we'll see less of that with this release. Thank you. I think the stat is that 40 something percent of top X modules are currently Drupal 9 compatible already as of a week ago when that stat was run. Can I add something to the first part of your question? Sure. Just like about the sort of conception or misconception of what the security team does. The security of Drupal is the responsibility of the whole Drupal community because it's an open source project. In order to do the sort of coordinated disclosure that we want to do for Drupal, which improves the security, some information needs to be kept confidential. And in an open source community, how do you do that? Because the code is available, everything's out in public. And the way that we do that is by making a small security team to handle just the things that need that confidentiality. The majority of security work in Drupal is to be done by the whole community in public. In our job, it's just managing that component that needs to be confidential. If that answers your question. It doesn't. There's other questions that we can go on. I know it's a long discussion, but I'm satisfied with the development. Thanks so much. Thank you. So unfortunately it is, I want to say 215, but it's not 215, it's 1115. And we need to move on because the session is over, but we will be hanging around. The security team typically wears hats that are either white, black, or blue. So if you have a follow-up question, feel free to find one of us. But thank you, everybody. Thanks for the question. Thank you.


The next speaker would have been Telea Mayo, but she has a family situation, so Jean Camelo is so kind to give the presentation for her. So Jean is from the University of Central Florida and the presentation is going to be about climate change impact on hurricane storm search risk. And with that, Jean, if you could start sharing your screen that would be great and the floor is yours. So hi everyone, my name is Jean Camelo. I'm presenting in behalf of my advisor and Dr. Telea Mayo. So we are basically interested in the coastal region because it is a dynamic area where there is a lot of intersection between physical processes and it is where water, land, and the built environment interact with each other. So a good example for that is Hawaii. Here is a picture and you can see that the coast is lined with both the national environment where you have the dunes and some greenery combined with the built environment such as these hotels right here. And the coastal region is also home to more than 40% of the population of the United States and it's only expected to grow as you have more and more people moving towards the coast. And this region is at an increasing risk for natural hazards such as floods and coastal erosion. So one of the naturally occurring coastal hazards in this area is storm surge and hurricane storm surge is an abnormal rise of water generated by strong winds and low pressure. So you have winds that are blowing over the water and they tend to pile up and as it reaches towards the shore it gets pushed up even higher. Although the low pressure coming from the center of the hurricane can also raise the water level, its contribution isn't nearly as much as the wind. So what we know as storm tide is basically just storm surge and the astronomical tides together. And when surge happens during high tide for example, you have like this like interaction where in surge and tides because they're able to amplify the surge heights as well. So here are some of the parameters that can affect the formation of storm surge and we are concerned with the hurricane properties. So in this study we focused on this hurricane parameters and what is generally accepted that can contribute to having a higher surge would be having a low central pressure, having a large size or radius and if you have a slower moving storms or having just slow forward or transition speed and you have this high wind speeds or just very intense storms and all in all like this can cause higher storm surge heights itself. So we are concerned because we wanted to study how this hurricanes would look like in a changing climate and we all know that climate change will have significant impacts in the coastal areas as well. Especially we've seen this from the very active hurricane season last year and we really think this is concerning. So there are different studies on how climate change will have an effect on hurricanes in the future but for storm surge concern we keep an eye on projections that says that there will be a shift towards stronger storms meaning you have higher wind intensity and lower pressure. Studies that says there's going to be an increase of radius and size or if you have just a slowing down or the slowing down of transition speed of hurricanes itself. So our study picks up from the results of an earlier work by one of our colleagues Ethan Gutman in 2018 where they basically simulated hurricanes from the years 2000 to 2013 in the present condition by forcing the WARF model with boundary conditions coming from the era entry model as well. So this same process is repeated again but in order to introduce the pseudo global warming scenario they impose the high emissions signals or the RCP 8.5 at the boundary. This warf model is actually very good because it is about four kilometers grid spacing and from this model they were able to recreate 22 storms that were present in both the present and the future scenario. So one caveat though is that the tracks of this warf model and the current storms that are in the herd that are the best track from the national hurricane centers do not really follow exactly the same path but they're very close and some of the hurricane properties in the warf simulations differ slightly as well. However for our purposes for storm search modeling we will take this warf storms and we will be comparing them to each other with the present and the future states to see how it affects the generation of storm search. For the storm search modeling we were able to successfully simulate 21 out of the 22 storms. So in order for us to be able to simulate storm search using a numerical model we use this model called ADSIRC or the advanced circulation model. It's a full physics model that uses the finite element method to solve the generalized wave continuity equation and the advantage of using ADSIRC is it has unstructured meshes and it allows you to have finer resolutions in the areas of concern like the coastline for example and you have larger elements in the deeper ocean and this helps out with the speed of computation as well. ADSIRC is able to take in various metrological forcing so for our study we use outputs from the warf model and it can be coupled with the wave model such as swan as well. So for this study instead of comparing the results of the search models to tidal gauges we just we look at certain heights in in different areas. What we did is we looked at or we used two different metrics. The first one is the inundation area which tells you which places in the coastal regions which were usually dry land but are now considered wet after being inundated with storm search and the second metrics that we use is the inundation volume which basically is the amount of water that is being pushed through the shore due to storm search. So what we did is we take the areas which is coming from the metrics before the inundation area and multiply the storm surge heights. So the mesh that we use for the ADSIRC model is called the HSOFS mesh or the hurricane surge on-demand forecast system. It is a very good model because it uses 1.8 million vertices which is those are the nodes where you get the the surge heights from and it's about 3.6 triangle elements and some of these elements actually extend over land which is what we wanted because we're concerned about inundation. So this is the HSOFS domain and as you can see it covers the Atlantic ocean and the Gulf of Mexico. This is how deep the ocean water is and this green part right here so you have like Florida the Gulf states so this green part would be the over land coverage for the domain itself. So just to show you the results of the simulation that we did so this is Hurricane Ike so above is the present scenario and at the bottom is where the climate change signal was introduced in the model. So at first glance it doesn't seem like there's much of a difference between the present and the future scenario but you'd see that for Hurricane Ike it's much more deeper red which means that you have higher storm surges for the future scenario. So if you look at the differences between the the future and the present right here on the right you'd see it's a lot more red which means that we're expecting that a storm such as Hurricane Ike in the future with this climate change signal would result in higher storm surges which is about 25 centimeters to more than one meter. In terms of changes in hurricane parameters future Hurricane Ike saw that there's an increase in wind intensity and increase in radius a slowing down of translation speed and a lower lowering of central pressure. So another example of a simulation we did is Hurricane Isaac so Hurricane Isaac made landfall in the Gulf area in 2012 and again the above one is the present simulation and the bottom would be the future so in the present simulation you'd see that a lot of the high waters are found in the western part of Florida which is just above Tampa Bay but if you look at the future scenario like this is already gone and some of the high waters were actually located south southwest Florida and some of them are here in Louisiana and Texas and this is clearly shown in the differences between the present and the future will compared to hurricane Ike here you'd see there's actually a displacement of water so this is where the water used to be and now like you can find it here in a different area. So in terms of changes in hurricane properties hurricane Isaac in the future saw that there is also an increase in wind speed an increase in radius an increase in translation speed and a lowering of pressure however we think there's other factors that might have contributed to the displacement of water in this situation. So when we looked at the overall changes so I have here I have the maximum storage storm surges so all of the 21 storms we got the maximum of them it looks like there's different there's several places that she can see red which is which means that you have storm surges that are higher than four meters and in the future what we found out is because of this warming conditions we can expect that there's a general increase in storm surge heights in the future we also saw increase in both inundation volume in area and there's just higher surges in more concentrated area especially in the states of Texas Louisiana and Mississippi some parts of the Florida the Gulf area some parts in the Carolinas and New Jersey as well. So we also tried to look at the hurricane properties and how they change with climate and how it affects the inundation so what I have here is a graphic where we rearrange the storms in in terms of increasing inundation volume so for all of the simulations we did Hurricane Ike had the greatest inundation volume for both present and the future and the way this graphic is arranged is the darker bands show you hurricane properties that contribute to higher storm surge so you'd see for wind intensity you are expecting storms that have this darker blue bands to it looks like we lost Jean unless I lost all of you guys nope I think it's her connection hopefully it comes back in a second yeah let's let's give it a few seconds maybe at the bottom hell over nope she's gone other shoes Jean sorry I think we lost you there for the last 30 45 seconds or something you were mentioning Hurricane Ike had the the largest impact currently as well as in the future scenarios and that's where we lost you oh thank you would you be able to pick it up from there um yes um are you able to see it now yep yes thank you um okay so sorry about that so again um so this rainbow graphics that we have basically um what we did is we rearranged the storms from the least to the most inundation volume so for for both the present and the future scenario we actually have hurricane Ike that have the most inundation volume so the way this is arranged is the darker bands represent the hurricane properties that we think contributes more to to more inundation volume so the darker blue for wind intensity you get a darker orange for radius since slowing down translation speed contributes more so we flipped it also pressure was flip um so we usually expect that having a higher wind intensity would contribute to more inundation volume or more storm surge however what we saw is you have storms that have darker color bands than Ike like for example we have Irene and Ophelia right here um but they are not at the I guess like at the bottom which means like they have more contribution to uh sorry storm surge inundation volume so what we saw is if you look at this last five storms that have the higher inundation volume we don't see really any significant pattern or this combinations of hurricane properties that would possibly have a positive effect to storm surge volume itself so what we did is we take this percent change to sort of like uh I guess like normalize the hurricane properties versus the hurricane volumes and what we see was quite interesting and here we have again the properties that are known to increase surge which is in red so um having an increase in wind speed an increase in radius um a slowing down of translation speed and um a decrease pressure would be in red so what we see here is Ike had the largest volume in present in the future climate however the change between those two is just about 32 percent which is fairly small compared to um Francis for example which saw the largest change in inundation volume which is about 161 percent change however if you compare um the properties between Francis and Ike for example they're they're very different so Ike saw an increase in wind speed an increase in radius a slowing down translation speed and a lowering of pressure however the largest change which is Francis had a decrease in wind speed a decrease in um in radius um an increase uh sorry a decrease in translation speed and a decrease in pressure which is very different so that's that's what we saw with all of this storms when we looked at um 21 storms as a whole so just to recap what we've seen here is we've seen an increase in both inundation volume and area over the 21st century and we think this is increasingly important because um we are actually expecting higher surges in more concentrated areas and it would have significant impacts in the built environment um I would also like to point out that these simulations do not have sea level rise yet and we think that if you add these signals it may further exacerbate these problems as well and one of the surprising things that we saw in this um study is we saw that the changes in inundation or the magnitudes of storm surge is not easily predictable by a single hurricane characteristics and even if you use do you look at them as a whole if you take them all together it's so difficult to predict the outcomes without doing the actual numerical simulations itself and um if you are interested if you want more information and details about the study um we have a paper that's out now and I have this like QR code for your convenience thank you wonderful Jean that was a very nice presentation and it's close to my heart because I'm I'm really fascinated by uh by hazards natural hazards so so very cool thank you thank you um so we have uh let's say a couple of minutes for some questions and again if you under reactions there is a raised hand if you could use that that would be great but you can also pass your question in the chat and I give it a minute or something or a few seconds to see if there are any questions coming in and while waiting maybe um we had yesterday we had a talk uh from our area and he talked about beach supplation and how different that can be between various communities of wealth and I imagine that those beach supplation can change over time as well and I'm just wondering how this will you know beach nourishment nourishment basically right that that's um that will impact storm surge as well and if those policies are changing over time and I'm just wondering if you're planning for future scenarios to take some of those human controls into account where you have a you know pure natural system versus um beach nourishment uh very sparse versus you know lots of nourishment going on are you are you guys thinking in that direction or are you focusing more on uh on the changes in in natural parameters um that's actually a very good question and we haven't really looked at that um we were more I guess like for this study um part of this actually is they also looked at precipitation so that's another thing that um my apologies for the technical issues we can see if it is that we're we're we're losing you there uh can you can you give a brief summary of what you just said yeah I'm sorry so in in terms of in terms of the the modeling itself for the ADCERC model um what we can do to add those scenarios is we could change the mesh the bathymetry of the mesh just to um add in like new built-in environments or we could also change the friction um if if you have like more vegetation for example in those areas so those are um the ways to I guess like add in like all of this new changes that could help prevent having storm surge and storm surges and flooding in the future yeah thank you and there's one other question in the chat um and this from Brad Murray why did inundation from Francis change so much when individual characteristics didn't um so Eureka and Francis is actually one of the interesting ones that we saw um what we were thinking is it's possibly because of the um there's also a change in track and those things actually came naturally from the wharf modeling itself and um I guess like these changes go beyond from what we were looking at so um we're thinking it's possibly because um Eureka and Francis was the future Eureka and Francis was actually was actually getting closer to land and that's why it had more um inundated inundation volume or flooding