who can't help but get 2,000 different hands involved, where you're just dealing with layer upon layer of people that need to have their input. With Daredevil, I mean, it's not like Daredevil isn't an inconsequential character, but he isn't a high profile Spider-Man. And so there's a little more freedom, I think, that the creators get to do, and develop a character that's more innately interesting other than trying to make sure they check off all these boxes on, is this going to appeal to the guys that love comic books? Is this going to appeal to people who don't read comic books? Is this going to? It's like, no. We're going to make a very compelling character. And my wife, Leslie, she's never heard of Daredevil before. She likes it? Yeah. And she thinks it's like, hey, I watch it. I don't even know who this guy is in the Marvel Universe. Oh, it's very. There were a couple episodes. I was watching the one I watched last night. I'm right in the middle of the season. Episode five, where they're sitting on the step after dinner, and there's this really intimate moment between Karen and Matt. And I was thinking, man, this is like a level of, I'm not like a comic book. The acting is really, really, really good. The acting's good, but the scripting's amazing. It doesn't feel hackneyed. No, you're absolutely right. And it's so easy to fall into these tropes. I mean, it is tropey. I'm not going to say that it's not tropey. Well, it can't help, but it's a superhero thing. It's part of the baggage. But I was saying to Jen is like, the character's in this other than the supernatural bent that's part of it, there's a vigilante running around this really hard-up-done part of town that's beaten up all the bad guys and stuff. That's not out of the realm of possibility. Not improbability, but just like, yeah, I believe a guy gets really angry and just goes around in a ski mask, dumping on organized crime. I'm not sure he would survive, but. I really enjoyed their take on Frank Castle, I think, the Punisher was really, really well done. Think of every Punisher movie they put out, starting with the Dolph Lundgren one and ending with that British actor where they shot everything in Montreal. They were all crappy, the Thomas Jane one. The problem is they wanted to make the guy likable in all those. There's some aspect of him. It's like, no, that's the whole point. He's a guy that's literally across the line. And there's no point where he's going to turn back. I do think it's sort of funny. All right, we're going to start the show. Sorry, guys. Oh, OK. Oh, sorry. Yeah. There's a show. You ready, Darren? Yeah. Sorry, I didn't want to interrupt such a great show. Yeah, I know. We have to interrupt their show to do this show. That was a good show. I'm just like, yeah, I'm not going to go long. We'll return to your regularly scheduled and return after the show. All right, here we go. Tech news, a daily frontier to explain advancing technologies and how they affect you to seek out new gadgets, apps, and pics of the day. These are the continuing missions of the Daily Tech News Show. But Tom and the crew can't do it alone. To help keep DTNS on the cutting edge of news and lovable, goofy, curmudgeonly commentary, visit dailytechnewsshow.com slash support to show your support. Now, let's hear that other theme song. This is the Daily Tech News for Friday, March 25th, 2016. I'm Tom Merritt, joining me today. Mr. Darren Kitchen, hack5.org, hacking his way through your lives and into your hearts. Yes, and your email sometimes. J-K-O-L. Occasionally. For good. It's a good letter. Yeah.  And what it meant was, like, the ones you sent me. The ones you sent me, right. It was the email administrator. So they might have taken that a little off anyway. You know, I hack your email. I mean, that means I spell check it and then send it back to you with correction. Man, you know who else is hacking together some epic artwork? Mr. Len Peralta is with us as well. You can find his great works at LenPeraltaStore.com. How are you doing, Mr. Len Peralta? I'm doing well. I'm so formal with you today. I don't know. I don't know why. You know, it's because it's Easter weekend. And happy Easter weekend to everybody out there who celebrates Easter. It's a good Friday today, and it's going to be a great Friday because Darren and Len are here with us. You know, it's funny. I've been watching the Spanish national television broadcasts every day to try to help brush up on Spanish. Top story. Like, a front of the Brussels news. Top story was, like, the parades and the celebrations and everything. Oh, right. Huge. I didn't realize. I mean, I knew it was huge, but I didn't realize it was. How huge it is in Spanish. Oh, it's huge. It's enormous. It's enormous. Well, we're going to talk a little bit about how 17 lines of code being removed from one place can bring down a huge chunk of the internet. And that's kind of by design, I guess. Darren, is that fair? It'd be fun. We'll kick that one around. It's not necessarily a bad thing. We're actually going to beat around whether it's a bad thing or not. But let's start off with the headlines. Netflix admitted Thursday it reduces the default bit rate of its streams to viewers that use AT&T or Verizon in the United States down to 600 kilobits per second. Netflix normally streams somewhere between three and five megabits per second. Megabits per second. Back in May, Netflix intended to release a, or I'm sorry, coming up in May. I get unstuck in time. Coming up in May, Netflix intends to release a data saver application that'll let customers choose what video quality they receive on mobile. There's a similar thing that you can do on the desktop, but we don't think it affects your mobile streams. T-Mobile limits streaming of its partners like Netflix to 1.5 megabits per second. That's around 480p. And Sprint used to restrict streaming video to 600 kilobits per second, but they stopped doing that last year. And Netflix says, well, Sprint and T-Mobile have more customer-friendly policies, so we don't throttle them, but we do throttle AT&T and Verizon. Yeah, this is really interesting. I think that Netflix is well within their rights to make that decision. And actually, this stream, if you're watching live now, may go up or down based on network conditions, and that's a very normal thing. I know many video engineers that do this exact thing, where you try to maintain a constant quality, but you vary the bitrate depending on those conditions. And I feel like if Netflix wants to do this, that is totally cool, just like if they wanted to respond to a terrible ISP that has some bad net neutrality questionable practices, they could 360p that whole network or even preface every stream with a annoying message about how terrible their ISP is, and maybe they should look for alternatives. It's well within their rights, because ultimately the FCC net neutrality laws only apply to the ISPs. Well, yeah, exactly. And a lot of people want, especially the carriers, would like you to think this is also a net neutrality violation. The whole point of net neutrality, whether you're forward or not, is the pipes that carry things are neutral. And you, as someone who sends things through the pipes, can send anything you want as fast or as slow as you want. But the pipes, if they say, well, we'll deliver it no matter what it is at this rate, we'll be capable of doing that. It's basically like, I don't know, I can't think of a good metaphor for it right now, but it's basically like I can go on the highway and the highway is rated for me to drive up to 65 miles an hour, but I can drive 45 if I want. I don't have to drive 65 miles an hour. And I'm not violating the highway rules if I do. I also love the fact that AT&T, which is also trying to avoid paying its own $100 million fine for throttling, says it's outraged by Netflix's, quote unquote, air quotes here, throttling, yeah. I don't wanna give Netflix a complete pass here though. If I'm an AT&T subscriber, or I used to be, and I used to be a Verizon subscriber, I would like to have control over that because Netflix isn't doing this because of network conditions. Netflix is doing this because they say they don't want their customers to run up their data caps. Well, let me make that decision, please, which is what they're gonna do in May, but I kinda don't like that they didn't tell me they were doing this. Well, they do the same thing where they determine, okay, so this is very similar to what they do when they determine your geolocation. They may say like, oh, but we see that you're dialing in from France now, so we're only going to give you the French bits even though you may be a U.S. citizen on holiday. I think that's different though. Yeah, I don't know, it's the same kind of idea. They're like, well, based on the... No, because they're doing that because of the content that they're getting, not because of you. They're saying they're doing this because of me, and I'm like, don't do me any favors, give me control. That the content providers of the movies that they run and the TV shows they run won't let them run them outside of geo-restrictions, that's a whole different situation.   Can you make it look like your T-Mobile? I guess you could tether, anyway, whatever. Fortune says multiple sources tell it that Snapchat has agreed to acquire Toronto company Bitstrips. If you don't recognize that name, maybe you'll recognize this one, they make Bitmojis. Bitmoji lets you create an avatar that looks like you that can then be worked into various one-panel cartoons that express thoughts or emotions, kind of like super emojis. There can be one of you jumping up and down, yelling, yay, or happy anniversary, or let's do this, or I'm late, or whatever. They're very popular amongst the hipsters. Wow, a company that's based on allowing you to embed an inline image. Yeah, I should draw that stain. What, the nifty thing about Bitmoji is they're pretty good at creating that thing that lets you make an avatar that looks like you. And so people like it because it automatically creates lots of different ones. I should draw those, man. I mean, that's great for Snapchat, but people should think about all the NCSA Mosaic users that won't be able to enjoy it. Yes, think of both of them. Remember when I said Bob's your uncle? He's the one still using NCSA Mosaic. Google has made its NIC Collection free. NIC Collection is a set of seven photo enhancement tools which can be used as plugins for Photoshop, Lightroom, or Aputure. Bundle used to be $149, but anyone who bought it this calendar year can now claim a full refund and going forward, everybody can get it for free. NIC Collection consists of AnalogFX Pro, ColorFX Pro, Define, HDRFX Pro, Sharpener Pro, SilverFX Pro, and Viveza. Why that one's not FX Pro, I have no idea. Google acquired NIC Software in September 2012 in order to get the Snapseed app, which they still make. I just think it's really interesting how Google tends to do this whenever they make changes in the market. They give refunds a lot.  There's already people suspicious like, does this mean they're getting rid of the NIC Collection because they made it available for free? It's like, well, I don't know, maybe. But don't look a gift horse in the mouth, at least yet. France's CNIL, the National Commission of Information and Freedom, which is their data privacy regulator, has fined Google 100,000 euros for not providing full protection for people's right to be delisted from search results. Google removes requested results under the right to be forgotten laws in Europe, but only for users whose IP address is determined to be in France. Google will appeal the ruling. This is an interesting case, right? Because you may wanna be on Google's side of like, hey, if somebody in France wants to be forgotten, it shouldn't change the search results under the United States, which doesn't have the same laws. But what the CNIL is pointing out, Darren, is an IP address is not a location. And therefore, they're not saying you should block up for the United States. They're saying, we don't know about that. All we know is that people in France can use a VPN and then see these listings, so you're in violation. Or are the people in France just on virtual holidays somewhere else and seeing the real internet? I mean, don't be wrong, I'm not for censorship of any stretch of the imagination, but I'm also not a citizen of France. You know, I'm a citizen of the United States and my old passport says the internet. So, I mean, I just reject the notion that any territory would impose its rules upon the entire world in that regard. And I think that's the cleverest thing about what CNIL has said. If you read it closely, they're not saying our rules should apply in the United States. They're saying our rules should apply to French people. And since a French person sitting in Paris, using a VPN can see that link that's supposed to be forgotten, you're in violation. You tell us it's hard to fix. I don't know, we're just following the rules. The rule says this and you're in violation. It's kind of bulleted, but it's also kind of brilliant. If a French person goes to New Zealand, are they still a Frenchie? Yeah, I'm curious what the CNIL would think of that, but they're not even addressing it. Like, that's what I mean about how clever this is. No, they're going about it like a five-year-old trying to get their way using child logic saying- No, but it says right here. Yeah. Without any interest in the rest of the world. Apple Senior Vice President of Internet Software and Services told The New York Times Thursday that Apple is working with Will I Am, Ben Silverman and Howard T. Owens on a television series documenting app makers. Apple has previously worked with partners like Vice to make series related to music, so this isn't brand new territory for Apple, but it's first time they've ventured outside of music. Silverman brought the ideas to Apple. He is an executive producer of many hit television shows including Flaked on Netflix. Q said, quote, this doesn't mean that we are going into a huge amount of movie production or TV production or anything like that. And yet, despite all these things I just said, most of the headlines read, Apple starts first TV show, not true, going into original content head to head with Netflix according to Q, not true. So there you go. Verizon reported an attacker used its Enterprise client portal, you really didn't have anything to say about that. No, I really, I don't know why I just, I don't care. I had to look up who I thought will.i.am was a domain name, so I'm a little bit behind. I was like, wow, how do you get i.am? That's a good TLD and stuff. He should actually, that'd be a steal. Verizon reported an attacker used its Enterprise client portal to steal contact information on approximately one and a half million customers. The attacker did not get access to the metadata on phone calls. That's something called customer proprietary network information that's stored in a separate area. Grebs on security reported that someone posted contact information for sale on a forum, and that's how this was made public. The vulnerability in the portal has since been fixed and only enterprise level customers were affected, not your normal phone users in Verizon areas. This is fantastic, wouldn't you say? I mean, I think this is going to, you know, like we should eventually prepare ourselves for the massive data dump that will be all of the text messages for a carrier for a certain amount of time. This is just contact info though. I mean, this is kind of a boring, boring attack. All they got was email addresses and mailing addresses. Yeah, but it makes me hopeful that eventually there will be that massive data drop of people's text messages because it will then, you know, encourage better digital hygiene, right? I mean- Well, here's what I would call hopeful. And maybe I'm being pollyannish here is that this would be the warning that Verizon should probably stop that. But again, this was also enterprise level. People aren't going to heed the warning that has been told to them for decades now until they're actually exposed and start using end-to-end encryption messaging, like, well, pick your poison. There's a million of them out there right now. Maybe someday. Recode reports multiple sources say Microsoft has been holding exploratory meetings about financing efforts to purchase Yahoo assets. Earlier this week, Yahoo Shareholder Starboard Value launched a proxy challenge to replace the current Yahoo board of directors because the sale process has been slow. Microsoft does not seem interested in becoming the majority owner, although Recode reports sources saying AT&T, Verizon and Comcast are all rumored to be interested in being the majority owner of Yahoo. And maybe Microsoft would go in with one or several of them. Basically what it sounded like according to Kara Swisher is Microsoft's talking about maybe putting a billion in. Yahoo's asking for 10 billion. They're estimated to be worth six to eight billion so they'd get anywhere from a seventh to a 10th of the company if this all ended up being true. So you think it's like AT&T and Verizon, Comcast, they're all like thinking about ordering a pizza. They're like, yeah, we're thinking about getting the Yahoo one and you want to get Microsoft. You're good for it. And they're like, we'll take a slice. Well, I'm just- And Microsoft's like, I don't know, what are you guys gonna put on it? Yeah. I might go in for a slice, but what are you getting on it? Yeah. Exactly. Is it gonna come with Oscar Meyer meets? No. Yes. No. The furniture reports that pre-orders of the Oculus Rift headsets are now shipping. CEO Brendan Ariebe tweeted a pick of a box headset saying that deliveries begin this coming Monday, March 28th. Rift can still be pre-ordered, but your delivery won't happen till July at this point. $600 Rift bundle includes the Xbox One controller and Eve Valkyrie and Lucky's Tale as bundled in games. Don't be wrong. Hardware is a necessary part of this whole ecosystem, but what I'm most excited about is kind of what we're going to see now that these units will be getting into people's hands before the F8 Developer Conference on, I think it's the 12th and 13th next month. So that's where I'm hoping to see some more content stuff. For sure. And finally, researchers at the University of Illinois, Golanai, report that they've achieved a record setting transmission of 57 gigabits per second of error-free data over fiber. That's right. Maybe we're not in your sports ball tournament right now, but we're setting records in fiber speed. Go, Illinois! Sorry. That's without cooling either. By the way, at 85 degrees Celsius, transmission still remain 50 gigabits per second. So they're thinking they could use this in places where cooling is impractical, might save money on cooling data centers. Team was led by Professor Milton Feng with Professor Emeritus Nick Holaniak Jr. and graduate researchers Michael Liu and Curtis Wang on the team. And gadgets John Fingus points out the trick will be to make this work over long distances. They did it in a lab, but they didn't do it over miles. My thoughtful conclusion, Tom, is that them be some hot bits. Yeah, man, 57 gigabits per second. I'll replace my hub. I'll replace my powder. 57 gigabits per second of 85 degrees Celsius bits. Yeah, no cooling necessary. That could be amazing. They were talking about using it in airplanes. Because you think of airplanes as cold because the outside is cold, a lot of the actual airplane networking sections are very hot. So yeah, cool stuff, go along. So make your stories, folks. Vote on them at dailytechnewshow.reddit.com. It helps us push the show together every single day. We couldn't do it without you. Well, we could, but it wouldn't be as good. So don't make the show worse. Go vote, dailytechnewshow.reddit.com. And that's a look at the headlines. All right, where do we start? Well, it's open source, so there's no wrong way to do it. I'm assuming reporting on this story, there's no wrong way to do it. Let me commit, should I commit? I think I'll go with the short version that I put in here. The background things that you need to know are that MPM is a private company in Oakland, California, but it is also the largest registry and repository of JavaScript tools and modules. If you don't know what tools and modules are for JavaScript, and by the way, these are open source, the tools and modules are things that you can point to instead of having to write the code from scratch every time. If you've done any kind of object-oriented programming, you know that that is incredibly necessary. You don't want to have to write every single thing code does from the ground up every time. Yeah, there's this whole concept of D-R-Y or don't repeat yourself. So don't reinvent the wheel is basically what it's saying. Now, what's happened is, because MPM is very large, very successful and open source, I don't know if it's most, but a huge number of modules are hosted by MPM. It is the default packet manager for node.js in which much code is written. So there's a guy named Azure Coachulu, and I'm probably not saying his name right, so I apologize, but Azure is the author of several modules, one of which is called LeftPad. LeftPad allows right justification of text. You can also prepend characters of any choice. It is a dependency in a large package called Babel, which has a line numbering tool that uses LeftPad. Now, a lot of people use Babel. Coachulu, in a dispute about the name of another package, just gotten a bit of a tiff with MPM and said, I would like to unpublish all my modules, including LeftPad, and he did. When he did that, code across the internet began failing because it referred to Babel, which referred to its line numbering, which referred to LeftPad, which was no longer there, and within 10 minutes it was fixed. Cameron Westland had published an equivalent of LeftPad under the same name, but it took about two hours to sort out the implications, things like version numbers, et cetera. So a lot of people panicked, and now a lot of people are mad because even if it was just for a couple hours, they feel like I can't rely on MPM anymore because MPM allowed this guy to pull his package out, and then there's of course the fight over the name, which we can get into that in a second, but it was a company said, we wanna use that name because it's the name of our product, and Coachula was like, well, no, I used the name first, it's open source, sorry. Right, and a lot of people claimed like, just broke the internet, and I don't buy that whatsoever, because it makes me really wonder, like who are these people that are blindly updating packages on a production server?  Right, and that's why I keep saying a chunk of the internet because it wasn't a large number of people complaining about this, but it wasn't like every instance of JavaScript suddenly stopped working, you would have noticed that. Right, and then, you know, this is also inherent to basically anything in the cloud, as it were, because the cloud, while very convenient, can be sometimes volatile. There have been outages in the past of other online services that make it difficult to get business done. I know I rely on Google Apps, for instance, when I can't get to Google Drive to open my docs and spreadsheets and stuff, it can be a real bummer, but I accept that risk when I go into that relationship with that company. The interesting thing here is that the developers are entering into a relationship, not with other developers, but with a company by proxy using NPM service, NPM being that company out of Oakland that maintains the repository for other people's open source code. So if you write a project, and you're like, all right, I'm gonna write this awesome Node.js project, and I'm gonna reference other people's code, and rather than copy and paste and all that stuff, I always want to get the latest version. I always want it to be really easy for other people to install. I'll just point to NPM's version of it, and NPM holds that little namespace, which is the little name of the project, and then makes sure that it references the good stuff. This isn't unique to NPM, either. Many languages have to deal with this thing. Go is dealing with it, every language. What's different here, though, is that unlike, I'll use another package manager as an example, Python, another very popular programming languages, uses PIP to install packages very similarly. PIP, on the other hand, is not a privately held company, rather an open source project, which means it's inherently decentralized. There's not like one guy that can make a decision and just yank some stuff. There's a committee, and every package manager is different, but the difference here is that if you're a Node.js developer, you may be not realizing that you're entering into a relationship with NPM the company and not necessarily the developers on the other end. Now, and here's where it gets interesting because I'm not sure that the fact that NPM is a private company is really the problem here, especially based on what you just said, I think the problem was the policies. NPM runs this registry as an open source registry, and yes, it does have a private company behind it, but so does Swift. And Swift doesn't have any problems, Swift isn't even that open really, but it's run by Apple. So I think the problem was that NPM has a situation where they will allow you to remove the packages and straten the founder of NPM says there's very good reasons why we want people to be able to remove their packages. At the same time, there was no safeguard against this sort of thing. There was no, I guess they just never run into it. So maybe it's not that frequent of an instance, but there was no way to say, well, hold on, that package is actually referenced a lot. So we need to do something before you're allowed to remove it. You can remove it, but we need to take steps to not break other people's stuff. There wasn't anything like that. And if you wanna get into the details, essentially what happened was Coachella wrote a module called Kick, a company called Kick Interactive that makes the kick messenger wanted to name their module package kick. They said, look, people are gonna be looking for modules named kick if they're developing for kick. So on March 11th, Bob Stratton of Kick emailed Coachella asking, hey, would you mind renaming your kick to something else? Cause so it doesn't cause confusion. And Coachella said, sorry, I'm building an open source project with that name. Now there's the first problem Coachella not going, well, wait a minute, I'd really rather not. Just sort of like, nope, not gonna do it. Stratton then wrote, our trademark lawyers are going to be banging on your door. Boom, poured gas on the fire. And that was the real problem there. He started threatening the lawyers.  So Stratton appealed to MPM. And I incorrectly called MPM's creator Stratton earlier. MPM's creator is Isaac Schluter who looked at this and said, well, kick's got a good point. It's their name. It's gonna cause confusion. People are gonna be looking for kick messenger and they're gonna find this other thing. I'm going to give the name to kick. Flames are already burning at this point. So that is a questionable decision at that point to do that. And I think that's where, well, there's not a committee. There is just one person making the decision is a problem. Send an email to Coachella explaining. Coachella said, great. I would like to delete all 273 of my modules.  Here is the command to do that. And Coachella deleted them and hence Havoc ensued. Of course, GitHub still had all the copies of them. And we had Cameron Westland run to the rescue. So in some senses, this is a victory, which is like, hey, we only had a 10 minute absence and only a two hour period of uncertainty. Right. The difference here, I think you hit the nail in the head when you said that as opposed to a more decentralized open source project, pick any, there's so many package managers, yum, apt-get, Pacman, PIP, whatever have you. It's not like one guy, Isaac, making a call like, well, yeah, they have a trademark. And you're using, if KIK was more popular and it had been used in Babbel and many other projects like that, they might've been like, well, we could just give the namespace KIK to the company kick. Or we could tell them, hey, it's already being used by somebody else. I think it's first come, first serve. You can call yours KIK messenger because otherwise we would be breaking things and people looking for that dependency would get the wrong thing. Yeah, and I think if NPM, and I don't get the sense that NPM wants to be a bad player, they're trying to be a good citizen and they usually are seen as a good citizen, I think they would be best to create some kind of foundation. Maybe that's going too far. Maybe it just needs to be a committee, but some kind of external operation of the open source community here. Because NPM is too big to have one person making that decision. Well, yes, just because they're too big right now, that doesn't necessarily mean that alternatives couldn't exist for that thing. And part of the problem is- That's the other way to go, right? If you're just learning to program Node.js, you may in fact think that NPM, because it's called the Node package manager has an affiliation with Node where it's a separate company. And so I think that it's worth pointing out, because I'm not calling them evil, but I am saying there should be room for alternatives and that's the beauty of open source. And an alternative did attempt to exist back in February of 2014 and looked for an available name on NPM. It was an alternative to NPM. And of course it wanted to be listed in NPM so that you could download it, right? And it was called, and so they looked for a name and the developer found that NPM.js, that namespace hadn't been taken. So they went and just published that. And so it had been available for four years. Moments after that was registered, the developer got an email from this Isaac character over at NPM saying, hey dude, that's not cool, change your name. And he's like, no, it was available. And the privacy, or the user license, the ULA was updated to basically say that the NPM registry can remove your stuff at any time at our sole discretion just for this instance, essentially. And then said, I wasn't asking, you're, we're deleting your stuff, move it. And then the interesting thing there was, it was a competitor in a way. I mean, it would have made NPM popular, but it was expanding on the APIs and such like that. And so it really makes you wonder like, okay, are they like open source, like let's all make betterment of mankind or are they open source, like let's own this stuff? Yeah, and so I do think that NPM should do the right thing, spin this out, make it an actual open source project or there is now enough anger out there for a movement to create an alternative method, which is the other way to do it. I think that this brings up something interesting in regard to what we were talking about in France is what if I, not an NPM, but any other repository, I write some code and it's really janky code. I mean, I got my name all over it and I get really embarrassed later in life. I'm like going to job interviews and people are Googling me and finding this just terrible code that for some reason isn't all of these repositories. Would the right to be forgotten in the EU not apply to that lousy code? So I think this is just bringing up a pain point that the open source community needs to figure out what is the best way to do this. And since every package manager does it different, sometimes the developer isn't even the maintainer in the package, so. It's not like we haven't dealt with namespace issues. I mean, going back to the rise of domain names, you know, there's a good model for how to manage namespaces. So it is a solvable problem. Yes. Let's get to our pick of the day. As tax season approaches in the United States, many of you may need to get documents to your tax preparer. The safest way to do this is to carry them in person, either on a very secure USB drive or print it out in person even better. Hand them in person to your tax preparer. That is not always practical. We understand that. So Phillip Shane sent this Life Hacker article as his pick for determining safe ways to send sensitive documents during tax season. The first one in this Life Hacker article is hand them to the person in person. But let's say there is a situation where the person for whatever reason just can't do that, Darren. There's some good recommendations in here. What do you think? I'm going to disagree and actually say the recommendations in here, which are only two, which are AES-256 encrypt a volume using like seven zip or some other zip archiving tool. That's what, when you do that, what you do is you're using symmetric encryption and now you have to share that key with the other person through typically an alternative means which we call out of ban. So you'd call them on the phone and say like, hey, I sent you all the tax documents. Here's the password for that zip file. And while that may be really convenient, it's still not the best tool for the job. The other one that they recommend is Dropbox. I don't recommend using third-party services to do your encryption for you. I say use the open source standard, use PGP. And so just ask your accountant, what's through your public key, give them your public key and then load it into an e-mail or whatever program you use for that and do it that way. And I also realize what I just said isn't practical whatsoever. And that's the thing is, I have worked with many different tax preparers in my time. Some of them would actually had public keys, most of them don't. So then you have to figure out your workaround system for that. But be careful. I think Dropbox encryption is recommended by Lifehacker with the caveat of, hey, you are putting your encryption in somebody else's hand. So if you're worried about Dropbox someday handing that over or being hacked, you should be aware of that. It's all levels, right? And so I think you're right, which is, encrypt it yourself, get a public key from the accountant is the best way to do it. But when that tax accountant's like, I don't understand those words, you're gonna have to figure something else out. It's also a matter of knowing from who you're mitigating the risk, right? So the idea that if you're using a third party service like Dropbox, I'll just point this out that, oh no, the government might subpoena my tax information from the Dropbox and they'll give it to them. Well, you're gonna give it to the IRS anyway. The IRS already has that information. So send your pics to us folks, feedback at dailytechnewshow.com. You can find more pics at dailytechnewshow.com slash pics. Got some great messages. A listener wrote in and said, TLDR, I'm a digital forensics examiner. I couldn't hack that iPhone 5C. The FBI might just be busy. Celebrate is pretty awesome. Sorry for letting this email get away from me. But it's a really interesting full email about this person's experience as a forensics examiner, having worked with law enforcement, not actually in law enforcement in private operation. Here's some excerpts he says, or she says, I don't really know. My understanding is that the FBI and most law enforcement agencies have a long backlog of digital evidence to work through. At times in my career, it's gone back a couple years. That could explain why they didn't just jump on this in the first place. If an encrypted iPhone comes into my lab, my course of action is to ask the attorney or the custodian of the phone, often their client or the opposite attorney's client, for the PIN or passcode. If they can't get it, I just say, sorry, we're not gonna be able to get to the data. We have too many cases to futz around with this stuff. Also, I would bet that very few cases come up that are such high priority that they can dump as much time and manpower into them as they have with this case. It's a very different kind of case. A lot of nice things said about celebrate products for data extraction from phones. And then finally, maybe the takeaway should be that we computer forensics people aren't superheroes like the guys on CSI. So I feel like this probably already exists as a meme somewhere, but imagine the first graphic is what you imagine about FBI forensics investigators, and then there's an image of the FBI. And then underneath it, it says the actuality and it's the DMV. Yeah. And I don't mean that as offense to any investigator. To either the DMV or the FBI, it's just somebody overworked and underpaid, probably. Yes. If the FBI could afford better Infosex professionals, we may not even have been having this discussion. Yeah. But that's a different problem altogether. We'll have the full email if you're interested in a comment in the show notes, in the show notes doc. Nick says, we've been mentioning that you can use the existing PlayStation Move Controllers for the PlayStation VR if you already have them. And Nick says, hey, it's worth pointing out. You should test your battery. The Move Controllers batteries don't last forever. In fact, video game journalist Jeff Gerstman who's giantbomb.com has been getting a lot of messages from people saying they've used, they've had used or sometimes brand new Move Controllers from the PS3 era with batteries that can't hold a charge. Apparently the batteries used in the Move didn't hold up that well over years and sometimes batteries don't. Even new Move Controllers might have been stored in a warehouse for several years and the batteries may be bad. So be careful about that. You might wanna test that controller. This is a problem not just with the PlayStation but really anything, I noticed the other day that my local coffee shop uses an iPad to control their very sophisticated PA system and it's a dox in a station that only uses a 30-pin connector iPad. And so I was thinking to myself, wow, I really hope like in a temperature controlled box somewhere they have spare iPads with 50% charge or something. Yeah. And then Yanov said after reading some of the tweets and hearing some discussion about Tay, Microsoft's artificial intelligence that became very racist on Twitter. Yanov says, I think it was a huge success. If I was a psychology major, I would be calling Microsoft for the data. This is an example of how a teenager thinks and how easily he or she can be manipulated to believe in different things. I hope Microsoft does not filter Tay or modify her algorithm to make her more immune to trolling, have a different AI but Tay is a really interesting case study. Microsoft actually apologized for Tay today by the way. The company said it had implemented a variety of filters and unstressed tests with a small subset of users but opening it up to everyone on Twitter led to a coordinated attack. Those are Microsoft's words, which exploited a specific vulnerability in Tay's AI though Microsoft didn't elaborate on what that was. Microsoft's taking responsibility for it. They're saying we should have tested better but they're saying we did do tests. We just didn't realize that people would be able to team up on it. I think the coordinated attack is probably less a coordinated attack and more a bunch of people seeing each other doing this to Tay and all jumping in the pool at the same time. Yeah, one kid starts poking on the other kid at the playground and other people jumping because they wanna be part of a thing. Yeah, egg, exactly. This is a great show, Darren. Thank you, I had a lot of fun. H-A-K-5.org as always. What are you guys going on over there? Oh, we have an amazing series going on right now where we're teaching you from the ground up how to build your very first quadcopter. We're going over all of the basics of flight and avionics and all of the components and how to put together stuff using open source and open hardware and it's really a lot of fun. Shannon and I are doing a lot of learning and teaching and we should be flying here real soon so you've got a couple episodes back to catch up on and you'll be right there with us soldering along. So H-A-K-5.org. Len Feralta has been busily illustrating Node.js. How are you doing there, Len? One of these days, I'm gonna be able to handle one of these esoteric stories in a good way.  So that's what I did. I drew the little rage quit guy who's saying, Internet, I break you and then at the bottom it says, I don't know if you can read that or not. Programmer takes 17 lines of code off the internet. You won't believe what happens next. You won't believe line 13. That's brilliant. No, Len, you always say like, I don't know. I don't know what I can do with this. And then you always nail it. Like this is the heart of the story which is the programmer getting so upset that he's like, I just go, I'm gonna delete all my packages. I love the table flip too. It's so great. That's exactly. Yes, you can actually go look at this at lennproutstore.com. It's there on the front page right now. Or you can go to my Patreon and go to patreon.com.forge. And you can get it that way, a digital thing. Oh, and I do wanna mention one more thing before we go. Next week on Wednesday, 3.30.16, my issue of Munchkin from Boom Comics will be going out into comic stores everywhere. You can actually pick up the issue that I wrote, illustrated, and did the cover for. So it's very exciting. I was talking to Tom about this before the show, working with Tom on comics and other folks on comics. And this is the first comic that's not self-published that's actually in stores. So you can go out there, support it, and get out there. And then go to your comic book store. Go into your local comic book store, go find Munchkin, and then point at it and say, I know that guy. Yeah, that's right. And if you do that, take a picture, put it on Twitter, and let me see you doing that, because I would love to see people going into comic book stores on the 30th and picking up my comic. All right, folks, would you like a UK perspective on the tech news, perhaps? Why not check out Nate Langston's text message this week? Give him a reason why, Nate. Thanks, Tom. Have you ever felt the pain of changing cell phone providers? Well, in Britain, it's no less painful than elsewhere in the world. And it's just been proposed that an entirely new British regulatory body be set up to change that, making the process of switching carriers close to a one-click task. Could that work? Could it be something other countries adopt too? And what's Apple's embedded sins got to do with all this? We'll be discussing the proposal and what it could mean for the future of phone networks this weekend at techsmessage.co.uk or simply techpodcast.uk. Thank you, Nate. That's not the only international take on the news you can get. DTNS itself will have a day six episode this Sunday from Australia with Peter Wells. If you want to see that go weekly or you want to get us to the next milestone of a monthly roundtable show of DTNS, support us on Patreon. Patreon.com slash DTNS or dailytechnewshow.com slash support. Our email address is feedback at dailytechnewshow.com. You can give us a call 51259 daily. It's 5932459. Catch the show live Monday through Friday at 4.30 p.m. Eastern at alphageekradio.com and diamondclub.tv. Visit our website, dailytechnewshow.com. Back on Monday to talk about bots with Matthew Hartman and Veronica Belmont. See you then. If I'm not a bot, I'm a bot. This show is part of the Frogpants Network. Get more at frogpants.com. Diamond Club hopes you have enjoyed this program. Tight show. Yeah, it was really good. I just had a brilliant idea for any package manager that doesn't support the ability for the developers to just go and delete their code off of the servers. They still, of course, allow them to update the code. So we should just standardize the practice from now on if you just want a table flip. Just push an update that replaces your code with 10, print, and then the Unicode table flip guy and a URL to Len Frault's awesome drawing once you go to that. Problem solved. That's hilarious. Suddenly packages across the internet are showing table flip guy. And Len's drawing. There you go. And Len's drawing, yeah. You know what you would do? You would send table flip guy to standard error and then standard out you would send the URL, the tiny URL to Len Frault's store. Yeah. That's awesome. I love that idea. I just love the idea of like accounting software across the nation breaking and people like calling Len like, hey, what's going on? I don't know, I can't want the reconciliation report. That's amazing. DTS require tech news. Oh, okay, okay. Is it, I have to pull this up. This is gonna be good. I can imagine Shobat is just teaming with good stuff today. Well, it's T2T2, so that one's syntax is dead on. Yes. The right to forget really allows you to open source code. Well, now I actually got the semicolon depending on the language. I don't know, man. Oh, that's true. We might have to, I'll send him a pull request. Yeah, all right. 10 print table flip guy, by the way, is already a title suggestion now. Oh, yeah. The problem is you can't use that kind of unicode in the file name on, I mean, you could. I could. You've done it before. You have. And it's been fun dealing with the help requests. We knew the users. Is that why, Tom? No, it was Android, some Android podcast aggregators did not like it at all. That's surprising. I would have expected it to be more widespread. I don't know. What about France's safe space? France's safe space. It's the, France's safe space is the entire internet, apparently. Oh, it's because of the five year old thing. I get it. Took me a second. Yahoo pizza. I like Yahoo pizza. The 11 most important line. No, I don't, I don't think they're in most important lines. Really fast fiber. Fiber in your diet really speeds things up. It sure does. But you can use that for any fiber story. True, true, true.  Apple to review the channel. They really want me to screw up people's aggregators because 10 for table flip guy is now winning.  That's good. 17 ways to break the internet is not bad. Well, I mean, any time you begin with a number, which in which case 10 print table flip would work because it begins with a number, you're gonna click it, it's clickbait. Top 10 most reasons internet broke. It's not the numbers at the start that causes the issues though. I've got it, here's what we do. We take all of the suggestions, we Google translate them literally to French, then we Google translate them literally from French to German, and then from German back to English then we use one of those. Sounds brilliant, you wanna do that? Yeah, unfortunately 10 print table flip guy is gonna come out as 10 print table flip guy. Yeah, well print might change, it's okay, I don't know. You're right, you're right. Might, I say might. Drunken, and. I need a name, what are we calling it? I feel like in here, I can't pronounce that in French. D, T, N, S require tech news. Yeah, that one's good. That's kind of my, I'm leaning that way, yeah. You gotta escape the quotes though. Put it back slash before each quote. I do? No, I'm joking, but you didn't put the final name. I'm only half, I'm only half my brains here because I'm actually typing, sorry. All right guys, well I have to log off because I have to pay a FedEx bill. Oh, all right, well I sell FedEx, thanks. Yes, and everybody have a nice weekend. Thank you, happy Easter to the possible. Yeah, happy Easter to Len. Yes, please, yes, and everybody have a happy Easter as well, and we will talk to you next week. All right, man. All right, take care, bye. I gotta give props to Beatmaster. Will I am be a URL? I don't know, I just, I didn't say anything because I'm so like under a rock in terms of media. Yeah, yeah, yeah. What happened to me was that I knew you weren't, you didn't have an ex by it, and I knew you weren't saying anything, and I just let the pause go too long, and so when I started the next story, I was like, okay, I gotta explain that pause. So I was like, so I had to call it out. In my notes for the Netflix story about the variable bitrate, I actually use T-Mobile as my mobile broadband at my apartment because they are so infrequently that if I do want the internet, I'll tether on my phone. So I have like a phone that I just use to tether to a Chromecast, and I've been for the last two weeks just watching like plenty of Jane Fonda movies and they stream just fine on T-Mobile. Yeah, I have T-Mobile on my phone as well. And I use it as my tethering on the road, and I've streamed to Lou and Netflix and stuff, and it's been fun. So if it were a reference to like Jane Fonda or Jane Powell or Frank Sinatra or Kerry Grant, I would have gotten those. I'm just a little behind on the more recent stuff. Sure, sure, no, that makes sense. Will I Am started music in the 90s. So just start back there. Okay, I'm gonna start with the 90s and work my way up. If I say Black Eyed Peas, the band, I know the Black Eyed Peas. He's a guy from Black Eyed Peas. Oh, well there you go. So there you go. See, we've solved it now. Hey, Darren, do you see a web browser in the place of my face? Yes. I would actually get that looked at. Yeah. No, not Darren. We have to ask the audience, yeah. So when I or Darren are talking, do people in the chat room see the web browser that Roger has, and you've clicked on yourself, I'm guessing, Roger? I have. Oh, right, because we don't see the TD output. We just see it. Right, we don't see live. Yeah, I don't know. I'm sure there's a cream for that, Roger. It's not focused on Roger though. Maybe if you clicked on yourself. Well, yes, I know that will work because that's how I do Len. But what I was hoping, oh, no, wait a minute. We didn't give you control room. Oh, no, you didn't give me control room. Okay. Now, click control room, I heard the dead. Now I'm presenting to everyone. Now, does everyone see it as the full screen? Now when I talk, people still see Roger as an instant or the web browser instead of me. I'm gonna talk and wave my hand so I can see it undone. I only see the web browser now, except for you in the thumbnail, of course. Okay, so now they're saying it's forced on me. Yeah, yeah, yeah. Okay, so that works. All right. Now, I'll unclick it. And it should flip back and forth between the three of us. There you go. Oh, it's no longer. So if I start talking, you should have Windows tension. Right. Okay. So what we need is whenever you wanna cut to the webpage, you just get some smooth music coming from Roger, huh? But you can have them like Girl from Ipanema or something.  Okay, well, we'll use Tom Steiner. Which one, the one that was originally done by Suzanne Vega or the one that was remixed by DNA, I think? And then remixed by everyone else after that, I believe. I don't know, I'm done with the original. Or you know what, throw in some will I am. Yeah. Through the course of the podcast, I'll start with the 90s and work my way up. Right. Well, I was thinking Black Eyed Peas, so if you just want solo will I am, you don't even have to go that far back, I don't think. Oh, there you go. Well, wait, that's the one with Fergie, right? Yeah. Oh, yeah, yeah, yeah. She's a doll. She is, isn't she? Yeah. I'm still curious what she was going to end up doing with all of that junk. Where was she keeping it? If I remember right, it was in her trunk. You know, last time I had this issue, we ended up illegally dumping it in West Oakland. Oh, see, now that's, you know, that's not good. You should probably have a garage sale or something. I wonder if anyone ever suggested that. Yeah, I don't advise that, by the way. You can just take it to the dump. Yeah, in fact, the El Cerrito Recycling Center will probably take it, they've got a... That's a responsible thing to do with the junk in your trunk. Yes. Just saying. So, Roger, you can do that during the show, keep yourself mute so that it doesn't switch to you automatically if it hears a noise, but then just click on yourself to show the web pages. That's amazing. Well, yeah, I have to click on present to everyone. You have to give me control and then I click on present. I have to give you control room and then, yeah, yeah. Okay. And once you really... You want me to be seen, but not heard. How very Victorian of you. I mean, you're going to go 60 by that way. Doesn't sound like that. Right now you got a little one-one aspect ratio going on.  I mean, seriously, right? Modern ratio is merely a preference informed by contemporary values. Okay, fine, so keep going with your Instagram ratio and we'll call it a day. It's a day. I want. Huh. You know, the prens did not translate and the quotes didn't translate into the URL. It's probably a good thing. So there's a lot, how far this goes? There's an article today about a woman whose last name is Null and all the trouble she has. That was the other thing I was going to say is if you couldn't just, if you couldn't table flip by removing your code, you could just replace it with Null, but it's open source. So people could always just revert back. I can't remember her first name. I'm going to say Elizabeth. I don't think it was, but she married a guy and he said, look, you don't have to change your name.    The one thing that I remember from the article is she has to call the airline to book a flight. Cannot do it online. She should change her name to backslash quotation mark, Null backslash quotation mark. Everything would be fine. It's a good idea, actually. I wonder if that, I wonder if her doing that when she filled out the forms would fix it. It should, shouldn't it? Me maybe? Maybe? Maybe? Or she might trip off across site scripting. Or that's just about to say like little Timmy drop tables. We all remember him, script dollar, hi. He's quite popular. Little Timmy drop tables. You know the XKCD for that one, right? So good. I've seen a, there's a great meme that's been around for quite a while of a person driving through a toll booth that uses OCR. And it's got their license plate followed by a quotation mark, semi-colon drop tables. So good. So good. Did you know that Randall Monroe's, I can't remember the name of the book now, but it's the book you explained. Yeah, yeah, yeah. It's gonna be in textbooks. No. Really? Houten Harcourt, Houten Mifflin Harcourt, they all merge so they all have different names now, has licensed it to put into their like chemistry, their biology and their physics textbooks. That's fantastic. Yeah. Yeah, I thought it was actually a really good explainer of the thing. Yeah. I read well it uses proper syntax. I don't know why. Like the upgoer is just about the, I don't think I've ever been beaming more smiley than after reading the upgoer. It should be required reading by all fifth grade students in science.  Oh man. You know, it's that, it's between that and the fact that like John and Hank Green get played in schools today that I actually have like hope that American, well, just that this country can turn its education around and it just so happens, not even from the private sector as much as the public, like the just us people, like, hey, we need to make better go and then go will better be. Whoa. Whoa, indeed. I think the finalist of 24, I'm gonna be profiled. Oh, there's a book about Creative Commons update, nice. There's a book being made called Made with Creative Commons. Nice. Yeah. Oh, I'm making one of those right now. I'm doing that too, right? Well, I'm like several books behind you, but I'm, Well, I'm not making a book about it. I'm actually making something that's Creative Commons. Yeah, you're making a Creative Commons book, right? Well, I'm making a Creative Commons license video and audio file. Right this second. When are you doing it? Right now. Right now, now? Yeah. What about then? Also. Okay. I'm gonna stop before we go plaid. Seriously. Ludicrous speed. All right. Thanks everybody for watching. I am out of the post. Someone asked me on Twitter, they're like, why do you say you're out of the post? What does that mean? And I was like, huh, I guess that isn't clear. I have a blog post that I create to publish the show. And once I'm out of it, I say so so that Roger can go in and do things to the post. That's all that means. Bye. Bye. Bye.


Flash Gordon for me is kind of mythical and strange because when I was a child I lived in Gold Fork, half between Don Gastron-Barnsley as a Yorkshire boy and in the local cinema every Saturday was Flash Gordon and it was Buster Crabbe who was a marvellous Flash Gordon. I mean he was always in pain when he got, you know, at the end of each episode when he was in trouble he expressed pain and of course he was a gold medal swimmer and a gold medal diver and all that, six or three and a damn good actor and it was in 20 episodes or 10 episodes you go each week to watch it and you wonder what would happen at the end of each one and it was bloody well done, you know, I remember that music and it was Flash Gordon had more effect on us as school children than anything else in cinema. Black and White he had those strange, those rockets going around, to lits as music, and all the way through the series there was always a slight moaning sound when you're on Mongo. So it was always sinister and the images were amazing and of course, you know, we then at the end of an episode, the railway in Bankman was outside, these great steam trains coming through and we'd run down the embankment, jumping, doing dastis, mint dares and you pretend to be, and I would pretend to be Volta. I would jump over the bushes down the embankment and I sprayed my leg I remember very badly because I thought I could fly and I never dreamt that eventually I'd actually play Volta in a film but I enacted it as a child.


Welcome to the second talk of the third day of GPN-21. CD, site reliability engineering explained an exploration of DevOps, platform engineering and SRE. CD is a software engineer and technical lead from Germany specialized in resiliency engineering at Microsoft Azure with a passion for distributed systems, site reliability engineering and resilience engineering. CD focuses on building adaptable systems that can withstand failures while monitoring performance. Thank you. Thank you and good morning to GPN. It's the second talk of the day, so I'm quite glad that everyone showed up and the room is not completely empty. Quick introduction about me. I'm in senior SRE. I work in this field for a couple years now and I do a lot of things even outside of work. I really enjoy analog photography. I have my camera with me on this event. You can find me on my socials and I want to talk about real quick why I'm doing this talk because I'm working in this industry for a couple years now and it never really caught on the term SRE and even if I talk to guys here at the event, they're sometimes a little bit like, what's SRE? What's that job title about? And because hope is not a strategy and we say this all the time in SRE, I thought let's do a talk about it. And when we talk about SRE, we always hear those terms about DevOps, about platform engineering and before we get started on SRE, I want to clear up something real quick. I think everyone's seen this graphics, right? It's pretty much in the name of DevOps. It's the intersection of DevOps and DevOps, but it's completely false. DevOps is actually not a job title. DevOps is a methodology. It's pretty much the same thing as we are not called agile engineers or waterfall engineers or even scrum engineers. We are software engineers, right? And the agile methodology, the scrum, the waterfall, it's just a process. It's the same with DevOps. It's a methodology and not an actual job title. The DevOps methodology focuses a lot on communication and collaboration because part of the methodology behind DevOps is we build it and we run it. We are responsible for a service end-to-end. We develop a feature and we ship the feature to production and we also do incidents response for that feature that we shipped. And that sometimes contains that we have to talk to operations teams. There are SRE teams involved, maybe. And we have to talk between the teams and we have to make sure everyone feels heard. So as I said, DevOps integrates software development with classical operations and we do this to improve collaboration. So we build feature teams that have the software developers and at the same time have people experience in operations so we can actually run our microservice. And more often than not, if a DevOps team is implemented properly, it looks something like this. Another product and the product consists of multiple microservices and each microservice is owned by one or more teams. Usually it's one-to-one or one team managing multiple microservices but not one microservice managed by multiple teams. So you have a feature engineering team that's responsible for one microservice and they go everywhere with this microservice. They do hand-holding for everything. They develop new features. They fix bugs. They release things to production. They make sure that the production infrastructure is running for that microservice. But I hear a lot of you guys now saying or thinking, well, but my job title is actually DevOps engineer. So it doesn't really fit with what I'm saying, right? Your job title actually might be DevOps engineer but in fact you are likely to be a platform engineer then because platform engineering by essence is working with automation, working with infrastructure as code, working with all those fancy automation frameworks that we know of like Ansible, Terraform, Chef, Puppet, Solstack, all those tools. And we use them to automate infrastructure deployments and build infrastructure for the DevOps feature teams to release their software on. And we help the developers actually doing this by running the GitLab instance for them and operating and maintaining the GitLab runner so they can run CI CD jobs. We also usually host monitoring for them so they can actually see what's going on in their services. So if your job title right now is DevOps engineer, you might consider looking into what platform engineering is all about and you might realize that DevOps isn't really about a job title but the methodology and platform engineering is what you're actually doing. Platform engineering comes with a set of principles and they usually evolve around developer productivity because if you're building infrastructure you do it for someone and that someone is usually a software engineer and you help those software engineers releasing their software faster, quicker, more reliable. And sure you do that by writing reusable components for example in Terraform module that you can reuse over and over again. And last but not least let's talk about S3. S3 in its essence is pretty similar to platform engineering. We do kind of the same thing about automation and also monitoring but we additionally focus on availability and monitoring a lot more and also incidence response and incidence response automation is a big part of S3. So S3 really and if you go by the definition of S3 is applying software engineering principles to operational tasks. If you never heard about S3 before and this is really your first time hearing about S3 and you want to learn more I highly recommend the book that I show here. It's written by Nile Murphy and the other guys from Google who invented the S3 discipline. And as I said, S3 in its core principles is really a lot about automation. It is one of the core priorities of every S3 is eliminating toil. And toil is defined as every repeatable task, everything that you do multiple times over and over again manually and could be easily automated. The benefit of automation is also the more automation you have, the less human error you have because if you have a piece of code that actually executes a task you can check in your code and get, you can have code reviews on that code, you can put in error handling and you don't have an engineer sitting in front of a screen typing the wrong command causing an even bigger outage. But when you're doing automation there's this fallacy of getting caught in applying Band-Aids all the time and I have a small example for this. The feature team that we work with recently released a new feature and ever since this new feature is in production there's a lot of servers that are down. So our job as an S3 for example might be look into those servers, why are they down, figure out the root cause of why they are down and make them available again. So what we eventually figure out is these servers are down because the disk is full and we hate that generally. So we look into why is the disk full and we figure out oh there is a new lock entry in the locks that causes the locks to just be way too verbose and that fills up our disk space. Well the fix is quite easy, right? We just truncate our locks and we're good again and it should be like 20 lines of shell script automation but it doesn't really fix the issue. It's not fixing the root cause, it's fixing the symptoms. The symptom in this case would be the lock running full. What we should do instead is go to the source code of this new feature, find the offending lock line and reduce the severity of this lock line for example. So the actual root cause of the incident is fixed and not just a bandaid applied. When we work as S3's another core principle and big part of our job is doing risk management and evaluating risk. And when we talk about S3 it's usually about very large systems. For example I work with millions of servers worldwide and if you have a couple million servers then a couple ten thousand servers are down every second. It's inevitable, right? If you have like an error rate of one percent that means four million servers there are at least a couple thousands offline for whatever reason. So we have to accept failure as something normal. It's not bad if something goes wrong. It's just important to not have it down again for the same reason. So we generally define error budgets and we talk about error budgets in a second but what I really want to show you is this triangle of sadness down here. If you really optimize something for cost then sure you can make your infrastructure super cheap but it's not going to be super reliable and you aren't innovating that much because if you don't have budget you can't innovate.  And at the same time you're not going to ship new features because every new feature, every change could introduce a risk so you can't really release anything anymore so it's not optimal either. If you go to the other direction you end up in the other extreme you're always living on the cutting edge your system is going to be majorly expensive and not reliable at all. So you have to find some common ground, some middle ground and you do this using... you use risk assessment criteria and do like general error budget measurements and for error budgets you usually use service level objectives and I talked about service level objectives and service level indicators in my presentation last year about incidents and alerting and if we look at the slides from last year I literally pulled the slide from my presentation file from last year and service level objective is a target value or even a range of values for a service level that is measured by an SLI or service level indicator and the service level indicator is defined as a carefully defined and quantitative measure of some aspect of our service. So to make it more graspable and more understandable I prepared two small examples. Let's say we are pretty much at the end of the month and our feature team wants to do a release next week and our job is to figure out should we do this release? Is it safe? And what we could do is look at the audits that we had this month and then overlay it with the releases that we had this month and we quickly figure out that we had four releases this month every release cost approximately 10 minutes of downtime so we already burned 40 minutes of our error budget and if we would do a fifth release next week then we probably breach our error budget of this month so we're not doing that anymore and we have to work with the feature engineering team to make sure that their releases don't break production that often or that long anymore. The other example that I want to make is the quite opposite of that we are at the middle of the month we only had like three minutes of downtime and we have 43 minutes so what do we do? Do we call it a day and be like, well, we did it? Sounds like an idea but it's actually bad practice either because you don't want to train your customer to expect something more. If you consistently exceed your service level agreements and you're always better than what you say you are a customer might expect a higher level of service than what they're actually paying for so what can we do? Can we release this super critical, nasty release that we are pushing ahead of ourselves for the past three months? No, we don't do that we try to make the releases safer and don't use our error budget to do unsafe releases what we could do instead is run a chaos experiment and we can use our error budget to do some proper chaos engineering and we do chaos engineering to build confidence in our services and this is what I do, what I work on on a daily base we intentionally break production and I don't mean staging, I mean production and I see often that people are very reluctant break to break production but use it on production so you can actually assess what the impact looks like on a real shortage and we do chaos engineering by building a hypothesis like we have free availability zones in three different data centers if one of those data centers ever fails there are still two availability zones left so our service should continue working we evaluate this against real world events like how could we lose a data center we could have a power audit or we could have a fiber cut between the data centers or someone accidentally unplugging the interconnect cable from the two data centers then we also evaluate how can we implement this the power audit might be a bit outside of what we can do we can't go to interaction and tell them hey could you shut off your data center please it's not really practical right so we might go with the network audit we simulate a fiber cut by literally unplugging the fiber from our server we run the experiment we break production intentionally and I guarantee you you learn a shit ton about your service because last year in my presentation I was asking the question are incidents a good thing and we came to the conclusion that yes indeed they are a good thing because incidents help us evaluating or finding the delta between how we think our system breaks and how it actually breaks and we can use chaos engineering to artificially create incidents and we can even go into more details how we think the system might break and learn even greater detail and this goes without saying that we have to learn from failure right if we run chaos experiments we expect something to break and if it breaks we have to learn from it and we have to do better next time so a really important thing and something that's very dear to my heart is blameless and sanctionless post-mortems the sanctionless part is often overlooked I hear a lot of people saying we do blameless post-mortem and that's a great start a blameless post-mortem would be hey we pushed a bad code path yesterday it caused an audit no one is really blaming any engineer the feature team might be released it but whatever and then management steps in and management is like well that's great let's make sure that never happens again how do we do that well next time you want to release something here's the list of things you have to check before releasing that would be a sanction and now no team wants to do any more releases because every team that wants to release something has to fill in this very extensive list of questions to verify that they're actually safe to deploy the sanctionless post-mortem on the other hand would evaluate even further asking the question how could this bad code path be pushed to production what led to it and maybe they figure out well there wasn't very good communication about the feature release and the timeline of it and maybe there was too much pressure put on the devs the feature quickly so they released something into production that wasn't properly tested and maybe we have to improve our communication between product teams and management another thing that I do on an almost weekly basis is reviewing old post-mortems and finding common themes across post-mortems because you might work an incident today and you might work an incident tomorrow one the day after and then in two months you work an incident and you're like man this failure this looks awfully familiar but I can't really remember what's going on so it's a good practice to review old post-mortems and learn from older failures and you can also use this to identify common themes maybe you identify for whatever reason every three months something majorly breaks in our caching infrastructure and maybe it's then time to look into your caching infrastructure why there isn't continuous audit every three months and the last big topic that I want to talk about is reducing organizational silos this is very often overlooked and sometimes really hard because this is your product and your SRE engagement is work with those two microservices those two microservices they run on some platform but the reality is the two microservices are operated by two different teams then there's your platform engineering team running the infrastructure then there's the customer the customer works with your support team and they're in three different business units and now you're here and you suddenly have to talk to salespeople and no engineer ever wants to do this right so it's really important to emphasize on a continuous learning across multiple business units you have to feel confident about talking to people in other business units and departments and sometimes even geographically different locations just as I said promote a collaborative culture is important and something that's also often overlooked for especially engineers is use empathy it's you're working with people it's not just servers you also talk to people you have to work with people a lot so be nice to each other be excellent to each other if you look at the similarities between platform engineering and SRE it's pretty much the DevOps philosophy so not much to talk about there are some certain differences I don't want to go into the details about everything here but to wrap up this presentation I want to go through a set of misconceptions that come across to me often and first of all DevOps is a job title you wouldn't believe how many recruiters reach out to me and ask me if I want to join their new fancy startup as a DevOps engineer I'm just like what do you mean what's DevOps engineer do you mean SRE do you mean platform engineering what do you want so no DevOps is not a job title another common misconception is SRE is just rebranding of operations yes SRE is a lot of operational work and you have to be comfortable with doing operational work but it's not just a plain rebranding using software engineering practices to run production it's using your software engineering mindset to approach your production infrastructure engineering it goes into the same direction SRE only fired fires no I don't do this I am rarely doing incidents response not a common one and I don't even know where this comes from so many people ask me I'm working as in Kubernetes SRE and I'm like oh that's great what are you doing yeah well I'm developing new features well then you're not an SRE I guess for some reasons people think Kubernetes equals SRE I don't know why it's not true and last but not least I think it's the last one platform engineering is just for cloud infrastructure and only needed in big companies also not true cloud platform engineers yeah we touch cloud infrastructure a lot but we also do other stuff like developer productivity and I guess that's it and now we have time for some questions CD thanks very much for the interesting talk who wants to have the microphone I know it's early I can't believe nobody please guys be confident that would be a first or maybe everyone's just turned off because I told them their job title is not real yeah there is one yes thanks for the talk you mentioned the not to use the job title deaf ops what about the job title deaf sec ops what do you think about that well the deaf sec ops is if I'm not mistaken deaf security and ops and I think security also should be a common practice in future engineering teams and so I would say it's also more of a methodology than it is an actual job title if you're developing software and you're not aware about security then good luck finding another job we have one question over here it's traveling salesman optimized so one or problems that we often faced with our production system were actually caused by the way we built our core product so my experience it's not always possible to like build a reliable platform without actually building the product right how much time do you spend like looking at the production code and figuring out oh we are keeping HTTP requests open for too long and that like stalls all our request handlers I would say I can't put a percentage on it but I would say that's like a huge part of the job I would say like half of the job might be fighting fires fighting incidents and the other half is actually looking at the code and trying to improve it and make incidents go away thanks if you don't feel comfortable asking questions here I put my socials on the slide you can always reach out and DM me maybe don't DM me on Twitter try it on muscle on Twitter it's like unusable