speaker, Orlando Owen. He probably has more experience in this room, more experience than a lot of us in this room combined. He's the founder of MagicMail.com. He's a two-time returning speaker to the 21 convention. He's not even intergame, he's ultra-deep game, which is on a whole other level, so I'm excited to hear about that as well. He's been coaching since 1985. Who here was not born in 1985? About 75% of you guys. That's awesome. And before he started coaching men, he taught women how to have orgasms and tontra. And he's responsible for multiple thousands of women having orgasms. Maybe not hands-on personally, but through his trainings and whatnot. So let's welcome Orlando to the stage. Thank you, Robbie. Appreciate that. Thank you. All right. Yeah, this is fun.  I'm from Florida, or LA actually. But the thing is, it's freezing. It was windy. And I vouched to my girlfriend to buy the first damn scarf I was going to see. And it happened to be this one. And then I saw, oh, wait, what does it say here? AFC. Y'all know what that is, right? Right.  And I'm thinking football, what does it say? Football. That's not football. It's soccer. And I'm thinking, no, actually, they're right. They're playing football. In America, we're kind of arrogant. We're playing hand egg. I guess it's a different sport. We're not really playing football. But it's not cold in here, so I'm going to ditch this little thing. But it was a real test of my self-confidence if I could walk wrong in this thing in a hotel like this. We're probably about paying four or 500 bucks a night. I don't know if you guys are staying here, but that's what it costs to stay here. And I'm not staying here, but walking into the hotel lobby and having the doorman kind of like look at me like, oh no, not one of them. Anyway, yeah, it's, I like to do these things just to test if I can sort of like be okay with it. If I can wear a scarf like that, that would peg me or stereotype me as a certain type of guy and then get away with it. And that kind of brings me to the subject, what we're going to talk about here today. And I'm sure at this convention and any others and anything that you've probably been listening to hearing was mostly probably outer game or how to game women, how to meet women, how to be confident with women. And then you hear about this weird thing called inner game. And people are saying, yeah, inner game. That's kind of like, it's a little gay and it's a little, that's usually when people sit at home that don't want to go out and they kind of like excuse themselves from going out and they're doing this weird thing that they're probably doing. Some tapping and some NLP and some EFT and whatever.  That's what inner game is, right? Is that what it is? Is that what it is to you? No? I think it's got a lot more credibility in the last few years than it used to have. But I think for a while, it was sort of hard for people to even understand that that was important. But I remember one of my colleagues, David DeAngelo, saying about 10, 11 years ago, he said, once you take care of your inner game, your outer game tends to take care of itself. And I remember Steve Pease, Steve Pickers, if you've read the game, saying to me, you don't have outer game if you don't have inner game. You can do all you want on the outside, but if your inner game isn't there, that's like building a house without a foundation. There's nothing there. And of course I worked on that for many years and I realized that even in teaching women how to have orgasms was a matter of inner game more than anything else that had nothing to do with the techniques. It was all inner game, 100.0%. It was inner game, religious issues, little inner blockages, things of deservingness, all that was inner game. So having orgasms for women, aside from the physical part of having to train the muscles, that's the only physical part. Other than that, if they have a clitoris, if they have a vagina, they're going to have orgasms if they have the proper inner game, if they feel deserving of it. But all inner game or everything, whenever you're feeling some deficiency with a woman as a man, and relating to her, and trying to seduce her, there's one key element. And if you don't have it, it won't happen. And if it does happen, woe unto thee, because you wish probably somewhere down into the relationship, be it a few minutes, hours, days, weeks, maybe months at best, in some cases years, that you weren't even in that relationship. If you don't have that one, one, one, one thing, that's the ultimate goal of inner game. Any idea what that might be? What is the one sine qua non, that if you don't have it, everything else, it's like you can take a trillion and a billion times a million times a quadrillion times zero equals what? Zero. Right, thank you. And that's exactly the same thing if you're trying to do all this other shit, all this other stuff without that one ingredient. Any idea what I'm talking about? A little more than that, it's a function of what I'm talking about, confidence. But confidence is more of a state. I'm talking about something fundamental that doesn't change from one day to the next. Nobody can take it from you. Let's say you're talking to a woman and she shuts you down hard. That thing will not collapse. Your state may collapse. But the one thing I'm talking about will not collapse that minute. It might have to maybe so many rejections. If that's all you ever get, then eventually that thing will collapse. Any idea what I'm talking about? No, it's very simple. It's self esteem. Holding yourself in esteem. It's funny because I teach in Germany, you might detect this accident because my dad was German, I lived there for a few years and I actually teach mostly in Europe. But in Germany means something else. Everything is a little different. And so I'm having a little bit of trouble. I just did a workshop on this thing that was 48 hours long of which we're doing 24 hours of pure workshop time, including podcasts and stuff like that that I sent out before to the people. So I'm taking something that I thought I was scratching the surface on it $40 into 45 minutes. It's going to be a little bit of a challenge. But I think if I give you a few key points of what that thing is, why you need it, how you lost it, how you can get it back, and what to look for in your daily life, I think that's at least going to start you in the right direction. How do you know you don't have it? What does it feel like when you don't have it? I've always said this one thing and it's provoked or it's been provocatively perceived by some people. If you most people think, well, I want to feel like a man. So then then I can go and meet some women. And I've always said, are you sure that's the strongest drive in your life to really want to meet women? I think you got back to differ. I think there's a stronger drive, much more fundamental drive that women have.  Come on, can't be that hard. You want to feel like a goddamn man? That's what you want to feel like. That's why people go and want to meet women. Oh, I have this hottie in my arm. I must be worth something. Or I can brag about it and what they call those things, lay reports, bragging rights, kiss and tell. Why would you want to do that? Who are you trying to impress? Obviously not women because they're not going to be impressed. They may think you're a bad boy and might be attractive. A lot of them are going to think you're a player and it's not attractive. But who are you going to impress with that? Johnny support in my buddy, he always says this one thing. He says, men are seeking the approval of other men. That's not a gay thing. It's just what is. But why would you even seek approval? If you seek an approval, if you seek in all these things, that's what we call a deficiency need in psychology. It's a hole. It's a vacuum. It's what I call the hole in the heart. Are they going to hate me for touching the mic here? But if you're trying to fill a void and need, then that's indicative of what? Well, self esteem. Thank you. And if you don't have it, nothing else matters. I used to do these funny things. I would meet women. And it was immediately was, of course, a lot of them I showed how to have their first orgasm was great, you know, they'll they'll be real thankful for that.   And I used to do this pattern. And I somehow turned total nymphomaniacs, or at least nymphomaniacs will me into eventually asexual women after I showed him how to have an orgasm. After a few months down the relationship, all of a sudden, I managed to create problems in the relationship. How? Well, they felt pressured sexually. It would happen like this. One night we wouldn't have sex for whatever reason. And it was like, Okay, no problem. You can have that. Because I took it as rejection because why? Low self esteem. And, of course, then I was like, Okay, maybe and then I would create subtle pressures, which made her not want to have sex the second night. Right? Even though the sex was good, that wasn't a problem. But it was me not knowing how to ask for it properly and creating subtle pressures because I was coming from low self esteem. I was taken this one night in 100 as a sign of rejection, fundamental rejection. That's how messed up my self esteem was. Had nothing to do with my successes or having many women are laid. Had nothing to do with that. Nothing. Because I was filtering all evidence to the contrary out of the picture. And so will you. If you have low self esteem, you will not be able to see what this is all about. You'll take every little thing as a sign of, Oh, it must be me. Must be something wrong with me. And then I managed to create more pressures, but I didn't know how to ask. All right, I didn't know how to initiate sex easily unless she would. And I was like, Well, I can't ask for it.  She'd always started. How do I do it now? It's weird, really weird. And I managed to turn relationship out of relationship asexual until I knew nothing better than leaving the relationship. And that's tragic. If you if you ever get to that point, I mean, I'm not saying I did this always in every relationship, but I did it more often than I care to admit. And that's very indicative of low self esteem. And that's typical for the kind of problems that start spiraling out of control. One thing feeds on another and eventually you realize, Oh my God, I'm running out of options here. Because the one thing that you need, the one thing that everything rests on, the foundation, the very foundation of everything in your life may not be there, or it may be compromised, it may have cracks in it, may have never been properly built. How do you know you don't have low, you don't have good self esteem? How do you know that? Ever had the feeling? Well, she's out of my league. You can prop yourself up with state management, also known as NLP. But that's like taking a toothbrush to do high colonics.  It's wonderful. And it can do a lot, but not if your self esteem is fundamentally low. It will never prop that up. It might prop it up for a few minutes or a few hours, but then it's going to go right back down. Have you ever been to one of those motivational seminars? Yes, I can. I'm ten feet tall. And tomorrow you're like, Oh, well, I'm still eight feet tall or so. And I'm pretty sure I can do it, yes. And then one day later, you're like, maybe seven feet tall. And I think I can probably try to do it.  I was actually six before, but now I'm four. Because it should have worked for me and now it doesn't. And now I'm feeling worse than I did before. That's state management. That's what happens when you're trying to correct the fundamental problem with contextual solutions, seminal solutions. There's no foundation there. And how do you know you don't have good self-esteem? Well, ever felt like, Oh, what's to use, you know, or ever said to yourself, if I approach her, you know, she might reject me.  How she's going to reject you ever had that? Who's ever had that? Oh, I'm the only one? No, there's a few. Okay. That's what happens though, when you don't have it. Ever felt like low in motivation? Or you felt like, Oh, I want to distract myself from certain issues? Or I need to motivate myself that I can't do this thing. And then you didn't do it.  Job is an acronym for just above broke, what they call a wage slave. And I want to get my own business, but can't do it in this economy.  And I know my uncle tried to do it and he failed. And yeah, I'm probably, it can't be done really. I shouldn't. And then you feel better because the anxiety recedes. Ever had that ever? Or you want to talk to this girl and you find some reason, some excuse? Well, that's what happens. You, you retract. You already rejected yourself. And that's what happens when you don't have good self-esteem.  Taking on a project. Did you think, Well, I can't be done. It's too big for me. Whenever you have that, whenever you're feeling depressed or down to yourself or powerless or any of that, that's what we call it pathological inner critic at work. And that's a very, very powerful thing to cut you down. In the workshops that I do, I spend about 12 hours on just that one subject. Ever had the inner critic at work? You know what that is? A psychologist, a psychologist or a sociologist named Eugene Sagan coined that term and he called it the pathological inner critic. And that inner critic is that inner incessant voice that always nags and cuts you down and always says you can't do it.  You're bore. Or I'm better than this guy, but I'm less than the other nine guys there. Have you ever had competitiveness in your life or comparing yourself or striving for perfectionism? These are forms of self-medication, but they're also forms of meeting needs, deficiency needs. And the inner critic is so like you're in a little Nazi, you're in a Hitler. You can't do it.  Yeah, lazy. Ever had those voices? They come from your parents. They come from church and state. They come from the media. They want to sell you something. And all the powers that be are very interested in you not having good self-esteem. Because if you have good self-esteem, then nobody can sell you nothing. You don't need it. You can't be manipulated if you have good self-esteem. That inner critic is incessant. He'll always tell you what to do and he serves certain needs. It's very hard to shut him up, but the first step is to start listening. If I give you a couple of miniature exercises to kind of take with you, then look for the inner critic. Listen to the inner critic. That inner voice, your inner, I don't know, the nagging voice that you might have heard from your parents or somebody else.   Or I'm going to get yelled at or she'll reject me. That's all your inner critic. And if you do nothing else but listen to that voice every day, you might want to make a little list. In the workshop I send out a podcast, two and a half hour podcast before the workshop, and a 25-page worksheet. And there I have people watch for a week preceding the workshop for that inner voice, writing down with date, time, and what it said. And typically people come up with about 10 or 20 of those a day for about a week. Just do it for a day. Just find 10 of those things in a single day.  Oh yeah, great housekeeping. Look at this mess. Stuff like that.  Start listening for it. And write it down. And it's a real, real powerful thing. It's a first step in catching this inner parasite, that inner alien, whatever it is. Get that. And then when you have a list like that, after like a day or maybe two or three, 10 points. Just do 10 points a day.  Write it down. And then figure out what need it serves. Because it serves a need. I can't go into all the psychology behind it. That'll take us hours just to do that. Operating conditioning, variable ratio, reinforcement schedule. Do the psychology behind it. It's very fascinating why you listen to that damn critic. Why would you listen to somebody who constantly cuts you down? Well, here's one good reason. Let's say you think, oh, she's going to reject me. Or people are going to reject me. Or I shouldn't go out and apply to these companies. Because they are going to reject me. It's like saying, look, you know, I hit my, you know, took a hammer, tried to put a nail in the wall, and hit my left thumb. And then people said, well, hit your right thumb, that'll hurt less. That's a real cynical way of looking at things. But that's how people operate it. The inner critic will do one up on it.  So why don't you preemptively hit yourself on the right thumb? And then when you inadvertently hit yourself on the left thumb, it won't hurt so much. In other words, I'm going to be rejected. So I reject myself first now. So when I will inadvertently get rejected, it won't hurt so much. Ever done that to yourself? I have. Everyone I've worked with has. That's one way. That's one need that this damn critic serves. And if you're aware of this, just that little awareness helped me a great deal. I mean, there's a hundred times more to it, a thousand times more to it than I can give you in 45 minutes. But it's a start. Or it does this. It drives you. Ever had perfectionism in your life? It's not good enough. Ever had that? Well, that's a motivational thing. You think, oh, I need to motivate myself to have this state that's unattainable. It's like the perfect 10, you know, asymptotically can't be reached. Only so close.  I would never do anything. Well, yeah, that's one way to meet that need. There's a healthier need, a healthier way to meet that need. But if you're doing it, most people using the critic to compare themselves to others on the off chance that they'll be that one time out of 100 when they're winning. It's like putting the slot machine, feeding the slot machine. Yeah, but the next time I could win. And that's reinforcing. It's creating an obsession, variable ratio reinforcement schedule. Look it up in operant conditioning. Very powerful. Very frigging powerful. Write that down. And whenever I have that list of 10 points a day, what you said to yourself, nasty shit, self rejection, comparing perfectionism, I should try harder. It's probably a pretty good work trying to kick you in the bum. But that's not the best way to meet that need. The best way to meet that need is if you find something that you're truly good at, life's purpose, if you're finding something that you enjoy. It's a lot more complicated than that, obviously. But it can be simple. Low self esteem. Where'd it come from? It starts with the what they call the prison religions or the Yavist religions. I am the Lord, thy God. You're worth nothing until proven innocent. They do the same thing. If you read the papers in Britain, you could be a tax evader. I'm pretty sure you are. Can you prove that you're not? Can you prove a negative? Why do you think we have that in the United States? Proven innocent until proven guilty. I mean, you're presumed innocent until proven guilty. Not that it always works that way in truth, but it should. But in Europe I found this a lot, particularly in Germany, essentially your suspect until you show me otherwise. But you can prove a goddamn negative if it's impossible. Can you?  You don't? Well, prove it then. See, I thought so. I knew it. That's what happens.  That's how far it's gone, my friends. That's how deep some of these guys go, or girls, or I don't know if they're girls or something.  You probably don't know who that is, but it's kind of like a weird guy in the US. But the one good thing he ever said, the one term that he coined that I really love is feminazi. In Germany, that's illegal to say. I have to bleep it out of the videos, but here I think I can. Ever met a feminazi? Typical man. You're looking at me the wrong way, huh? I said, no, I'm looking at you, period, but never mind.  There's no relationship. No, you're right. There isn't. Ever had that fundamental sense of wrongness that society kind of imposes, religion imposes, all these different institutions of society impose? Well, that's one of the problems. That's a big problem, and it runs, I don't want to offend anyone's religious beliefs here, but in the Eastern religions we don't have that so much, especially in Buddhism and Taoism. There is no such thing as guilt. Guilty until proven innocent. Yes, fundamentally, you're born into sin because some girl some time ago ate an apple, and that's why we still have that cut-out piece in the MacBook, probably, but that condemns you to eternal sin.  That's what I call the prison religion. There's nothing to do, I don't want to offend your beliefs, I don't care if you're Jew, Muslim, Christian, whatever, but just be aware of how that seeped in. I mean, the God that I believe in, like Bono said, isn't short of cash, mister, but he's also not cruel. The whole idea that your worth, your self-worth, has to be earned, that you're wrong, born into sin, guilt. There's always something wrong until you do something to make it right. Default state is guilt, sin, as long as you have that, as long as you don't exercise that, find what it is and exercise it, you'll always feel fundamentally wrong, and then everything you do will be wrong until you make it right. What is your self-worth depend on? Where does it come from, self-worth? Come from some external source? Why do you think it's called self-worth? Where does it come from? It comes from the self. And then, oh, that means you're selfish, egocentric, self-absorbed, ego, no, that's all compensation, coping strategies for low self-esteem. That's not, you can't have too much self-esteem. The great psychologist and I guess educator of humanity, Nathaniel Brandon, who would be a great guy to come here to speak, he always said that, that was the immune system of your soul, of your psyche. You can't have too much of it.  You can't be too healthy. There's no nothing wrong with that. People say, how about that guy is like so arrogant?  Irrigans is what? It's compensation for low self- esteem. Posing, bragging, being the, I'm the alpha male of the group. I don't need to say hi to women. That's low self- esteem and action for Christ's sake.  You won't have to impress a woman. You'll just sit there. You don't need to think a fan. I'm not saying you don't need any outer game. Sure, you need to be playful and do all that, but even that springs automatically from a sense of self-worth. But what's that self-worth depend on? Again, religion and the systems, the elite schools, they tell people, you're only working, if you're working less than 75 hours a week, you're a, what's the word they use?  That's the basic, basic of, basics of these schools like, I'm not even talking about Harvard and Yale. I'm talking about these elite business schools where you get your MBA. So you can be a banker and then get paid Boney.  That's what people do who have low self-esteem. Like, pick up is like, oh I can't get it any other way. I need to resort to tricks.   Not as long as you don't like yourself. And what does it depend on? Default mode as you come to this earth, you're like an empty vessel born into sin, essentially you condemn to hell unless you sort of redeem yourself some way. And it's all about, we're talking about this in the US. He's worth ten million dollars. Well, he's worth one million dollars. That means that guy is worth ten times as much as that guy. That's his value. As a human being? Well, maybe as a human doing, but certainly not as a human being. It just means you are. What's your worth? What's your value? Does it depend on what you do in the world?  Yes, that might have something to do with it, but that's in the long run. But when you come to earth, are you worthless?   That's your worth. That's your value as a human being. Well, then good friggin luck in finding self-esteem. As long as you think that your value, your worth as a human being depends on what you do, what you can, what you know, what you have. None of this is you, man. This is all ego. It's all descriptions about you. It's data. It's stuff.  But it's not you. None of this is you. You know what builds self-esteem? I like the way Nathaniel Branden does it. He has six pillars of self-esteem. I'll list them briefly. You can get his book, The Six Pillars of Self-Esteem. Excellent book. Six Pillars. Number one, the practice of living consciously, aware, becoming even aware of who you are, what moves you, what you're all about. You're living, breathing, being. That's really, really important. He does it with sentence completions. There's other ways to do it. But I like his six pillars. And that's number one, the practice of conscious living. Number two, the practice of self-responsibility. People think, oh, responsibility is like guilt or duty or task. No, it's taking your power as who you are. Not ego power, but like true personal power. Who you are? It says, I can make a change. Self-esteem is a choice. It may take me a month, a year, or a decade to get it. But I will get it and I have a choice. I'm no longer a victim. That's self-responsibility. It's all scratching the surface, man. It really is. I wish we had like a little more to do this. There's others. Practice of self- assertiveness. Standing up for yourself. And others, by the way. Courage, you know. Self-assertiveness. If somebody says, yeah, you're nothing, it says, no, sorry. I mean, take your opinion elsewhere, but I know who I am.  People say, well, but you know, there's something wrong with me. I don't like myself right now. So why I can't accept that? What are you just doing? You're wholesale rejecting yourself. You're pouring incredible amounts on something that you can't even control that way.   And there's not a goddamn thing you can do about it. Ten seconds from now, you can do something about it, but this very second you can't. This is what is. Like Byron Katie, loving what is. The work. Great. That's reframing on a whole new level. That's taking an NLP, like, to at least one flight of stairs higher. Accepting that which is who you are, saying to yourself, I'm whole and perfect as I was created right now. I'm right here. I'm right now. I'm here because my creator wanted me. I have a right to be here. And even though I may not like I have desires and thoughts and things and my apartment is a mess, why I can't accept that? Well, then you pour energy into the uncontrollable. And you can't move on until you do that. We spent hours on this in the workshop and it's unbelievable how resistant people are. The ego, I can't accept that.  Like a hammer. You're not you're not getting anywhere until you get that self-acceptance. Pillar number four. Pillar number five. Really important for self-esteem. The practice of self-integrity or personal integrity.  Oh, you're so beautiful. Can I, you know, do favors for you? Take you to dinner lunch? Well, that's very inauthentic. And then they sort of get it and they learn some skills and then they turn the other way.    Well, I used to do the same thing when I went through that. And you know what happened? I felt like Alfie.  And eventually it created subconscious guilt. And I started undermining myself because I really didn't feel deserving. That's low self-esteem. I did this whole thing in the first place to get there.  That's what we're most pickup guys are stuck in. It's compensation. First you get a nice guy. That's the problem. Then you over here on the other side, which is compensation, overcompensating, training wheels, crutches. But then you need to move one step up to the integration.   And then you don't have to, you build up self-esteem.  Then you have game because that's who you are, not because of something you do. And number six is the practice of living on purpose or purposefully. Purpose. Your life's purpose. People say, I need to have a vision. I need to have goals. I need to have all these things. Well, those may come from ego. But purpose is something very different. It's, you ever heard of Martha Beck? She's the original life coach. Great, great woman. One of the best coaches I've ever come across. She has this book, Finding your own North Star, like staring by starlight. That's when you find who you are.   You'll never have to motivate yourself ever again. You never need to prop yourself up with NLP or anything like that if you find your life's purpose. It's like getting on the power curve. I started this thing a year ago called kite boarding. And it's amazing. And the first time I was even on the board I was just in the water and I was like doing in Cranton Park, remind me. And I was like, whoa. And then the thing kind of starts figuring out, figure-aiding. And then all of a sudden it gets on this power curve and I was literally, literally I was waiting out. I was thrown to about where you're sitting back there, Franco. And I was probably about literally camera level out of the water.   And it was like the biggest rush.  No, this was a whole new level. This is like the quarter-mile in five seconds.  And that's kind of the feeling you get when you get on that power curve of purpose. That's what it is. It's that curve. It's like a cam. It's like you're down here. Most of us have never passed two, three percent of it, five, ten if you're lucky. But when you get like 50 percent of that power curve, it's like it feels like a thousand. When you get into 70 percent it feels like ten thousand. It's amazing. And that's what gives you a sense of purpose. You feel like I'm making some useful contribution to the world. So that's probably, that's one thing I'm really, really big on. You'll never run out of conversation.  You'll really like yourself. You can't help but be successful.  Even if it doesn't work the first or second time eventually you will be. If you're finding who you truly are, your true self, your essential self, that north star, that emotional GPS, that really is you rather than well I want to get a good job at Wall Street because it pays well. I've been there, not on Wall Street, but I've been a millionaire. I felt it was the most empty place on earth. It wasn't me. Now I earned like five percent of what I earned like 10 years ago. But I'm very happy doing it. I'm working 80 hours a week, not because I feel like I need to, but because it's fun. It's what I do. I enjoy it. My girlfriend hates it kind of, but it's what I do. I enjoy that. I truly love what I'm doing. And that gives you self-esteem. And that's not something that a little shut down. It's like some girl that gives you a lip.  Okay, thank you. And it can't get to you. It's like water off a duck. If you want to have self-esteem, find out who you really are and then live that and you'll find you'll never have these other problems again. Do you think I'm insecure with any woman because of her beauty? It can't happen. And I'm not even as cute and young as you guys are. And I'm not saying I'm getting them all, but I don't feel like inferior. I sit there because I know who I am. There's not a goddamn thing she can do a say to make me doubt that. Because it's real. It's not state management. It's not white out on the computer screen like most NLP and other techniques. It's real. It's who you are. I want to give you one more exercise with this. Because most people kind of flip-flop, ever had that? I had that when I was probably your age, 20s, 30s, whatever. I had that a lot, this roller coaster. One day, and I was trying to become a professional musician, even though I didn't have quite the talent to be the next Harvey Hancock, the next Diana Crawl. But I wanted to be that because it was cool. And I thought I needed that to feel good about myself. It couldn't be done. Even though I practiced 12 hours a day sometimes, 8 to 12 hours a day of piano, couldn't quite get there because I didn't have the core talent. You need to find that core talent. You need to really get an accurate self-assessment. And I was on this roller coaster because some days I felt like this is incredible, man. I'm like God on the keyboard. So I get it right. Everything worked. But that was only one in 10 days. And for the other nine days I was struggling trying to get that asymptotic perfectionism.  I can't do it.  And no amount of Steve P hypnosis, NLP or any of that stuff worked on me. It couldn't. It couldn't do it. I tried to hypnotize myself to be that guy that can play like God. No. If it's not there, it's not there.  Yeah, I know if you learned like the talent code in all these books doesn't work. And then I would be like on this roller coaster. It's like a candy. Right in the candy bar express. You ever done that? Sugar rush. Mental sugar rush. It's like, it's called bipolar. It's, you know, manic depressive. Those very few moments that I was in this perfect state I was God to myself in my own universe, obviously. The other nine days I was like dirt, piss on. And that roller coaster is what happens when there's nothing solid there. And eventually once I got to know who I was and what I stood for then it all kind of, it's like it went steadily like apple stock. You know, it may dip a little but eventually it's going up. Unlike most stocks. But that's how it works because it's solid. So the one thing that one exercise that I would really like for you to do is to just write down several areas of your life and those would be your personality, your body, how you relate to other people. Pick your own categories. Sexuality, your work. Do all that. We did this exercise and a guy wrote about his body. He said flabby, kind of chunky, feminine, whatever. He wrote all this stuff about his body ugly. Incredible. And then I was like who wrote that? Would that guy please sit up? That guy was six foot five. He had arms bigger than my legs. He was on a SWAT team. That guy was looked like a friggin Navy SEAL. He felt feminine.  He was good looking. He was like Arnie. He looked like a, I mean he was like built, right? Ripped. Not as ripped as he wanted to. And then we reframed it for him or we helped him reframe it. And he was like no that's not me. He would completely shut out all evidence to the contrary. But that guy was like the exact friggin opposite of what he wrote. Everything he wrote you would expect some little deformed guy to come up there and crawl up on the in the center of the room.  He looked like he was he could have been taken out of a commercial for physical fitness. And he thought he was like feminine and flabby and all that. Because he had like he could pinch about an eighth of an inch. But to him that was fat. Distorted self-image. And it may not be. Most people then say well I'm great at this and they're trying to prop themselves up.  Take several categories in your life that import they're important to you. Write these down. Your looks your physique all that your body. How you at work. How you relate to other people. How other people see you. All these things. Write those down. Get categories. Six seven eight. And then write down first write down just brainstorm what do you think it is. And then once you have that list. Let it sit for a day. While on it and then next they go through it again and then eliminate all period of language from it. All of subjective language. All negativity. All generalizations globalization all that global labeling get all that out of that and just really sit down with a friend do this with a buddy. And have and you know keep yourselves honest. Each other I mean. And yourselves of course. And just do that. That's maybe my other little homework. Number one you remember. Keep a list of 10 things you say to yourself for like two three days. And then go and look why you're saying these things to yourself. And if that's even really accurate. Question everything. And then number two do an accurate self assessment. This is not even scratching the surface because what I really do with people is. I don't go into NLP. I don't even go into hypnosis.  And I combine these things. Cognitive behavioral therapy and all that. With a process that's completely bypassing the logical rational mind. And I haven't I haven't seen any NLP that can do that. Even though I've worked with some of the best. I haven't seen them go down to that level. They can prop somebody up for a few days or weeks. But it's still. It may point you in the right direction. So then you realize oh wow. I have choice. I can go out there. I can work on my self-esteem. But the actual work is going to take you a little while. Because it took you probably decades to bring it down or at least years.  Maybe years. But that's the only way you can do it. And if you have that. If you strive for that. There's good books out there. There's really good stuff out there. There's really good people.   But that doesn't mean there isn't good ways to do that. But if you work on the one thing. Everything you do is ultimately trying to get that feeling of self-esteem. Everything you do. Every outer game. Every successful woman is geared toward that feeling. Why not go for it straight. Go for it directly. Like the Gordian knot.  Go straight for that feeling. How do you know you have it. You don't know. Go straight for that feeling of self-esteem. And work on catching yourself whenever you're trying to put you down or you're trying to make it dependent on external factors. That was five minutes right. All of it. I felt like I talked for five minutes compared to what the subject matter does. All right. Any do I do a sales pitch. Well actually okay. Q and A. Yes. Exactly. Any questions about that. Anything you'd like to know. Okay. You were first there. Sir. Is there any books you recommend to get more into this the deep self-esteem changing. There's two books that I like more than any others. One is one of before mentioned a book by Nathaniel Brandon. The six pillars of self- esteem. And the number the number two is written by a couple of guys. One is a PhD. They called I forget the first. It's Fanning. Two ends. Fanning McKay. And it's called self-esteem tools for recovery or something like that. I think that's the name of it. Those two books are incredible. Unfortunately they're still on the logical level. They don't go once you combine that though with the real deep trans work.  Once you combine it you can do you can probably get 10 times the effect out of this. Then you could get from the books alone. That's kind of like what I do and that's probably my sales pitch. You were next. Same question. Okay. You were third. Unless I overlooked somebody over there. Okay. Well my question was about find your core talent. Core talent. Yes and then you had your self-assessment. Again there's two really great books. One is called there's a trilogy of management books I really recommend. They call Clifton Buckingham. There's actually a Clifton strength finder by the Gallup organization. That book is called discover your strength now or now discover your strength. One of the two. And it's by Clifton Buckingham. Mr. Clifton is dead. He's no longer with us but he divides a test that you can get online and there's a code in the book that if you do it it'll give you a list core talents and the book to me is more important than the actual test because it'll give you 34 things that you never thought. Most of them you probably never thought could be core talents. And it flies in the face of books like psychocybernetics. As good as that guy is. It flies in the face of the talent code which to me is one of the worst books ever written and a very dangerous book in my humble opinion. Because it'll lead you down the path of thing. I can be anything. I'll pick it from a menu of a shopping list of ego desires and then I push myself to get there. That's the wrong way. We're going the other way. Clifton Buckingham. Discover your strengths now. You'll find it if you Google it. That's a really good way to get there. The other great books really that I recommend more than anyone. The original life coach the term was coined for her is Martha Beck. She's an editor for Oprah's magazine but she goes well beyond some of the stuff you see on Oprah. She's really great and a book that I like the best is called Finding Your North Star and Steering by Starlight. You can get those on Audible.  If you work through that stuff you won't need me. I shouldn't say that bad marketing. Anyway no you do need more than that but it's a really good start. And if you want to find out I haven't given any workshops in the US for about four years simply because I was so damn busy working in Germany where I do about six or ten major workshops a year and you know I got to spend more time in the US. I'll be a lot more in there Florida and Los Angeles. Miami and Los Angeles are the two places that I hang out and the website is being renewed. There's new stuff on there if you want to go on there magicmail.com with the CK.  I'm using it as opposed to stage magic illusionism. It's a form of magic to me means you're taking responsibility. You're not taking the path of the mundane of the muggles as they call it in Harry Potter land and you're saying look you know I have powers because we all do even the muggles. The muggles are only muggles because they believe they are. They may not go like this but even Harry Potter had to learn all this stuff and magic with a CK is to me a high form of consciousness self-empowerment you taken. It has nothing to do with ego or whatever it has to do with yes we can. I know I know we're all tired of that but essentially it's yes we can yes you can and that's what magic is. So it's magic mail with a CK mail as in as opposed to female magic mail.com and there you find more stuff on this stuff. All right okay thanks appreciate it


Hi, everyone. I'm Matteo Carlinini, Director of Software Technology Management at ARM. My colleagues Shabu and I are also Chairman of the Board of the TrustedFewment.org project. And today, we're going to give you an overview on what the project is and how we are helping out the industry building more secure firmware on all ARM devices in a completely open and collaborative way. So the first slide is really about security vulnerabilities which made the news in the last couple of years. You might recognize some of those, like the most popular in the middle. But the key point is that these security vulnerabilities are affecting all the devices we are interacting with in every single day of our lives. They affect IoT devices, connected cameras, smartphones, automotive systems, laptop servers, everything really. Now, this slide is very generic. It talks about general software vulnerabilities, not necessarily only regarding firmware. So let's have a look instead, specifically at the firmware vulnerabilities as identified and extracted by the NIST, the National Vulnerability Database. And you will see that the trend in the last five to ten years is that firmware is increasingly becoming the preferred target for attacks in every system. So there is a very simple explanation for that. And that is the firmware is the most privileged, the highest privileged software, piece of software that runs on every device. So it has more privileges than a hypervisor and more privileges than an operating system or any possible applications that runs on the device. Which means that a vulnerability in the firmware can bypass or overcome security hardening or features targeting security that are implemented in hypervisor or operating system. So it can also weaken a lot of features like secure boot or measure boot. And the real reason then is that if you own the firmware on a device, you really own the device. You own all the system, all the resources on that device. And that is why it's so appealing for attackers, as you can see from the graph. And 2020 is on the same trend of the previous years. But as we always say, there is hope, there is always hope. And we strongly believe that hope, in this case, passes through collaboration. Collaboration is key for building security in firmware for a number of reasons. So the first one is that software vulnerabilities and firmware vulnerabilities specifically are very complex problems to solve. So think about Spectra, for example. So hands up how many of you have understood properly the Spectra attack. And then how many have understood it by reading it at the first time. So it really requires technical experts, security experts in the field to openly collaborate around finding proper solutions for these vulnerabilities. And then if you look at the right hand side of the slide, this is just a snapshot of all the industry players in the IoT market in 2019. So it's a large amount of players, a large amount of companies. Which clearly means that security fixes and security within the industry has to be scalable. So it's a security by scale problem. All the mitigations, vulnerabilities, fixes of vulnerabilities that we find needs to be applicable to all the single partners and needs to be deployable by all of them. And if we find a way to solve these security problems which are so complex in a unique place, we are really achieving security by scale. We are solving the security problems once and for all, for all the members and all the industry that then will have to deploy and upload all their devices. So complexity, security by scale, two main key pillars. And all of them passes through collaboration, getting the right minds together to find the proper fixes in a scalable way. And this is the reason why, couple of years ago, six companies came together and decided that it was the right time to form the TrustedFirmware.org project, which at the time was based on the two main projects donated by ARM, TrustedFirmware A for the A class processors and TrustedFirmware M for the M class processors. This was the shape of the project at the beginning, two years ago, six founding members, two main projects. But shortly after, we were joined in 2019 by two other big companies, and by Yopti, which was donated by Linaro as a reference implementation of a Trusted Execution environment and moved into the governance of TrustedFirmware.org. Finally, this year, other two big companies joined the project, and also two more projects that you can see down there, and Beth TLS and Hapnium. And we will elaborate a bit more on these projects in the next slides. So you can see above the current roster of all the projects which are forming the TrustedFirmware.org open governance community project as of today. And so TrustedFirmware, as I said, is an open governance community project, which provides the reference open source implementation of all the secure software running on ARM processors across all the different market segments. For A-profile, so processors implementing the A-profile architecture and the M-profile architecture. Membership of the project is open to everyone. There are two main bodies which govern the project in its lifetime. On the left-hand side, the board of project members, just comprised by these 10 companies, part of the project. So the board typically decides on the investment and strategical direction of the project. While on the other side, the technical steering committee, which is formed by technical experts, by the company members and by the ecosystem, which decides on the technical direction of the project. So as we said, TrustedFirmware applies to all market segments. Let me rate the rate on that. So from low power, resource constrained devices like IoT or wearables, up to smartphones and connected devices, automotive systems, laptop and clamshells, clearly covers all the embedded space, including the edge and edge computing space, finally up to server general purpose servers or cloud deployments as well. All of them have devices which implements TrustedFirmware as a basis for their entire software stack. So having such a wide variety of markets to address, we realize at a certain point this year that we needed a more robust and organized and centralized security vulnerability and security incident process. And that's why we defined the new process, which is described in the page linked above. We have one single place of reporting now, which is the mail alias in bold, they are in the middle. And we have also identified the need clearly for a coordinated disclosure process of security vulnerabilities. And we aim to coordinate that with what we define trusted stakeholders and especially sensitive stakeholders. These definitions are described in the registration page and companies are more than welcome to get in touch with our project and with the mail alias is listed in that page for having more information. We also have security mail aliases for every single project, which comprises TrustedFirmware.org, TFA, TFM, and BATLS, and so on. But I really encourage to go through the centralized space and the security at mail alias in the middle, if you are in doubt, that's the really new centralized security place in which all the experts will look at the advisory and get in touch with the reporter for fixing properly the vulnerability. Now let's have a closer look at the first project of the family, TrustedFirmware A, and then we will go through all the others one by one. So TrustedFirmware A is the older project in the roster. TrustedFirmware A was really born seven years ago in 2013 under the name of ARM TrustedFirmware. It was an ARM project which was donated in the open through GitHub. It has always been released under a BSD3 closed license, so permissive license, and it's now accepting all the contributions under VCO. So no need for sign any contribution agreement. So it's a well-established project, alive for seven years with a lot of major releases. We are now approaching the release of 2.4, which will happen in few weeks from now. There are already announcements on the dedicated mailing list. And what it provides, it provides the reference implementation and the reference boot flow, TrustedBootFlow, for all the cores implementing the A-profile architecture. Cores both running at AR-64 or AR-32, and there is also support for the legacy V7A cores and systems. The diagram shows what really comprises TrustedFirmware A, so the EL3 runtime portion of the firmware, and also the EL3 and the transient SEL1 boot time portion. If you want to know more about the inner architecture and all the list of features for TrustedFirmware A, I would encourage you to look at the ELC presentation from a few months ago. Two team members gave a varied aura description of all the features of TFA, and you can retrieve the video from the link below. So, have a look a bit, instead of the statistics, more high level of TrustedFirmware A in terms of contribution, because we spoke a lot about collaboration. So how does the collaboration look like for TFA over this period of time of seven years? Well, when we started the project seven years ago, ARM TrustedFirmware clearly started with zero contributions from partners. In the other commits, all the code was developed by ARM engineers. Then, as the project became more and more popular, a few contributions started to come in, but at the time, we still had, ARM still had in place a contribution agreement to be signed with every contribution company. And we realized a little bit later in 2016 that that was really a barrier for people to contribute more openly. So we decided to get rid of the contribution agreement and just accept every contribution under the terms of the DCO. And as you can see from the graph, that immediately boosted the contributions from partners and ecosystem. Contribution continued up to late 2018, well early 2018 when we announced TrustedFirmware.org, and then autumn 2018 when we launched the project. And then another boost of contributions that continues nowadays with the introduction also of Hathnium, elaborate a bit more on Hathnium in the next couple of slides. And you can see the increasing trend continues. It just doesn't stop. We have, as of today, more than 45 partner platforms supported upstream from more than 20 vendors, different vendors, not ARM platforms. We have done 14 open source releases, including the upcoming 2.4. And in 2020, we also pointed new containers for both EFA and Hathnium. And half of these containers come from the community. These are not ARM employees, half of them come from partners and ecosystem players. So it's a history of huge success and huge collaboration. You can see an increase of 600% of contributions in the last four years, and more than double the contributions also in the last couple of years. Really a great story of collaboration. TrustedFirmware A comes also with a test project, which is equally released in open source, and it can be extended from our partner so the test cases can be extended as well. The project is called TFA tests, and it provides a strong basis for validating the interfaces from the normal world without the need of running a proper fully fledged high-level operating system. It doesn't really have an 100% coverage, but still it provides a strong foundation for testing all the interfaces for the interfaces listed below, for the specification listed below, including the most recent one, which is the firmware framework for the A-class devices, which I'm going to talk to about that in a second. As I said, this is all open source, same license and same contribution agreement as the main project, and partners as they develop and upstream features can also develop and upstream the test cases for those features as well. So let's talk a bit about Hathnium. What is Hathnium? Hathnium originally is a project started by Google that was donated earlier this year in April 2020 to the TrustedFirmware.org community project. Hathnium comes as a reference implementation of the secure partition manager for the ARM A.4 Securiel 2 virtualization extension. And it fully implements the firmware framework for A-class, the FFA specification, which I was talking about. It's been donated and it's been contributed and licensed under the terms of PSD-free clause, as all the rest of the projects under the TrustedFirmware umbrella. It comes with a very minimal cut base and a reduced attack surface. It enforces the principle of least privilege and it really threatens the defense in depth of all the software running in TrustedZone. And one of the main news cases is that it enables the isolation of different secure partitions which can implement different services or even different Trusted Execution environments in TrustedZone. Isolation in the sense that these partitions will be isolated one another. We have a supporting quote from the Android security team, which we captured during the launch of Hathnium within TrustedFirmware.org earlier this year. And looking at the architectural diagram of what Hathnium and TrustedFirmware aims to achieve on A.4 enabled platforms. So you can see the blue boxes, TFA running at EL3 and Hathnium running at SPM in Securiel2, achieve the isolation of different secure partitions running in the secure world on top of Hathnium. These partitions, as I said before, are isolated one another and they have a limited view of the system resources which is controlled by the underlying Hathnium SPM. But the important thing to realize is that the combination of FFA, which is the specification that defines the interfaces at the boundary level of each component. So a combination of FFA and Securiel2, with its reference implementation, achieve an increased security. Because now the underlying firmware EL3 plus Securiel2 is protected from compromised software running within the secure partitions. So if there is a malicious code which takes control of one secure partition, that code is no more able to compromise the highest privilege firmware. So it's no more able to own the entire device. And therefore, also the normal world is protected from compromised software running in these partitions. So we really achieve a higher level of security and defense in depth by implementing Securiel2 and the isolation that it allows. There are other two pillars of the combination of FFA and Securiel2. One is around the standardization of the interfaces, because clearly if all the components implement the FFA specification, one partner can deploy one secure service, either in the normal world as a VM in the normal world running on a typical hypervisor, and easily port this VM in the secure world running on top of Halfnium. So we achieve portability through standardization of the interfaces. But we also achieve de-fragmentation of the secure software space of all the software running behind TransZone, especially highest privilege software. Because the blue boxes are then delivered through TrustedFirmware.org, EL3 TFA, Securiel2 Halfnium SPM, and also a reference OPT TrustedOS and its Trusted application. With de-fragmentation, we achieve the transparency of the firmware which is running on the device. So we can really tell from which code base and from which release a firmware has been derived from. And that is all the certification and audit process of these generic firmware pieces. Eventually allowing our partners to reduce their time to market and their maintenance cost for their most secure software piece on the device. And now it's time for me to hand over to my colleague Shabu, which we'll talk to you about the evolution of OPT under the umbrella of TrustedFirmware.org, and then we'll talk about the other projects part of the TrustedFirmware family. OPT stands for Open Portable Trusted Execution Environment. It is used to create a Trusted Execution Environment on Cortex-A devices, leveraging the ARM TransZone technology. It works as a companion to the Linux kernel running on the normal world along with applications. OPT provides global platform compliant internal APIs which the Trusted applications running on top of OPT can make use of. It also provides the global platform client APIs which allows normal world Linux based applications to communicate to the Trusted applications. The project was originally launched by ST back in 2013 and it's in 2019 the project was moved to TrustedFirmware Community Project Governments. One of the work that the project has been doing more recently is around providing the platform security architecture root of trust for Cortex-A devices. PSA is a program that kick-started around three years back to provide better security to platforms by providing architectural specifications for hardware and for firmware that will aid vendors to create secure platforms. And as part of that program, there is the associated open source implementation which is where OPT comes into picture. As part of the PSA program, PSA has defined a set of PSA functional APIs that allows applications to easily use the security that is provided by the underlying hardware platform without having to of course understand the complexities involved in the security of the platform. As shown in this implementation, we have been working on providing implementations against those PSA functional APIs for basically three functionalities, cryptography, secure storage and attestation. By allowing those to run a secure partitions in secure EO0 above OPT, this allows Linux-based applications to make use of these secure services by calling these functional APIs which gets wrapped using the firmware framework A transport layer. It reaches the OPT layer which then using the secure partition manager gets dispatched to the appropriate secure partitions thereby availing the secure services that the application requires. This adopting this implementation on Cortex-A devices allows platforms to meet the requirements for PSA certification and thereby certify their platforms. Now let's look at one of the other trusted firmware projects, trusted firmware M. Again, this is also a reference implementation that was born out of the platform security architecture program in terms of providing a high quality open source reference implementation. Trusted firmware M provides a secure processing environment for the ARM Cortex-M CPUs. It especially leverages the trust zone technology to bring about isolation between the non-secure processing environment and the secure processing environment. It consists of a secure boot which allows to authenticate runtime images on the platform. For TFM runtime there is the TFM core component and the secure partitions. The TFM core is responsible for partition management which means it makes use of trust zone and MPUs to create isolation between the non-secure and secure processing environments and within the secure processing environment using secure MPUs it creates isolation between the different components as well. Then there is the secure partitions which you can see is the secure endpoint of the system which is sandboxed and is accessible through user authentication mechanisms. These secure partitions normally would have related secure functionality. A secure partition can be a crypto secure partition and the secure partition can be a storage secure partition. All these things are merged together in a single sandbox secure partition and applications are then able to call the secure partitions via the calling mechanism enabled by TFM core. TFM has been in development for the last two or so years and today we have got TFM one by one which is the latest release version which allows platforms to be PSE level one or level two certified and also achieve the PSE functional API certification. Quickly going through the functionality that TFM supports today it supports the PSE level one and level two isolation using trust zone and the secure MPUs which creates isolation between non-secure and secure world and between the PSE root of trust which is the most trusted portion on your platform and the application root of trust. It supports multiple secure services which most of the IoT applications can make use of in order to achieve security in their use cases. So the secure services are the protected storage, the internal trusted storage both used to store secrets whether it's use case specific data or to store keys, certificates, etc. securely in the normal time memory. Then the cryptographic service which allows you to do the cryptographic operations whether it's for establishing a TLS connection or for secure debug, etc. And an attestation service which allows the platforms to prove its identity to a remote entity like a cloud service provider. The crucial attestation service we use the entity attestation token defined by IETF as a format to collect platform specific data, sign it using the attestation key pair you need to the device and then send it on to a relying party who can verify and then create trust on the platform itself. Today TFM is supported on a wide variety of silicon platforms. Here are a few, the NXP LPC platform, STS, STM32L5, Cypress Psoc64, and the Rene CSI6M4. TFM is also integrated with some of the more popular open source real time operating system. So today you can see upstream integration of TFM in embedded OS, free R2S and Sapphire for certain platforms. Here is a quick, very quick look at the free R2S integration that we've done recently in cooperation with Amazon. So in the free R2S kernel repository the link is given here. You will see an example of how TFM is integrated to free R2S on one of the ARM reference platforms. In the Amazon free R2S repository, there is a PSA API shim layer which allows the PKCS APIs that Amazon free R2S uses as to store certificates and for KLS client authentication to in turn use the PSA API supported in TFM wireless shim layer. And this is also enabled in certain platforms. Again, this all allows free R2S and TFM enabled platforms to leverage the underlying security provided by the hardware. In one of the more recent work that we have been doing in the TFM project is around profile, considering the huge variety in the IoT world in terms of complexity of the device, the device capability in terms of CPU performance and memory. You will see a lot of these devices would exam enabled will have different device configuration and use cases, whether it's a small home base, smart bulb, smart thermometer moving on in terms of complexity, whether it's a smart meter, an educate way or a tiny robot. All of these will have different security requirements. So TFM is starting to provide pre configured bills, which will have different security capabilities more aligned with these use cases. And these profiles are also aligned to the PSA certification scheme, which means as per your use case you can pick up one of the TFM profiles in handset to add any more functionality and then you will also be able to certify your platform using the PSA scheme. Now let's look at the last TrustedFirmware.org community project. I would say it's one of the most widely adopted TrustedFirmware projects as well. It came to TrustedFirmware.org from earlier this year. What it provides is easy to use TLS library and also supports X509 certificates. As I said, it's very widely used in a wide variety of segments, especially in the embedded space. Again, it's distributed using a Bashi2 license. And although it has been well adopted and it's got a huge user base, previously it had challenges around getting contributions into the project, reviewing it by the maintenance, etc. So the move from ARM to TrustedFirmware.org is with the sole aim of making MBTLS a more vibrant community project with ARM very much still heavily invested in this project with most of the maintenance still coming from ARM. I'd also like to call out the PSA Crypto efforts that has been going on under the MBTLS umbrella. Here the aim is as part of the platform security architecture program to provide a world-class PSA Crypto library that contains all the required Cypher algorithms that are exposed using the PSA defined PSA Crypto APIs that can be used inside a trusted execution environment. It can be used by other security related use cases like secure board, secure debug, etc. It's very much advanced in terms of development, in terms of supporting all these crypto APIs. Of course, it has been derived from the MBTLS project. So MBTLS project is being separated out into two libraries, the MBTLS bit which has all the TLS aspects in the traditional MBTLS project and the PSA Crypto library which basically has all the Cypher's that are getting exposed through the PSA Crypto APIs and MBTLS over a period of time would move to fully using these PSA Crypto APIs as well. And we have been also trying to define a PSA Crypto driver interface as part of this program which would allow PSA Crypto implementation to be integrated with secure elements and accelerators by having vendor drivers that has returned against the specification. So this will allow us a platform which has got secure elements or accelerators will get invoked by the PSA Crypto APIs instead of being executed at the software library level. So we have very quickly looked at some of the trusted firmware community projects starting with trusted firmware A, hafnium, opti, trusted firmware M and finally MBTLS and PSA Crypto. One common theme across all these projects is collaborating to build world-class security solutions. There has been many initiatives since tf.org was formed in terms of bringing this collaboration to the next level. OpenCI being one of them. What this allows is any patch that gets submitted into one of the constraint projects results in a build job that builds the different configuration of the constraint projects and then it gets tested using the linear test system on a variety of platforms that the project supports. And this is all openly visible to the developers who are submitting their jobs. So what this gives is an easy way for the developer community to work on patches, validate whether they are introducing any regressions. And it makes the life of the maintenance a lot easier because they can then easily have the conversation with the contributor about what might be failing and what the developer needs to fix. This is an ongoing effort. So today we have got support for M, A and hafnium in the open test system and there are more features like static analysis models and more platforms that's getting added in this openCI and boot farm. Again, continuing on the collaboration theme, we do have biweekly open for tech forums for many of the projects which has been up and running for many months now which brings together the relevant developer communities of those projects discussing new design ideas and implementation details. We had a workshop last year in Lyon for President of America M. Considering the current pandemic situation, we can't hold such a session physically so we are going virtual with an MBTI list workshop being planned for November the 3rd. I would encourage all of you to attend this half day event where the aim is to bring about more collaboration in this great MBTI list project, talk about how we move forward in terms of improving the speed of reviews, getting more features into the project, etc. A sneak peek preview into the future direction of the project, etc. As we come to the end of the presentation, I would like to talk about the holistic approach the community project is taking towards collaboration and it happens at all level starting from a very vibrant now for almost all the trusted from their projects where any new design ideas are openly discussed issues are being brought up by the developer communities and by the user base. Then as I said, there are biweekly tech forums, workshops being held once a year, all the code is openly available. It's hosted in Git or in GitHub. There are open reviews happening in GitHub or in Garrett. So the development flow happens totally out in the public. Anyone can review the patches. Then finally, with the open CI this enables all the work to be openly tested. That's being able to maintain the high quality of these code bases, but at the same time, allowing collaboration across a wide. Number of developers as well. To conclude, I would like to say that technological innovation is hitting all aspects of our life, whether it's through autonomous machines, IoT devices, cloud computing platforms or mobile forms. But this comes a lot of challenges to the cyber security world. And if you look at some of the top predictions in the 2020 cyber security reports, one of the recurrent three theme is of course the increasing complexity of some of these security issues and the ever increasing skills gap to address these issues. So it's quite important that as we continue our journey towards a trillion devices in the next few years to have a collaborative approach to build security software that will power the next trillion devices. Thank you very much. So I encourage you to go and visit our homepage trust informer.org where you'll find a lot of useful information around all these six projects. Please do subscribe to the meaning list and the check forums. And if you have any questions, please do email us at enquiries at trust informer.org. Thank you very much.


Committing suicide actually takes energy and planning. So this happens just above the lowest point when they still have the energy to think clearly and execute it. Family members and close friends who were in contact with the individual before taking their own life have even reported them seeming happy and calm. This is because the suicidal person has finalized their plan and thinks they can finally escape the pain of this world. So those are some of the major signs that someone may be suicidal. But again, please keep in mind that single sign does not necessarily mean that that person is going to hurt themselves. In the comments below, please let us know what other signs you think we've missed. What do you think about suicide?   What do you think is the best way to commit suicide? Question or phrases like these may suggest that a person is considering it. They talk about it because they want your opinion. In a way, they're asking for advice on committing suicide while not openly admitting to it. This may also be a way they're screaming for help. It's an odd occurrence when someone gives away their expensive items. In their mind where they're going, they don't need material things. Giving away their possessions to loved ones may be a way they think they're helping friends and family after their death. There are usually a number of triggering events that cause someone to write their will. These events can include marriage, having kids, being of older age, starting a business or a close loved one dying. If a person seems to want to write a will out of the blue, try asking them why they have decided to write one. Of course, the mere act of obtaining a weapon doesn't mean someone is suicidal, but paired with the previous signs mentioned should serve as a warning. Those strange sleeping patterns are often seen in suicidal people. It isn't the sleep disorder that causes this. It is actually the stress or restless thoughts of personal problems that causes the person to have trouble sleeping at night. Because of that, the inability to sleep may be a clue that someone is suffering from depression or suicidal thoughts. Low energy levels are often seen in people with depression, which is sometimes coupled with suicidal thoughts. This low energy level happens as a result of lack of sleep and little motivation to do activities that would actually help them feel better. When people don't feel connected to anyone, they may turn to drugs and alcohol as a form of escape. Another reason may be because they think these substances might give them enough willpower to commit suicide. Seen in depression as well, suicidal people find no interest in activities they love anymore. Self-harm is one of the biggest signs that someone might be suicidal. Examples of this include cutting, burning, and poisoning oneself. In a sense, it's a way that suicidal people test the waters to see if they actually have what it takes to commit suicide. Former self-harmers often say that the physical pain helps them escape the emotional one. Studies have shown that suicidal people tend to take more risks. Look out for signs such as driving recklessly or picking fights. The number one and most obvious sign that someone might be suicidal is that if they have attempted it in the past, this is called suicidal tendencies. One thing people don't understand about depression is that it's not easily cured by a pill. A sudden stop in medication may trigger a worse wave of depression that might lead to another suicide attempt. This sign is hard to spot because you might be under the impression that the person is doing better. A misconception about depression is that people commit suicide at their lowest point. What actually happens at this stage is that the person is unwilling to do anything. They are at such a low point that they are unwilling to eat, watch TV or partake in their favorite activities. Their days are spent mostly in bed. Whatever your experience with suicide is, it's important for you to understand the science of suicidal behavior. But please keep in mind that not every suicidal person will show these signs and not every sign means that a person is suicidal. The point of this video is to make you understand these signs and to work out whether the person needs a friend or professional help. Hey Psych2Goers, welcome back. This portion of the video is dedicated to Robbie.  It can happen to anyone, even your closest loved ones. And you may not have ever had any idea what was going on. Robbie is an RN and wants to share her personal story in the memory of her loving son, James Garrett Culek. Robbie collaborated with her patient and wrote a poem wholeheartedly for James and for those who struggle with mental health. Robbie writes, James was funny, popular, handsome, and wise. Anything anyone would have wished for. My relationship with James was so close, not only on a mother relationship but also like best friends. On December 3rd, 2019, my own adolescent son took his life. Everyone including his best friends had no idea this was coming. There were no warning signs at all. This poem is for you and others who struggle with mental health. The poem is called Be True to You. It has been said, to thine own self be true. To think a lot of others, you must think a lot of you. Self-harm can become an addiction. Who needs that with all the affliction this world already has to offer? Addiction can multiply to the point that you might even die. Not on purpose, just using the pain. But just one time you could not refrain from going a little too far.  It hurts them to see you be cruel to someone they see as a jewel. When you think no one really cares, plus life keeps on throwing you scares, think of someone you care about who deserves love without a doubt. Then, imagine them self-harm engaging from depression or sadness or raging. What would that do to your heart? Now, with that answer in your mind, look in the mirror and you will find the same is true of you. Whether angry or feeling blue, get help when you need for sure. Even though there's not always a cure, you can stop the dangerous behavior and become your personal savior. Robbie Culek, RN. Upon collaborating with a teen patient, my self-harm is a bad idea.


My name is Jimmy Lai. I'm a staff software engineer at Carta. Today I will talk about Python linters at scale. So in this talk, you can expect to learn about the different scaling problems when using Python linters and learn about what kind of tools you can use to solve those problems. For each category of problems, we provide a checklist to help you navigate through the solutions in a more structured way. So we start with some context. We have many Python code bases and one of them, we call it monolith. It's a large Python code base that has a lot of code. In our case, it has more than three million tonight. But in the meantime, we also have other smaller Python code bases. They are either some microservices, GRPC service, or some Python libraries, and we also have hundreds of developers. So all of those comes with different scaling problem. People will start talking about the problems, so they could get some Python popular linters. Here are the linters tools we use at Carta. Black is used for code formatting, and it can format the code into a consistent way, like turn the red block code into the green block code to make them easy to read and write for developers. The configuration of black can be added to PyProject.tomo in a section toward that black. The default millions is 88. You may want to extend it to a longer number, considering everyone has a white monitor now, or you may want to specify the target version, or exclude some generating code. We also use iSort to sort our imports. So the different import statement from the same module can be organized together and sorted in a perfectly. The configuration can also be added to PyProject.tomo. When use iSort with black, you may want to use black profile to keep the format consistent with black format. We also use PlayGate to check our code style, syntax error, and box. It can provide a suggestion like undefined name or end-use variables. Unfortunately, PlayGate doesn't configure to PyProject.tomo. You can use any of those config file when use PlayGate with black. You may want to ignore some rules from the black aid in order to avoid the conflict. Otherwise developers may feel confused. We also use myTie to type check our code, which is really useful to catch type errors while developers editing the code, instead of finding until the code was released to production. It can be configured in PyProject.tomo. And we usually recommend configuring myPy by enabling those configs to make the type checking and type annotation more strict, which can make the myPy suggestion more useful and more specific. So far we can see we want to use a lot of binter and each binter has a lot of config. And in general, we usually configure our binter by using our version control system like it. So we will add our binter version and binter configs in our code base. We can use a specific Python package management tool like pip or poultry, provide the binter version. In this example, we specify sort version in a requirements file so we can use pip to install it. We also store the config in PyProject.tomo. So when we run dinters, we will use that specific config in the code base. And yeah, that's the common approach. So once we have the version and config in the code base, we can do run them in the local environment where developer edit the code. The goal is to help developer detect dinter errors early at development time and interact fast. We can use the mentioned Python package management tool to install the package or install them in the darker image. And in either way, we can also configure the git commit hook to automatically run dinters at commit time or integrate with IDE through FireWatcher or language server to monitor IDE events. So by doing all those, we can help developers run dinters easily. And the developer can also choose to run them in a hard way through COI command. Another environment we want to run the dinter is the continuous integration environment, which we want to always make sure the code merged to the main branch don't introduce new errors, test error or dinter errors. So whenever a change is pushed or proposed, we want to run all the dinters by starting a BI runner and in order to fast finish the dinter run fast, we will want to pre-install and catch the dependencies in the CI runner either through remote cache or using darker image. That way we can immediately start the CI runner when a commit is pushed. Okay, let's start looking to what are the scaling challenge we are going to base and solve. So the first challenge comes from the large code base we have. In our example, we have more than three million sites of code and more than 30,000 Python files. When we run the mentioned dinter in this code base, black can take more than 10 minutes to finish. MyPy can take 30 minutes to finish, which is too much time for developers to iterate back. Another challenge of scaling comes from having too many code bases. We have many code bases and initially different code base enabled different dinters with different version and different configs. So a lot of inconsistency that code for developer experience and in order to make them consistent with the then best practice is take endless effort to upgrade the dinters and configs. And the third challenge comes from having too many developers all of our developers they constantly submit requests to make changes for our code base. And it's not easy to understand how dinters work for them for each developer, each code base and each code changes. It's just too many of them. And before we having merge queue, we also occasionally has dinter errors merged to the main branch, which cause issues, blocks other change and the simple dinter situation if it show up too many times, it can slow down a lot of developers. We want to help them faster. And also so far we only talk about expected dinters or Python, but to development, we also use other tools. We use GitHub, we use Docker and many other tools. We actually also need best practice for those tools. So we summarize our challenges in two categories. One is the dintery also another one is the full developer experience. We develop and try to solve the solution over the past couple years. And here are some of the different approach we take which worked. So for stating up the dinters, our strategy was to avoid unnecessary co-manages on large number of code. So here's the checklist which summarize different approach. The first one, if we can only run the dinter and updated file, we can make the run fast. When running dinter locally, we can try to get the updated file from it like doing a github or if you are integrating with your ID editor, you may use a file watcher to get the list of updated file and provide them to the dinter. That way dinter only analyze the updated code to be fed. And in CI, when developer propose a change, they only updated a few files in their progress. So we can get the updated file list from the github or API like this. Even for request, we can get a list of updated file and provide them to the dinter to run faster. Another way, a tool that you can use to only run an updated file and run different dinters in parallel is the pre-commit tool. So it's a tool that provides several features. It can run on a committed file, help you configure your pre-commit hook easy. And when you configure multiple dinters, it run them in parallel. And it automatically set up a for sure environment, install the dinters in the environment and reuse the environment.  So the configuration is something like this, pre-commit config in mobile by adding a config like this. We add a black version 22.10 to be configured in the pre-commit. So we can run the pre-commit command or just commit our code, then the dinters will be run. And when you configure multiple dinters, it will run them in parallel. Another strategy to make dinter run fast is to reuse the prior results. Especially for large copays, some dinters like MyPy, they which require the knowledge of the entire copays and entire dependency graph, which can be a huge analysis. If we cache the previous run results and store them remotely, we can download them in local environment or in CI environment to be reused. So the workflow to use remote cache is like this. When we start the dinter run, we will check if the remote cache has a recent cache that we can reuse by looking up the revision we are currently at. If a cache is available, we can just download the cache and run the dinter and the dinter can reuse the previous analysis result. At the end of the run, we also update, upload the updated cache back to be reused later. In our large copays, MyPy used to take more than 20 minutes, but by using remote cache, we can improve the runtime to be less than five minutes. Another strategy to not only reuse the prior results, but also try to find a faster implementation is so, an example is like graph. Graph is a rust implementation of Flakey and I-Sort. It can parse the code and run different analysis. And the implementation rust make it really fast. It also built some cache features. So it can provide pretty good performance and it's getting really popular this year. So now let's look into the second category of the scaling problem, which is the war developer experience. We talk about inconsistency and the entity's effort and hard to know what's going on. So the strategy for solve all those problems is to build linters for any back practice we want to apply and provide auto-fate to help developers fix any issues in a productive way. The check is include the imagery as the linters and auto-fate. The imagery is the way to help us understand what's going on. So we can collect metrics from the CI and local linker runs to understand where our linker run in which environment, which code base, what kind of suggestions it makes and how it runs, what's the latency, are there any exceptions based. So we use data doc to collect metrics like this. We can know MyPy make a unused type ignore comment, a full request at specific file, specific line. We can also know this MyPy run, it takes how much time and aggregate the latency metrics for us to work on speed up. So with the telemetry, we can understand what's going on. Then we can try to build more in terms to, and also provide auto-fix to help our developers. When we build custom Python linters and auto-fix, we can use a framework, it's called fixit. Here are some built-in rules that are implemented with fixit. The first best practice is to always, it's pretty easy say frozen when you declare a data class. That way by default you may want to make your data class immutable by making frozen equal to true. So this in turn can detect when frozen isn't specified and warn the developer and the suggested auto-fix is automatically act frozen equal to true. There's also another rule, such as use AppStream when a percent format is used. So this in turn help you build suggestions and auto-fix for Python code easy. And in order to provide better digital experience, we also integrate with GitHub check, which allows us to mark the check as required to protect our main branch and allow us to provide notations to show the data errors in the context of code to help developers understand the data error easier on their request. And also we mentioned we may have some other non-Python linters, which we want to apply some custom expertise, for example, before we have a merge queue, we found errors sometimes merge to the main branch when two requests, they have some logical conflicts in order to reduce this issue. We have a best practice linear tool, which is a bot to check every full request if the full request is behind the main branch too much. It will make a comment to recommend the developer to rebase, to make the rebase very easy. We also provide an auto-fix. So as it mentions here, developer can just add a rebate label on their full request to automatically check the rebates. And when, because of the telemetry matrix we have, we will know when an error show up on a developer, if the same error also show up, when the error show up on the full request, when the same error also show up on the main branch, we know this error is not caused by the change on the request, so the bot will make a comment like this, saying the error is from the main branch and a fix is already available, so they can just rebase to get a fix instead of wasting their time on investigating a related issue. We also built some other custom Python linters to help us be able to incrementally solve linter, solve errors incrementally, especially when you have a large code base that has a lot of tech depth. In this case, linter will start with making subscriptions to prevent new usages, but in the meantime, we also want to collect the existing errors to fix them incrementally. And in this case, the strategy we mentioned collect telemetry matrix and build custom linter will be useful. With this approach, in this example, we try to build a tool to deprecate some library. So this type sample is a target we want to deprecate it, but we want to stop the bleeding by blocking new usages and we know it still has a couple hundred existing usage from our metrics. So we continuously collect metrics by analyzing the code base so we know what's the existing errors and we can just help the engineering team incrementally fix those by providing this dashboard to them so they can easily find the action items and the owners of those items to collaborate with them and see their progress over time. Another tool we built to help out the developers across different code base reused the workloads, like the GitHub check creation, the dinters, so we used, we built a framework. Okay, we built a, sure, well, we built a reusable framework which it provides a simple API. So anyone can use those API to build their custom linters and autofix and they can focus on building the custom linters logic and the framework automatically collect metrics and generate the GitHub checks and without annotation. So the last thing about autofix is automatic refactoring. Probably you already tried to use dependent but to automatically bump your dependency package version. We built our custom autofix to fix some trivial dintter errors so developers don't need to spend their time on fixing them. We used the CSG to build custom comat and use a GitHub library to create requests. And so I had another talk last year talk about how we built the automatic refactoring framework that create requests and manage their life cycle to get them merged to solve the large tech problems. If you're interested, you can find my talk in EuroPython 2022 and also check my blog post about how we use it to solve type of notation problem. As I mentioned, we have a lot of autofix. So here are some example for Flakey complain about used import a lot. So we provide autofix that can use the editor but also the request. So we integrate with GitHub check. So GitHub check can show a autofix button like this. When developer click on the fix Flakey button request, the bot will pick up a workload automatically push a fix. That way they don't even need to open the editor or run it coming. Everything will be generated automatically. We also build autofix for some my pie errors. For example, one common one is non-return. When a function has no return statement it should has non-returns connotation and build an autofix which can automatically do that for developers. We also have a custom autofix. For example, the request has them being reviewed after it's created. So while in a large organization you may have different teams and different code is owned by different team. It's not easy to figure out who owns the code you modify. So we provide an autofix, notify reviewer teams the developer can have this label on their request and we will base on the call on nerds and the GitHub stack mapping we have to find the call on nerds sectional automatically send a reminder for the developer to get their request reviewed. Here's another example, release on merge automatically release, make a new release when the request is merged, if the label is added. So as a result, we were able to develop a framework that makes building linters to support custom linters on autofix or want to developers in more than 30 different code bases. And with this, we make running on the internet with the same calculation and that practice is easier. So far each week, the internet has run more than 10,000 times and provided 25,000 suggestions and the autofix also been used a lot of times. So to recap, we provide a checklist for the linters to speed it up and we also have a strategy for improving the developer experience. Thank you for your attention. If you are interested in more of our work, you can check out our engineering block. If you are interested in our job, we are also hiring. Thank you. Thanks a lot for your talk, Jimmy. It was nice hearing from you and it was very useful to hear about linters. And maybe will you be available on Discord maybe for remote people to maybe ask some questions for the next minutes or something? Thank you very much. Yeah, thank you. Have a nice day, Jimmy.