Um, for those of you who are here this morning, I'm still only functioning about 50%, but my PowerPoint works. So we're way ahead of the game. It's amazing when you're used to using audio visuals and they don't work how they hold. The rhythm gets shot, the timing gets shot, the whole routine. Any event, my name is Don Blumenthal. I'm a consultant in Ann Arbor, teach at three universities. Used to be with the Federal Trade Commission, where most recently I ran the Internet Lab, which was our center for Internet investigations, the network operation side of it. Part of what I do in consulting is work data breach response, which is obviously how this presentation came about. Now, just to clarify, because of some conversations I've had the last couple of days, I want to go into what this is and what this isn't. I'm not going to be talking about consumer protection, what you as an individual do when your data disappears. I'm not going to be talking about forensic responses, closing the holes, anything like that except a very high level briefly. What I am going to talk about are the laws involved. I'm going to talk about certain policies and procedures that I'd suggest people think about. And I'm going to toss out what I think are some useful practical suggestions. Should your data or more accurately data that your company is holding disappears. It's an evolving area, obviously. You read more and more in the way of data breaches, just another one two days ago, major league. Same day there was a story about how the Secret Service is bringing indictments, criminal charges against some companies. And it looks like some of those charges are based on data that might have been stolen as long as four years ago, which gives you an idea of how this field is changing, how murky it's getting, how for different reasons companies are not companies, the bad guys, the thieves are in a position to sit on data and not even use it for a while so that you may not know the extent of the problem for a long ways down the road. I've got no good solutions for that part. You've got to take certain measures, but there's not much you can do about controlling how it's used wherever it's disappeared to. I have a piece of paper that says I'm a geek and I also have a piece of paper that says I'm a lawyer. It's obvious what's driving this slide. Very briefly it's the standard disclaimer. I'll just pass that on by. There's a lot of questions here, a lot of definitions to be raised and there are no good answers yet. Fundamentally the things you need to address when you're looking at breaches is what is PII? Personally identifiable information. The definitions vary. What is a security breach? What level of disappearance? Is it internal? Is it external? Is it both? Is it data that's stolen or it's data that's put in the dumpster? Who needs to worry about some of the data breach laws? If you need to worry about them, you need to notify when and how if so. Who needs to get notified? What do you offer to consumers to at least try to keep them at bay, keep them mollified happy? Beyond that how do you plan ahead? Now the title of the talk is what to do when my data's disappeared, post. I need to get into some of the earlier issues, things like laws just to put things in context. I'm hardly going to deal with how to plan ahead. This is not a discussion of data breach response planning. I don't know if anybody here remembers John Moschita. FedEx commercials about 10, 15 years ago, the mile a minute. Beth Fest is talking understandable human. I'm going to try to avoid getting into that mode. There's a lot to cover here. I'm going to be probably doing a workshop on this in a few months that takes an entire day. I'm going to hit the high points, but sometimes it's hard to identify exactly what the high points are. This is one of the fundamental definitions of PII and almost all of the laws that apply to data breach focus on PII, the personally identifiable information. Its information related to an identified or identifiable individual could be any of these elements. In some cases together, some require all, some require enough to make the link. Name, address, credit card numbers, personal information, medical information is a growing area. These laws at the state level started with credit information, financial information, the state of California added medical and one other, I forget which one, I think it may be Rhode Island has also done that. So the whole issue is definitely branching out into new areas. A sensitive PII is also another piece of the puzzle that's not quite as common, but you're starting to see regulations that talk about it. Good medical conditions, racial background, opinions might help identify, you'll believe it or not, if they can be synchronized or correlated rather with other pieces of data. Religion obviously, trade union membership, sexual preferences, marital status. All these things go into the equation of determining what's sensitive information, what's information that needs to be protected, what's information that if it disappears is problematic. Let's start with a legal framework overview. I'm going to really focus on U.S. law, but I think it's fair to mention non-U.S. law because there's a lot of back and forth these days, because there's a lot of misconceptions these days, particularly when it comes to Europe. Basically, the U.S. takes a sectoral approach. It's a patchwork set of laws, there are laws for financial services, there are laws for health, you know, Graham Leach-Bliley, HIPAA. The EU model is more societal. The European Data Protection Directive is, I think, the best known. That covers everything. It covers all areas where privacy is a potential issue. It's not just the EU, it's some other countries have taken that model. There's the hybrid, Japan, Chile. APEC is interesting. It's European rim countries. The U.S. is part of APEC, European rim, Pacific rim. The U.S. is part of APEC. APEC itself is developing a hybrid model, although it's got a ways to go. It's not finalized by a long shot. And then many countries, including some real hot button possibilities, the first two come to mind right off, have no laws concerning data protection. Now, the first thing you really need to do to start this whole process, and this is what I said about understanding things in context, you need to know the relevant data security and privacy laws. The U.S., it's quite sectored. You've got Graham Leach-Bliley that covers financial institutions, and that uses a very broad definition of financial institutions. If you're with a university, you're covered by GLB because you process student loans. I mean, it's not just banks, it's not just credit unions. It's essentially any organization that processes financial data for the process of extending credit, managing your money, anything like that. There's the FTC, Fair Credit Reporting Act, Fair and Accurate Credit Transactions Act, FACTA. Probably the best-known thing in FACTA is annualcreditreport.com. Let me give that a plug here.  It's annualcreditreports.com. There's HIPAA, there's again Education, the Family Educational Rights and Privacy Act, and others. These are all part of the picture. There's also FTC Act, Section 5. Any unfair or deceptive act or practice in or affecting commerce. That's a fun statute. There wasn't a whole lot we couldn't muck around in if we put our minds to it. But as a result, I worked data breach cases that had nothing to do with the financial services industry. BJ's wholesale, for example. Microsoft passport. We did spam cases before canned spam. There's the Sarbanes-Oxley Act going to corporate governance that now has some implicit requirements concerning solid IT practices, which include data security practices. We need to know the regulators, what they want, who they are, how they act, how they behave, what they expect. Graham Leach-Bliley, believe it or not, has eight different agencies enforcing it. That's because they have different jurisdictions. The FTC has explicitly no jurisdiction over banks, which means the Federal Reserve has to have a piece of this game. FCRA Fact is the FTC. Sarbanes-Oxley is SEC, HIPAA, HHS, FERPA, DOE. The Justice Department is lurking in the background because under some of these laws they have to do the actual enforcing to get a number of rules to be aware of. These slides are the ones that are on your CD, so I'm not going to go into a lot of details on them. GLB is the most enforced. It may be the only enforced of the data breach laws. Be aware of it. Be aware of the FTC and how it's approached these cases. That will be your best indicator when it comes time to dealing with the regulators. The other thing I'd really recommend checking is the FFIEC guidelines. They take a little different approach, but they're critical. HIPAA, read the rules. Maybe someday HHS is going to get serious about enforcing HIPAA. They've brought one case. Until they bring more cases, nobody's going to really know how they interpret the statute, how they interpret the regulations, whether they follow the FTC's model of closely scrutinizing security plans, or just say, you looked at it, you made this decision, it's sufficient, bye-bye. In this international world, you can't forget international laws and directives. You can't forget common law, basic stuff. The government may come after you, but your stockholders may come after you. Your consumers who are ripped off may bring suit. Don't just focus on the government, whether federal or state, and then there are the private standards. I kind of covered this just a second ago. Contracts, tort, didn't mention privacy issues. Those are growing, it's becoming a growing area of law, just common law privacy. It was my data, you should not have let it go. This is going to grow as class actions get more heavily involved. TJX is a good example. PCI DSS, which I know you've heard if you've been at some of these other presentations. I'm not a big fan of it, but it's in place. The audit standards, the feds, FISMA, all part of the game. But for all of that, there's really only two sets of national requirements that deal with data breach response planning. They all say what you need to do to secure your systems, but they don't say what, if anything, you need to do if you lose your data. One is a Fed document, interagency guidance on response programs. Again, it's in the CD. You can find it easily enough if you run Lexus or a search engine. And FISMA, which is a NIST standard that applies to federal agencies with one caveat that I'll get to in a minute, we're unique. As far as I know, there is no government or government alliance outside the U.S. that has anything to do with anything in place concerning breach notification, which really surprised me when I did the research. Even Europe, with its data protection standard, has nothing on breach notification currently. Focus your attention here to really learn what might come somewhere else. The interagency guidance I mentioned is issued by four of the HGLB agencies, and they have this definition, sensitive consumer information. A little different from PII. PII is your name and your address and all these other possible elements. Sensitive consumer information is, to me, a more legitimate set of tests. Because it says, if the information is there and somebody can put little pieces of this, that, and the other thing together, figure out who you are, you can be hurt. You can be ripped off. So a username and a password is sufficient to trigger this, if it's leaked. A password and an account number, no name, is sufficient to trigger the Fed definition. Again, much more, much more reasonable. I think it's a definition to keep in mind, regardless of what your breach may be. As you'll see later, I'm a firm believer in overreacting, providing too much protection, erring on the side of notifying, even if you're not sure you have to. Because the long-range liability is going to be much less, I believe. The breach response under the guidance, I think, is a good solid set of elements. I'm also a big fan of Graham Leach-Bliley, which is really very general, when it comes to security plans and what should be in them. Leaves it up to the individual situation, knowing you've got to justify what you've done, if things get ugly. But the Fed requires that a plan be in place to determine the nature, the scope, figure out what's disappeared, what's been misused. And this may not be a very easy task. I worked a project recently where a hard drive was stolen. If your database is breached, you know it's gone. You know the data elements or you should. If a hard drive disappears, you may not know it's on there. If that hard drive contains email, you definitely have no clue it's there. We were astonished, disgusted, depressed, whatever term you want to use, after doing the forensics on the disk and finding out how many people were emailing work files with sensitive information home so they could work at night, emailing through Yahoo Mail, Hotmail. Even a more protected or non-webmail interface. If the email is just brutal, if that's what you've lost. The Fed also requires you notify the primary GLB regulator. You tell law enforcement so they can be on top of it quickly. But the other thing is so they can tell you keep your mouth shut. There's an instinct, there are notification laws. We've got to talk. We've got to tell people. Well, law enforcement may not want you to tell people yet. If there's a delay, they may be able to get on top of things. So informing law enforcement is, that exemption I think is very important. It's one that we'll see is in other laws. The Fed also requires customer notification. You have to describe what happened, how you handle it, and provide consumer education and services. This is the only law that requires services. You must provide credit assistance. You must provide credit protection. Again, it's something I think you would consider no matter what. But if you're balancing what you have to do and what you might want to do, the Fed's the only one that enforces it. FISMA has procedures for detecting, reporting, responding. So they have something in place that says you've got to have breach response. What's interesting is that there is no notification piece to this. The VA was under absolutely no requirement to tell veterans when their data disappeared. Now, there's an ongoing legal battle. As a matter of fact, the last I read, two people within a given agency disagree as to whether if you're a federal contractor holding sensitive information, whether you're covered by this piece of FISMA or not. Obviously, if you are, you've got to worry about having these procedures in place. It's not settled right now. The other place to look for possible ways that you're going to be expected to react to a data loss? The FTC has a business education pamphlet and video. What happens if you're breached? A response plan is one element of what the FTC recommends. This tracks, to some extent, Graham Leach-Bliley, a designated coordinator having a plan. Check this publication out for purposes of knowing what an FTC regulator, an FTC lawyer might expect from you if you get breached. I think most of it is solid. I think one element really doesn't make a whole lot of sense as a flat rule. This came out after I left the FTC. I won't take responsibility. I'm going to let you guess which one I think is, to put it politely, not such a wise blanket piece of advice. This is really more for, I think, consumers to understand what a company should be doing. It's much more useful in that respect. But if you're under FTC scrutiny, they are going to look, to the extent to which you look at these elements. So be aware of them. Regulators are going to look for these items, pretty much. They're going to look for a risk-based plan. This is straight out of GLB. And again, this is the only security statute, privacy statute, but data security statute that's really been enforced. The plan's got to be appropriate to the size and complexity of your business. They're going to look to what your response was when the data disappeared. How you address the nature, how you address the scope, what was breached, what systems were breached, what data was compromised. They're going to see if you inform law enforcement, the extent to which you contained and controlled the breach. If you notified, we're appropriate. And that's kind of curious because the Feds don't require notification except in a limited sense. There's no hard and fast rules about which of these are the most important. Should the regulators come knocking? So it's just a guessing game. It's probably not a good way to put it. Lawyers don't like it to talk that way. But at least these are the factors to consider and apply. And again, I'd suggest applying them in general, not just if you're a covered industry. Even if the regulators can't come after you, your customers and shareholders can. Even if they can't and your management can, and even if they're not going to, it's to me just good solid business practice to have a good solid security plan in place, including what you're going to do if things blow up. Now you need to be proactive. You know, have the plan, know the regs, apply to your environment, and react well.  Got to show you used it. Got to show the notebook is where somebody can get to it, not in somebody's backseat of somebody's car. True story. Some of the stories are bizarre. The company that transferred sensitive data through unsecured wireless network to sit on a server unencrypted. And by the way, the server had anonymous FTP going. And, gee, the data got stolen. Got stolen through the air, got stolen off the server. That was one of the true slam dunks of my career. That's when I was with the lab, so I was kind of advising rather than bringing the case. The real enforcement factors are going to be what you represented to the public. That's part of it too. Microsoft passport was, and there was no breach in passport. Let me explain that. But, you know, there were affirmative representations on the security of the system that weren't true. The enforcement factors are your practices to protect practices. The data to detect if it's flown. How reasonable are the measures? Now, there is no cut and dried rule. And when I worked cases, we would look at what companies did and we did our best through internal people, hired consultants to say, was this reasonable? I mean, we brought cases where there were breaches and the cases were dropped because what they did was reasonable. Data still disappeared. There's no perfect system. There's an issue of demonstrable harm and there's also the issue of how to direct. What was your breach notification? Right there, okay. Once we get away from the feds, we've got the states, which are far ahead in notification. As of April, there were 39 states that had breach notification. The district has a rule. New York City and Puerto Rico both have statutes on the books. The usual state PII is what I've kind of talked about. First name, last name, source, driver's license, all the standard stuff that might be in a database. Most of the laws have exemptions for encrypted data, for whether the PIN is, say, for an account is included or not. If you've got the account number and there's no PIN, well, maybe it's not triggered. A lot of variations, as you would expect, from 39 different states. You need to be aware of all of them, though. There are a lot of good matrices out there on the web that catalog them. I'm working on another one now. The elements are PII, like I said. They generally exempt if data is encrypted. A lot of variations on what encryptions to find. Rhode Island, I believe, specifically says 128 or 256-bit. Some states don't say anything, which suggests that if you've got a Microsoft password on your Microsoft Excel file, that's okay, too. I don't know which is better. I really don't. Keeping it general gives the flexibility to look at a situation and say it's reasonable, but you can run into some real problems. On the other hand, do you really want to put specific technical standards in the law? Because if those standards changed, if 256 gets hacked, we all know how easy it is to change a law and bring it up to speed. Most of them have exemptions if the business involved is covered by Graham Leach-Bliley. They vary on allowable forms of notice, email, phone mail, phone, snail mail, whatever. They have different triggers with the data accessed. Was it accessed and used? Was it disclosed? They vary on who makes that determination. Does a company decide if it's likely or unlikely to have been used? Some statutes, yeah. Some statutes let the company decide whether it's harm is likely or unlikely. There's variations on if the statutes apply outside the jurisdiction. There are some states that say, I don't care if you're doing business in my state. If my citizens are nailed, you have to provide notifications to them. There are other states that say, if you're in my state, you'll provide notification. I don't care where the customers are. I believe all of them have provisions for third-party data holders. If you farmed your data out, are they covered by these laws? They all have provisions. They vary significantly in how they apply. They will vary. I keep using this term, but it's an unfortunate reality. I wish there were a uniform law. How long can you wait to notify? What state and local agencies do you have to notify? Some non, some attorney general, some consumer protection. Some require that you notify credit reporting agencies. Some say you've got to notify credit reporting agencies or the state AG or whatever it is, only if more than 5,000, more than 10,000, more than whatever thousand customers' data has disappeared. Now the real trick there is you may not know for a long time. And you may want to respond, get your notification going long before you really do know. Some state statutes allow penalties by state government. Some have nothing. Some allow private rights of action. It's a hodgepodge, obviously. Like I said, there are spreadsheets out there, word documents, all sorts of things. All have tables that are really good references. If you want to get on top of what you've got to do if your data disappears in terms of consumer notification. From a legal standpoint, that's probably the biggest issue is consumer notification, customer notification. And the advice here, obviously, is know the stuff. If you've got, as part of developing your breach notification plan, have all this stuff tabulated. Have it ready to check. I don't care if you've got outside counsel to ask after the fact. Make sure you've had your in-house people or outside counsel prepare something like this for you. So you've got it. Probably it'd be a good idea to also know where your customers are. Keep a running tab. Know that if something happens, I've got to worry about this seven states. I've got to worry about this 12 states and Puerto Rico and New York City. All part of being ready to move quickly. But laws and guidelines and regulations go just so far. The real world is where it meets its test. It's the real world that's what provides solid examples of what to do and what not to do and what to think about. Now, basically, even before this mess does or doesn't happen, you need to have, and this is standard enterprise security stuff. I teach that at UMichigan. You need a management commitment to privacy and to compliance with the necessary laws. And you need management to be willing, ready, and able to give you the funds necessary to have things in place to keep your system secure, to keep your data secure. That's more, you know, I'm worried about data security here. The rest of the systems, well, that's another issue, just as important. You need a good solid structure so that different divisions can talk to each other. The business folks know what the tech people need. The tech people know what the business people need, and management has a handle on everything. You need targeted training so that people know how to protect data. They know what to keep on top of. And this can be basic stuff like passwords for folks who just use PCs all the way up to good solid systems. Security training for the people who are maintaining the systems. And you need a response plan, obviously. Now, the breach response can't be done in a vacuum. And this is a common issue that I run into with enterprise security. Too often, things are stovepiped. You've got this bunch of folks working PCI. You've got that bunch of folks working HIPAA. Somebody else is doing GLB. And maybe different machines are involved. Different terminals are involved. Different databases are involved. But it makes no sense to do these separately.  All this to make sure you've got a comprehensive approach. Your approach is efficient. It's cost-effective. And everybody knows what's relevant. If you do all of these things, let's take a university because there's not much that they couldn't get hit with. The GLB people know what's important to protect. It's useful for the people who process credit cards to know that. They're covered by PCI, non-government. And the HIPAA folks, well, there's some cross-connection there, too. So not only do you have, say, a common systems approach, everybody's got an understanding of everybody else's requirements, and that is very valuable in the planning process. Okay, you've got the loss. You need to have documents, diagrams, plans, and I'm not going to throw out buzzwords because they're antiquated the day you hear them. Data maps, for example. You need to know where the data is. You need to know what's in it. What's in that database? What kinds of data do you have? Whose data do you have? Is it all customer or is it cross-connected with other stuff? You need to know who the stakeholders are. Are they just your employees? Are they your retirees? Are they customers? You need to know the lines of authority in the enterprise. Who do you talk to if something happens? Who do you talk to if you need to plan for something happening? Who do you talk to if you've got a question? If something's ready to go. And it all comes down to just making sure everybody who needs to coordinate can do it. Everybody who needs to coordinate gets it done. Everybody's on the same page. To me, the poor critical pieces of the response plan are preserving evidence. And that's writ large. That's in a broad sense. Determining what's been lost. Determining how it was lost. Saving audits. Saving logs. If you're talking about a break-in breach. Saving logs. If you're talking about an internal transfer out. Internal crisis communications. Who are you going to notify? When are you going to notify them? How are you going to notify them? Who has to be notified? Customers, employees, like I said, retirees. And this last one is really important. Got to have communication structure waiting for dealing with investors and employees. They're the ones who probably, particularly if it's private data, they're the ones who probably couldn't create a lot more problems for you than customers can. It's going to be much easier to demonstrate their losses than if a credit card is stolen on the outside. One of the reasons TJX really hasn't been subjected to much in the way of penalties is it's almost impossible to prove that a stolen credit card came from that breach. If the worst happens, notify. Include the business, the legal, PR, human resources, you know, law enforcement. Talk to your subject matter folks and document every step because the regulators will want to see it. It'll be important in a lawsuit. Identify what's lost. You know, if you need to bring line of business people in, they know your systems. They're going to be able to spot what's gone a lot quicker. They're going to be able to spot how the data fits together to figure out is it really PII or not. They're going to want to tell you what's that abbreviation mean. You may not know if it's PII. Have a lawyer, have business people around to guide every step of the process. So you've covered all your bases. You've looked at everything. You've considered all possible ramifications. Where we're talking sensitive data, don't forget things like trade secrets. Those can folly up worse than anything if some of that gets leaked. You need to engage outside counsel. It's unlikely your in-house people will have sufficient expertise if you've got them. But vet your outside counsel choice. Just because somebody says, I work for the Federal Trade Commission, doesn't that mean that person knows a plaster thing about Graham Leach-Bliley? She may have left the agency two years before Graham Leach-Bliley was passed. And if necessary, if that means going with a different law firm than your usual counsel, do it. I would suggest, I have a definite bias against going with the law firm that your general counsel used to be with in general. But it can really bite you. When you're dealing with something that's potentially damaging as a data loss. If you need to, use your own law firm and then also hire somebody who really has applied demonstrable security and privacy experience. Because that firm may not be able to litigate, to be fair. So your litigation counsel is fine, but have other folks who know this field. You know, be ready to engage forensics to help you determine what's lost. A crisis management company? There's a skill to this. Identify a crisis management company who has experience, who knows how to handle the PR, who knows how to handle the required notifications. Can just roll them out, not have to worry about them. And be ready to help individuals whose data is lost. Lawyers should be lawyers. You know, be careful about the good old boy. You identify your forensics people. Your lawyer may not know, except, well, this firm's good. My ex-partner's there. Check out, you know, very often you want outside people to review the lost data to determine what's PII. Do you really need a contract lawyer doing that at lawyer rates, as opposed to a paralegal? Things to look into just to protect your own pocketbook. Fundamentally, I believe in going on above and beyond. Do the right thing. You know, the law requires notification. Maybe it does. Maybe it doesn't do it. The PR value is going to outweigh the cost. You know, public perception can be everything. And, you know, if the data holders expect notification and they don't get it, they're not necessarily going to care. You know, you don't notify, but word gets out of the breach. They know it happened. They expect to hear from you. Respond to the press. Respond positively. You know, be realistic here.  And I worked a project where I looked at the press release, and I know it happened, and I just depressed at how little came out that customers should know. But what they did was legit, and they weren't pressed, at least so far. Who knows what's going to happen next. You know, if the regulators do call, know what the laws require. And for those of you who were here this morning, I repeat my mantra. Show respect. Don't play games. That's the worst thing you can do when law enforcement comes knocking on your door. Protect your rights. Protect your interests. But work with the folks, not against them. Just in the future, things to keep in mind, things to look for. The identity theft task force report has recommendations. There's laws to extend GLB to all entities. There are laws for federal breach notification. There may be clarification of how FISMA relies to private contractors or states that hold federal data. There is a breach notification law that passed a House, a federal level one, which might be a good thing. It has not passed a Senate, given where we are in the election cycle. I doubt it will pass this year, wait until next year when it's reintroduced. EU does have a breach notification proposal in the works. Maybe they will start requiring notification. The Canadian Privacy Commissioner has a voluntary notification set of guidelines in place. Be aware of it if you do business in Canada. Even if it's not formal, it's not nice necessarily to aggravate people in high places. You never know when something informal is going to become formal. Any questions, please don't hesitate to contact me later on. But in the short run, are there any questions here? Yeah, I'm not sure what you mean about exposure to client. The laws and the regulations are going to apply regardless except when you get into issues such as notifying credit reporting agencies. Certainly the scale of your response, your response plan, your security plan may not have the same level of requirement in it and still satisfactorily passed a regulator's muster. I mean that to me is one of the beauties of Graham Lee Splyly, the beauties of HIPAA. They are worried to take into account the realities of the business situation. They don't have anything really strong and firm. The idea is have a plan in place and be ready to document your reasoning behind it. No, it's more of the lights not. Part of it would depend, I mean are we assuming here that HIPAA is covered? I mean that you are covered by HIPAA? Okay, because there are some areas where they're gray. I approach HIPAA on the basis of following all the required guidelines, using another presentation covering all the R's and A's and thoroughly documenting every step you did on both the R's and A's and why you did or didn't do them. And if it's a smaller company you're going to, I think, and again HHS hasn't really enforced, if it were an FTC case they would take the size of the company and the resources into account in how you addressed each element. But I would address each element. I don't care if it's addressable or required. At least have that documented. Thank you. Yeah. It could. Yeah. The question was whether it relates to offshore data havens. The cross jurisdictional pieces are very difficult. For the most part, it could in theory. I'm not aware of any cases that apply. And certainly none of the U.S. laws apply directly.  As a matter of fact, Graham Leach-Bliley specifically requires that if you do outsource your data, you require them to follow Graham Leach-Bliley requirements. Certainly. Now there's nothing, state laws may not because these folks are not U.S. citizens, or state citizens, state residents. But there's nothing like, and think of, that says if the data is housed here and it's a non-U.S. person, then it wouldn't cover. Boy, this got convoluted. Yes, I believe that a non-U.S. resident would be protected. I think there was another one. These lights are killing me. Yeah. Oh no. Yeah. FERPA? It's one of the lesser known privacy laws. Certainly it applies to higher education, student records, student information. I'm not aware of any enforcement cases under it. I mention it because the data elements to me are things that need to be considered when you're looking at the data that should be protected.  Now, if a student says no, and students do, there's no question about that. Given that there's that, ha, quickly. Given there's the element of privacy there, a regulator is going to look to see how those specific pieces of data were protected. I just got the you're done sign. I'll be going over to media room if I can find it this time. I'm glad to answer more questions. Thanks.


I hope everybody is having a nice day. This is the fourth or fifth year that we've been doing this call. It's been a really fantastic way to get some new ideas for people who don't have them, and just as importantly, validate for people who do, like, hey, that idea that you have that you're not sure about is totally worth pursuing. And the real truth is almost anything is worth pursuing. Like, it's a big audience.  You're not that special. The things that you think are awesome, we also think are awesome. So I also want to say that so far pretty much, I'm now going to have performance anxiety, but so far pretty much every year that we've done this, our top submissions in terms of, like, voting of the program committee ended up coming from this meeting. And the review process is anonymous, but some of the reviewers are here on this call, and I very strongly remember comments that are like, oh, I totally remember this person at the CFP call. Oh my God, I'm so excited. I'm so glad they submitted it. So yeah, I have high hopes is what I'm saying. You guys, pressure's on. We have a bunch of wonderful people here today, but I want to introduce specifically a few of them who are either on the program committee or who I told y'all would be here. So I feel like I should do that. So Godfrey and Yehuda are both here. They're both going to be speaking at the conference. They're both on the program committee. Melanie is here, and Jen is here, who are both on the core team and who I suspect will end up being on the stage, even though I don't at this point know what they're going to be doing while they're there. I see past speakers, like I definitely saw a little Jessica Jordan headshot floating around at some point, even though I don't see her anymore. I see Vaidhi, I see past volunteers and other speakers, and James is a speaker, and I can't see all your icons. Chris spoke at BonusCon last year. I can't see all your headshots at the same time. So if I'm not calling you out, it's not because I forgot you. It's because you don't have to be on the random assortment people on the screen right now. So the first thing I want to do is ask just a few of those people to introduce themselves briefly and talk about either some of their past experiences with this call or what they're optimistic about for today. So Yehuda, do you want to start us off? We can't hear you. OK, can you hear me now? Yes. Blue jeans was like, you cannot be heard. Maybe you don't want to be muted. OK, so I've been obviously doing EmberConf talks since I'm Yehuda. I was a co-creator Ember. I've been doing EmberConf talks since EmberConf was called EmberCamp. And I want to second what Lea said about some of the best talks come out of this brainstorming.  And actually having a few back and forth rounds to figure out like what might be interesting to the community, the committee, et cetera, always makes the proposals better. I also want to say that for people who don't know, the proposal process itself is iterative, which means that you can submit a proposal and there's a few rounds where the committee members will give you responses back and allow you to modify the proposal. So I think coming out of this, you should just write a draft proposal if you have an idea for one. And don't worry so much about getting it perfect the first time. The point at which anybody is really like greeting or judging your proposal is really at the very end when the committee sits down to look at the finished proposals. So don't like, I would say the theme of this is like get feedback early and often and we're trying to give you as many opportunities as possible to do that. Cool. Melanie, we heard from you a little bit, do you want to introduce yourself and add anything to that? Sure. I'm going to pitch the same talk that I have for the past couple of years. I still think someone should do a talk that's like integrating a piece of music that starts out simple and increases in complexity and it compares that parallel to Ember somehow. I will tell you full disclosure, I bought a cello to give this talk. I have almost finished paying for this cello. It's almost paid off and I still have not learned how to use it. But someday I will see this top on stage and please feel free to steal this idea and use it because that would be awesome. And I would say we need people to speak about ideas so why not you? There's everything, you can learn everything. I took some lessons to learn how to give talks and I still say um and uh a little bit too much and I still kind of wander in my head and maybe down around a hole or two but I'm out there talking about a thing that I think our community needs to pay attention to and like that's it that you're the person. You're the person coming to give the talk. You don't wait for someone else to do it and if you want help we're here for you. Awesome. Jen, I don't see you anymore but I assume you're here. Say anything and introduce yourself a little bit. Yeah, sure. So my name is Jen Weber. I've been helping out with learning team stuff for quite some time and starting around this time last year. I also joined the framework core team and I guess my own speaking experience has been it was kicked off by somebody else involved in the Ember community who um heard me talking about my idea for a meet-up talk and said hey you should submit that for EmberConf and I was like no way is that gonna like be a thing. I don't know what I'm hardly even doing with this meet-up talk and he said that's okay do it anyway you'll figure it out you have six months so um that is kind of what led to public speaking and it's been one of the most rewarding things that I've done I think in my technical career is giving me so many opportunities to connect with other people and to like share and learn and grow as well as to help expand the knowledge that's available to everybody else and I guess what I'll say as well for my like one piece of advice is if you are feeling nervous about the idea of giving a talk in front of a bunch of people good like that's normal if you're not nervous wow you're so lucky but um like it I always feel deep regret like the day before I'm supposed to give a talk I'm like why did I sign up for this and I always feel very nervous before I get up on stage and um the like I don't ever regret giving a talk when I'm on the other side of it I'm like so happy that I did it so you know I encourage everyone to use this as an opportunity to challenge yourself and even if the talk isn't chosen for EmberConf you have a very strong foundation for giving it at a meet-up giving it at another type of conference and like it just opens up so many opportunities after you take the time to do that planning and the thinking about what you want to share yeah and um there's more people to introduce but I do want to add a couple things to that um you have made a comment like six months uh and I want to uh focus on that which is to say you don't actually have to have your talk ready to get your proposal in which I like sounds obvious but isn't and I myself like impose oftentimes a standard of like well I don't know if it's going to be any good until it's completely finished so I can't submit it until it's completely finished but that means you need to be finished with your talk for next March by like November and that's not happening and even if it did happen it would be stale by the time you got to March so all you need at this stage is the idea um and like an outline right a rough outline of what we want to talk about you don't actually need to know exactly what's going to go inside and you don't even need to have necessarily learn what's going to go on each side there's like a a burden that people have thinking like oh I need to be an expert and when they approach this topic they think to themselves what am I an expert in but a lot of people don't personally consider themselves to be experts in anything just because we're all like nice modest human beings and because we're always learning more and more things you don't need to be an expert and oftentimes the best person to teach something is somebody who very recently learned it because they can remember the mindset of the person who is learning it versus like a seasoned expert who's been doing the exact same thing for a really long time um I've just somewhat off topic but uh I follow somebody on Instagram uh her name is Lenora Porter I think and she's been learning Ember and she does a lot of uh posts of like little videos and little things and just yesterday she did one that sort of clarified what she was up to for me and she was like oh by the way the reason I'm doing this the reason that I've been um I'm here for like weeks and weeks in a disciplined fashion telling you about ember octane and watching you letting you watch me learn is because I decided to volunteer to teach octane to my team at work and I have to do that in a month um so here I am learning it uh and it like it was very appropriate timing considering this call today but um all the time during her learning by the way I didn't think like oh you don't know what you're talking about I thought like oh I didn't know that that's cool and like watching her learn it was meaningful for me um but knowing that she's doing it to give a talk very much like the one that we might be hearing from a bunch of you uh made me very happy yesterday um and then the other thing is if you're nervous same thing good be nervous it's great it'll push you to do well just don't let it overwhelm you but also like there are so many people here who want to help and want to support you and that means dry runs over the phone along the way ahead of the conference that means lots of people who really want to review your outline and give you ideas review your slides give you ideas all the way up to like a space at ember conf the day before the conference where you can like get up on a stage and give your talk and do a legit dry run um and the next thing's on their those lists are basically whatever you can think of there are a lot of people here who want to help you and so if you come up with something that's going to be helpful to you uh we want to do it um so next I saw uh Kenny Bolo pop up uh can you hear us you want to introduce yourself and tell us a little bit um about your ambitions for today yeah yeah uh I'm a bit like uh I'm Thomas I work at linking I'm also maintaining a few add-ons like ember fetch and pretenders so uh so uh I don't know what you guys talked before but I'm just basically want to get some feedback on the ideas of what kind of proposed I can get so um so I'm thinking of maybe I can talk about how to do like error tracking ember apps like uh people may know this ember dot on error or window dot on error or how to catch a promise error or how error tracking works in a fastboot mode so I think that might be helpful if I can get a talk for that topic and I I'm also thinking about doing some like maybe uh how real user monitoring works all the performance markers and how ember apps boot and transition faces is like so uh do you think those topics would be good for a conference talk so both of those sound like good topics and I don't think anyone mentioned this yet but you can definitely feel free to submit more than one talk um having done selection for many many years it I can't even think of one time where it hurts somebody to have more than one talk it might not necessarily mean that the one that you thought was better gets selected but that's fine um I think you would prefer that basically so uh in terms of the two talks I think if you just only focus on the ember dot on error even with fast food I think that's like more of the size of a lightning talk but I think if you add in general error handling like how to think about promises failing uh error state things like that I think that makes sense as a full talk basically like how to handle errors in ember and I also don't think that there I can't think of a talk that I can remember that already covered the topic in the past so I think that's great um I also if you do the real user monitoring talk I would when you started saying it I was thinking I wasn't that interested in it but then you talked more about the details of how to think about how rum fits into the ember model of transitioning and that's done interesting to me um the that topic itself also sounds a little small on its own but you also I think if you if you flushed it out there's a talk there so both of those I guess my general feedback here is like be cognizant of the 30 minute limit but still try to cover more than one narrow topic like if you could imagine giving the talk as a lightning talk try to think about not don't like add more topics but try to think about how to flush out the topic so that it was like to let it fit into a bigger spot yeah good thanks for that um ah I see you now hi pinnipolo how are you doing I'm good I'm good hi this is the one other person who I also wanted to introduce who spoke last year um and did fabulous and is getting more involved this year and that's a common trend by the way is once I get my head into you and I get you involved with some part of ember confidence and pulling and pulling um so why don't you introduce yourself and uh I don't know say something sure okay hi I'm Steven um I'm a software engineer that's based in Finland uh originally from London and I've been in Finland for a couple of years now I've been doing conference speaking for about three three years thereabouts um and I've loved it I've enjoyed every bit of it I think that the the the one thing that I found interesting was speaking at conferences is taking me from being an intro of it to actually being an extrovert because I did my masters I was the one person who literally said nothing in class but going to conferences and speaking to people helps me overcome most of the stage fright and it's also helped me connect with a lot of people so I think one one advice I would I would give would be uh something I found really helpful for myself and my talks when you have an idea and you're not so sure about it it's always good to actually have a group of people you can actually brainstorm with so the last year I did it together with Chris and Jessica we had a couple of topics that we were interested in and we basically brainstormed together and tried to pitch the topic to each other and doing that basically helps us to see if it was making sense in terms of the audience or if it needed to be tweaked a little bit and I think it was important because it basically helped us to get proper feedback even before actually submitting the CFP so it's more like getting feedback from your own peers who are also working in the industry and asking is this something you would actually like to hear at the conference and then of course people need to be honest with you we were quite belongs with each other so I would say that was pretty helpful but yeah um that I think that's pretty much what I have to say for now if you if you uh a doubt in your idea or you're not extremely sure about the idea then it might be a good it might actually be good to uh go through it with some other person who would understand and try to find out if this is something that will be interesting for them to listen and if they say not so interesting then try to find out why because they could give you good point as to actually modify the talk or whatever you do that's also yeah and I wanted to also say that that I that really does happen I think the difference between someone who iterated on their talk not to be a broken record here on iteration but is it's like the difference between a talk that might have nothing to do with something that could be accepted and like the best talk in the conference and that's just not just from iterating after it was accepted that's from iterating before you submitted it um I know uh even you have already started to do a little bit of reviewing of proposals so you could back me up when I say uh very little like very few proposals come in that are like actually terrible or embarrassing right like not everyone's going to make the cut but most things that people want to pitch and most ideas that people have are good and decent and a good start um and uh don't let your doubts stop you from joining the list basically yeah I the only talks that I was I don't know what you're asking but the only talks that I would say are embarrassing are people who submit talks or obviously not part of the ember community and are submitting like a prefab talk that like has nothing to do with ember at all or like mentions ember as a templating matter I don't mean to I mean as a they took their talk and they wrote the word ember in it because they were supposed to do that in the conference or like one line proposal where the proposal was like I'm going to go talk on testing those are I would say are embarrassing and I shouldn't use the word embarrassing because I don't want to be like like I guess those people are probably not at home crying either but like yes don't submit a talk that completely has nothing to do with ember at all um and that's actually like a wide guideline because there are a lot of general concepts that belong here just as they belong at a Python conference or a million other different technical conferences or even non-technical conferences but where you just have to like insert that little tweak to make it more relevant to the people who are going to be here again right maybe adjust your examples to be written in ember if it's a general computer programming concept or something like that if I should clarify that I am not saying that you if you for example we've had accessibility talks that are I would say in many ways a very vanilla accessibility talk but we accepted ones where somebody made it clear that they were going to spend the time to understand how it fit into ember because people can go online and watch a even an important general purpose talk but people it's not just it's not just about making it like relevant in a abstract sense or philosophical sense it's about making the talk useful to the users that you're that are in the room right like if you say make sure to use a button instead of whatever instead like I'm using accessibility example but a better thing to say is the action helper or the on helper has these issues in ember and here are some other patterns that you could use that would be more accessible right whereas if you gave the talk that you would give to the Chrome Dev Summit you would just say don't use an event handler here use button and those are different but there's small tweets that can be applied to someone yes you just have to be an ember community member I think that's the bottom line you have to already you have to know what ember is and what how what you're trying to say affects ember yeah I think where I was going before was I think Melanie and Stephen have both started looking at a couple of proposals how are you feeling so far about the stuff that's come in an anonymous tell me happy things way uh Stephen I would say I would say it's been quite good in my opinion um a lot of the talks have been they've come in have been quite high level um it's quite difficult now uh with rating because you're reading so many good stuff and then you're thinking like how you know how do I read this yeah so in my opinion it's been quite good I've gone through a couple of them I think the ones that came in earlier uh during the first two weeks I think yeah and it's been good it's been really good it's been some really great talks and I'm hoping that we will get way much more and it's going to make the job more difficult for us yeah um so I'm not on the program committee and I'm the only person who gets to see everything unblind so I'm glad that you said that they all see that a lot of them seem really good and I want to add that I don't know most of the people who um submitted these talks so it's not like it's just like the same 10 people submitting over and over again and they're buddies so we rank them highly and then they get to get on stage um we try and promote CFP widely and then um I'm always excited like I get really excited I spent this morning actually just like googling random people whose names are in there just for my own personal interest because I was like oh I don't know you who are you um and they all look really good okay next up uh let's go to somebody random who has an idea that they um want to get some thoughts on and what you got it gets scary um so I gave a lightning talk at emberfast um and I see some people who were there who have actually seen it and um a lot of them encouraged me to also write a CFP for emberconf and I've been brainstorming a bit with Jen about it so what I did at emberfast was basically explain how I as a non-ember developer became involved in contributing to especially the ember times but also being your personal I upload thomsters that person for the website um and I um thought that might be nice but I recently also discovered that with my background in psychology it might be interesting to add on something about uh social psychology related to online communities and open source contributing um somewhere along the lines or touching also upon some research that at least Jessica also posted in her blog post um so something along these lines and I would really like to but I don't know how yet um do something interactive um which is scary it's really like do you remember Gavin talk when he did that uh yes it was such a hit yes so no the thing that I would like to do or I'm thinking about is doing some kind of experiment ish to show how you get people involved or connecting and I was thinking if I could do somehow something that people who are first time there or they're alone somehow get appreciation for being there but also feel part of the group because I know for example Isaac somehow found us last year at ember conf and he's now completely involved in giving amazing talks um so he managed on him on his himself but I think there are also people who need a bit of extra help yeah um I like all those things and which doesn't help you narrow it down I know but uh that reminds me of a larger point I want to make so just in general in the world like I really love that computer science right now has so many career changers um and I love it professionally in terms of like the people who we hire at my company I I just love the fact that like there's so many different backgrounds that people are bringing to the table where they have expertise in a thing that the rest of us know nothing about but that can totally help the actual computer programming that we do every day psychology is an easy one and by easy I mean like big win not that getting your psychology degree or whatever it was easy I can't speak to that um but it's one that comes up over and over again because everybody wants to understand how people think and how people work um and we love having a few talks on the agenda that are always a little bit off the top like that or like maybe it is a talk it's mostly about like the human brain but then how it relates to the community we've had that in the past the one that's coming to mind right now is when Casey Watts data talk about neuroscience and programming but uh I don't even remember that talk specifically so I'm not I'm not necessarily saying it's a benchmark but I think that's a great um optical area that has a lot of new fresh content to mine uh Yehuda I saw you nodding was there something you wanted to add uh I am agreeing with everything you said I think this is a really good example of something where the ember connection has like needs to exist and it and would be easy to to forget about or make very light I think um we talked about the music Gavin's talk and I think he did a good job of making that like super fun and the fun at if you were if you were in the audience and you didn't know ember it would still have been a fun talk right but it wasn't if he went on the road and gave it that react comp that wouldn't make sense you would have to make significant tweaks to it so I think I agree with Leia that I liked a lot of what you said I um I also agree with Leia that taking advantage of stuff that you already are an expert in from a previous career is something that can make a talk really interesting um and I think yes and I think I think that's pulled out like Leia said I think that's pulled out the programming ecosystem is that we're all really good at like a big part of our job is taking complicated things and making them digestible like that's that's what we do and so taking like I'm thinking about something you that you were an expert in in the past and thinking about how to make it digestible for a for an audience is actually kind of in our wheelhouse in terms of what we what we do especially as front-end programmers so I like I like talks like that I think they're good cool I have one more question I was thinking about submitting it as a 15 minute talk do I have to decide that when I write my CFP or can people help me upon deciding this so there's no like um button to toggle in the system for I'm not sure but you do have sections that are like speak to the program committee this doesn't go into on a website somewhere but you can explain to them your qualification or whatever or anything else you want to say and that's a good spot to say like I've submitted it as X but I'm also open to it being wide and we do periodically see that and sometimes we'll also get stuff where people will pull in a talk and the reviewers would be like hey this is a really great idea but I don't think it's enough for 30 minutes it should be 15 or it should be even a bonus talk which is part of why we introduced the 15 minute experiment this year we'll have to see how that goes yeah that's that's actually also I think it's important for people like that is a good question that Lea maybe we could find a way to like put in prose somewhere around the application um you like you for sure you can add you can submit a talk that has some you have to check out some things in the in the submission and you can write whatever you want in the in the program committee box which could include I really didn't know what to go out here and especially if you get it in like reasonably early this this is what I mean by iteration like if you get something in reasonably early you can you should try not to be like sloppy or one-linery or whatever but if you're just like I really need help figuring out the answer to these characteristics people are really usually pretty excited about helping yeah the only really focus on filling it out the only asterisk that I wanted to add because you mentioned interactivity is a thing that I now I need to every year basically I have a long list of stuff that I send to speakers once they're accepted which are like pro tips don't do this don't do that whatever or here's some ideas here's good tools for slide one thing that I need to add to that list is it almost never goes well when at the beginning of the talk people are like raise your hand if x raise your hand if y for a variety of reasons including like people just don't like raising their hands or you might have asked the question that the answer is in fact not a few people for but the reason I don't like it is because the lackluster response that it almost always gets gives the speaker like that immediate like oh they're not with me like the audience not paying attention or nobody cares or whatever and like you don't want to or I guess I think like you're hoping to get a particular reaction and what if you don't get it and if you don't get it like you should still give the talk you were fighting on giving but it really demoralizes you there's also a bunch of other things I would say like you really have to say raise your hand something something if you can something something which like just don't sign up for that like you like you have to do it when you ask people to do physical things but for no reason at all like don't do that also I think in general it really like I don't like when like the presidential debates do it because it like takes a nuanced question and turns it into like this binary thing like are you a blah program or not and I think that just doesn't add a lot of values like it's very rare it's like it's usually like a raise your hand if you've written text or something and like like what does it mean if you raise your hand or not not much right so anyway anyway cool did you have any other ideas that you wanted to say out loud here and not that you didn't have no I think this was basically it so now I have enough input to think about it and I really like the comment that you would have made about the questions often being binary when there is a lot of things to say so if I'm going to do something interactive I will definitely keep that in mind awesome I see people have been tossing around some ideas in the chat also but does anybody want to speak up verbally who we haven't heard from yet or I could just call people and make them feel awkward okay Sushita hi guys I don't know most of you don't know me hi I'm Sushita I work with LinkedIn and I'm thrilled to be a part of LinkedIn because a lot of people are a part of LinkedIn so that's awesome so tomorrow I'm giving a talk at the rva.js conf on Octane and that's kind of going to be a way where I'm going to show how the whole thing shifted from 1.x to Octane and when I was creating the demo for it that that's when I realized oh my god this is so awesome so that's why like I was thinking does it make sense to even give such a talk at Ambercon to give up an example of the journey of how it was before and how it is now or something yes I think seeing the progression sorry this is Vaidhi I don't think I've said anything so maybe this sounds like a voice that's like yes I'm hi I'm Vaidhi I was just gonna say I'd love to see a talk on Octane from the perspective of like this is this is the progression and this is what changed and really like either from like a it could be like more technical like here are the actual pragmatic things of what changed but I'd also love to see a talk on like here's why this change changes your here's why Octane changes the way that you interact with and experience Amber because I think those could even be you could go two different ways with that but I was mentioning this in the chat I think there are a lot of good opportunities for talks with Octane and that just might be because that's what's on the forefront of my mind but if you've been working with that like I think there's gonna be a lot of people in the audience who are like want some sort of guidance or some sort of template of like how do I approach this how do I think about it how do I learn from somebody who's already done this so it'll make it easier for me so I think your ideas would make some a lot of people would benefit from awesome because I great idea thank you because I feel like one of the pain points that I saw from most of the people is it's steep learning curve that Amber introduced when it was there before but with Octane it is so so easy because now it's more in line with how the native JavaScript ecosystem is so that's why like I was very excited so I thought okay let me hop on this call and at least get some input from you guys to see what do you guys think about that I think this is great I think in general I would categorize that as like a case study talk and generally speaking I try to accept like a handful of case study talks but not to fill up the program with them and I agree with the with fight II and if anyone else said anything that this is this feels like a good and timely case study talk for this problem I think I want to add correct me if I'm wrong but like octane is new enough and still in the works enough that I think a lot of people aren't thinking like but I don't really yet know exactly how XYZ intimate detail is going to work and that's totally okay like I think it you want to be clear about that in your proposal but like basically you're going to do the writing not now you're going to do the writing other talk over the next four or five months where the rest of all those details are going to feel clear so don't like don't not do a talk because you're like here this part's still a little bit of a black box to me right pitch it and you can even say in your pitch like this thing is still actually under debate and the court team is still figuring out how exactly this is going to work and so it'll be current at the time of the conference based on what happens between now and then oh awesome that's very helpful thank you nice yeah by the way when someone pitches an idea if you hear quiet after that it's not because it's a bad idea or I don't want to say anything it's because I think you would also we don't want to just stop everybody else from talking so we'll fill the vacuum if it really happens but anyway who did I just accidentally cut off yeah that was me actually okay yeah I just wanted to say which regards to this talk I actually find it quite interesting and I'm looking at it from the perspective of people who have probably used ember before and do not use ember anymore I think it's going to be interesting because it's going to show a paradigm change in the way which ember actually works if I recall correctly there was a treatment there was someone who actually tweeted that the last time he used ember it was when it was in 1x and now he used octane and he could not believe you know how ember had progressed so I think I think in terms of in virginism also about ember this is also going to be a very good talk here awesome absolutely thank you um what else I see lots of people talking in the chat so I know we have ideas oh Preston you said you might have something to say yeah can you hear me yes all right um so I have no idea what like what length of these would be but like one idea I had was just like um like on submitting rfcs like instead of just complaining about something you don't like like actually thinking about how you would solve it and getting feedback on that and then iterating on that um but yeah I don't know how long like how much time I could use with that do you mean the um like that you want to talk about the intimate details of creating an rfc or how to have productive conversation on an rfc uh like I don't know I guess maybe both yeah yeah there was a really great talk about the rfc process at rush comp a couple years ago which was called like something something state of the union or something and it was about it was by the person who made the rfc for adding the union type to us and it was like sort of framed around I'm not this is an idea you don't have to use this idea but I think it's good to watch us talk anyway like your talk is really on the same topic anyway use the particular rfc that didn't have like the slam dunkiness of a lot of rfcs and sort of walked through like what the process was to get it all the way through um and what was nice about it was that it actually did cover a few of the things that it sounds like you want to cover like don't expect that you'll submit an rfc and it will just get immediately accepted but you might get some feedback and it actually helps to listen to it and iterate and hear like here are some things you could experience that might that would be good to understand the context of whatever right and I I actually would love to have a talk that was like that talk at ember comp because I think like like I said before it helps to local like in some sense you could just watch that other talk and it has the same meaning more or less but it helps to localize it think for our community cool if you can't find it just ping me on discord and I'll try to help you find it yeah I think uh one of the challenging but also interesting parts of the talk like that would also be like uh there will inevitably be people who comment on your rfc who are not that productive or I want to say might be jerks uh and the the delicate part is talking about that without actually like putting anything on the stage that's like look at this person they were a jerk so but it's absolutely doable and it's worth addressing and I think if you look hard enough for a talk like this you'll also find some cases where you will find people seemingly being jerks and then everybody like responding in a helpful way that led that to be productive right like not everybody just gets written off because they didn't necessarily present themselves very well but oftentimes like that's part of one of the things I love about the rfc it's like you'll get a long thing of like a million comments and you can uh see someone earlier on and then like 20 comments later how they totally shifted their perspective or they're like oh I I apologize I was like let me explain why I was so passionate and grumpy about it or whatever um and it's been nice to like watch that little evolution on threads um who else lots of ideas but I'm gonna and I see people I think it'll be okay to like but I don't want to make anybody feel bad if they don't want to speak up I know that um uh Jan has some ideas Venus had some ideas Devin posted some ideas do any of you want to say anything well yeah I can share a few ideas uh so one thing that we're doing at my company is we're using a mono repo um so we are using a yarn workspace uh to in one repository host multiple engines and also at once and then the core application and that would be quite interesting talk I guess and then there's also um I was very interested in to see how tracked under the hood actually works the gilma vm the stuff that's changed tracking because that's actually kind of like a bit of magic to me um and I never really ducked down deep into the code but I think this would also be interesting for exploring so personally I would say that the talk on the mono repo I would absolutely love to watch it and I would definitely love to listen to that um I've had to learn about that the hardware so if there would be a way for others not to basically go through the hardware then plus one for me absolutely that would be great yes cool I really like the idea of going deep I said this in the chat but I'll just reiterate it for anybody else I like the idea of going deep into how something works um especially if you can find out a way to tie it back into the practicality of it like um I was rewriting my app like I was shifting to octane and there are no more computer properties this is what computer properties used to do now you can use track what is track maybe I'll go a little bit deep into what it is and what you might need to know about it but here's some things you don't need to know but they're cool but also tie it back to something practical so it's not completely a deep dive into something technical that leaves the audience with nothing that they come away with that's the only thing that is like you have to be a little bit careful when you're like telling the line with technical talks as long as you can tie it back to like here's why it's relevant to you as a timber developer or as a front end developer I think it'll be really useful I would love to see a talk on that I would also say for new octane features uh track is probably the biggest one but also like timber components um it is since this is going to be the first time people really get a deep dive into them it would it's important to cover the new programming model first and like try to center around it it would be very easy I mean the react community does talks like let me implement use state for you and I like I'm just going to tell you that I am not enthusiastic about a talk that's like let me re-implement tracks for you so you can understand this um whereas like here's all you need to know to be productive here's like a rather involved example that you might have thought would be hard to implement but actually it's really easy and here's how you can start to think about things in the new way that will help you understand why that rather elaborate example works like just works like person I'm just speaking for myself like other committee members can speak up also but I would find that more compelling um and I think I do I think it would be good to get a few talks that were about the like the banner features which are like the glimmer component features and native class features and tracks I think those would be good talks but they really need to be focused on like this is it's not going to be a good time to spend 15 minutes talking about like what's not great about it yet for example or to like talk about next steps because it's the first talk about it right so like it's going to be important to take the 30 minutes to really cover how to think about it well some other ideas that people have been chatting about in the chat are talks on accessibility talks on ast and ast with a linter uh yarn workspaces um and these are all ideas that are jumping out from the chat because lots of people are plus one in them so if you're one of the people for one of those ideas I expect to see it in the CFP anybody else would like to speak up also have an idea for the like the dependency management like the peer dependency and one you put your member add-on or npm packaging dependency versus depth dependency and how that affects your your viewed vendor.js or if you have amber engine what it goes into the engine vendor would that be helpful and also I didn't hear that can you help me this solution for the nested add-on and how that affects the final asset for some reason I can't really hear you how would you turn that into a full talk though like there's a list of rules and usually last one in wins can you talk more through that idea yeah sure like um especially when you are an add-on author uh you need to be aware what you put into your dependencies and or your depth dependency in your package add-on and how those assets goes into the app's vendor or the engine vendor I think this actually sounds like a great mini talk to be honest like I think there's real advice to give and a description but I think if you try to get into it in 30 minutes it's not like you can't it would just feel really confusing to a lot of times if you try to expand it but I do think it's a good mini talk and as Lea said the 50 minute talks are experimental and I can't rule out the possibility that it would be a good 15 minute talk although I think I think even that is pushing it yeah I think I agree with some of the comments like I think that it could be a piece of a bigger talk about good practices for writing add-ons but I like I what I would try what I would encourage is to try to focus on practical advice and clarity and not I wouldn't want to have a 30 minute talk that just made it seem very baroque and complicated I don't like I think it's not that there aren't any complicated aspects it's just that I like I as a user when I'm going to make a new add-on I always end up in one of two modes because I don't write that many new add-ons I either like get a good starting point and good advice and just like go ahead and start writing an add-on or I get like land on a blog post that wants to tell me a lot of things and I just like can't write anything so I just think try to if you're going to give a talk on good add-on practices and I don't I think we must have had talks on that but I think it's like a primarily good topic try to focus on like making it clear and like here is like how you would make an add-on and like you don't it doesn't have to be I'm not saying you should keep it simple like you should avoid getting into the details I'm just saying ground the details in like real practical advice and example yeah also you mentioned blog posts of Jen literally just typed what I was saying do you want to say it Jen yeah sure so um one thing that can be useful as an exercise to figure out what you want to talk about at what level of detail and to get some early feedback is to write a blog post about it um because it like I find it very difficult to write the proposal upfront because that act of like trying to hone it down to like uh you know persuasive pick my talk message is pretty difficult but the act of like hmm what would I what do I want to teach some someone about what do I want to share putting that in writing in a blog post which can be nice and messy and I can mix up my scope and everything is really a great exercise I would say if you like writing just general advice everyone if you like writing I encourage you to try to write a blog post or just even sketch out the outline of a blog post just part of your process for figuring out where you want to focus on your talk if you don't like writing or you haven't done many blog posts um be careful that you don't set that in front of yourself as a blocker um because like for example I'll use my husband as an example he doesn't do much blog post writing um he would give a very good technical talk uh very good like lightning talk or something like that but uh if if someone told him write a blog post first then he would never get to the point where he gives the talk and so it really just depends on who you are and how you like to work but it's something that works really well for me and working on a talk by the way is a really great opportunity to generate your own content if that's something that you're interested in like as you're working on the actual materials you're going to hit a lot of like smaller areas where you're going to learn a lot and maybe they fit into the talk and it's like correct like a bunch of blog posts that if they were all smushed together are you talk or maybe it's just completely things where it's like I can't go down this road in my talk because it's too much detail but um that it's just a really great opportunity for um content generation so we are we're hitting 11 o'clock so we're gonna start losing people I like a lot of the ideas I heard I like even more than that I saw in the chat that I'm going to um read through after and kind of uh sneak out a bunch of different ideas but does anybody else want to quickly try and um sneak in their idea or thing that they want to say before we start dropping off I had two quick general pieces of advice just generally for anybody who didn't speak up or if you still are trying to figure out your ideas two things that I think are really helpful when you're thinking about what talk to submit is to write the talk that you wish existed that doesn't exist um generally that puts you in a really good position to write a talk that will address the pain points you felt so like if you wish there was a talk on x and it doesn't exist write that talk and fill in those gaps um and it'll definitely be helpful to someone um and the other thing is make sure you write make sure you're giving a talk that you're excited about whether that's something you learned or you want to learn because inevitably you're going to spend a lot of time on it so a good indicator of whether something's a good talk idea or not is if it gets you really excited um because chances are you will not be the only person someone else will also be excited to hear that talk and then also in terms of like tips and whatnot uh there are a lot of people who want to help we could do a conference every year with the same time people get up on stage and say different things every year but no one's really interested in that so the idea of somebody new who hasn't been around is very intoxicating and we usually end up with a very good mix of uh like established community people established speakers and new to our community people and new to speaking people um and basically at every point along the way there are so many people who are like excited to help you with your proposal to excited to help you flesh out your slides there's like an ember talks channel there's an ember cough channel there's a learning team there's everybody basically everywhere uh so point being there's a lot of support um and not everybody's need for support looks the same so it doesn't really matter what yours looks like but uh we'll help you let us help you um it's okay to I see Jen popping some tips in there that I like as they're flying by it's totally okay indeed to submit a talk that you have given uh before uh they're not talks are not single use and they shouldn't be um considering how much work we put into them and even if they're recorded somewhere else like most people are not gonna be watching every video on the internet we haven't seen it right so we definitely make sure there's a balance of like fresh content at the conference but it's totally the case that a bunch of like our best talks sometimes have been given elsewhere um either at another conference or at a meetup which is a great place I think I want to say a stronger thing than that which is actually this is me speaking on behalf of the committee which I shouldn't do but I'll say a personal belief that I have I think this year we should just not penalize meetup talks at all I think um we really do encourage people to give a run a pre-run out of meetup and there are so few people out of meetup that I think considering it was given out of meetup as like equivalent of a not new talk is wrong like I think we really really would want to encourage people to give talks at meetups even in many places to get the talk to be good once you're in you're in but in the imaginary keeping a score you get more points for a rehearsal or giving a talk at a meetup not less right and I would also say that um if you're going to give a talk at another conference um if you're re-giving a talk at another conference it would be very useful to write in the speaker notes about ways in which you may have changed it either based on feedback or just for contextual reasons because if it was even even if it's lightly changed if you if you did significant work to iterate on the talks from a previous context I think I would also consider that much less of a ding than if you just like take your ember out your uh what's ember out east talk and like literally don't do anything with it and then plop it into the projector and give it an ember conference that's the kind of thing that I think is ding so just be clear about it cool um okay anything else super critical that people think I missed the CFP app is up and running um CFP closes December 1st so end of the month um there isn't really a rush and we usually do see a big spike at the end however the earlier you submit the more opportunity you have to get feedback it's okay to put something in there and save the draft it's okay to put it there's not like a technical draft status because we're using an open source app that doesn't have all that many features but you're welcome to put it in the title you're welcome to uh just kind of be clear like if you want to start a draft and you don't want anybody to read it put it in the comments like this is not ready to be read yet right if you are in a draft state but you're open to feedback you can say that um and even if you're finished like maybe you're not really finished so put it in there and then if you put it in early you'll hear from people like Steven like Melanie um who will say things like oh I think this could be a great talk maybe you should flesh out blah blah blah or who will ask questions like I don't really understand this point in there can you clarify for me um the reviewers will not be able to know who you are when they're asking these questions so don't reveal your identity in your responses um but it's a great way to make your proposal even better yeah I was just going to reiterate and that with my own experience also so um and the contrast here I recall that uh when I first took my talk into the CFP it was nowhere close to being ready I think I edited it almost seven different times until I got the final version so even if you're not sure and you just have a couple of words you can always put that in and just continue to rating and making it better I think it's easier when you actually start writing uh writing it out then you're actually dropping your ideas basically on paper as opposed to just having them in your head because when you have you can easily lose them so just let it out then put it out there and then iterate iteratively actually improve the proposal well I hope to see proposals on some of the topics that we talked about a bunch of them that we didn't talk about but I hope to see things from all of you folks who took the time to join us today this was really fun it's always really fun I need to come up with more excuses to just chat with a couple dozen random ever guys because you're cool and we will post the recording of this meeting as well as a short list of some of the ideas on the website hopefully by tomorrow and yeah join us in the ember conf channel on discord join us in the talks channel everybody wants to help everybody wants to hear what you guys say you just gotta put it down on paper and and get it over the finish line see you around friends