Welcome to Sheboygan County government working for you. My name's Adam Payne, Sheboygan County administrator and co-host of this program. Although, as you can see, my partner's not with me today. Chairman Mike Van Der Steen actually had his second surgery on his second ankle recovering at home. And as I think I mentioned last month, if you get a chance to give Mike a call, please do. I'm sure you'd appreciate that, spending a number of weeks, in fact, recovering from some pretty serious ankle surgery, both feet, but I can tell you, it's still very engaged with the county and spending far more time on email and internet and texting than I care for, Greg. It's always checking in. But no, we miss Mike and we wish him well and certainly we wish all of you a Merry Christmas and happy holidays. Thanks for joining us today. Like every month, we're pleased to have one of our department heads with us and this month it's Greg Schnell, our Highway Commissioner. Welcome, Greg. Thanks for having me, Adam. Greg does an excellent job as our Highway Commissioner and as you know, tis the season when folks are gonna get out there and start dealing with some conditions that they haven't experienced for a number of months. And Greg, as you know, it's a busy time of the year for your staff as they gear up for the winter season. And why don't we start there? Please share a little bit with our viewers about what are the seasons of the Highway Department. Well, let's start with winter, I guess. Winter, it takes us a while to prepare for that and some of that preparation starts way back in May already when we take our final inventories of the prior winter and that inventory is salt. That's one of the largest expenses that we have with our winter. And so we take a look at what we have left over and we evaluate what we think we're gonna need for the future and that's based on a five-year average. And then we give those numbers to the DOT and the DOT goes on a statewide bid in order to give us the best bang for our buck. That's just the salt end of it. We also check our blades that are required on our plows, tires, chains, you name it, that takes to move snow. We have to have all that stuff prepared as well as hanging snow fence so we can protect some of our roads from the severe drifting as well as just making sure that we have the proper staff to take care of what we need to take care of. And at any given time, I mean, if we get hit with a real harsh snowstorm, how many trucks, how many units can you have out on the roads? Our initial attack is gonna be 42 trucks that takes care of state, county and town. County and town are taking care of a lot of times at the same time. And then if it develops into something bigger we can bring in our graders, which we have 12 of and we also have eight Oshkosh trucks that if we have to get bigger. We have also three snow blowers that hook up to front end loaders that open up the big stuff if we need to. So our viewers might be thinking, well 42 trucks coming out to plow, how long can that take? But my bet is what they don't have a feel for is just how many lane miles your crews are dealing with out there. Put that in perspective. We take care, we have 450 county trunk miles. Plus we take care of 465 miles of town roads and we have 260 some miles of state roads. So about 2200 miles, lane miles all together that we have to take care of and maintain throughout the storm. Well we'll come back to winter in a minute. So that's one key season. What are other primary seasons that the highway department gears up for? We only have two in the highway department and that's summer, the other one is summer. So summer and winter is what we deal with and as we're all well aware of in the last couple of years there's been a tremendous amount of influence and construction work that's been happening on our state highways as well as our county highways. And it's kind of strange to me and I shouldn't say strange, but it's new that our construction season is starting to gain length. We all witnessed it this year with the I-43 bridges being replaced at Owen and Jay. Those projects started at the end of February already which is still considered to be winter and that years ago hasn't happened. So now we're extending our construction season. So really there is no in-between anymore. They're all running together. And set the stage as well with your staff. How large is your department? Tell me, employees do you have approximately what's your annual operating budget? We have 90 employees including myself. Our annual operating budget is about $15 million. I don't have $15 million, we have what our staff takes care of is we have our own asphalt plan, crushing operation. We have a full construction crew, base patching, paving. You name it, we can do it. We're pretty much a one source operation. We have our own pits. So we're a self-contained construction company. So during the construction season, of course, everyone has their respective roles and responsibilities. Then when it turns to the winter, is everybody getting behind a plow or how does that work? How does that transition happen? The transition is that all of our operators work in the summer, also work in the winter. So they just come from either their dozer and they're utilized on a grader or a truck for plowing snow as well. We have, I shouldn't say extra employees, but when you get to the bigger storms, when you still need everything, we may be a few guys short if we had to run all the Oshkosh trucks. But in the past quite a few years, those trucks have been very limited use and we hope we don't have to bring them out. So it's not a bad place to keep them in the shed as well, but it is also our insurance policy for the bigger snows. And of course, everyone's been trying to conserve energy. In fact, you may have just noticed that the light's just brightened here on the set. And that's because we're all very conscious about saving tax dollars and making sure that we use them wisely. I know I hope that, I hope folks didn't notice that too much. I imagine it probably feels like a sunny day here right now. I'm almost getting kind of warm. Well, construction season, winter season, you talked a little bit about the transition. You talked about how staff are allocated. Let's go back to winter a little bit. And because again, that's generally what's on people's mind right now. We've been lucky so far as this tape is being, as this program is being taped, it's actually raining out, which helps our county budget. We don't have to the high expense of plowing or pushing snow and doing all that. But back to those preparations. So all these trucks go from a construction mode to what happens to the typical truck to get ready for winter. This year's a little bit different for us. And by different, I mean, technology-wise, each one of our trucks is gonna be equipped with an AVL GPS system. That means that at any given time, I could go on my PCI work or my shop superintendent or even our road superintendents and view where that truck is almost instantly. And they can gather such information such as the plow being up, plow being down, wing up, wing down, if the salter's being used. We can also gain some information as far as if the truck has had mechanical issues and that will be sent to us as an email. So this is, we feel is gonna be very good technology for the future. Gives us a better handle of where our trucks are at. And if there's an emergency, we can take the closest truck, not just take the truck that's on a specific route, but if there's another route that's close and the other truck's far away, we'll just pull them and get them into that emergency to help whoever is in need. As far as the preparation goes, and I think I mentioned this to you in an email, a lot of our preparation starts at the fall of the year when we go out to the marsh and we measure the muskrat homes to see how high they are. And that's usually a good indication as far as how high the water's gonna get in the marsh if we're gonna get a lot of snow. And then we also check with the trappers as well to see if there's excess fat on some of the mink and stuff that they catch before the season starts. Highly scientific work. You also mentioned, isn't there a fuzzy caterpillar that you put a lot of weight on?  And if that all fails, then we go back to the farmer's almanac and gauge a lot of our stuff on that. And what are they saying? How high were the muskrat houses this year? What are they saying for this year's winter? Well, you can talk to various people and everybody alludes back to the winter of 36, which obviously you and I were not here, but I guess it was pretty bad. And in fact, I've been asked how are we preparing for the winter of 36. And one, I don't know because I wasn't there, but two, I would have to say is that let's think of what 36 looked like and what our roads looked like and let's look back at what they are today and the size of our equipment, the road widths. I really don't believe you could... We maybe have had the winters of 36 already and people just didn't notice it because of the fact that we have more snow storage, we have the equipment to move it and technology's gotten a lot better. Good point, very good point. And thus far, it sure doesn't feel like we're gonna have that winter of 36 with the mild temperatures. However. That could change quick. That's how the winter of 36 started. All of December and January were pretty much dry and the whole winter came in February and March, March being the worst of the two months. We encourage you to go out immediately and start buying groceries and canned goods because this could be rough. Interesting. We've done a little research then on the winter of 36. Well, I've checked into it just to be prepared but we'll deal with it as it comes and a lot of our businesses is, we like to watch the forecast, we have some of the technology that's given to us by the state where we have our own meteorologist that we can contact to figure things out or help us out. We get warned of events within three hours before if it's gonna be a freezing rain event or what type of snow event it's gonna be. So those things we have in our back pocket but as we're all aware of, some of those forecasts can change within hours and hours much less days and days or months and months ahead. From time to time we both get questions from folks about well what about purchasing salt and how do you go about purchasing it and how do you make sure you get the best price and occasionally they may read in the paper from one year to the next that boy salt prices are going through the roof. What's the status of that, what's the process? Our process is like I said earlier, we in May will get the direction to check what our inventories are. We go on to statewide bid, not every county does that throughout the state. Some that are closer to depots where the salt comes into, feel there's a better advantage of buying it themselves and hauling it themselves. Our salt is trucked in, it's on average about $60 a ton. We do about 10,000 tons a year so about $600,000 of our budget goes into salt consumption. That can vary obviously it's been higher other years. We use a gauge that with the people I associate with they'll say well it wasn't that bad of a winter. In Wisconsin so our salt price shouldn't be up. Well on the other hand you gotta look at that globally or statewide or in United States wide. Some places may have gotten a lot more where some of our salt may have gone too so it really is a supply and demand thing as far as how salt is charged to us. Very good point. Are we storing all of that in Sheboygan County or is that how much we order and we can store a certain amount? We only store a certain amount. I think 7,500 tons is our capacity at a time. So we, obviously when we go through a weekend of events where we use a lot of it we will put our order in and it takes about a week, week and a half. As you can imagine if we're ordering and so is everybody else in our community so sometimes you have to plan a little bit ahead. What's the general ratio? Are we putting down predominantly salt? Is it a salt-sand mix and how is that decision made? It's all salt. Over the years, the 20 plus years that I've been involved in this starting as an operator and working my way up I started working with the sand years ago and what has come out of it are studies have shown that the sand is this there for an abrasive and a lot of times when you're dealing with higher speed traffic such as in a rural setting where the traffic is traveling at 55 miles an hour a lot of times the sand after the first three cars went over the top of it blew it to the side. So it really didn't have that all that a much effect. So it was determined at that point that it was better to use the salt instead of having to go back over and over and over again and reapplying the sand because the salt is gonna stay there because it melts almost instantly. And going off of that we've also have invested in what's called anti-icing tanks about half of our 42 units have tanks on that carry salt brine that we mix ourselves, break it down and it's kind of a chemical balance between the water and the salt and we inject that into the salt at the spinner. So as soon as that salt hits the road it's already activated. When you're putting down dry salt it takes traffic and stuff to break it down in order to start its melting agent. Now with the addition of the liquids it's working instantly and we're getting a better product and we can cut back on our usage of the rock salt. Have we tried any other approaches? Occasionally you'll read about beet juice or some new approach to de-icing areas or improving conditions. We have not gone with the beet juice and a lot of it has to do with the cost of it. It's not new but the product itself is relatively expensive. And in order to do it you have to, it's something that we can produce ourselves so it has to be trucked in and a lot of times they don't want to just mess with a half a load or three quarters of a load, it's a full load and those gallons can range, it could be range to a dollar a gallon and our capacity with liquids is probably about three to 4,000 gallons at a time. So it can get expensive especially applying it but what we do for some of our shaded areas that have high volume traffic prior to an event we have a truck that has a tank on it that can spray this stuff right onto the road and we'll do that with our bridge decks on I-43 as well. Every other day or so we go out and we spray those bridge decks. In this type of year, especially in December now we've had a lot of frost issues that a lot of everybody hasn't noticed as much. And by applying that salt brine doesn't form the ice or the thin layer of frost on those bridges because it melts that moisture down. And as you can imagine the bridge is cold on both up and on the top end and the bottom so that's a huge frost area for us. So if there's a little bit of moisture in the air and it's around that freezing mark we're gonna have frost on the bridges and it's very unsuspecting because the road's dry you get to the bridge and it's icy and as you can imagine most of the people on the interstate are traveling with their cruise control on and that's why a lot of our accidents or incidents happen around bridge decks. I've seen it a number of times. So you'll have the plows aren't set up for both clearly you'll have a separate truck that has the brine mix and then they'll just hit all the bridges in the air. That's correct, yeah. We have two units that go out and like I said about every other day the product will last about three days on the road depending upon the amount of moisture that's in the air obviously with everything that we applied either early this week or late last week is now gone due to rain events that we've had this week. Timing of sending the crews out there. The typical day if someone's working seven to four or eight to five or whatever it may be and the snow starts coming down during the days is there kind of a pattern or a way of attacking snow storms that you try to be as efficient as possible? The way we're structured at this point for hours is that if it would start to snow let's just say at 11 o'clock in the morning during the week we're gonna start to take care of that and we're gonna continue to move with it as long as the storm goes. We'll go up and tell about eight, eight, thirty and we'll pull our trucks back in on our lower volume highways. We do have a night crew if you will. It's a skeleton crew. Two guys come on in the second shift and mainly their focus is I-43 and State Highway 23. That's where the volume of traffic is moving. They will go off and do various locations for emergencies if needed but if that event increases we will add more staff to our nights and to try to keep as much stuff open as possible. And then if it continues through the night like I said the bulk of our crew will go home at eight o'clock, eight, thirty and we'll come back in at three o'clock in the morning depending upon the size of the storm. So going home at eight, eight, thirty p.m. Work in the next morning starting at three a.m. Trying to get as much cleared off before folks start heading to work. So for people to really have the expectation that roads are gonna be clear and there's gonna be a number of staff out there in the middle of night especially if you work third shift and that's when you're relying on good roads and frankly that's just not where the emphasis is. That's correct. We're not a 24 hour operation.  We are called out for a lot of emergencies whether it's high wind, hailed events. Fortunately we don't have a lot of that if there's flooding, washing out.  It's just that we're not staffed that way. So we respond to the semis that are tipped over on the interstate and car fires, you know. So it's... You're not at full staff 24-7. That's correct. But you're operating 24-7. Yep. Yeah, no very good, good explanation. What if someone comes across a bad bridge that they're one of the first ones on the road in the morning and just saw the car in front of them, hit that and have an accident. Do you encourage people to call the highway department or the sheriff's department to report a slippery area? The best bet is to call the sheriff's department first. They have contact with our superintendents either by phone or by radio and that's how it's gonna be handled. In off hours when our superintendents are sleeping, when the night people are on, then the sheriff's department will call them directly and on the radio and say, can you take care of this hotspot that's causing some issues? Now this next question is gonna be one that I know you rarely ever hear about but every now and then, it seems a mailbox gets taken out out there. And I know your crews do an outstanding job and do their best to avoid those hundreds and hundreds of mailboxes but as I've personally experienced, when that snow is heavy and wet and those plows hit that, it's almost like hitting your mailbox with a two by four when those come by. So it may not be the wing that hit it, it's just that heavy snow. How does the highway department handle that? Because obviously I'm in jest, I do know you hear about mailboxes perhaps more than you care to. The physical damage should be caused by the plow in order for us to be taking care of it. Now with that being said, I'm sure we've replaced a few of them that maybe this snow just took care of and the heavy wet slushy stuff is the one that causes the issue. As you can imagine, if the truck is going 25 miles an hour, the stuff is coming off the end of that wing at about 40 or plus. So it's obviously it's not something we wanna go back and do. The best advice I could give you is that make sure it's secure at the beginning of the season, do your due diligence and make sure that everything is in top notch shape and we'll try to avoid it as much as possible. And Greg and I are very proud parents of two 16 year olds, both that play basketball and we like to trade war stories and obviously see them out there pounding the pavement and they both have recently started driving. So to all our viewers who have children who are just getting behind the wheel for the first time in their first winter conditions, any advice? Well, first of all, I wish we could go back and change legislation to say that. I think that every kid in the Midwest should spend a year with their temp so they have to drive through the winter without having to, I mean, it's, to me, it's really spooky. My daughter was, it's within two weeks that she's got her driver's license and this time of the season, it can go bad. I guess the advice I give to the parents and the kids, you know, stress, take your time, give yourself enough time, stay back from the plow equipment because you never know when they're gonna be backing up. And if it's that bad, don't go. Yeah, just slow down. Yep. And unfortunately our kids see us as adults driving and we're the role models and when we're racing to and from which we know we all often are, they tend to pick up that same habit and it's not good during the winter. No, it's not. We do our best to try to keep as much of the friction on the road as we possibly can but when it's falling sometimes at an inch and hour or less than that, it's very difficult to keep up with and as more cars pound it down, it even gets stickier and stickier and slipper and slipper. Yeah. Well, you and your team do a wonderful job out there and I think the key that people need to remember every winter is patience, not only slowing down when you're behind the wheel but recognizing that it takes some time to get to those, how many total miles of road? 2,100 lane miles. 2,100 lane miles, it takes some time and there are higher priorities and there's only so many staff and there's only so many dollars and all of that comes into the equation so folks need to be patient and we certainly appreciate that. Switching gears a little bit, back to the construction. Recently your department has been involved in building roundabouts and this has become more prevalent not only in the state but nationally. Set the stage a little bit. We've talked about this in the past when you've been on the program but there are real mixed feelings from some folks about roundabouts. Why are they becoming more prevalent? The statistics show that a roundabout will change the injury accidents in upwards of 90%. When you look at the construction or the configuration of a roundabout and how you have to go through it in that slow pace that we talked about earlier with the kids driving, obviously it's more of a vehicular incident where there's just property damage and not the injury accidents and that's really what our focus point is. We don't want to put them at every intersection but if you have an intersection that has a history such as the old K and E intersection that was just recently built this summer, if there's a history of those types of accidents, one, you can increase your funding with the severity of those accidents which that particular intersection is 90-10 funded by the federal government. So our crews built it this year. It turned out to be very well orchestrated, done well. We've gotten more compliments than we got complaints. I don't know if the people that don't care for roundabouts maybe are still avoiding it, I'm not sure but it's been a very, very good addition to that end of the, of Sheboygan County and again, it's has stopped basically all the accidents. Not there's still gonna be a few accidents in there but they aren't gonna be the life changing type of accidents that we've seen in other intersections. Personally, that's why I really think it's a good move. I know the first couple of times I've gone through a new roundabout it can feel a little uncomfortable. How's this working and how many accesses and exits are there but from a safety standpoint, no question that you're not gonna see the injuries that people see at stoplights or four-way stops would have you. And then also, frankly, I like the fact that you keep moving, that you're not stopping or have the long back up in traffic, it keeps things moving. That's one of the things that maybe really hasn't been studied and when you think about, we all talk about the carbon footprint when we're going into this green environment that we're into, the more time you spend at a stoplight or a stop sign waiting for somebody else, obviously, you're emitting more of your emissions and with a roundabout, you can continue to move and that's one thing I don't believe was measured yet and you're right. And one of the other positives is you never get lost, you just keep on going around and around.  That's correct. We only have about five minutes remaining and we didn't spend a lot of time on construction, obviously good discussion of the roundabouts but please quickly touch on what were some of the big projects your department recently wrapped up and some big ones in the future. Okay, well, this year we were very fortunate to get the support that we did from our county board members and they took a look at our infrastructure and said, you know what, we need to keep up with our roads and do some more paving. So we were given some additional money to do some more paving. So we paved 27 miles this year and we should be paving around 30 miles so we're getting to where we need to be. So that went on. We've also completed the construction on Coney Trunk or Superior Avenue that is now complete. Next year we're gonna come back and put the top layer of asphalt on and we're gonna let it settle out where the storm sewers and the pipes have gone in and we'll finish that next year, which was a major accomplishment. I started back in 2008 and now we're finally completing that. Obviously all the state activities that went on up on I-43 was a challenge for a lot of travelers in this area but we're getting there. Once we get this stuff completed, the fixes that are out there are probably 15 year, 30 year, 50 year plus depending upon the improvement that was done. So we shouldn't have to see that type of activity for quite some time on those particular roads anyway. And what do you see in the next two, three, five years? I know you're real involved with planning and what you're gonna tackle next. What do you see as some big projects down the road? For next year we're looking at Coney Trunk J from 32 to Highland Road, which is about a two mile section that we would like to get accomplished and then taken care of. We're also looking at doing another 20 to 25 miles or 27 miles depending upon where our oil cost comes in for next year for paving. The following year we're looking at the next two miles of Coney Trunk J from Highland Road out to Coney Trunk M. It would be nice to get all these projects incorporated into one year and just knock it out but obviously funding's an issue. So that's one of those things that we have to prolong the process a little bit which sometimes is a little disheartening for businesses and residents but that's kind of how it is. Whether we're doing it or somebody else is doing it, you have to chop it up a little bit. Following that we're looking at doing some reconstruction up on LS near the bluff area in Arthur Whistling Straits is something that we're working on. Could be a real expensive endeavor. It could be. So areas that we have concerns for and are trying to take care of it, that's one of our areas that we need to be addressing more sooner than later. As you commented and it's certainly true not only 27 miles paved this year but the last few years the county board has really made a concerted effort to do more overlay and make sure we're taking care of our infrastructure because it's far more costly not to. Real quickly the difference between a mile of overlay versus repairing that damaged road versus completely reconstructing it. An overlay runs about $100,000 a mile. Pulverizing and repaving and putting a brand new four inch thick mat on there runs about 260,000 a mile and a complete reconstruction with ditches, asphalt, gravel, new pipes is about a million, million and a half a mile. So it absolutely pays and it's just frankly smart to take care of what we have 100,000 a mile versus 260 versus a million and that's all part of what the county board has to balance every year when they prepare their budget. Greg excellent overview covered a lot of ground and I'm getting the sign we need to wrap it up so thanks for joining us. Thank you for having me. And thank you to you and your team. You have excellent staff, you're doing excellent work and Greg like most departments have been tightening the belt and reduced their table of organization yet are continuing to do an excellent job so appreciate it. Thank you. Thank you for joining us. Until next month I hope you have a wonderful merry Christmas, happy holiday, new year and we look forward to having you back and next month our guest is going to be Jim to Beast our building services director who also will be talking about the importance of taking care of our buildings, departments, infrastructure and he has some very good staff as well so look forward to having him here and until then again, thanks for joining us.


Hello students! In this video, we're going to be talking about narrowing topics and analyzing problems. OK, so remember, in Assessment 1 and Assessment 2 in this subject, you need to write a problem-solution essay. Assessment 1 is the first draft of this essay, and Assessment 2 is the final draft of this essay. You are given the broad topic area. It might be something like food safety or scams. You need to narrow this topic down into a problem-solution essay question. OK, here's an example. So, the broad topic area is healthy eating. And, after thinking about it for a minute, you decide your question is discuss healthy eating. OK, the good part of the question you have a function word, discuss, but other than that, there's no narrowing. You cannot just have an essay question such as discuss healthy eating. You need to narrow the question down much more. We recommend that you talk about the problem in the question. So, for example, you could have unhealthy food is a serious issue, discuss the causes and effects of obesity and present some solutions. OK, this is better than the first question, but it could still be further narrowed. Unhealthy food by itself is a very big issue with many causes and many effects. So, we could think about what type of unhealthy food will be discussed, for example, fast food, soft drinks and so on. So, for example, you could have discussed the problems caused by eating chocolate and present some solutions to solve these problems. This is fine, much better. The question is appropriately narrowed. OK, so we have the narrowed essay topic. We have identified the problem. Now, we need to analyze the problem. To analyze, you need to break down the problem into research style questions and then find information. Breaking down a problem is important because it helps us to avoid jumping too quickly to solutions that might only address the impacts and not the causes. So, you need to start thinking about the root causes of the problem. Taking the essay question on chocolate as an example, you need to ask questions such as, why do people eat chocolate? Is chocolate by itself unhealthy? What ingredients in chocolate cause problems? What are the health effects of eating chocolate? And so on. This is how you analyze a problem. OK, that's it from me. Here are some further resources and a video to help you in writing an essay question. All the best and remember, enjoy your time at university.


YouTube NextUp is an intense one-week boot camp that helps you grow right at the YouTube spaces. Most of you probably have never heard of YouTube NextUp, but I recently learned, here is the website behind me, that many big YouTubers with 1 million plus subscribers got their start, got their focus and motivation at YouTube NextUp. Let's have a look. The link to this website is down there in the description below. And let's take a look at the eligibility requirements. In order to qualify for YouTube NextUp, you need to have a channel with 10 to 100,000 subscribers, so it is for medium-sized channels. And once you've achieved that level, along with a few other requirements, you can then apply for a contest where the winners will be taken to the week-long YouTube Creator Boot Camp. Did you know about this service that YouTube offers? Tell us in the comments below if you know anyone who's taken the YouTube NextUp program. I personally do not know anyone, so I'd love to know if you do. Now let's get on to spotlighting your channels and deserving comments. CareOne asked his question twice, which is, why should I make a trailer for my channel instead of just playing one of my videos? Isn't that like creating a fake video of just highlights? Well, I have a quick answer to that question, which is, do you ever judge a book by its cover? Yes, you do. Everybody does. Your channel trailer is the cover of your channel. It's your book cover. So if you don't have an attractive channel trailer, people aren't going to get a good first impression on your channel. It might be a fake video in the sense that you never make a video like your channel trailer except for the trailer. But what it does is it gives people the best moments of your channel to catch their interest so that they want to watch the rest of your videos. So yes, it's extremely important to have a great channel trailer, and if you don't have one, make one. How? Click that I up there. That tells you all about how to improve your channel trailer, all the things your channel trailer needs to have to catch your audience's interest. Hope this helps. IBYM Gaming actually replied to that comment without replying to it by saying channel trailers are like a cover of a book. And if it's not good, then people will judge that video for the whole of your channel. And he's talking about that game is awesome. What game is that? Click that I to find out it's the freedom game. It's a secret code that you can enter into the shiny freedom dashboard and play a game. The secret code is be free. Boxingnow made an insightful comment.  Kidding. Of course you'll get paid. This is just a game.  That's a good point. If you do shoot your earnings, you may never get them. Kidding.  In fact, that's the point of the game is to blow up cool stuff. I challenged you to make videos of the freedom game and share your videos and illusions did just that. He said, watch me play the freedom game. All right, here is illusions playing the game.  All the text and images and earnings on your freedom dashboard. Dragon of Legends also made a video of him playing the freedom game. Let's have a look. Roll it. And he's playing TARDIS for Doctor Who. Well done playing the freedom game. And let's look at one more person who said, I am fourth. Yippee. And his version of the freedom game is Godzilla. So he plays the Godzilla monster and he's shooting up everything, everything in the dashboard using Godzilla. Next comment is by Hazami who said, Hey George, I remade my entire channel using your tips. And really, my channel looks much more professional now. Here is Hazami who's got a great power by freedom in his batter. So it's Brazilian. He's using the YouTube cards feature and he's got great playlists, gameplays, tutorials, Tree of Savior, which is a new MMO for those of you who don't know, free to play. It's the spiritual successor to Ragnarok online. News Do Canal. And let's have a look at your video thumbnails. Wow. Very impressive. You use the category of your video as a text on the left, gameplays. And you're using color coding like tutorials. I'm really impressed. The text is clear. The tab on the left is clear. Very well done. Click that eye, that eye up there to look at Hazami's channel. Just monotone wrote, Hey George, please respond to this or shout me out if you can. I try to use Outros in pretty much every video with the exception of my first few. Outros are so important because they give your audience something to watch after they finish watching your video. So instead of going to watch someone else's video, they can see another one of your videos. Click that eye up there to see all of your Outros, a video focused on Outros. And let's have a look at just monotone's outro so you can learn and improve your own outro from seeing these ideas. So here is his outro. He puts a link to his last video as well as the subscribe button. I must say the annotation is not properly aligned to the button so it looks broken. So I would encourage you to do a better job of positioning your annotations. I would like to end this video with a preview for the next video which is about VidCon. How many of you are going to VidCon? I will be there. I just booked my hotel and so I would love to meet any of you who would like to meet me in person. Tell me in the comments below and we'll talk all about VidCon on the next episode of The George Show. And who am I? I am George, Papa George, George Sunpai, many other Georges that you, the freedom family has given me. And the whole spirit of freedom is we help each other grow together as a family. I am George and if you like this video, subscribe, click the like button down there and subscribe to our channel, youtube.com slash freedom. And you've been watching and we will grow together as a family because this is the freedom family. You are part of it. We are all part of it and we're all growing together. So grow with us and partner with freedom. That play now button right there on the video bar is all you need to click to get started.


Alan Agresti has a reputation for being a fantastic textbook author. He is probably best known for categorical data analysis. Having read categorical data analysis and foundation of linear and generalized linear models, my opinion is that the latter is his crowning achievement. Now, this is a little like comparing apples and oranges because the topics are pretty different. I have so many positive feelings about this book. I love the Matrix approach to many of his derivations. I like the full notes section at the end of each of his chapters, taking time to explore some topics further and allowing myself to get lost and some of his notes paid dividends. It's a good way to become generally informed with statistics overall. I would say his end of chapter notes are comparable in quality to what would be found in computer age statistical inference. I think the exercises are useful. At the end of the book, he has a list of exercises for the reader to work out in R. I think that this is a good way to review the entire book. It is as if he is inviting the reader to have one last skim of the book and apply what was learned with data sets he provides. I highly recommend Foundations of Linear and Generalized Linear Models by Alan Agresti.


rude people block his tractor, have no idea that won't stop him. He couldn't believe it. They had done it again. As he stepped outside his house and absorbed the situation, he tried hard not to lose his temper.  Trying to resolve the situation peacefully. But now it seemed that polite words weren't going to do the trick. He had to think outside the box, and what he came up with turned him into an internet hero. But it shouldn't have had to be this way. Coexisting peacefully with your neighbors is supposed to be one of the perks of living in a rural community. Or at least that's what Devo Batakovic used to. Think. Devo loves his life in Jakusovak, a sparsely populated village adjacent to Zagreb, in Croatia. But lately, his fellow townspeople have been giving him constant headaches. He tried to let it go, but it soon became unbearable. Devo is a farmer who owns a modest field near the village center. The town's population is around 2000, but it has slowly been growing and modernizing. Recently, a market opened up not far from Devo's farmhouse. He welcomed the new addition. Since now he'd be able to walk less than five minutes to buy his groceries. But he had no clue of the impact the new shopping area was about to have on his life, and it was not a positive one. As it was right in the village center where there are already many other buildings, the new market didn't have a dedicated parking area. So shoppers parked on the adjacent streets and walked the rest of the way. But it soon became clear that this wouldn't suffice. The market was attracting a lot of people, and there was just not enough street parking available for all of them. Some of them decided to get creative, not knowing who it would affect. One day, Devo noticed that people were parking on his field, so they could go shopping in the new market. A couple of cars didn't bother him, so he didn't pay it much mind. But as the weeks went by, it was clear that word was spreading. More and more cars were parking on Devo's field, especially on the weekends. It became so full that he was unable to do fieldwork on some days. He had to make it stop. Devo started going outside and asking people not to park in his field as they were pulling in. Those who encountered him did retreat, but if he wasn't out there on the field, it was a free for all. He couldn't just stand outside all day blocking cars, though he had things to do. He became increasingly desperate.  But none of the options seemed promising. In a particularly angry moment, Devo started thinking about slashing the car's tires. But he knew that would get him in trouble. He also thought about building a fence around the field. But that would be expensive, and it would also make it harder for him to bring his own vehicles into the field. He had to think of something that would deter people while not interfering with his life and habits. And then he began to hatch a plan. One day, Devo came outside to find entire rows of cars parked on his field. He took a deep breath. He chuckled a little at the thought of the chaos that he was about to create. He slowly walked to the other side of the property. He climbed into a large red tractor and started the engine. He drove straight toward the parked cars, plowing tow, churning the dirt in his wake. He had reached a breaking point, but revenge would be sweet. Passersby started to take notice of the of the tractor. People walking nearby stopped to watch the fed up farmer as he exacted his revenge against all those inconsiderate drivers. He drove around the rows of cars, plowing deep trenches across the whole field. It was clear that they would have an extremely hard time maneuvering their small sedans through the turned over mud. And uneven surface. There was no escape. Those who didn't have cars on that field laughed at the sight, and one person even started recording the whole thing. But one woman was not amused. One by one, as they came out of the market with their shopping bags, the car owners found themselves in a nightmarish position. Those who were lucky enough to have parked next to the street were able to make it safely out without getting their cars stuck in the mud. But the rest of the cars were stranded. Still, that didn't stop one particularly angry driver from trying to get out. One woman, owner of a Silver Pujo, was none too happy about what Devo had done. Huffing and puffing, she got into her car and tried to drive out of the field.  But she was nothing if not persistent. The infuriated woman steered her little car from left to right, even furiously driving in reverse to try and free her vehicle. It didn't work. Angry, she got out the car and stormed over. Devo was expecting a heated confrontation. But then she pulled out her phone and did something Devo wasn't expecting. The angry woman called the police, and when they arrived they were stunned at what they found. It was obvious they'd never had to deal with an incident like this before. They were immediately approached by a number of angry car owners, demanding that something be done about the farmer's transgression. Some of them even wanted him arrested. But then the cops spoke to Devo.  The police heard Devo out and had to agree that the drivers were indeed in the wrong. After making sure he hadn't intentionally done any damage to the cars, the cops turned to the drivers and delivered some bad news, there was nothing they could do. This was, after all, Devo's property, and he had a right to do on it what he pleased. They, on the other hand, were trespassing. Devo could have technically taken legal action against the car owners for trespassing. But leaving their cars stranded among trenches of mud was enough justice for him. He had made sure that no one would ever park on his property again. Meanwhile, the video of Devo's revenge was spreading on social media and the news. The video of the farmer exacting sweet revenge on the inconsiderate drivers quickly went viral, with people all over the world praising his actions. Everyone loved how he took matters into his own. Hands and came up with a creative solution to his problem. One commenter wrote, Farmer wasn't grumpy, he was smart. No one has the right to dot park on private property. Good for him. And another wrote, perfect. That didn't cost him much, he didn't involve the authorities and got the point across, I'm certain. Even today in my community people are willing to talk things out, as they. Always have. Unfortunately, not everyone is raised that way. But the video is an indication of a growing problem with illegal parking and people are simply not going to stand for it any longer. A group of Brazilian pranksters posted a video that showed them dealing swift justice to a driver who had illegally parked on a handicap spot. Once the car was left unattended, they covered the entire vehicle in blue and white posted notes. Eventually forming the shape of the universal handicap symbol. The driver was none too pleased and stormed off, but the video went viral and helped raise awareness about this important issue. But that's not the only instance of hilarious revenge on illegal parkers. People are fed up with illegal parking, so they are coming up with hilarious and creative solutions to the problem, like Devo did. Most of us will just simmer quietly and get on with our day, but there are some who will not stand for these infractions any longer. Lazy and inconsiderate parkers, beware.


All right guys, does this work? Can you guys hear me? Okay, so I sort of was taken by surprise at finding myself in the entertainment slot because whoever does a 2pm talk has to get everybody awake again you know, it's a It's a bit of an interesting challenge because I've also spent the last two days Helping the crew here set up the video stuff which meant that there was time. I was not making my slides. So let's see how this goes All right, so just give me a sec I'm going to put out an example on screen that I'm going to use for a couple of things So it's also the first time I'm presenting with this device. I'm going to find out how well it works So let's see. Let's come back on the site Okay, so how many of you voted on the funnel for talks this time? So that's about half the people in this room and do you guys remember the login screen that you saw when you voted? It asks you whether you want to go to Twitter or Google. That's what we're talking about. We're talking about how I built that and what I learned in the process of building that and So basically among the lessons that I figured is when I started doing this I went in Trying to solve a login problem once and for all and the reason I did this is I build multiple websites. I Organize events the same way that like by con and every event has its own website And the problem now is that if you want to register a user and you want to use that account Not just an email address and name an email address But you want an account something that they can use to log back in and work with this site trying to do User management across multiple websites basically means that you're making people make accounts multiple times And they're just silly you want them to say you made an account once use it again And the best account is one you don't have to make at all. You just use Google or Facebook or Twitter or whatever else So basically I went through a series of learnings trying to do this starting from 2011 I also gave a talk at Picon 2011 about this project. I'm not going to repeat what I did over there What I'm going to do instead is what I've learned in the period from 2011 to 2014. So In 2011 I figured I'm just going to Find a simple way to help people register accounts. It's a you would think that making accounts is as simple as this all you're doing is I That the user can register an account log into an account Reset their password verify an email address So you know that they could capable of receiving email at this address maybe verify a phone number and that's about it and maybe you want to make it easier and Provide them log in with Twitter Google or some social media service. So In the process of doing this what I learned is that in reality Making an account is about understanding identity and representation. These are not technology problems These are user behavior problems and they come back to bite you as technology problems If you don't understand how user behavior maps to your technology decisions. So I'm going to go through this so when I started trying to do federated entity I looked at what was available and what was available for cross-site entity and Open ID for a long time had been touted as one solution I spent some time studying that realized that open ID was actually completely horrible it's going to cause a lot of problems for people trying to use it and One of the clearest examples of where it's gone horribly wrong is a stack overflow Stack overflow has stack exchange, which is a centralized login mechanism You can use open ID from a variety of services to login, but you look at the login dialogue Can any of you guys remember what you use the last time you used stack exchange So it takes extra effort on your part try to remember and say I remember I used my Google account last time and not my Facebook account, so This is basically what I learned in the process now the fundamental notion of Logging in is about saying who are you? You're trying to tell the computer. Hey, I am Kiran John Legada and I'm back and I'm trying to log in now The problem is who is this guy? so Let's say that I want to just log in and say hey look I'm Kiran. I want to log in now the problem is You need to provide a unique identifier and say this is the identity that I'm using to log in that Nobody else in the world has because that's the only way to say that I'm the guy who's actually coming back You can't use your name. That's very well established. You search online They'll always be somebody else with your name no matter how unique you think it is One thing that works is generally using an email address And so this was a lesson that Amazon learned way back in 95 when they started doing e-commerce and Essentially until then you had user names, which is basically what you used to log into a computer shell, but in 95 Most people did not use Unix. They used Windows Windows booted you straight into the desktop So this idea that you log in Was a fairly unusual concept for people coming online and realizing that there is some such thing when they go to a website And so Amazon figured They're not going to ask you to make an account with the username They just going to say please provide your email address and maybe set a password against this email address and that's it So they did a clean job of doing that There is a problem when you do that I'll come to that Now if you look at say Twitter on Twitter you have user names Very obvious right in Twitter your username is not just the way you log into Twitter. It's how people know you That it's not enough to have your real-world name online You need to have a unique online name that exists only within the service and that is your identity in the survey It is your actual name. This is how people know you so Twitter has essentially convinced you to say that Make up this new name for yourself and remember it forever And how do they do that by making sure all your friends address you by that name? Because that's the only way that they can talk to you on it So basically they help you understand that this is your identity now. It is not just a login identifier now Google on the other hand did not have accounts until about 2004 if you guys remember trying to say Google preferences Back in 2003 it would essentially save it in a cookie and just save it in a browser and that was it There were no user accounts in 2004 they introduced Gmail Gmail for the first time required user accounts and Google also wisely decided that most people cannot remember strange names. So they said please use first name last name at gmail.com and Make it easy for you to remember because it's first name dot last name Use that now Google Did that seem like a sensible decision back in 2004, but more or less since learnt so email has an unfortunate problem If you put your email address out in public you get spam, so if you want an identity That is about saying this is me and here are my contact details on this website Here is how you talk to me you actually get afraid of putting your email address there Because you really do not want to be spam now the spam problem these days is more or less resolved It's very well tackled by most anti-spam tools But that was not the case for at least a decade for at least a decade We struggled with spam to the point where we would be very very careful of putting email address out or obscure them in various ways and so on so what happened there is Google had an account system like Amazon that depended on your email address Twitter and other services basically forced you to make a completely new identity Facebook copies the Twitter model eventually when they introduce usernames now Google essentially went on to launch Google plus which is the first social network in the world where they have problems like this again Let's get to that so What Google plus realized is if you want a friendly URL to your profile page What is in the URL in Twitter Twitter comm slash username? Google plus plus Google comm slash what? your email address You can't put an email address see Google basically created an identity system Where the identity system was unusable because it was an email address So they had to then queue random numbers you get some random hash a number that nobody can remember and In essence when you start depending on an email address as someone's identity It's easy for them to get started because almost everybody remembers their email address But then you can't go build a social profile on top of it We need to now force them to create a new kind of identity Which is a little confusing for you people who you have not taught this right from the beginning so This became one of my pain points the other things that you learn is Does one human have one email address Obviously not This is the part where Google wasn't really thinking very hard because when they introduced accounts in 2004 Until you had Gmail you had no user accounts when you had Gmail your Gmail account became your Google account and it's basically gone all the way from there saying that your Gmail account is now your Google plus account and Basically, that's how you get to the situation where in Google Gmail in Google plus Because they cannot identify a human by more than one email address Every single email address of yours becomes a separate Google account and therefore Google plus is the only social network where you're two humans at once Okay, and this is a basic design problem that when you assume some things about how the relationships work between email addresses and people so When I started building last user this was one of the lessons that I already had the foresight of looking at because somebody else It's screwed up already. And so what I did is set up my user account model saying one You can have a username if you feel like having a username. It's optional To you can log in with either your username or email address. Whatever you prefer 3 use your Google or Twitter or whatever social profile that you have although that caused me more problems later on and For Identify verify the email address when somebody says this is my email address We send them an email with a verification link. So you please verify this is your address if you don't verify it We don't believe you so anybody can claim any email address, but until you verify it. We don't believe it's yours Okay, once you verify it nobody else can claim it. So that would seem like It's all the problem But then you get to this problem Is one email address only one human anyone willing to So is some question in the room He's not so some question and his wife Runa for a long time had a flicker account that said Runa and Sankarshan two humans in one account Behaving like one person for all practical purposes Sankarshan's removed Runa's name from the account for some reason But the user name still says Runa and Sankarshan go look it up now The thing is in this case, it's two people sharing an account Consciously behaving like one person within a service because they understand that things will break down if they behave like two people Yeah but What happens when you do this? This is an email address that goes to about four or five people We are all separate individuals. We are not trying to behave like one person In this case, it's a shared address. You can verify that I receive mail at this address You cannot use it to say this is this person Where is this a problem? Suppose I add this to my account the next per guy who's receiving mail at this address can use it to hijack my account and That means your account is not secure anymore So now we have a security problem when you trust an email address and say any mail address belongs to a person And now I don't have a solution to this problem This is one of the things where you look at this and say no matter what you do something will go wrong in your architecture so the The ways you deal with this is You understand that a person is different from a group and you build in mechanisms to deal with it. Don't do it like this If you look at github on other hand, they have actually thought this over very carefully If you look at the terms of service for github, it says your login may be used by one person a Single login by multiple people is not permitted So very clear One account has to be one human only One human can only have one account Yeah They make this very clear from the beginning Make sure you please do not do this Google press kind of nonsense where you have two different people behaving One account or two accounts for one person and so on Let's have a user account separate from an organization account and the organization account can be shared by multiple users And we come up with different permissions models for that and so forth So unfortunately most of the services don't really have an answer to this problem. They basically either Willfully ignore it like Twitter where they don't really care who you are You just have an account. It doesn't matter if the account is a company or the account is a robot or the account is a human It's an account or you have Google plus where they're completely confused so Now once you get past all of this You have to deal with the next set of problems How long does your email address last? So in 2011 you had a email address from your company in 2014 If you are still at the same company, you are extremely loyal most of us are not like that, which means your email address no longer works Okay, so now this is a problem when you make an account on some service with this email address now normally what we do is We have learned from bitter experience to never use a company email address for anything apart from company work Because it will not be accessible once you leave So you always sign into online services with a personal account and make this a thorough habit Now how many here don't really believe in this you always go sign up with your company account Nobody does he's joining a mailing list. You're joining a social network You're joining anything you always use a personal account because you want to guarantee long-term ownership This works until at some point. You're suddenly representing your company now for instance I happen to run a job board called has job and has job was built before last user So at the time I built it I went very very carefully through my architecture to make sure there were no user accounts at all because I did not want problems caused by user accounts and Essentially on the job board when you post a job you provide an email address and say that this is the address to which all resumes must be sent and That address then gets an email with a link that says click this link to edit the listing or to delete the listing And that's basically it if you don't have the link you can't do anything with this listing And Eventually I had to retrofit it and say okay now that I have a proper account management system Let's add it to the job board now the problems come in from the fact that when you post a job You are representing your company. You will use a corporate email address Okay, and when you create a corporate email address and use it for the service Suddenly now people get confused should they make this a separate human account again? Where in this is Kiran Zolga at home and this is Kiran Zolga at work Or do you say I just want to add this account to my is the email address to my account People get extremely confused when you are asking them to make such decisions Mostly because they don't understand the idea that they have an account most people simply do not like thinking about accounts as something that they consciously do and So you get problems Like this Yeah, the sign-up page I was trying really hard to avoid this problem of users creating duplicate accounts and you invariably end up with this problem again Simply because users do not remember that they made an account They can't remember what they used last time. They're going to click one and see maybe it was this and Then they come to a sign-up page which asked them for a little more detail and then they say oh shit This was not it now go back go the other way but in the meanwhile you already just made an account So if you go look at my account database It's littered with people having two or three accounts because they just can't remember what they did now the show more thing Initially used to be fully expanded This was the point where I had this moment of awakening saying please do not offer options that confuse people Use the two most frequent ones that people have been using so far hide GitHub hide LinkedIn hide everything else, you know Now when you come to this Eventually you have to address this problem people get extremely confused about this If you have submitted a talk on the funnel How many if you guys here submitted to speak at a pycon or a has weak event? so Now one of the things that people tend to do and I'm not saying you guys did it But a lot of people tend to do is they intentionally make a second account to go upward themselves If the Python selection team selected purely on the basis of our ports you're guaranteed that it's been gained By people making fictional accounts just to support themselves I know this because I have to debug problems caused by this kind of situation. So What I have been trying to do is do account merger at the database level This is extremely scary Because there is no undo When you merge an account and there's no undo because it's a fairly complicated database transaction But I have actually done this. It's incredible. I will show you the code just because it will not make any sense to anyone here Now So let's say let's let's just let's just look at the code. Okay Most of you who have used last user, which is something that you have actually used if you Submitted to pycon or voted on a proposal, but this is basically the code I'm going to jump to the relevant parts Now what this essentially tries to do is automate the process of merging accounts as much as possible This is the basic function. I don't think you can see it very well. Let's see if I can zoom in So what it does is that the instance is the current account Are there is other account that you want to merge into and you're trying to say Find everything in the database that is linked to a certain user and re-associated to the other user and then eventually discard this user Now what I have done in this case. Now, this is all Python code This is all written around SQL alchemy. So and because it's a library. It is not an application This is a library that is used by all apps that talk to last user It essentially has to be able to discover the architects of this database Figure out where the foreign key references are and go correct all of them. And what it does here is first it looks for The column that is being referred to in the SQL alchemy structure Keeps track of all the tables has been migrated and tries to figure out the SQL alchemy base class So how many of you guys here know how new style classes work? Your Python program is right. You understand that there is something called a new style class in an old style class Okay, one of the nice features about new style classes is you can essentially do This You guys understand what this line does a base class has subclasses method Which if you call returns a list of all the classes that derive from this base class Python allows you to inspect a base class and pull out everything that has ever been declared that is based on this base class So what I'm doing in this case is discovering the base class that is used for SQL alchemy models Find every single class in your Program that is a model because it is derived from this class Then go look it up for does is refer back to the user table and go fix it up. So what we're doing here is to say discover what the User table contains for discover the base class first keep iterating through one models base classes until you come to the root base class that is used for SQL alchemy then use that to go do migration and In this case we say that if the class happens to have a helper method for migrations use it Otherwise, we'll try to do it ourselves now I'm sure I've lost you here because this is not a Funny code, you know, it's scary. It was really scary for me to write it because I no idea what I was doing half the time But what in this case I do is go find the table that is referred to by this class Look at all the columns in the table if this particular column happens to be a foreign key to the user class You got it now. You need to change the value in this column Anytime this particular column has a reference to the old user's ID number change it to the new user ID number And then you're migrated it except when you have a unique constraint Like when you abort You're only allowed to abort a proposal once If you have afforded your proposal from two different accounts and eventually you come to the point where you're trying to merge These two accounts you can only keep one upward Which one do you keep? Now this is easy because I put it twice you can just discard one and be done with it But suppose you were trying to use the job world and you submitted a job application to an employer You're only allowed to apply once to a job And now you merge your accounts and you had two job applications. Which one do you lose? The older one, but how do you know? How can you make the judgment call?  It's simply saying I'm trying to fix a database model here Somebody accidentally created two accounts. I want to help him merge it. So there is no easy answer to this So the automated thing basically says If it is unique, don't touch this model Ignore it more on to the next If you find that there's a primary key constraint or a unique constraint Your automated process of migration cannot do anything about this. This is now the application developers call How do you want to define user behavior and merger and so forth? And so what we do is we keep track of Whether it is safe to remove this instance because we do not encounter any unique constraints If it is then your merger is successful. You remove one account if it is not Merge it not successful you're migrated most of the data But some data could not be migrated because you encountered a unique constraint that you didn't know what to do about so the reason I'm going through all of this detail is Because of this This is basically what happens when you Create a user interface construct that you thought was friendly for the user but in fact caused more problems and the only way to solve this problem is by doing complicated database migrations and so on so The other way to deal with this is to simply say what if the user just never logged out If the user logs in once keep the session permanent If they did not log out, there's less likelihood that they'll accidentally created another account And this is somewhat the Facebook strategy that on Facebook you never log out once you logged in it stays there now this also happens to Be something that for a very long time was considered bad behavior in an application For a very long time. We believed that computers could not reliably be linked to one person If it's a desktop, it's going to be shared by whoever sitting at the desktop right now. You cannot assume that If somebody logged into this website, they want to remain logged in forever So for the longest time the way we have done login sessions is you always log out when the browser closes And that's basically by using session cookies Okay, if you want to now turn this around and say you want to log in forever This is essentially a change in usage patterns of computers that has happened in the last ten years that most of our you know best practices documentation hasn't really accounted for that these days you want to design your applications to never log out Unless the user wants to log out browsers now have an incognito mode or a private browsing mode Which is what users supposed to use when they do not want to remain logged in See if we put it around earlier it used to be the application developers responsibility to ensure log out at closing of the browser Now it is a user's responsibility Okay, and this is something that users have started to accept But if you want to now turn this around and say you're going to change the way your software works To deal with never logging out Then you also have to deal with the fact that there are other complications that come up in this and one of them is database sessions So let's go digress briefly into looking at how authors worked for the long time In the beginning there was HTTP basic auth now who do you hear remembers how this works? Does someone want to go for it? Yes, I have a mic so I Don't want people falling asleep at this point and I'm not got much more material left. So guys hand mic So there's someone in the back there who had wanted to talk about this Yeah, so let's get you on the mic so everyone can hear this It's just sending the username in the password with the HTTP request itself It's still done by some websites where you get a alert prompt saying what you're using you get a browser alert point not a HTML page, but a browser dialogue. It's an OS level dialogue that comes up saying login and password now the way this works is essentially on the server when you want the user to log in Normally you return a page with HTTP status 200 in this case you return it HTTP status 401 Which is authorization required and 401 makes the browser throw up a dialogue that says please enter your login and password okay, and The browser sends back whatever you type in if you accept it then you return it on it again If you don't accept it return a 401 again Except when you do this from now on every single request ever will have the username and password in the HTTP headers unencrypted and That basically means anybody sniffing traffic and simply read it off the headers and they have your login and password and this used to be standard practice in Most web application frameworks as recently as 10 years ago in 2004 Zopin Plone where by far the most popular Python web frameworks Pylons and Django and everything else was yet to come and this is how they worked that you do a HTTP 401 based HTTP basic auth Browser sends username and password and it's there in every single request ever after until the browser session closes and How do you log out? Has anyone tried logging out with HTTP basic auth Send another bad request. What happens then? Yeah, so he's right So basically what happens here is you send a 401 even though it's a correct login and password The browser will put out one more dialogue saying please log in again And this is when you say cancel and once you hit cancel on the dialogue the browser will not send a login and password again so Basically, you have to teach a user that to log out you have to See the login password again and not enter anything now try educating users about this and say this is how you're supposed to do log out not going to work so So the web community at this point had this had to find a way to deal with the situation and say this HTTP basic auth Is not user friendly Okay, people do not know how to reset passwords because the dialogue offers no option for this They do not understand how to log out. They don't understand why log out is showing them a login prompt again And so you say discard this Let's actually build our own infrastructure for doing this And so what we did was use cookie-based authentication where you do a HTML form now And the HTML form can have additional options like forgot password and whatnot and when you submit Save the username and password in a cookie Maybe base 64 encrypted because that was what encryption was for most people back then But essentially it's unencrypted. It's in clear text. It's going with every single request your browser makes again Okay, I'm not sure who invented this idea of using a cryptographically signed token at this point but it came up roughly about 10 years ago and I'm sure you guys already know this if you use Django or flask or pretty much anything This is how they work nowadays that you use a type 3 cryptographically signed tokens who wants to try explaining this Anyone guys, it's it's dirt simple and I'm sure you use it even if you don't understand it go over again You have the mic There are you you don't actually encrypt anything It's encryption can be resource intensive. So you simply sign it so so the way this thing works now is When somebody logs in once you confirm that the login and password are valid and this pillow is allowed to log in What you do is set a cookie which has only the username and Then sign it sign it with a cryptographic hash So when this cookie comes back the next time you can verify that this was set by the server It is not set by the client the client did not simply say I happen to be somebody else So you don't need to send a password back every single time you simply need to send a signed token that is referring to this user and you're done and It's not a certificate. It's a simple hash Okay, that you do a hash see you do hash with some random value that only the server knows and you append the hash to this cookie and Send it out again when it comes back, you just check the hash is valid Okay, and you just check the hash is valid on every single request as long as not been tampered with you know that The user hasn't attempted to become somebody else this works great until Something else happens and something else didn't happen back in 2011 so Do you guys remember this who remembers what this is How many people in I've used this thing you guys used it fire shape Yeah, so what does it do? It hijacked session over the air because on Wi-Fi you can decrypt other people's traffic if they're not using WPA to They this network is on WPA to if you're using web is very easy to crack and pull traffic out of the air If you're using an open network, which is basically what you're using in a cyber cafe Any place that has an open network that gives you a browser based login prompt is insecure because every piece of data going on the network Can be sniffed by anybody on the network and what fire ship did was it would essentially sniff traffic off the air and capture login cookies and You can take a cookie from anybody session put it in your browser, and you're not that user Damn simple, you know and this essentially shamed a lot of companies including Twitter and Facebook Into starting to use SSL Until then nobody took SSL very seriously It was considered as something required only when you log in only when the password is being transmitted And you would stop using SSL after the password and say that once you just have a cookie set with the hash You don't need password. You don't need SSL anymore now fire sheep Demonstrated that that was just not good enough. You have to use HTTPS all the time or you're not safe so HTTPS solves most of your problems It does not solve one problem, which is still somewhat critical and that is to do with how you log out again And that's when you need database back sessions now to understand this problem we're talking about essentially a Multi-site login process we're talking about a piece of software that is meant to have one user account That you share across multiple websites in this case the PyCon website, maybe the Hasgeek website Maybe some other website whoever is happening to use this People tend to think of logging in and logging out as what they do with the computer Not what they do with the website Yeah, that you're done with this computer. Please log out. That's how you think about this You know, you don't tend to think of saying I want to log out of every single site that I remember using in the last Whatever period of time so unfortunately cookies on a per-site basis so There were typical logout process you delete a cookie That's what you do when you log out with a cryptographically signed token You simply say the user has hit the logout button so delete the cookie and you're done now You don't know who this guy is anymore You can't do that if they're not on this site right now and when you're doing federated authentication They are not on the site when you hit log out because they hit log out on one side But you want to log them out from five different sites So some services if you remember yahoo in the old days And Google for a while is when you hit log out and look at your address bar It takes you through a tour of websites It'll go to one website after another delete a cookie then redirect you to the next website And if one website happens to be down Your login process has failed.  I mean log out failed That is essentially not a nice problem to have and so The way you solve this is by starting to use database back sessions now I got this idea from the GitHub guys get up posted about this on their blog about a year ago and Essentially said that they have switched over to using database sessions. It gives you a bunch of interesting Outcomes now cookies If they got stolen somehow it may not have been over the air anymore because you are using HTTPS But it could be an excess attack a cross-site scripting attack Which you can protect from if you use HTTP only cookies But some of us like to do fancy stuff in JavaScript and therefore you can't use HTTP only cookies and therefore Your cookie is still vulnerable to being stolen from the browser itself How do you deal with the fact that a user may want to say I Want to see where else I'm logged in from and I want to knock off a session which I don't remember Being correct anymore, you know, like I don't remember being in a different country when I'm using this website because I certainly now traveled in the last month So who's the other guy talking off? So if you want to do that then what you do is you start recording your login session as a database entry and Say that this is a session entry in my database Which has the last access time and it has unique session ID and the session ID is one hour to put in the cookie So cookie contains a session ID and it's signed and that's all it has it doesn't have username or anything else Every time a request comes in from the browser you look for the session entry which has this ID and find the user from that and This way you get multiple advantages You can see where else you're logged in from you can see what IP address and browser was used for that particular login You can also log out remotely And when you're logging out from multiple websites, this is a much clearer way of logging out than by doing it in the browser So in the browser you simply say log out once you invalidate that particular row in the table On the server side and you're instantly logged out from everywhere else because that cookie on other browsers is on other websites Invalid now it's going to be discarded the next time the person comes back to the website. So And this gives you a nice stat for the guys who have to do the marketing for your company Usually they want to know how many monthly active users you have if you simply use cryptographically signed Cookies you have no way of knowing when this guy came in last If you use database sessions, you simply look at how many of these sessions were active in the last month and that's it That's your users So you can tell exactly how many users are valid in our active in the last day in the last month last week Whatever you feel like just look in the table so this mostly is what I had to do to Get to the point of saying how do you implement a Permanent session safely In a way that does not cause problems for the user when they discover later on that they were logged into site That they did not intend to be a remain logged into Okay, so I've gotten this far There is The next problem Now this is something I don't have a solution for and this is basically why you should not trust anybody who says They are going to be and your identity provider whether it's Facebook or Google or Twitter At some point in your application You're going to have a point where you want to confirm the user really wants to do something that they just try to do Like they try to delete their own email address from the profile Now that's possible because either they left the company and that address no longer works or somebody's trying to hijack the Recount right now Which one is it? Now you verify we're saying please give me a password to confirm you really want to do something like this if you used Twitter to log in What password now you're going to say okay go back to Twitter and come back and say it's really you and of course Twitter will send you back because that's what Twitter does You know because Twitter says here you already authenticate to this website. I don't need to prompt you again So please go back to the website. So the pseudo problem is the point where you say there is no option but to have a password and That's basically the end of your social logins Okay, unfortunately, but true and the last one is Not quite related to this login business, but it comes in again and now this one is Something that I've been working on in last user Remember we talked about GitHub and the way it deals with you and your organization by saying you have an organization account separate from your account What happens is this does not work in real life I Have created the ability to I've added the ability to create organizations. Let me see if I can just open the page and show you if our connection works So What I've done here is basically defined a bunch of organizations I just type the URL so it's faster in Last user you can do this you can define an organization and then define teams in the organization. This is exactly the same way that GitHub works Now this I've tried putting this into practice in real life and trying to build apps based around this concept It turns out it doesn't quite work because the way this assumes things work is Somebody is the admin who defined this organization in this app and decided that these people belong in this organization In real life, you will not acquire users that way Take the job board The people who go to has job and post a job are not there because Somebody is decreed that you shall use has job. That's not the way it works They just found a site in today's school. Let's go use it and a lot of times You have people who say that I represent this organization and you can verify it because my email address is the same domain and I have we happen to be hiring. He has a JD Now when you do this the person who posted a job is not the owner of the company Is not the authorized representative when it comes to saying I will own the account for this company on this service They simply used it and so you have a bottom-up approach that people come in and give you data in and a bottom-up approach Simply doesn't work when you have to do things like this So I don't have an answer to this one. This is the part I'm working on right now And basically by the time we do Python 2015 I'm going to come back and say hey completely new architecture. There's a new way to solve this problem so This is basically it Things that have learned in the last three years of trying to do user management the right way. It turns out there is no such thing There's always a new wrong way to do it So anyone has any questions. I think we have mostly done for time. We got about five minutes for Q&A Hi, I have a question You said you finally chose the database back sessions Yes, but you still have the log out failed problem there to write because only once only the website you currently on should log out That's it. Okay So because it does that you'll knock it off in the database and from there the cookies invalid now for everywhere else So you don't have to actually delete the cookie because it'll be deleted the next time they come to the website. Yes No matter what it is you're building today, please please please use HTTPS and do it right HTTPS is very very easy to screw up on but fortunately it is not a application developers problem. It's a society's problem So basically it's somebody else's problem not yours Yes, so yeah educate yourself It's the only way I mean it's I thought I knew everything about making HTTPS certificates And then I went to a new website that says let's find new ways in which to discover if your certificate is insecure And it says yes yours is insecure Like I thought I had covered every single base I ran through every single SSL test that somebody had come up with and this one says you're using SSA one instead of SSG 256 as of last month that is considered insecure Like okay, man. I can only do my certificate once a year, you know So anyone else hi Kiran. Yeah So what are the disadvantages of using a database back sessions? The just database rights It seems pretty obvious to go ahead with that solution Yeah, the only one that I can think of as a possible problem is that you're now doing a database right on every single get request Okay, and that's unavoidable you have to write because you need to update the last use timestamp The so I don't bother changing cookies anymore now, you know only when I think there's a serious problem I go change the So secret key, but that's it So earlier if you had a password breach, I mean or if you had a cookie breach The only way to fix the problem for your user is a change in the secret key We change it which locks out everybody on your account. Okay, so with database sessions is easy. Just knock off one row. Yes Yeah Yes, so it is it is it's just equal alchemy Exactly so this is just equal alchemy and The way I approach this problem is to say let's deal with it when there's a problem and so far. I don't have a right problem Okay, so it opens those if you feel like you want to push it to read is please put in a patch Because we already use it is for caching in other parts Hey, Kiran one question. So you said that the if you use HTTP PC card. Yes on you know Yes, yes, and you're not really targeting for the so you're more Fine if you're dealing with users who know what they're what they're up to No, no, see I'm saying that you're if you're giving out as an authenticated service mainly for developers like as a Yeah, out if you're giving. Yeah, is there any problem with just using HTTP. Yes, and Basic out there isn't it's as long as it is not a user who gets confused. It's fine It'll work perfectly fine and in fact within last user. That's how an app talks to last user That okay a client application, you know the website, which is getting a user account has to talk to last user to get details And all of that is using HTTP basic out. Okay, and that's perfectly fine. If it's over SSL In fact the OAuth spec requires it to be HTTP basic out Okay, have you done guys? So I guess we also are out of time. So if you have any more questions, I'm going to be outside and around You can come and talk to me anytime. Thanks you. Thanks everyone


Hi everyone. In this video I want to talk about torsional impact loading. So torsional impact is basically the same as when we talk about linear impact, but of course we're talking about a rotating system now rather than something in linear translation. So really not much changes when we talk about torsional impact. The deflection delta becomes theta for how much the the object deforms or deflects and that equivalent force becomes an equivalent torque. But really not much else changes. We can write torque for torsional springs as k theta, you know with the difference being that that's k is now a stiffness in a rotational sense. So it's how stiff or how much torque needs to be applied in order to rotate by a certain amount. And we can calculate torsional stress using kind of a standard torque equation, but now substituting in the equivalent torque rather than just a normal torque that's applied. And you know be careful this equation as I've written it is a simplification of of t r by j, which is for circular cross-section. So it has the substitutions in there for polar moment of inertia that only apply to circular cross-sections. And I can do the all the same manipulations that we had done for linear impact, but writing them in terms of um their torsional components we have two times the square root of kinetic energy times g which is bulk modulus over volume. So other than that nothing's really changed in terms of how we analyze a torsional system compared to how we do a linear system.