It's now the evening of the 27th of April, we've just completed the first day of the conference and you can see that I'm a much more relieved and relaxed person than I was in my video log this morning before the opening ceremony started. I have two major worries in these conferences. The first one is getting everybody who goes on the field visits outside the capital to come back safe and sound. And we had 150 or so people in nine different groups go and spend two nights in the field. They all came back quite safely yesterday. The second big worry is the opening ceremony where we invite dignitaries and important people from the host government. It's always very tricky dealing with VVIPs. They don't always come on time. They don't always come and turn up as they promised. But we were very pleased that they didn't need to turn up and they came on time. So we had a very good opening ceremony with lots of important speakers from the country of Kenya and the continent of Africa. We also had the vice chair of the IPCC in Champa Sqal in Brazil.  So we had a series of plenary sessions and parallel sessions and out of the box session as well. And a learning session, learning from failures session is something we've been trying to do for some time unsuccessfully. But we actually, this time we didn't fail and we actually succeeded in doing a session on learning from failures. So we're very pleased with the rest of how today went. We still have a dinner to go to at a cultural show put on by a Kenyan government host. And then we have three more days of deliberations here and I'll be giving a daily update in my video logs every day as we go along.


Thank you. Hi, everyone, welcome to this session. My name is Lirantal, also known as the guy with the yoda hat. And I'm a developer advocate at Sneak on a mission to help developers build applications securely using open source. Actively working with Node.js or the OpenJS foundation on the ecosystem security working group to help improve the state of security for open source. Node.js and NPM JavaScript as a whole ecosystem. I'm involved in other application security projects. So you're welcome to follow me on Twitter or visit my blogs on the Sneak website if you have any questions or want some references.  And I'd like to open up with this following questions to ponder upon. And that is, are we going to have less or more software in the future? Are we going to use less or more open source software in the future? So to answer these questions, we need to take an underlook at how software is being constructed these days. At the very core of the applications we're building, there lies our own custom applications code. This is the top of the iceberg above the water. This is the code that we, as developers, can very clearly see day to day. It's what our colleagues write. It's what our IDE is and what is on our focus and state of mind all the time. So looking at these code snippets, can you find a security issue? It brings up the question, are you aware of the security issues in your code? As you look at the following expressed middleware, as is common in Node.js application, what actually is hidden there? And there is a security issue here, but we'll get back to it later. So there is the open source code that has been there with us for many, many years beyond just our own code. This is the open source code that lies beneath the iceberg. And we may not think about it too much in our day to day coding activities because maybe some of it is abstracted away and we may not be even aware of the libraries that we use, but it really makes up the majority of the code that we write. Up to 90% of these open source software and libraries that make up today's code in different ecosystems like NPM and Ruby and Maiden. And most of the time when we find vulnerabilities, we find them in open source packages that are coming from transitive dependencies. So this is a whole new complicated world which we'll dive into as well. But really now on open source packages, let's take a look at this code snippet from this popular open source library that you might have used at one point in time in your Node.js application. Can you spot the code injection vulnerability that hides here? Once those vulnerabilities become publicly known, the first thing you want to do is, well, know about them, right? So you could then take actions like upgrade to a fixed version or maybe patch them, apply a patch if there's no upgrade fix. Maybe you want to migrate away to a different library if needed. So here's a mental exercise summing up a little bit of these open source roles. Imagine you're building an app, this could be a Node.js app or something else. Your mental image of your application is focused on the own code, what you write. You dwell about it, you spend hours debugging it, you're refactoring it and testing it, right? This is something that is very much the application core of what you're building. But really the reality is a little bit different. This is the mental exercise here, that the code that we're actually building for this application is actually significantly smaller than the mental image that you have of the application itself because the application you're building is actually relying on a lot of community-powered codes and we're leveraging this beautiful open source world which boosts our productivity, but need to be aware of what's going on there. So to put this in more perspective, we shouldn't be surprised that our applications today may have security vulnerabilities, right? We are containerizing them to our serverless functions, bare bones, easy to installs, so many ways that we can bundle open source dependencies here and there and therefore lies the risk. So the use of open source is accelerating as we're seeing, but the adoption of that, the great adoption of that comes with great responsibility and risk as well. So we're seeing continuous growth of vulnerabilities in open source software in different languages and this is growing along with the growth of open source in general. And as users of this, we need to be, we need to have the ability to mitigate them. We need to be, we are maybe owning them in a way we are maintaining or using open source software and this is a viable risk. Now taking a step even deeper into this world of open source software, there is the question and the topic open source supply chain security. And I wanna share an article that was published, not so long ago, October, 2020. So very recently by a government, right? By the United States of America, the cyberspace solarium commission that was really advancing and then promoting the notion of potential compromises, right? From supply chain security. And actually it calls for establishing a center for open source software security within government organizations. So I will give you one paragraph that I paraphrased out of this article which I recommend reading and that is dependency on adversary countries for some or most of our critical software supply chains threatens to undermine the trustworthiness of critical technologies and components that constitute and connect to the cyberspace. As you can see, there is a lot of awareness in terms of what could actually be coming out of open source supply chain registries and things like that. And that is why this is catching the attention of governments worldwide along with companies and everyone else relying on open source. This is basically a testament and acceptance of us. And evidently, we've seen these security incidents happen time after time. For example, on the NPM ecosystem, we've seen a social engineering attack and a malicious incident for this package called the event stream that was downloaded millions of times a week. And it demonstrated how deep the attack surface that was aggravated and by security concerns, it nested dependencies because someone were able to socially engineer a way into injecting a malicious package into this popular package that was downloaded millions of time. But we have to ask ourselves, have we learned nothing? Because a year after event stream, another incident took place, this electron native notify package which targeted still in cryptocurrency, the same as it was with event stream. It targeted this stealing of cryptocurrency from users who are using the Commodus Agama wallet. And it really went through the same process. So what was going on there, right? A dependency was added to a library. Three weeks later, that dependency publishes a new version with malicious payload. And three weeks after that, the Agama wallet software is rebuilt and pushed using a recent version of an electronic notify which now includes the malicious version. So this is how software trickles down from supply chain into the end users to like the build process and development and everything else. And if that software is compromised at any point of those stages, that is a whole story of open source supply chain security. So another example, this is this word package name is one out of three packages that existed on the NPM repository for actually more than a year before someone found out about it. And it targeted a complete system compromise as you could see from the NPM staff announcement when this was found. So living aside even the supply chain security, there are different aspects of security vulnerabilities. For example, those that are unrelated to malicious incidents that we all need to be aware of. For example, a UI library called Frappercharts from 2020 having an access as a cross-site scripting vulnerability in this front end charting library. Maybe a universal library like URIJS, which has use cases for both front end and back end needs but it is suffering from validation issues. So you may not be using it in a correct way or there is an upgraded fix that you could use to have the safer version. EJS, a popular no-JS templating library that is still vulnerable if you're using 3.1.5 version of that which has a high severity code injection issue. All of those which you should be very well aware of if you're using open source software. The thing is with open source, we need to do a bit of due diligence to find out specific things about open source packages. So this advisor website that you could use gives you this sort of health metrics around popularity and maintenance and security considerations and community. So you could evaluate if you wanna use a new package or an existing one and you have second thoughts or you wanna check what is the, if you should move to a different alternative or similar package, what are the options of doing that and are they actually doing any better? So we have all of these tools but really understanding our dependency trees is a complicated task. Even more complicated at times is the ability to tell where vulnerability originates and how to fix it. So as an example in the JavaScript ecosystem more than 80% of vulnerabilities that sneak users find are in indirect dependencies. It means that even if we are looking and watching at change logs and everything around the direct dependency the express of the world what is happening is most of the time when we find vulnerabilities they will actually manifest in those indirect dependencies those transitive dependencies that the direct ones simply bringing in which is hard to track because then we have a bigger dependency tree. So nowadays at the very least we have bots automated bots that help us stay on top of security vulnerabilities whether you're getting those automated pull requests from sneak or GitHub or somewhere else that is great that you are knowing about us but really what is it telling us is this is a message where we are entering a world where security is turned on by default is something we are now used to. Secondly tools basically adapt themselves to a developer's mindset not the other way around. And this is an entire mind shift of how developer security is actually and developer first security tooling is actually changing the way that we interact with software. So developers, if we sum it up developers often think about the security of their application in terms of vulnerabilities that play in their code or in their open source dependencies and your open source dependency footprint is a great way to start to improve your application's security posture because as we've said open source components make up to 90% of your code base but really what lies beyond that point, right? Beginning with security in open source dependencies is a great start as we said but we are transitioning into this cloud native world where your application is really more than your code. And what I mean by that is when we build cloud native applications as developers our application stack surface is more than just the base of the application code. Still, right? What is that actually mean in practice? So I wanna explore that with you. Let's say you consistently scan your project repositories for security vulnerabilities. You are now aware of security vulnerabilities coming from your code and from your open source dependencies. So you audited your dependencies and once you fixed things how do you know if you're not vulnerable to a new vulnerability that was released after you last scanned it? So what you actually need to do is not just scan it as a one time off but you actually need to monitor the project because you may have scanned it at one point but then new vulnerabilities are keep coming up and are you monitoring that project all the time to get those alerts? So you've done that but now you have a baseline of the vulnerabilities that you have. So as the next step, hopefully you even got to a really, really good baseline point where you have maybe a few or even zero vulnerabilities in your projects. I want to say congratulations, amazing job which it is but there's a bit of a misconception here and that is what I wanna highlight specifically in this talk and that is our application repository is continuously scanned for vulnerable dependencies. This is great but it is not the complete picture. It is not capturing the whole story. There's the issue of potential dependency parity drift which are deployed artifacts. And that is right. It means that we don't just develop applications to build them and save them in the repository's main branch. We also deploy them and there could be a drift of different states between the dependencies in the deployed states and dependencies in the main repository branch. And that is the drift that I'm talking about here. So this is where the next layer of our story actually reveals itself. In a pre-cloud world, we deployed on bare metal servers. We deployed on maintaining our own infrastructure. We had hopefully achieving elasticity and some flexibility with virtual machines but these days, who even remembers those days or care about the overhead of maintaining your own infrastructure because we have entered into a cloud era, right? This says we are living it. We're not just entered. We are the fact out there. So it means that if you build a small API, maybe you go ahead and deploy it as a serverless Lambda function. If you build a frontend, you may deploy it on a Netlify or Verso as cloud frontend infrastructure and they worry about all the SSL and the caching and the edge deployment and the atomic deploys. You give them that concern and they manage that for you. This is the cloud. If you maintain several microservices, it's natural to fill the way, the urge to wrap them up in a container and deploy them to the cloud, right? And let's focus on that specific part. This is the whole cloud native part. This is containers, for example, as one of those example that I've said before are an easy topic to talk about because we can easily relate to that. It gives us cross a platform compatibility to deploy no matter what cloud you're running on. It is faster and more lightweight to spin up those than VMs. It provides you this reproducible application environment. So for all of those reasons, we could talk about containers. So let's dive deep into this and now try to fill those blacks. We talked before about all our application dependencies and our application dependencies are not running in a vacuum, right? They are part of somewhere. This gets deployed somewhere. Don't just write code for the sake of writing code. And so now this black space, I think it becomes clearer because if we're sticking to these examples of Docker containers here, an application that we containerize as a Docker application, for example, this Node.js application, suddenly tells us how our attack surface grows in ways that I'm sure you may have not thought about before. So let's break it down and see what attack surface is now being more of a concern for us as developers. For example, this is a Docker file which I can go ahead and show you how we actually have a Docker file for a Node application and what actually hides in it. So what are we actually bringing in this Node.js image? If I'm bringing in, if I'm saying from Node, and there are different bad practices here, right? So this is just for the sake of simplicity and brevity kind of small. But what, if I'm doing from Node, what OS dependencies am I bringing pulling into my dependency, into my application? And do I need all of them? You may need some specific tools and libraries available on the container for the application to function properly. So maybe you want to convert images. So maybe you do up to get install image magic because you choose to spawn a system command that uses image magic library that is available on Linux distributions, like Node is based on Ubuntu or Debian. So this common software makes up your container and well, potentially it increases your application attack surface. Now, I understand that at this point, maybe it seems like, well, how do you connect the dots between a vulnerability that someone is able to exploit from the other side of the application into a dependency that is running on the container itself that could be vulnerable. Well, I'm going to show you how we do it in a live hacking session quite soon. I'm going to go see all of these unfolds. But more in this Docker file, what lies in there, right? The version of the dependencies in deployed containers can be significantly different from what you have even scanned and monitoring your repository because deployment doesn't necessarily mean that it is the same thing that you had in your repository because of the drifts. So if you're not installing dependencies in the same time and you're not fixing them and you're not pushing those security fixes, right on time, you may have those disparity drifts. But really the thing that I think people are missing a lot in terms of understanding the containers, the container side of vulnerabilities is not the actual vulnerabilities in the container itself, but actually the runtime. What are you doing from node, right? Which version are you actually pulling in? Do you know which version are actually running in production? Do you know if it is vulnerable or not? Because this is the node runtime. This is what people have direct interaction from the outside of the application to the node application itself that you've built. So it's meant that if there's a vulnerability in the node.js runtime, well, that is directly impacting your application and node.js vulnerabilities do happen time to time. So you need to be aware of this. Now, there's a good reason we're talking about containers here as an example because this race to the cloud that we also often referred as this digital transformation has accelerated the use of container technology. And what it means is that this problem space of using safe base images isn't very intuitive for us to figure out. So what is happening as an example here is we are consistently, year after year at Snakeware, we've seen that the top 10 Docker base images on Docker Hub are carrying security vulnerabilities in them by default. So just by using the default node base image, you're actually introducing, you know, 500 or 600 vulnerabilities, maybe more, maybe less. And this is just by getting that from node image. So let's hack an application, right? Let's go into this live session where I will take you through a process of how we're exploiting an open source library called the marked, which is a markdown library that I used to build an application, a to-do application. You can see kind of like how it is used between the application logic and how it is used in the view to render data. And we're gonna take even a step further. We're gonna hack an application based on the fact that we have a vulnerable dependency in it, specifically image magic as a way to convert images on the container itself on the application. Even more, I'm gonna show you how we are able to hack into an application based on a vulnerability that exists in a node version in a node.js runtime itself. So hopefully you're ready for that. And I'll be happy to have that session run as like an interactive one. So if you wanted to take part, if you wanted to ask questions, if you wanted to engage, I'll be asking here and there for you some hints. Go ahead and use the Q&A box to just submit some questions for us. And I'll be trying to do the live hack and monitor that at the same time. And we'll be able to have a bit of an interactive session here. So to get us started, what I'll do first is run the app. So for that, we need to run MongoDB as the database for the application. It's a lot of logs which we don't care about, but we go here and let me know that the database is running fine. I'll be running the app. It's available on port 3,001. So we could go there. There we go. And we have the app running. So as I said, this is basically now for us way to start investigating what is wrong with this application because it has a vulnerability in it that has a dependency that has a vulnerability in it.  And it has marked which is a marked down library. So I've started here before in this advisor thing, which gives me a really good health score, you know, a hundred or a hundred. This is pretty great. So pretty perfect. Anyway, this is five, almost five million weekly downloads. This is getting, you know, really great numbers. So I'll use this. It looks, you know, very maintained, very healthy. And this is what I'll use. And I've already added this to our project. So you can see here, I have required that in the top in my require file. And then we have marked set option sanitize true. So this is interesting from different perspective. First of all, if I hadn't done that, what it meant is if I hadn't initialized like marked with any specific sanitize or other options, what would happen is it would actually initialize in an unsafe manner. So at this point, I am going to, you know, put all the security gates that I can in here. You know, this is where I'm exposing it to the view. And, you know, later on it is showing up there. So it could be things like maybe we want to add links. Like this isn't good examples of markdown, right? You can do something like this. And there we go. We have markdown turned into a link. So this is the capability that we wanted to get from this markdown library, which is of course I'm not going to use, you know, write my own markdown parser. So I have this and this is like the greatness of open source. Next, I will try to exploit it. So any ideas on what we could try next to maybe exploit this vulnerability? Would you maybe try something like this as one hint? And as I said, you could feel, you know, you could feel engaged to just put something in the Q&A. If I try that, what do you think will this work? That's right. Well, it didn't work. It's not working because we're sanitizing. Remember we said we're going to sanitize all this input that we're getting. So marked has this logic that anything that it gets, it's gonna try to sanitize it away. So this didn't really work too well. I can try something else. For example, I know that through links, I can also add JavaScript. So I could try something like this. Let's see if this works, JavaScript alert. Okay, so this is almost there. We're trying to create an XSS across I scripting vulnerability here based on the fact that maybe the marked library that we're using is vulnerable. This doesn't work. And there's a reason why it isn't working because of the fact that there are regexes inside the marked source code that remember we said sanitize through. So it's looking at all of those, you know, things that we're trying like JavaScript call on something and it's, you know, sanitizing them away. And I've got this great answer here from David Acosta. Thank you. I can try HTML encoded characters, which means I can, if it's looking for JavaScript call on something like any function that goes from it, I can represent colon in a different way. And these are called HTML entities. So I can do something like this. And 41 is the closing here. And I can try and represent stuff that I know, you know, maybe looking at the source code of marked, I know that they need to escape from them. So let's try that and see what happens. Almost, almost. This is a great direction, David. Thank you. So for us, what it means is it's not really game over because we can still try more things, right? Marked is open source. I can see what the actual regex is trying to look at. And I know there's another regex because it looks for HTML entities. So like the maintainers were thinking about this and they had like great security mindset here, which is amazing. So this is great, but what's actually missing what is what kind of like, you know, the security bug here, the vulnerability that manifests is if I'm gonna represent and I'm gonna make a slight changer to the HTML entity, I'm gonna use this document or even like this as like a JavaScript, you know, this is a valid JavaScript keyword, right? If I use that, this doesn't make sense as, you know, the whole string here doesn't make sense as an HTML entity. So it passes the sanitization process and that is where the flow is at. So it passes it and this, you know, mark says, you know, this is fine, whatever you want with it, put it on the screen, but the browser treats it as a different way. Maybe the browser allows this to actually execute JavaScript. So let's try it. Well, first of all, we're seeing to remind you like this is what we've just added. And you can see that now we have a link. And if I click on it, then at this point we have basically had this, you know, established our exercises. This is a cross-site scripting vulnerability that happens in marketing and open source library, having millions of downloads. And this version that I'm using that I know is vulnerable for this, you know, demonstration purposes, but it is a real vulnerability in an open source package. And this exploit for it is live. Now, there's an interesting, you know, story here between this library, which is why I like, you know, repeating on this specific vulnerability because there's a story of open source here. And, you know, let's go through this. So if I go into my vulnerability database, you know, over here and I, let me filter this for NPM and I'll go ahead and do more. I wanna search for this one specifically. See, it had over the times, you know, different kind of 2020 and, you know, I think I said something on 2021 as well last time. Yeah, so even in 2021, not so long ago, different kind of vulnerabilities that we know we should be aware of. But this one specifically, which was, you know, fairly a few years back was discovered by Matt Austin. And I wanna show you what happens to her because the way that it was discovered is, they opened this open source pull request to this repository, you know, saying there is an exercise with no vulnerability here and there's like a great report.   This is really helpful. This is for me as a maintainer, I wanna merge this, right? This is it has tests and really like for regression testing and it has the fix itself as well, like everything is here for me just to go ahead and fix it. But as is with open source, right? Maintainers have their own lives and we can't expect them to hold them accountable for all of those things. And this is part of the open source story where maybe a pull request gets open in 2015, but yet only got merged or released to production. Even if it's a security issue, you know, a year later, and this is the problem, right? So there are ways to, you know, what do you do when you have this problem, right? What do you do when you cannot upgrade a library? There's like no upgrade for this library at, you know, war at that point in time. So Snake has this cool stuff, like, you know, there's a patch and all of this is like freely available. You could, you know, you could just, you know, view it and use it and then the whole sneak building if you didn't want to, but we make it available. So this is for you now a patch that we take and you could just, you know, run like a sneak CLI command, sneak patch. And if you have this, it will go ahead and apply that patch if there's no, no upgrade fix. So this is a great story of like how open source connects how, you know, you need to be on the bleeding edge. Sometimes there are no upgradeable fixes, which is, you know, a whole story of itself, but this is the story. So hope you were having fun.  Let's go ahead and do run something in a container. And, you know, if we had bundled in an application container, what could go wrong? So I'll go ahead and stop here. My mom going to be, I'll go ahead, stop the app. I said that it stopped and I've got some slides of screens ready here. So I will start with, first of all, as we need to do first build a container, but I want to show you first what is going on there. So as we go over here, we can see the actual container itself. So this is my app. It's a very small application. The whole thing that it does, this note app that I deployed to production on a containerized instance is I want to convert an image. So I have this upload route that all of the app is exposed from this slash public route as well. And what I'm going to do is I'm going to spawn a command because I do not want to block the threads for the Node.js application to do anything like no synchronous here. So I'm going to use this convert application that is built and available as image magic is on my container. And then, you know, just go ahead and resize the image. This is my Docker file. It's pretty straight. I didn't even have to install image magic. This is just apparently it's available in this Node image. And yeah, we're taking now, you know, the time train we're traveling back in time back to where Node 6 were alive. And if you think about it, if you were running Node applications back then as well, you know what could have happened. So this is just picking, you know, some, you know, some node image tag here. And all of this is, you know, pretty, pretty simple. So I'll go ahead and do Docker build, which I've done before, but it's always great to see that this is up to date. And then I want to run this application. So I've got this one different for there we go. So this is going to run in this port and I call it RCE. You know what, when RCE that should give you a hint of like what is going to go on here. So let's, let's leave this up and move into this one. Okay. So a new application, as I said, everything exists on slash public. So I will open that. And as you can see, this is allowing us, you know, tell odor, upload an image to convert this. So I can go ahead and upload the conversion of images. So maybe I'll go ahead and choose one. And I've got a few of them ready. So hopefully you've uploaded something to social media. I have something called RCE1.jpeg. I mean, that's just fine or it should be fine, right? But before I do that, I want to go into the container itself and tell you why that might be an issue. So let's go in and see. First of all, I will find my running container here and see RCE1 and connect it. And at this point on this side of the screen, I want to show you the files that actually this is deployed in user source Goof. Remember that's what we had over here, user source Goof. This is the place where we deploy the application on. This is the working directory on the container itself on the OS. And these are the files that exist in it. This is, you know, what I showed you before, the server.js, everything there, even the Docker file is there. This is not a best practice, but this is great for our demo purposes. So I have it here. And what I want to do is resize this picture, which is, you know, makes sense as, you know, maybe if you want to build. So it looks like it's over, it looks like it's done and we have resized our applications. But what is going on? Let me show you a difference here. So as you can see on the right side here, my directory here is a little bit changed in terms of outputs of what you see here. Specifically, what I want to call out is there's this new file called RCE1 that was created on the running container, which did not exist before, as you can see on the top of it. Now, why did that happen? This is because we have an exploit. Oh, there you go. I'm already on the exploit directory and I will cut RCE1 and show you what's going on there. So essentially what we have is you probably, you know, haven't seen this one before. It's not a very common way to create JPEG files, but it is supported. It is a way that ImageMagic is a library, like I said, a tooling for, you know, for Linux to basically allow you to manipulate images in different ways. It has this feature called Delegate where you could have not binary data, but declarative text data that tells you how to build the image, tells the ImageMagic library how to create an image.  But what it has is a vulnerability that does not check, does not validate that this could be, because this is offloaded to another command that ImageMagic spawns, it doesn't validate that this is a specific, you know, URL and not something else. But what it does is it takes that, you know, we take, it exploits that vulnerability and actually appends to it or adds to it this command execution that is touch RCE1. Touch is a Unix command that creates a file called RCE1. And that's why we have it here with the size of zero because we just touched it. We just created nothing else except that. But by the fact that we were running a vulnerable version of a dependency in a container, right? This is nothing to do with the application itself. The fact that we had a vulnerable version of a container here of a dependency there, ImageMagic, you wouldn't know about it at all if you've seen this one. This had introduced a vulnerability here that we have exploited. And, you know, the code here, there's no issue with the dependencies here. There's no issue with like, you know, code security issues here that allowed that to happen. This is just a fact that we have relied on a specific dependency in a vulnerable container. Now, how do you manage all of those things? So if we were talking about, you know, scanning your applications, right? This is the, you know, me scanning this Goof application that I showed you before and this is the dependencies, right? So I can see the dependency tree. I can look at, you know, all the dependencies remediation. And I can see that to marked is, you know, having vulnerabilities in it. I can go ahead and fix this. If I do it, you know, get this automatic pull request that fixes it. If I don't, you know, if you just set it up to just fix those dependencies. But this is a great way of understanding your dependency tree and all the problems that happen from it, you know, but even more interestingly is, you know, the ability to know how to remediate this problem from, you know, what do you need to upgrade and what problems does it solve? The other thing is the container side, right? We've, we're running node six, right, a specific base image of it, which has 800 vulnerabilities. Again, if I look for image magic, that's here. So what do I do with all of those? I know, what is it like? Hundreds of vulnerabilities in image magic. How do I know what to move into? So maybe something gives me an advice what to move into, but I'll get to that in a second because I showed you how we can do it from the app side and the container side, but actually want to take it a little bit further. I want to talk about what happens when the node runtime is problematic. So what I mean by problematic is, you know, vulnerable. So for us to make that happen, what we need to do is first of all build the container. So let's say you know that now node six is vulnerable. So I'll go out of this and I'll first of all start, I'll stop my containers, my container is running here. There we go. All stopped. And I will go ahead now and say, hey, you know, this is, remember this is us back in time, back in the days where there was node six and maybe you had that running in some microservice and you're saying, well, you know, now this is have like a new version, like the new LTS is eight, right? Let's use node eight. Let's use node eight, zero five. That's like the newest. That's like the latest version of the stable. It has all the fixes, everything in it. Maybe, maybe it doesn't, I don't know, but you could have made that decision to move from node six to node eight, five, zero. Let's see what happens when we do that. So I will go ahead and need to now rebuild this, this is the same app we're going to rebuild it. So Docker build, there we go. Yep, done. So once we've rebuilt it, the Docker image, now we can go ahead and run it. I'm going to do the same thing as we've done before. So it's the same app. Let's see if this works. Okay, this is the same app and you know, it now doesn't really have the other vulnerability of image magic because we have used a new version of image magic in that, you know, node eight, five, zero. So we have migrated out of one vulnerability, but what happens with a node runtime itself, which is another concern that you should have. So if you're using slash public, maybe you want to try different ways of, you know, run times have issues. Some of them could be, you know, redos attacks or, you know, just denial of services of different kinds or maybe, you know, HTTPS related issues and, you know, leaking of information and things like that, like memory issues and stuff that have been also hitting nodes in the past. One of the other things could be a batch reversal that maybe the runtime is not managing that correctly. So what we could actually do here is, you know, try and traverse this tree like that, which as you can see, doesn't really work too well if I do it from here. But if you have any idea how I can do it from here, you see my question box to you. Okay, go ahead and suggest, but I'll just go run into it with this in the meanwhile. And that is maybe I want to go ahead and try something similar to what we did with Mark, which is I'll go ahead and URL encode those dots. So a dot is the 2% key. So 2% key. And you can see I've already like tried this a while ago and this is basically the way for me to traverse the tree of the directories back inside as if this was running inside of the container itself. So the container has the slash public as the root directory, but we want to traverse far out of it because we want to see the package JSON. We want to see the dot end file that you may have API keys. We want to see different things that might be telling us as attackers for this might be telling us more information of how we could hack in. So the way that we're doing it is we're basically, 2% to 2% here we're now traversing up the tree. We're using a bit of a logic magic here to exploit the vulnerability related to patch reversal in the Node.js runtime. And if I run it, this is basically now the output of the ETC password of the running container of the inside like this node application. So this is nothing to do with dependencies on the container. This has nothing to do with my code being bad like over here, nothing to do with this. I've basically just created a public route here with express and known framework for Node.js. But I am taking advantage of exploiting a vulnerability in the Node.js runtime. So this is the case of traversing from the top to the bottom. And I want to go back into our slides and continue this story. So hopefully that was fun, right? But what can I do about it? And I'm pretty sure that this is kind of like, what could I do with this? But first of all, I want to give you a bit of like references here. So what we've exploited on the container side was this improper input validation, CVE vulnerability report that came out for image magic. And this is very, very real. But it is also very easy to miss as a problem. First of all, the CVSS score is not like a 10, right? Which is shouting. The CVE report doesn't mention remote command execution or whatever you could do with it. This is just improper input validation. And it looks as if this is, you know, maybe not so significant, but as you saw it is, I could run commands on the running container. And to give you an example of like why I chose specifically to use a story here, a demonstration that uses image magic and Node.js to spawn commands because this is something that people do. This is something that people may do as like a job server or something else. And this is like a screenshot I got from YouTube of a video from Google IO 2017 event where they demonstrated a similar capability live to run the stage, doing the exact same thing, right? So this is a very common way to do things like converting images if you wanted to. But we need a way to help developers understand that. We need, why do developers think that that could be vulnerable? So like an application to image magic. So tooling like this makes it easy, right? It shows you this layer of, you know, layer level indication of where this is coming from. This is maybe me doing up to get installed image magic. And if it's coming from somewhere else like the base image, it will tell you it correlates the Docker file run and whatever directives you have to with the actual vulnerabilities themselves. So you know where to look for the problem itself. But even so, right? So how do you fix it? Like I told you there's like, you know 862 vulnerabilities in this Node 10 image. What do you do about it? I searched Docker Hub before and it has almost 4,000 different node image types. Which one should you move to? To 10.5, to 10.6, 10, to 12 something. You have no idea, right? And this is where we're trying to be helpful. So you have no idea if a new version is gonna be, you know having more vulnerabilities, less what's gonna happen there. This is where the tooling really helps you. This is where developer first security really shines because it gives you this database recommendation that tells you, hey, there are, this is the image that you're using 862 vulnerabilities but you can move into a different, you know kind of like base image. You could upgrade to maybe node 12 or you could just stay at node 10 but use an alternative. No image that's like a little bit smaller has less dependency footprint. Maybe that's just enough for you to run your applications. So, you know, we talked about code, right? You writing your own code like this kind of lines of code of what I had there. And we talked about using open source dependencies and the issues that they may have. And we talked about your container, right? And your dependencies, runtime as well. All of this that we've talked about but what did we miss out? We talked about all of those things but how do you deploy? How do you deploy an orchestrator applications, you know in production, in deployment time? That's the thing right there, right? We have commoditized infrastructure in the form of code. And I can hear, you know the thoughts in your brain running around, you know asking me for examples, what do I mean by that? So let me show you your infrastructure as code.  And this is really the last piece of this puzzle, right? This is the bottom of the iceberg an entire application orchestrated using the power of code. And why are we even discussing, you know these kind of things, right? Because these are nowadays, you know the cloud infrastructure that has been completely obstructed a ways, you know from, you know anything the hardware based into into the form of code where we can deploy it as fast as we're deploying code we're deploying infrastructure. At the same time, those mistakes that we make in configuration are the number one cloud vulnerability as is identified by the NSA. So let me give you some examples for this. This is a Firebase configuration that adds a rule so that only authenticated users can view or create documents. You know, this is a good story that I have from like a real-life application. This is a really use case where this was a security misconfiguration because what's going on here there is no authorization implemented there is authentication but no authorization. So the fact that this is, you know there for you built, you know by default doesn't mean that it's with security by default enabling and protecting you and maybe you have disabled sorry, maybe you have enabled only specific users to log in but you forgot to disable registration. All of those are really ways for someone else that if you have done any cloud misconfigurations you're for them to basically exploit those concerns that you have missed. I'll take you to a Kubernetes examples where this is a partial Kubernetes demo file that will deploy a pod that the, you know the full, you know this is just part of it but the full one deploy is just fine. The only problem is it's missing out some crucial security related hardening that is not turned on by default. One of those issues with Kubernetes is this thing called the security context which if you are missing it then it allows you to run application without root user control and this pod level, you know directive now fixed it the fact that I added it but I've no idea like I'm not a Kubernetes engineer I'm just a developer so how do I know if I have more issues? I don't know about issues it's like who knows this stuff? So that's why we need again those developer first security platforms because they point out the issues in the form that we developers understand them and that they are showing us how to fix them and why are they even happening and where are they happening within this code because like everything has now been abstracted away into that form.  One of them is, you know connect your source code repositories to continuously scan them. I want you to connect your container image registries always so you can continuously scan them as well and have this, you know not have that drift like continuously monitor what you have deployed as well as what you have in your source code repositories. If you can, you know perform minimal base images secure base images however you're managing those but you know be able to act with some kind of image base image recommendation advice or if there's a vulnerability that comes into life you know where to move to very fast. And lastly, you know don't forget your infrastructure it's just as vulnerable and take measures to monitor it and fix it. So this is our session I want to, you know wish you a safe journey here in this like cloud idea of applications security space because you're all cloud idea of application developers and there are some resources here and we'll show them there's like a lot of security chitches and how to do things the right way in different contexts of technologies you can find them on this sneak.io.slash blog and with this I'll go ahead and let's go to the questions say some of them are already there. So I'll go ahead and go through some of them. Thank you for this questions. First one was how are dependencies marked? How often do you upgrade marked? Okay, so I'm going to assume this was based on the marked dependency here which you may have got that we have this plugin that shows you when you type something in it kind of like annotates this. This is if I got the question right like how do we annotate that? This is based on this one cost plugin and how often do you update to marked? So well, if there's and there's the context of being on the bleeding edge but also being very wary of being on the bleeding edge is important because sometimes you could just be a victim of malicious security incidents like we've had before with event stream and DSLink scopes and others. So you want to automate that process through things like the sneak tooling that helps you upgrade those. And we have inherently added this kind of like artificial delay where even if a version is out it will delay the upgrade a specific amount of time that we have observed from other recent incident security incidents that took time to find those issues. So that's how we automate it away. You could do that or you could like use something like a sneak see life you needed to like automate whole workflow based on your own processes and pipelines. That's this one, what else? How about container registry in enterprise cobalt to reduce the security vulnerabilities? So container registries not sure about cobalt specifically but if you have container registries what I'm suggesting here is if you, this is basically this takeaway which I don't know if this was there before but if you connect those container registries wherever you host them whatever cloud infrastructure into what you monitor like your application security monitoring thing then you can actually see those vulnerabilities in runtime runtime meaning here not the runtime of the container but like when we find new vulnerabilities that's when we will tell you of this stuff happening. So for example, I'm monitoring here this is from Docker Hub so you can see the source I've connected this I have this image here and anytime we're gonna scan this on a daily basis and anytime there is gonna be new vulnerabilities or maybe new recommendations to upgrade to different versions you can see for example if you move from node six which is super old end of life you can move into different node 14 which is long term support and this is a great way for us to basically win this win this, you know less vulnerabilities at XRFS so it tells us how to do this and this is kind of like the way to connect what we're having on the image registry and what we actually want to have running in production as well in a safe way. Great question. So if this and this is maybe the last one does this feature Infra as code Kubernetes template scanning works with Helm? Yes. So that was answered live. Thank you for that one. So we have support for that that's already out and you could probably take a look at the sneak blog and other resources on the sneak website to see both roadmap of what's coming next. Helm is supported and the Kubernetes channel file as well. More information is definitely they're being accurate on like the timing and releases and the exact feature completeness that we have there. But yes, this is let me take that screenshot back again and this is basically the Kubernetes that channel file that we are I'm showing here the screenshot. All right. So I think we are going to wrap up. Thank you for all the questions. Hope you enjoyed and I hope you're going to be stay safe using open source software. Great. Thank you so much to Laurent for his time today and thank you to all the participants who joined us. As a reminder, this recording will be on the Linux Foundation YouTube page later today. We hope you're able to join us for future webinars. Have a wonderful day.


Let's take a look at an example of a problem in which we are trying to determine if it is continuous and differentiable at a specified X value. So let's start with the continuity piece. And in order to tackle that one, we're going to utilize our three steps in the test for continuity. So of course the first step is that we need to verify that there is a function value 1x equals 1. So it's the second piece that allows us to substitute in 1. So we do get a y value of negative 9. Second step is that we need to verify the limit exists as we approach 1. Well because it's a piece function, we are going to have to consider both the left and the right limits. So let's do the left side first. So if we're approaching 1 from the left, remember that means through values less than 1. That's the second piece that applies. So in this case, we're just simply going to get the same thing that we had for the function value. If we now consider the limit as we come from the right, it is the first piece that applies for those values greater than 1. That would be 3 times 1 plus 1 and we get 4. So because of this we figure out that the limit does not exist. So it falls apart for continuity and this function is not going to be continuous at x equals 1. Now because of that theorem we studied, that differentiability implies continuity. If we know it is not continuous at x equals 1, therefore we automatically know it is not differentiable at x equals 1. But we're going to go ahead and prove it anyway. Otherwise you can definitely call upon that theorem and really that's the end of it. So you easily could do that and that is perfectly legal to do that. But let's go ahead and just show you how the differentiability piece would work out otherwise. So for this we'll want to actually find our derivative. So the derivative of the first piece was 3. Remember that was when x was greater than 1. Derivative of the second piece was negative 2, that's when x is less than or equal to 1. Well, obviously they're not equal to each other. Really it's because we're looking specifically at 1 and really what the reason is the derivative from the left at 1 does not equal the derivative from the right at 1. The derivative from the left at 1 is the negative 2. The derivative from the right at 1 is 3 and obviously they're not equal. And that's why it ends up not being differentiable at x equals 1.


The three most important Chinese policies to know for teaching experts in China Work in China is very appealing for several reasons like traveling, good salary and working conditions However, there are some pitfalls experts should know If you desire to work in China as an ESL teacher, here are some things to take into consideration Visa status, passport country of issue, as well as age, education and experience 1. Visa status Many people think that it is appropriate to arrive in China on a tourist or business visa and start working in a company In fact, it is not any type of visa, but the working one is considered to be illegal by the authorities Police officers regularly check schools and if they find out that an employee is not on a working visa, he or she can be fined or even arrested An employer must pay around $7,000 fine for a violation in such a case What is even more important to know is that sometimes companies may not have a permit to hire foreign teachers, so they offer an applicant to get a working visa for other specialists like managers That is also illegal. Are you a student? Don't think about working with this visa type either Last but not least, your working place must be the same as it is stated in your documents Even if you work for the same company, but stay in another campus is a reason to arrest you 2. Country of your passport In 2018, the Chinese government restricted the policy toward non-native English speaking teachers Since the time, only native English speaking countries passport holders are qualified for a work visa There are seven native English speaking countries recognized by the Chinese government, UK, Ireland, USA, Canada, Australia, New Zealand and South Africa Many HR agencies still seek teachers in other countries, although they know that it is almost impossible for non-native teachers to obtain a work visa The reason they do that is simple, it is cheaper and faster to hire a person from a non-native English speaking country because there is no need to process the documents from both sides Plus, non-native teachers get paid less 3. Other restrictions We have already learned that to teach English in China one needs to be from a native English speaking country and hold a work visa There are many more things to consider to be able to get that work visa, age, education and experience A potential candidate for the Chinese work permit is under the age of 60 and has at least two years of experience after graduation If your education is related to teaching it gives you more chances to get the visa Otherwise, you should get certified If you are not from a native speaking country and still are interested in teaching in China, my advice is be very careful and look for bigger international schools instead of language training centres because they usually have connections with the authorities Are you ready to teach English in China? Apply now for your TEFL test all certification course and start teaching in a matter of months Speak with an ITTT advisor today to put together your personal plan for teaching English abroad, send us an email or call us toll free at 1-800-490-0531 to speak with an ITTT advisor today


I want to say that this is one of the most important gatherings one could imagine in the College of Engineering at Purdue. As you know that getting tenure at Purdue Engineering requires very high bar in many ways. And we want to congratulate publicly those colleagues who made it and also ask them to share with all of us, including some PhD students and postdocs and colleagues, what they did and what difference did those wonderful work make in research but also in learning and in engagement and impact to society. And this is the third of this semester's Celebrate Associate Professor Sirius Armin, who really is the architect along with his wonderful office behind the series is traveling today. So that's why you get a substitute like me. And I want to thank Armin and his team for doing this. And today I think we're going to celebrate Abigail and Amy and listen to their stories. If you see me exiting like before 12 o'clock just because I have another engagement. Nothing to do with your content. And I was eagerly looking forward to learning from these two now tenured faculty colleagues. And before I handed over to the two heads of the schools and divisions to which Abigail belonged, I want to highlight what tenure means. It means different things to different people. To me it meant I got a whole year devoted to child care of our first daughter and while my wife was at medical residency. So to me tenure meant a lot of diaper changes and like a dip in productivity in other dimensions for a year or two. But it was the happiest year I ever had in my life. And to others it meant that I get to imagine things outside of the box. I get to write a proposal that is risky and may not be funded. I get to maybe teach online. Maybe I get to finish that textbook. Maybe I get to think about a patent invention, a startup companies. Maybe I get to just pivot to a whole new field. Well you are free to do whatever you want to do. And that is a true unique beauty about at least American academia enterprises. Once tenured you can retire or you can dream. Please do not take that as a recommendation. You can dream really big. And we know that here at Purdue Engineering all those who get tenured after the champagne and celebration with family and friends say yes now what can I do? And what can I dream? Things that I try not to think too much about pre-tenure. So this is the most fantastic thing a faculty can have is to now sit down and think really big. And with that I would like to introduce Abigail's school heads, Nate from ABE and John from Triple E. Thank you. Hello, I'm Nate Mosier and I'm the Interim Head of Agricultural and Biological Engineering. It's my pleasure to begin the introduction of Abigail Abbey Engelberth to our program. So she will talk about her research here in a few moments. She has been a great asset to our program across all three missions of the land grant mission of a university like Purdue. She's very active in teaching at the undergraduate and the development of a critical undergraduate hands-on practical laboratory learning experience and spearheaded the development of some practical hands-on professional development and leadership opportunities for graduate students in their education as well. In addition to the research she's going to speak about in a moment. She's also actively engaged in industry collaboration and outreach and is an important member of the Laboratory of Renewable Resources Engineering here at Purdue University as well. And so with that I would please introduce John Sutherland, the head of Triple E. Alright, thank you, Nate. My name is John Sutherland. I'm head of Environmental Ecological Engineering. We always say Triple E. It's really a fantastic pleasure to help introduce Abbey. She is one of the charter members of the Triple E faculty. In fact, she was one of the first people that Triple E hired. And it doesn't seem that long ago, but I guess it's six, seven years. She is a fantastic and inspirational teacher. She's been inspiring so many students. I've seen her teach. She does an outstanding job. She helped kind of make the Triple E curriculum, build it out and make it all happen. I'm really excited about her research because we all know that the CO2 footprint for industry is in large measure driven by the use of non-renewable resources. And Abbey is involved in working with renewable resources and making products from those. So I want to thank ABE for working with us when we hired Abbey. And it's really an honor and a pleasure to introduce Professor Abigail Engelworth. Alright, well thank you John, Nate and Maung. I know you're important when you get three people to introduce you, right? So I want to thank you for the opportunity to come talk today. I'm very excited. As you can see from me, value-added recovery is on the horizon. It was very obvious to me. My husband was like, what is that last night? So that's my little play. I'm learning now that Twitter actually has some academic sustenance. So if you are so inclined, please tweet this out. But I want to tell you a little bit about what I have been working on towards the tenure process and what I kind of see as some of the future projects. So a little bit about my path. I actually started in 2011, so eight years ago, which doesn't seem possible. But I started at the end. I started in November of 2011, so it doesn't really count. You know, there was the holidays in there and all that stuff. So it just was kind of me getting to know campus for two months. But then I started working on the whole tenure process. And the first part was, what on earth am I doing? What am I supposed to be doing? How do I do this? So it took some figuring out how to get students, how to establish the lab, how to mentor students, how to realize that they weren't all little versions of me and that they're all independent people with their own thoughts and opinions. So how do I work with them and how do I manage and make sure that they can be successful? And I've had a number of projects along the way. And I'll talk about a few selected projects. We don't have the time for me to talk about all of them. But once I was a little more established, I kind of got what I'm doing. I understood it. I was able to go after some projects that were a little bigger. And then finally, as a last push to tenure, I was able to get on some even bigger projects and kind of decide where I wanted to go. And then as I'm looking towards the future, I'm looking more at things that are, like Monk said, a little more risky, a little more exciting. So not just kind of every opportunity out there, but kind of taking a little bit of time to refocus and figure out what exactly opportunities are going to be the most fruitful and the most impactful and potentially the most interesting to me. So my research goal along the way has been for value-added product recovery. So that involves finding a product. So what is the product of interest? How do we get at it? And then how much value can it add? And this does not happen with every single project. The techno-economic analysis is a portion of my research that often gets put on the back burner. But I find it to be very exciting because it lets you know what the value-added product could be worth. But it's really hard to do on a proof of concept. So sometimes projects have to be a little more mature before you can add an economic component. A common target that I often go after is something that is eliminated or discarded, material or substance, or a byproduct that is no longer useful. So what I'm talking about is waste. So looking at wasted products or underutilized products, so low-value streams, how do we convert those into something of higher value and recover something useful out of them? So give them a life beyond what they had.  But I'm going after what's called, or I'm thinking of, as more unconventional wastes. So there's both kind of food wastes, so these are industrial food process wastes. So spent in coffee grounds have a lot of nitrogen and oils still within them that you could extract and use. Cacao pods contain antioxidant properties, along with avocado skins, which also contain carotenoids. Ad residues such as bagasse, corn stover, and rice holes have a lot of utility left in them, but they're not necessarily used to their best value, and this is not, like, the best way for everyone to see this. But bagasse and corn stover are often used in the lignocellulosic biorefinery to create ethanol and other products of that nature. And then rice holes contain a lot of silica that can be used for silica nanoparticles, lithium ion batteries, things of that nature. Now while I don't necessarily work on all of these, these are the types of things that I go after. These kind of high val, or high volume, low value product streams. And I just really like this because I want to point out that I've actually been at this for a while. This is the cover letter for my application to graduate school in 2003-2004. I wasn't smart enough to put a date on it, apparently. This was when I was applying to my master's program at Iowa State, and I said that I would like to study how to separate a product out of a waste stream and use it to fuel the manufacture of other products. Well, that was pretty insightful for what 22-year-old me, so way to go. I figured it out right away. But I just like to show this because it really shows that I've kind of been on this path for a while, and it's something that I'm really passionate about. Now when I started out, I was really looking at bio-renewable resources, so kind of the ag residues and the bio-refinery co-products. I've expanded this a little bit more to look at other waste streams as well. So food waste, using soybean oil for a higher value product. So not just bio-refinery wastes, but other products as well. So I've kind of expanded that. So in traditional processing, you have some kind of feedstock that you make into a major product. Along that way, you can take some portion of it, do another side reaction or a side stream, and have a value-added product as well. So that's a lot of what I do. And now it's much more beyond just the biomass area and looking into other waste streams and other sources of carbon. So I want to talk to you about some selected accomplishments. Like I said, if I had talked about all of my accomplishments, we'd be here all day. No one's got time for that. One of my first projects that I did with my first Ph.D. student was recovering acetic acid from corn ethanol. So the goal of this project was to improve the fermentation of cornstover ethanol by removing an inhibitor via liquid-liquid extraction. So acetic acid is a ubiquitous inhibitor, found in all lignocellulosic biomass, and it reduces the amount of ethanol that can be produced. We were able to demonstrate that we could remove acetic acid using ethyl acetate, keep the sugar stream intact, and we were able to improve both the fermentation rate and yield. We threw our model into the National Renewable Energy Labs model in the Aspen process software, and we were able to run a techno-economic analysis. And we found by just adding in our process that you could reduce the minimum ethanol selling price by about 35 cents per gallon. So by adding in this process to take out the acetic acid, we could improve the major product and recover an additional byproduct. I also worked on the recovery of lutein and zeaxanthin from DDGS, which is dried distillers, grains, and solubles. So many acronyms. But there was evidence that DDGS contained lutein and zeaxanthin. Now, lutein and zeaxanthin are carotenoids, which are found often in the human eye, and they're found to the more you have, the better eye health you have. But you have to get them from your diet, so they're not things that you can make within your body. There was initial trials that found that if the chicken feed diet, if it were to be increased in the amount of DDGS fed to the chickens, that the amount of lutein and zeaxanthin in the yolk would increase. So that would lead us to believe that the amount of lutein and zeaxanthin in the DDGS should be fairly significant. But there were no reports at the time as to how much was in there exactly. So we did some experiments and we found that the process to make DDGS, so the corn wet milling process, actually concentrates the lutein and zeaxanthin from where it is in the corn. And this was very significant because this had not been reported yet. But this also lets us know that DDGS is a viable alternative for lutein and zeaxanthin recovery. Many of you may have seen lutein and zeaxanthin on the shelf of your pharmacy. You can buy it, you can take it, you can help your own eyes on a regular basis. It's also added often to infant formula for eye development. But the current source for lutein and zeaxanthin is marigold flower petals. So we were looking to see if potentially if there's a better way that we could get some of these compounds. And then the last project I want to touch on is recovering lactic acid from food waste. So this kind of started me into the research area of value recovery from food waste. So the goal of this project was to use food waste that was inoculated with primary sludge, so wastewater sludge, to produce high quantity and quality of lactic acid. Now lactic acid can be used to produce polylactic acid, which is used fairly regularly and commonly in 3D printing and other plastic applications. And we were able to demonstrate that our inoculation scheme was able to produce up to 58 grams per liter of L-lactic acid and L-lactic acid is the desired form of lactic acid to produce polylactic acid. And we also determined that some non-controlled variables play a significant role in lactic acid production. And what I mean by that is that researchers were looking into this but they were holding a lot of things not constant. So some researchers would get their substrates, so their food waste, and they would freeze it and then they would use it later. Some would get their food waste, they would not freeze it and they would use it right away. Some would use continuous versus intermittent pH control. And we found that these factors actually played a really significant role on how much lactic acid is produced. So we published that as well and it's been getting a lot of attention. But what's next? What's on the horizon for me? I see a lot more going into the area of food waste. This is becoming a pretty significant problem in the U.S. and globally. There's a lot of food that is discarded and it's not just food from your household. Though now whenever I see it I'm always like, oh gosh, that's just waste. But there's a lot of food waste that's produced in the industrial level. So these are things that are not edible anyways.  But they're good sources of carbon. So can we somehow get those and make them into something higher value? This was from a publication I put out last year comparing upgrading of some industrial food waste products using either anaerobic digestion, upgrading straight to methane to be put onto the electric power grid, or into some specialty products. And this paper was also really interesting because within the past year alone in 2019 there were 17 citations that I thought was really cool. But this was looking at how do we upgrade food waste and what are the economic trade-offs between doing a low value, high volume product like methane or some more specialty product. I'm also working with a few researchers across campus on closing the loop on food production. So looking at using food waste to power anaerobic digestion, to create carbon dioxide and methane, to power a vertical farming unit. So how can we use food waste from both the industry and potentially later on collect it from food service and households? How do we, can we use all that and close the loop from other applications? One of the interesting things about researching in waste is that there's not a lot of funding because waste is very low value. But recently I think there's gotten to be a lot more interest in the area which I think is really cool and I've seen more calls from government agencies looking at specifically food waste and other waste as well. So I see a lot going in this area which is why I'm excited that I've kind of set myself up to go more into this. In the end what I'd like is to be able to sell my own little widget on Amazon too. So can I find a waste product, make it into something really cool that you want to buy potentially four at a time? I don't know. But I thank you for your time and I hope that was helpful and I'll have time for any questions. All right, thank you Abby. We do have time for questions from the audience. Oh man, it was that good. Thank you. Thank you for the presentation. So could you go back to the beautiful diagram you showed before? Are you focusing mostly on the one before? Please? Yes. Are you focusing on the west from the industry alone or is there any way to improve or we can utilize the west that come from the household or because I think it pay a really big contribution. So initially we are focused on industrial food waste and that's for a few reasons. One, it's easier to collect and get after. Two, it's more homogenous so you can do a little bit more with it. And we've also had pushed back some, we submitted a proposal and one of the reviewers thought that we were going after, it didn't say this anywhere but they just got it in their head, but that we were going after household waste, which they said that we would then encourage people to waste more food, which is just silly but there's a public perception within there. If we're going to do stuff with food waste then it's fine if I don't eat it or if it's fine then if I don't use it. So I think there's a lot to do in that area but I think getting to the household waste, it's going to take a while. Hold on, I'm sorry.  So my research has led me to create my own compost pile at my house. After everything that I've done I realized that I wasn't composting and that I really needed to be. So now I compost. It's mostly just coffee grounds, just in a bin. But I think there's soil in there, right? There's lots of bugs and stuff. It's just emptying stuff into the compost is like so annoying. But it's made me realize that that has to be done. In West Lafayette at least there is some anaerobic digestion that happens so when you do put food down the drain and put it in your three-year garbage disposal and it goes to the treatment plant stuff does, good stuff happens with that. But when you throw it in the landfill that's not great. It then creates methane, CO2, all that from the landfill whereas that can be used, you can get that somewhere else and that would be better use. So if you can, community composting would be great. So I'm Eckhard Kroll from ME. Why are we so far behind in this in the U.S.? If you're in Europe, especially in Germany where I'm from, food or the whole waste separation is a common. It's a must. You actually get fined by your local community if you don't separate your waste and have everything that's compostable in a certain pile and then only that what needs to go into the landfill really needs to go to the landfill. So it takes a change of culture but how do we change this culture? I can tell you, I composed everything in my home in my backyard. I just dump it, but anyway. Maybe not the best way to do it. You're right. It's going to take a cultural shift and one thing I think that's really hard about the U.S. is we are a really big country. I mean, Germany, it's very small comparatively, right? So if you want to implement something there, it's almost in some ways easier to do because you're very small, but U.S. is very large and we cover a lot of geographic areas, a lot of different weather patterns, a lot of different cultures even within the U.S. So I think that is a question to bring on some social scientists to help answer because I don't know how to change the culture. I think there's going to be a lot more education and required about why people should be treating their wastes a little differently. And I'm not necessarily sure how to do that, but I know doing some research and driving the economic value of waste in a different direction would be beneficial. There was a hand over here. Is there another question? Oh, yeah. Oh, what? It's for the live stream. Yeah, I had a question about how you mentioned that marigolds are currently the only source. Are there other sources that you have come across? Oh, yeah. So a lot of the foods you eat contain lutein and zeaxanthin. So most foods that are either yellow or orange in color contain it. So bell peppers are great sources. Corn, other foods that are yellow that I can't think of right now. But also like kale and spinach, they have everything in it, so I think it's just to eat a lot of that. That's not a great commercial source for that because those are also really high value foods, so we're not going to necessarily extract it from something like that. But marigolds, it's there, and marigolds are pretty low value and easy to grow. Not necessarily easy to harvest for this type of application, but it's a high enough value product that it's done. Yes, Craig? Great job, Abby. So you focus primarily on crops, but is there an animal processing component, animal byproduct component that you're also interested in? Yes, but I haven't gotten there yet. I've mostly worked on the plant matter. The animals are a whole different ball game for me that I haven't gotten there yet. I decided not to go with the beast analogy, so... My question is maybe a bit outside of your work, but since you're working in a waste, how do you see the U.S. projection or in the future after the Chinese recycling 2018 stopping contract, how do you view the U.S. solution in the future? So I think that's going to have to be a cultural shift as well, and I don't know how to solve that problem. You're right, it is outside my scope. It's something I'm interested in just as a citizen of the planet, but I don't know how to solve that problem. But I think we're going to have to change how we interact with products that we no longer value as useful, and I don't know what that is, but it's something to definitely look forward to. All right, let's thank Abby one last time.


everyone it's your girl Kenzie here from Layton Sports Cards and I'm ripping a 22-23 Panini contenders basketball hobby four box break number 20 pick your team got Adam K. Pistons Andrew G Thunder Blake H. Cabs Brian M. Bucks Chang S. Celtics Chihuahuan C. Magic and Blazers Chris C. Sons Chen Wei W. Mavs Daniel C. Raptors Edward P. Heat Ziko M. Nets Jeffrey C. Hornets Harper B. Kings T. Wolves Human H. Pacers Jeremy T. Clippers John B. Nuggets Mike Y. Grizzlies Richard R. Lakers Ryan L. Pelicans Ryan S. Rockets Scott N with the Wizards and Spurs Steve R. Sixers and Warriors Warren L. Jazz Young S. Hawks Yusung J. Bowles and Zachary A. Nicks all right best of luck here we go um Personals tonight Matthew will be over on drip Kyle will be on drip at five got group breaks during the daytime and at night Kyle will be on drip at five you can always pop into the drip app and ask him if you ordered it for rip on YouTube he can rip that on drip for you column Anthony the RJ Barrett season ticket so Mike how's it going Kyrie got lottery ticket Agbaji for the jazz and we've got a Blake Wesley on the rookie variation playoff ticket Spurs on that one pulled the cracked ice redemption out of the last break Bacell and Yanis and we got eight teams on the next one that's going to be the last contenders for the daytime got jazz Colin Sexton the 249 D. Wade Carmelo Anthony got Mitchell Yolkich and Hayward last contenders of the daytime Benedict Mather and rookie of the year uh Anthony Edwards uh James Harden next auto up we've got a Kennedy Chandler for the Grizz Memphis taking home that auto Steph Curry and Nurkitt Lillard Beal we've got Pacers uh Chippin uh conference final sorry to 75 Tiger East Halliburton superstar die cut LeBron James uh lottery ticket Chet Holgren they've got Mike Conley KD and Chris Paul uh Matthew it um no it's it's fine uh drip is another app that we use a different platform to rip personals you can either download the app on your app store with your phone or you can go to on your web browser drip shop dot live Westbrook James Harden uh Cal will be on at 5 p.m. Eastern time there to 199 to Marta Rosen bowls ticket Lillard we've got die cut superstar of Yanis Chris Paul Carl Anthony Towns in John Moran yeah Timothy he's a hard pull out of this I pulled a cracked ice the other day which was a you know a huge car and that's the only one that I've seen of him Jeremy Sochin on the allottery ticket Kyrie Steph Curry ticket up to the hall we've got rookie Otto of Wendell Moore Jr. for the T Wolves Wendell Moore Jr. got Brogdon and Jalen Sucks Trayman Kominga we've got Lakers AD playoff ticket to 249 random for this verse John Morant Giddy Sabonis and Paul George last pack here box two Ingram Deontane Murray we've got Jaws season ticket LeBron ticket to the hall Jalen Williams rookie of the year we have playoff ticket for the Bucks 22 of 99 Marjan Bochamp a walkie marking in and Miles Turner three okay let's see where we are we're sold out looking at 21 Nets Bowles Cavs Clips Nick Sixer Sons and Raptors still eight teams left let's get that one filled up that breaks right after this eight to go on the last contenders of the daytime Johnson um Franz Wagner we got Nets playoff ticket Ben Simmons to 249 sweet shot Yokech tickets to the hall Kyrie Zion de Rosen go there Ben Simmons Jalen Green like Baji lottery ticket got D Wade Carmelo Anthony a rookie Otto of musta Diabato for the Clippers on the Hall of Optic Diabato clips do for a gold vinyl man SGA and Jimmy Butler that'd be nasty I haven't seen one of those yet Kauai Christian Wood got semi-finals ticket and for any Simons to 99 Blazers Benedict Metheran rookie of the year got Anthony Edwards Halliburne Desmond Bain Evan Mobley and Bede Booker they've got Booker season ticket James Harden another LeBron die cut here got legendary here that's gonna be a Hakeem Alajuan 18 to 25 nice Hakeem the dream for the Rockets some cool vet uh vet autos out of this stuff Kyrie and Bama to bio last box here y'all last box in bead Booker got James Harden die cut LeBron again for the Lakers lottery ticket Shet Holgren we've got contenders Otto to 49 Andre Drummond for the bowls ad and Zion Williams Simons heeled got bold Zach Lavigne to 249 sweet shot to Jordan pool tickets to the hall Paul Cassone DeMar DeRosan Rigo Bayer SGA Ben Simmons Jalen Green we've got cracked ice to 25 rookie of the year Christian Coloco for the Raptors gosh the cracked ice looks so sick nice one there D Wade we've got ad ticket to the hall and we've got a Jabari Smith jr 36 a 99 playoff ticket here you go Houston that one's going to Ryan S man Ryan is killing basketball today at the short print night move out of Don Russ and now a Jabari Smith jr we'll nag that one for you Ryan wise man hardaway jr last pack why Christian Wood we've got uh Mike Conley on this shimmer numbered on that one first one of those I've seen rookie of the year by Nick Mathurin sweet shots Anthony Edwards got D Fox Julius Randall and John wall all right there's solid break there do a quick recap contenders Otto for the bowls Andre Drummond to 49 legendary Hakeem Olajuwon for the Rockets to 25 Wendell Moore jr T Wolpes Kennedy Chandler Grizzlies Marjane Bochamp to 99 bucks the Opticalo Musa Diabate for the Clippers Blake Wesley Spurs on the playoff ticket and Jabari Smith jr 36 of 99 playoff ticket for the Rockets all right that'll do for 20 we've got 21 coming up next thanks everyone


It's already the first five minutes of the room. Did you do that? No, no, no, I didn't do that. But I'll see that in five seconds.


Kompas Guiding Safe Migration Hi, my name is Diyo Jin, Monitoring, Evaluation and Learning Officer for IOM as part of the Kompas program. Hi Tio, this is James from IOM Nigeria. I sometimes get asked how we know if what we are doing under Kompas actually works. I heard that the Kompas team recently developed a monitoring, evaluation, accountability and learning guide for the program. Can you tell me more about what that is? Hi, James, I'm glad you asked a monitoring, evaluation, accountability and learning or meal guide defines a process through which we learn whether what we are doing is making a difference. As we implement Kompas program, it is very important to understand which interventions are working well and which ones are not. This is how we learn and adapt our approach as we go along. It is necessary to identify what requires change, what the expected change will look like and finally how such change can be achieved. Through Kompas, we aim to guide safe migration and empower migrating to contribute to sustainable development in their communities. The meal guide therefore is the Kompas that keeps the program on track to reach the target objective. I can see why it's useful. What exactly are we measuring under the Kompas meal guide? Good question. We are measuring community level change, individual shift in attitude and behavior as well as change in knowledge and level of satisfaction with the services. We also look at whether the interventions adequately meet the need of beneficiaries. The meal guide defines indicators like signposts that help us know if we are on track to reach our objective and define how we recognize success or failure. So we can adjust as we go along. I feel like I've got a lot to learn about all of this. That's okay. Learning is part of the meal guide. You can find a basic overview on our website www.im.int forward slash Kompas and if you are looking for more detailed information for you or your partners send us an email at Kompas.im.int. We are using monitoring, evaluation, accountability and learning to guide safe migration better together. Thank you for watching. Kompas, guiding safe migration.