Hello and welcome. I'm Lynne Freese, producer of Global Political Economy, or GPE News Docs. This is part three in the concluding segment of a conversation with Prabhat Patnaik. He's talking about his read on the history of capitalism, that he breaks up into five periods from colonialism into the present, and how imperialism, which existed in the colonial era, persists to this day and the system cannot do without it. Topics sourced from a new book, Capital and Imperialism, Theory, History and the Present, authored by Prabhat Patnaik and Utsa Patnaik and published by Monthly Review Press. A world-renowned economist, Prabhat Patnaik is professor emeritus at the Center for Economic Studies and Planning at Jawaharlal Nehru University in New Delhi. Earlier books by Prabhat Patnaik include accumulation and stability under capitalism, the value of money, and re-envisioning socialism. Professor Patnaik, welcome and thank you for joining us. Thank you, thank you very much. We're going to pick up the conversation where we left off. Let's start by going deeper into what happened to the world economy and the era of globalization for the first time in the history of capitalism, and how all this fits into your read on the history of capitalism into the present, so the fifth of five periods, the current period of protracted crisis. Throughout its history, capitalism had this remarkable feature that it actually kept the entire world segmented in the sense that there was a diffusion of capitalism in the temperate regions, but there was no diffusion of capitalism in the sense of capital shifting from the global north to the global south. That means investment occurring from the global north to the global south, because after all in the global south, for reasons which have to do with de-industrialization under colonialism, there's huge unemployment, huge reserve army of labor because of which the wages are close to subsistence level, and the wages are close to subsistence level, then it would be profitable for capital to invest in the global south using exactly the same technology of production for meeting global demand that actually then they start investing producing in the south using the labor of global south which is much cheaper for producing for the entire globe, but this did not happen. Had this happened, then the gap between the north and the south wouldn't have been so pronounced, the gap in fact shouldn't have been there strictly speaking because of the fact that capital is globally mobile like inside a country, similarly in the world as a whole if it's globally mobile, then it would have the tendency to equalize wages all across, but that did not happen. Why that did not happen is an extremely important question, but certainly historically it did not happen. Because of that the wages in the south continued to remain low and labor from the south as I was saying was not allowed to move freely to the north, therefore the wages in the south continued to remain close to a subsistence level while in the north because investment was taking place because labor productivity was growing, there was an increase in real wages occurring as well, therefore you had a divergence of wages, northern wages kept increasing, southern wages kept remaining at a subsistence level. That is the genesis of this segmentation, that is the real kind of gist of this segmentation. Now what has happened in the current globalization is that to some extent that is being overcome because now capital from the north has started moving south to locate plants in China, in Vietnam, in Indonesia, in Malaysia or to locate service sector activities for instance in India. You have call centers in India which actually do the same job that normally in the US these jobs will be getting performed, but the wages there are much higher compared to the wages here, so it's much more profitable to shift that kind of service sector activity to India rather than to retain it in the United States, so for all these reasons a whole range of activities are increasingly being shifted from the north to the south and that is a unique feature of the contemporary globalization. To the extent that happens then that difference in wages which had existed certainly does not grow and what is more there is some tendency for the wages also in the north to come down. Stiglitz made a calculation according to which if you compare the real wages of a male American worker in 1968 with the real wages in 2011, average male American worker then in 2011 the real wages were marginally lower than in 1968. Now obviously it does mean it has been falling all through or has been stagnant all through, it had gone up but hopefully it has come down somewhat. It's still much higher than what you find in the south, there's no equalization of wages but there is a pressure on northern wages. Let us say therefore that the kind of different wages or if you like the vector of wages all over the world does not go up. It's more or less given, more or less fixed in this period of globalization. But on the other hand labor productivity is going up everywhere. If labor productivity goes up but the real wages do not go up in that case you find that the share of surplus in output increases everywhere. It's like a distribution from wages to surplus, wages to profits. But of course if a hundred dollars are shifted from wages to surplus, if they were part of the wages all of the hundred dollars would have been consumed but if they are shifted to surplus then let's say only fifty dollars are immediately consumed within any given period therefore there is an overproduction of fifty dollars worth of goods because demand has gone down by that therefore there is a tendency towards ex-anti-overproduction which this phenomenon of globalization generates because of the fact that it is actually making workers everywhere including northern workers compete against southern workers who have an albatross around their necks in the form of the huge labor reserves that have been generated because of colonial de-industrialization. So these labor reserves now begin to affect northern wages as well. They cannot go up with productivity and therefore the surplus rises everywhere in the world economy as a whole and there's an ex-anti-tendency towards overproduction. I see you note in the book that this rise in surplus and the distribution between wages and surplus in the world economy as a whole shows up in the inequality of income distribution in most countries established by Thomas Piketty and other researchers. You know people like Piketty who actually document this increase in income inequality do not see the increase in income inequality as arising from this reason. They use all kinds of other theoretical frameworks which I don't go into but those frameworks assume full employment and so on which are really not realistic assumptions. Their work is important because the document is increasing income inequality everywhere in the period of neoliberal. Well that gives us a broader perspective on overproduction crises and capitalism and how the tendency to overproduction was unleashed by globalization. Comment more on what you call desegmentation. Corporate media reports that globalization and outsourcing from north to south made the global south a beneficiary of growth and development. What are your thoughts on that? Firstly I should make it clear that desegmentation which means the coming over of a lot of activities from the north to the south does not mean that south is developing. It is not that the third world countries as a whole are actually witnessing development by the way which is the standard thing that all breadth nodes institutions everybody says that all you know globalization has brought about a high growth rate in the south. That high growth rate is something that is not giving rise to an improvement in the conditions of the bulk of the population in the south because the hiatus now is within the south. The dividing line is now no longer between the north and the south but it has now reached within the south. The dividing line is within the south between a segment of the population who are the beneficiaries of globalization and those who are integrated with international finance capital which consists of the monopoly capitalists, big capitalists and so on on the one hand and segments of the upper middle class that that are beneficiaries that are attached to this big capital and the rest of the population consisting of peasant agriculture, laborers, urban workers, craftsmen, fishermen and so on so that you know petty producers, peasant agriculture is laborers of various description. They are the sufferers from this globalization so it is wrong to say that globalization has benefited the south. No globalization has basically meant a shift of some activities to the south of which there are there's a small segment of the population in the south that's the beneficiary but the rest of the population are actually sufferers. As a follow on to that comment on how growth theory in mainstream economics is concerned with accumulation through expansion whereas you point out that what you call accumulation through encroachment is a hallmark of contemporary imperialism and a direct result of neoliberal policies. Explain that. So I draw this distinction between accumulation through expansion and accumulation through encroachment. Now suppose you have a certain amount of capital let's say capital is in 100 blocks, each block grows by 10% because each block makes some profits out of that profit the investors in the market it grows by 10%. Now that's obvious that is what economic theories all the time talking about they look only at accumulation through expansion. All growth theory in economics is concerned with that accumulation through expansion. The amount of capital stock it increases because of the investment decision. In addition to this there is what I call accumulation through encroachment. Now that accumulation through encroachment can be let us say the public sector units are being privatized. So the private capital stock is rising not because they have made investments not because they have made physical investments but because they have just bought up the public sector units so that taking the economy as a whole there is no increase in the capital stock but taking the private capital stock there is an increase and this increase is what I call through encroachment. Similarly if you have private capital that displaces small producers. Now you don't necessarily take over the exact physical assets of small producers but the market that the small producers had occupied or catered to is the market which now accrues to the big capital and the big capital therefore you know occupies the space that the small producers small capitalists were. So that is again an example of accumulation through encroachment. Now under neoliberalism because of the fact that all obstacles to accumulation through encroachment are removed peasant agriculture is no longer supported or defended by the state. Similarly small capital is not necessarily defended by the state. Similarly public sector units are actually privatized to actually find that the scope for accumulation through encroachment increases considerably. So that increasing scope for accumulation through encroachment also means growth by appropriation of what had been common resources. Yes that's a classic example of accumulation through encroachment and that goes back a long way that began in the 16th century enclosure movements in Britain. So the 16th century enclosure movement meant basically that the commons were appropriated by the big landed states and because the commons were appropriated by the big landed states the land they had increased but at the same time the small the peasantry you know had access to commons and because they had rights over the commons they actually managed to kind of you know a whole lot of commodities were garnered by them from the commons but because the commons were appropriated by the big landed states they cease to have that access anymore because the commons got enclosed and that being the case the small peasant's economy became unviable many of them had to abandon agriculture and become laborers. So the the enclosure of the commons is a classic example of accumulation through encroachment. The mistake which is often made is to assume that this is something which only is confined to the period of birth of capitalism but once capitalism gets born then it only proceeds through accumulation through expansion but no this phenomenon of accumulation through encroachment is a phenomenon that lasts throughout the history of capitalism. You argue this phenomenon of accumulation through encroachment lasts throughout the history of capitalism. So staying with the case of encroachment on peasant farmers talk about what's going on with peasant farmers in India and the broader implications. You know there's a huge agitation going on of peasantry in India at this moment it's going on at this very moment big agitation this agitation is against three farmed laws that our present government has brought in and these laws will basically allow agribusiness to encroach on peasant agriculture through contract farming but contract farming is a way whereby they actually put the squeeze on the peasantry and ultimately the peasants are worried that they will lose their lands and simply become laborers or lands cultivated by big business. We always used to think that the peasants produce let's say food grains higher food grain prices would hurt the laborers I mean hurt the industrial workers so we always thought that there is a conflict of interest between the peasants on the one hand and the industrial workers on the other and a conflict which had to be managed by the state coming in through food subsidy and so on but now what we find is that if peasant agriculture is getting squeezed then peasants actually migrate to cities for jobs because they are not viable anymore as agriculturalists when they move to cities as jobs for jobs they actually don't get jobs they're not that many jobs so they swell the reserve army of labor or a given amount of work is distributed among more people and even the organized that is unionized industrial workers bargaining strength goes down so you find that the distress of peasants gets translated also into the distress of the urban workers so there's a commonality of interest there it's in the interest of the urban workers to make sure that the peasants are not displaced are not distressed so it's it's a commonality at both ends and under neoliberal globalization for the first time in the history of capitalism as you commented earlier distress among workers in the global south gets transmitted into pressure on wages and so bargaining strength of workers in the global north so comment more on your argument that globalization under the hegemony of global finance capital so basically what we refer to is neoliberal globalization is at a dead end it is clear that the world cannot be where it is this prolonged crisis is having very important implications in the capitalist world because of which something needs to be done urgently about it one important implication of this prolonged crisis is in my view the growth of neo-fascism neo-fascist movements are arising everywhere India a little bit Poland Hungary even the United States and the Trump you look at Britain UK you look at Marie Le Pen France you look at you know Germany AFD Brazil Bolsonaro everywhere there is a strengthening of neo-fascist movements now the strengthening is obviously something which gains from you know I mean it profits from the increase in unemployment because neo-fascist movements as marginal phenomena exist in all modern society but they're moving center stage aided by monopoly capital because monopoly capital feels threatened in a period of crisis it's legitimacy social legitimacy goes down therefore it actually uses the neo-fascist movements in its own interests they help in very many different ways they change the discourse in India today the idea of the government is not to continue with a discourse of people's living standards it's to do with accentuating the division between Hindus and Muslims everywhere neo-fascism targets the other changes the discourse we one against the other it occasionally even explains the crisis in terms of the other that the Chinese are stealing jobs from us the Mexican are stealing jobs from us all this poses a very serious threat to the socialist structure of capitalism that being the case there is now a certain urgency that even the liberal bourgeois elements in capitalism face in order to do something about the crisis and it's in that context that some of the moves which are being made today have to be understood one of these moves is the fact that you know that now there is an effort in the United States to revive a kind of Keynesian policy because the United States is less concerned than the other major capitalist countries about pleasing globalized finance because globalized finance considers it its home base and therefore there is not going to be huge capital outflows from the United States elsewhere because United States is safest place currency is as good as gold and therefore you will not find capital outflows the same way that you would find from other capitalist countries so US has a degree of freedom some leeway but anyway the US fiscal deficit is going to increase and the whole argument is we are there by reviving Keynesian we know that Trump had spent $2 trillion as kind of you know rescue come support package during the pandemic when Biden became president he spent another $2 trillion and now he has come up with another proposal to spend close to $2 trillion $1.9 trillion for an infrastructure plan not confined to a single year but over a period of time now I was saying that Biden is attempting to revive Keynesianism but there is an aspect of it which I want to draw attention to which is not often recognized as I said finance capital which is opposed to Keynesianism if the US is pursuing this may find it difficult to migrate elsewhere and therefore Biden may actually be able to stimulate the US economy but suppose he does that then you would find a revival of inflationary pressures already oil prices are rising and the IMF today has said today that actually in the US inflation is beginning to become now when that happens then you would find that an effort would be made to impose austerity on the third world so that inflationary pressures are kept in check so that the prices of raw materials are kept in check so we may end up having a situation where there is Keynesianism in the first world and austerity in the third world now that is something which is again going to really worsen the plight of the working people presence workers and so on in the third world actually make matters much worse that is something which is a fallout of if you like what the capitalist solution might actually lead to as opposed to this what we are arguing is an alternative we cannot have a global solution in the sense that the whole of the third world suddenly rises up on the whole of the first and the third and every possible world you know the world proletariat and the world peasantry rises up because obviously they have not had joint movements of that kind movements have remained confined to individual nations now that being the case that let us say in India now there is a big struggle of the peasantry that is going on now suppose you could have a struggle of the workers and peasants against the crisis which is engulfing the Indian economy if so then politically this might give rise to the coming into government of an alternative political formation that represents the interest of the workers and peasants if this alternative political formation is going to remain faithful to its constituency then it will have to overcome the hegemony of globalized finance capital therefore it has to delink itself from this web of financial flows by having capital controls that is a necessary condition for the autonomy of the state that we have been discussing that if you have globalized finance and a nation state and in the nation state is caught in the web of globalized finance then of course the nation state cannot do anything other than simply count out to globalized finance but in the nation state is going to do something different then it will have to get out in the web of globalized finance and an important way of doing so would of course be through capital controls that's a form of delinking from globalization the problem is when you have capital controls then you would have difficulties in meeting your trade deficit so you would have to have some trade controls and when you have trade controls then you would have pressure being exerted by the advanced countries through for instance the imposition of sanctions on any government that tries to get out of this globalized regime therefore the transitional difficulties are there but one has to face these transitional difficulties as best as one can and the people of the third world the workers in the presence and so on have to recognize this and they have to be aware of the fact that getting out of this globalization is essential for a new order to come in and when they get out of globalization they would be opposed by the local capitalists it will have to be on an agenda that would actually lead on to socialism it will have to be an agenda that is opposed to the local monopoly capital and of course globalized finance capital and that would necessarily give rise to an alternative trajectory of development that must lead on to socialism that would provide an alternative to ending up in a situation where the conditions of life for vast populations in India and throughout the global south are made much worse under a deepening of subsistence wages a swelling of the reserve army of labor and so on in an ideal world that kind of fallout from first world policy could also be avoided if instead of austerity along with kanesianism first world policy would support and promote third world capacity to increase their supply and so keep prices and inflation down that way yes you know i mean after all uh as i said there are two ways in which prices can be kept down one is by squeezing demand the other is by increasing supply that actually if the petty producers the peasant agriculturists and so on are protected and promoted and encouraged to increase production then of course the inflationary pressures would be kept down and likewise of course in the case of minerals oil and so on which is very important commodity in this country so there are two kind of issues here one is to a large production and of course in the case of oil one has to move out of oil use develop other substitutions on these are complex issues i don't want to go into it but therefore they all that has to be done but for a range of primary commodities which are of an agricultural nature output has to be increased and therefore in an as you said in an in an ideal world the first world should be supporting the third world and third world governments to a large output as a means of controlling inflation but not to impose austerity not to impose income deflation but you say this is actually been the typical method not only earlier even now third world debt is supposed to be rolled over and many of the third world countries went to the IMF to enable them to roll over the debt and the IMF wherever it helped imposed conditionalities and oxfam had studied that out of about 81 such agreements where the IMF you know came to the rescue of third world countries to roll over their debt the conditionalities entail austerity out of 81 and 77 cases so so austerity imposition of austerity is not an idea that has been given up by the Bretton Woods institution therefore the tendency would be to control inflation in the first world by imposing income deflation on the third world while ideally as you say in an optimum world it should have been through enlarging supplies from from the third world by enlarging output which could have by supporting present production petty production and so on I believe that a socialist economy can do that in fact I believe that a very fundamental difference between capitalism and socialism is that capitalism encroaches on petty production while socialism can in principle prevent such encroachments and protect and promote petty production. In commenting on imperialism into the present you say a significant feature of this new phase of imperialism is the squeeze it imposes on the rural economy of the third world countries where the bulk of these countries populations live do you then think that this will be the principal source of resistance to contemporary imperialism well I mean I think okay let me put it this way I believe whether it is in the third world or in the first world the existing crisis requires that overcoming it must be by confronting globalized finance if Biden is following a Keynesian policy then he is also in some sense confronting globalized finance because globalized finance doesn't want Keynesianism so the confrontation against globalized finance or getting rid of the hegemony of globalized finance is a necessary condition for mankind to get out of his present predicament now if in the third world we simply keep waiting then the first world confronting globalized finance and getting out of the current predicament there would simply mean that our burdens would become even greater that's what I was talking about austerity here as opposed to you know kind of the Keynesianism there therefore what we have to do is that we also have to make our own effort to get out of the hegemony of globalized finance now that hopefully would not arouse the kind of hostility from the advanced countries that it has done till now but on the other hand we have to reckon with the fact that it will arouse that hostility and if it does then obviously life become very difficult here but we have faced the difficult life and when in the course of doing so we would be following a trajectory of development that would lead on to social so so I would not say that the struggle is only in the third world I would say the struggle is everywhere people are probably not aware everywhere that there's a common enemy that is globalized finance capital but on the other hand unless the struggle is joined everywhere we may end up in a situation where the first world confronts globalized finance and adopts Keynesian policies but the impact of it is to squeeze the third world even further we are going to have to leave it there in this conversation with Prabhat Patnaik and this look into capital and imperialism theory history and the present Prabhat Patnaik thank you thank you very much and from Geneva Switzerland thank you for joining us in this segment of GPE News Dogs


Good afternoon. My name is David Horvath and I'm a Product Manager at Hacker One. Today I'm very excited to talk to you about Hacker Powered Data, specifically why the most common vulnerabilities aren't what you think they are. A bit about myself, I've generally worked in the security industry for a bit of time. I worked at Okta which is an identity and access management space for four years and I was the first Product Manager hired on at Hacker One. I'm really excited about the work that we're doing at Hacker One. One of the things that gets me most excited as we're focused on real and not theoretical security risk. So one thing that I strongly believe is that data will transform security operations even though it seems like that statement might be often overhyped. And what I mean by this is not that we necessarily need to use AI and machine learning for everything in security, but data can really help us in certain areas. It can help with better anomaly detection, help us make improvements to our scanners and help us make important decisions like whether to patch vulnerability and whether not to. And today I'm going to talk about a somewhat ancient technique involving data and that is counting. Counting has been around for 40,000 years and at Hacker One we've done our fair share of counting on the bug bounty programs that run on our platform. And we think that the day that we have is interesting or can be interesting to everybody and can help us all make better decisions about risk trade-offs. Before I get into those details, I'd love to learn a little bit more about everybody in the audience. So I'm going to ask a couple of questions and if the statement applies to you, please raise your hand. First question, does your company or project have a channel for vulnerabilities to be reported? Cool, that's pretty good. How about a process for dealing with them? Okay, maybe some fewer hands. How many of you know what a bug bounty program is? Everybody, most people. How many of you have one? Somewhat less. And the most exciting question, how many of you have ever participated as a hacker? Okay, we got a few. Cool. Thanks for sharing. So it seems like most of you are familiar with bug bounty in general, and some of you have probably heard of Hacker One before, but here's a brief overview for anyone that doesn't know. At Hacker One, we work with a community of over 500,000 ethical hackers. Security teams can create either public or private programs, which hackers submit real vulnerabilities to. And most of those programs will pay out a bounty to reward and incentivize the hacking on the platform, and those bounties can range anywhere from $50 all the way up to $100,000, so there's quite a large range. And the Node.js community actually runs two programs in Hacker One. This is the program for third-party modules, and there's another program, a core program, for security vulnerabilities on the Node runtime. Both these programs have pretty good activity from our hacker community, and they're helping to keep this community safe and strong. So over time, we found that companies working with hackers is less bleeding edge than it may be used to be. As you can see from the Google search auto-complete results for the phrase, should hackers be? Two-thirds of the responses are related to hackers being hired by companies or them being protected, and only one-third is related to them actually being punished by companies. This ratio was probably flipped even a couple of years ago, and this is really exciting to us at Hacker One, because it means that it's becoming best practice in most industries to listen to hackers and to work directly with white-hat hackers. So Hacker One is in a pretty interesting position. We have lots of cool data. We have 1,700 programs that are running on our platform. Those programs have found over 140,000 valid vulnerabilities and have paid over $75 million in bounties to hackers over the last seven years that our company has been in existence. And I think this is one of the most comprehensive data sets about what types of vulnerabilities hackers actually find. And when a hacker finds an issue, it represents real risk. This is something that a criminal hacker could find and actually exploit today. On the vulnerabilities, we also have some interesting metadata, like what is the skill and performance level of the particular hacker that found it, what severity did the team assess it with, what type of asset was it on, and what type of industry is the program in. So at Hacker One, our mission is to empower the world to build a safer internet, and we take this mission extremely seriously, which is why earlier this year we released the Hacker One Top 10 Volns report. And this is a list of the top weakness types that are found by our hackers and are actually paid out bounties by programs. You can access this full report today on our website, but I'm going to go through a lot of the highlights and the rest of my talk. So here is the Hacker One Top 10. Of note is that companies pay out for cross-side scripting far more than any other vulnerability type. It accounts for over 30% or about 30% of the total bounties that are paid out platform-wide. Some companies we know are not as interested in cross-side scripting because it doesn't always expose user data and mass like other vulnerability types do, but from our data it seems like it's here to stay at the top of the pack. The second most common is improper authentication, followed by information disclosure, then we have privilege escalation, and then SQL injection and code injection. The next one is number 8 spot SSRF. We think that that's going to grow in the coming years as more and more companies move to the cloud. So in the rest of the talk I'm going to dig a little bit deeper into what's behind our top 10 and what implications that has for all of you. So let's start by zooming into cross-side scripting or XSS. As you can see here, not all cross-side scripting volumes are created equal. There are a couple different types. Stored XSS is either a higher critical severity over 33% of the time, whereas generic cross-side scripting is only higher critical about 6% of the time. And accordingly the bounties paid, the average bounty paid to those is pretty different. Stored pays out $481 on average while generic only pays out $288. Stored is harder to find, which means it only accounts for a smaller portion of the total cross-side scripting volumes found. I think it's about like 18% right now. So why does this comparison between the different types of XSS matter? I think it matters because if we look at how often a vulnerability type is found, we can infer how easy it is for a hacker to discover it. And if we look at how highly a vulnerability type is actually paid out, that can imply how valuable a company sees that as being the tangible amount of business impact to an organization. And if we think that risk equals discoverability times impact, then we have some real-world bug data that can help us as we're making risk trade-offs. So in a world where security teams are low bandwidth and also embrace risk, we think this data can help prioritize whether companies need to patch a bone or they can leave it or at a very minimum what needs to be patched immediately and what might be able to wait a couple of days. So another interesting thing that our platform tracks are hacker skills and performance over time. This is Pete Yorsky. He's one of the top hackers on our platform. You can see he's got really good stats. He's a 93rd percentile signal hacker, which means he's in our top 10%. And I was interested to look at whether there's a difference in the types of vulnerabilities that our top hackers like Pete find and whether there's between sort of less skilled newer hackers. Is there a difference? And the answer is yes, there is. There are some differences. So this shows the top bounties awarded split up by our most skilled and least skilled hackers. You'll notice that for both of these groups, cross-site scripting pays out more bounties than any other vulnerability type. I thought that was pretty interesting and surprising. The other thing to note here is that our most skilled hackers tend to focus on pretty specialized and difficult to find vulnerabilities like SSRF, code injection, and IDOR. These typically pay out a lot higher bounties but are more difficult to find, which makes a lot of sense. So another thing that our report looked at were differences by industry. And you can see that there are some differences. For example, aviation and aerospace as a percentage sees three times more sequel injections than some of the other industries shown. But the general trend here is that we see fewer and fewer differences over time between these industries. Over time, aviation and aerospace and probably like travel and hospitality look more and more like the profile for computer software. And we believe this is because the world we're living in now is effectively that most companies are software companies or at least we have core software parts of our products and offerings that make us vulnerable in very similar ways. So I also looked at some trends too. What is the growth or decline in weakness types over time? And we started tracking this in 2017. Before that, our data was not as great. So on the downtrend side are vulnerability types like violation of secure design and CSRF. But probably more interestingly is that our top two vulnerability types cross-site scripting and information disclosure, those have still been on the rise the last couple of years. But the highest growth volume types are business logic errors, IDOR, SSRF, and code injection. And what these all have in common is either they're associated with companies moving to the cloud and there are also things that humans are really good at finding and scanners are not good at finding. So I've talked for a bit of time and you might have noticed that I haven't mentioned the most famous and popular weakness framework, which is the OWASP top 10. I assume most of you have heard about the OWASP top 10 and are maybe fairly familiar with it. And right now it's sort of the security community's only option. And many people sort of for better or for worse consider it the list of weaknesses. But there are like a lot of reasons for a list of things. And if you'll humor me for a couple of minutes, I'd like to talk about music. So there's a very big difference between an editorial list of the most popular or the best musical artists of the year and the most streamed artists on Spotify. For example, at the bottom left you have Kendrick Lamar and Kendrick Lamar received eight Grammy nominations in 2019, more than any other artist, but he was nowhere near the top of the Spotify streaming charts. On the other end of the spectrum, Ariana Grande was the most streamed female artist in 2019 on Spotify, but sadly to some myself included, she only received two Grammy nominations, both of which I don't think she won for. But you'll see a similarity between these two lists and that is Canadian and former Degrassi star Drake. So you could say that Drake is kind of like the cross-site scripting of music. He's both highly acclaimed and highly popular, just like cross-site scripting is popular among the most skilled and least skilled hackers on our platform. I guess what I'm trying to say with this comparison attempt or the comparison is that the OS Top 10 is an editorial list and there are lots of good reasons sometimes for an editorial list, but the Hacker One Top 10 is based off of what we actually see in the real world, which makes it a little bit more akin to the top of the Spotify streaming charts. So here's a comparison between our two lists. You will see a lot of similarities. One major difference is the relative position of cross-site scripting. So at the top of our list, kind of middle of the pack on the OS side. So I'm going to dig into the data a little bit on our end, but as an ethical data minded product manager, I wouldn't be doing my job if I didn't explain that there are some limitations in the data that we do have. The first is that there's selection bias on behalf of the programs and hackers that we looked at. These are all companies or organizations that have programs on Hacker One, which mean that they're probably a little bit more security conscious than your average organization. The other assumption that we're making is that the types of vulnerabilities that white hat hackers find are the same or similar to the types of vulnerabilities that black hat hackers find. We think that this is probably a reasonable assumption to make, but wanted to call it out. So with those two caveats, I'll get into some more comparisons of the data between our list and the OS top 10. So I think this is one of the most interesting charts in the deck. And it shows the market share for vulnerabilities found or the discoverability of them as classified by the OS top 10. And what you can see here is it shows that of all of our bounties that were paid out on the platform, the OS top 10 has a coverage rate about 50%. That's pretty good when you think about it one way, but thinking about it in another way of 50% covered means that you're 50% uncovered. If you only care about the OS top 10, that's maybe not so awesome. On the other hand, the hacker one top 10 matches 90% of the vulnerabilities that are found on our platform. So this chart is the same idea, but instead we're looking at the market share of bounties paid, not just vulnerabilities found on the platform. And here you can see that the OS top 10 coverage is even higher and it's at about 30%. For the record, personally, I thought this was surprisingly high coverage. It was great. But again, 70% covered means 30% uncovered. So how great really is that? A couple of other things to note on this graph that are interesting are even though cross-site scripting is on the rise overall, its market share of bounties paid is declining over time and compared to all the other options. And then you'll see a little green blip in 2018, and that is XXE, and I will get into that vulnerability type in just a couple of minutes. So another question I had was what do programs pay out a lot for that's not on the OS top 10? Those vulnerability types are CSRF, SSRF, Open Redirect, and IDOR, and conversely, what is in the OS top 10 that is much lower down on our list? And that's XXE and security misconfiguration. So I wanted to understand a little bit more about the disparity specifically with XXE, so I will get into that. XXE stands for External Entity Processing, and it's been on the rise over the last couple of years. It's that purple line at the very bottom of the graph. It's been doubling over a year since 2016, and it's gone from pretty much nothing to a little bit of something showing up on the graph. It's not an often found vulnerability, but when it is, it's almost always a higher critical vulnerability based off of impact, and it's our highest paid bounty type on Hacker One, coming out to 1600 US dollars a pop. A hacker has to have a lot of skill to find an XXE vulnerability. Typically when they do, they can find it in a number of places, which is why we see a lot of our top most skilled hackers specializing in this type of vulnerability. But it's this lack of discoverability, which probably accounts for the reason why it shows up on the OAS Top 10, but doesn't show up on the Hacker One Top 10. And what this difference really underscores is that not all vulnerabilities are created equal. We typically look at things like the technical exploitability and the severity and the impact of a vulnerability, but we also need to consider its hacker discoverability. Just because a volume is technically exploitable does not necessarily mean that it will actually be exploited by a criminal human hacker. And what this means is that what scanners find is very different than when hackers find human criminals use hackers or use scanners too. So we're not saying that they're useless. They definitely have their time and place. But more generally, what's the point of sharing all this information about the data we have? Why does it matter to you? And I think it matters because data can lead to better conversations with development teams. We run a survey of our customers every year and 90% of our customers say one of the most important things for them to be successful is for them to have a better relationship with their development teams. We find that even if security teams know what to patch, they can't necessarily always get the buy-in for the development teams to work on it. Typically, the security development team conversations go something like this. They say, hey, you've got to patch this now. It's important, and the development team comes back with. Well, you say that every time. How does this fit in with our current priorities? And what we really want to do with the data that we have is to enable some mutual understanding between these teams. So the conversation goes something more like this. The security team says, hey, this vulnerability is highly exploitable by a hacker of low skill. And when exploited, it's often critical and impactful. And the development team says something like, hey, I understand. We'll fix it today. So we hope that with this better understanding comes ownership and with ownership comes patching, if not everywhere, at least towards most needed. Thanks for listening. That's all I had. I have a couple of minutes for questions if folks have any. Thanks. Any questions? The folks that are hackers, do you have anything to... Oh, cool. Well, when you're done with your course, check this out. Yeah. Yeah. For companies that use our product, they can track, or even you, you can track what types of vulnerabilities you're receiving are the most common. We have some details around what those are typically found by. So we expose some of that in the product to customers to help them make better decisions.


T. F. N. N. headline news update. Good afternoon everybody I'm Tommy O'Brien coming to you live from T. F. N. N. 4 p.m. Eastern time as we reach the closing bell markets finishing in negative territory and the market awaiting Amazon earnings and Apple after the bell right now though Dow closing it out around 300 points in the negative that's 1.2% trading twenty four thousand three thirty one S. and P. is finishing twenty seven points in the red nine tenths percent negative at twenty nine eleven Nasdaq finishing only twenty five points in the red it's about a quarter percent at eighty eighty nine in the Russell down forty four points or three point two percent two of the biggest culprits to that were Amazon and Apple check out the acceleration in the last fifteen minutes of the day as you had Amazon trading from twenty four thirty seven up to twenty four seventy five and Apple shares getting a boost as well as the final fifteen minute bar from two ninety one up to two ninety four fifty three quite a move in both of those equities jumping back to the charts jumping over the commodities before we jump to the stories your action in crude oil check out that acceleration above nineteen dollars right now to finish the day at about nineteen oh two go contract pulling back today at sixteen ninety five we've got natural gas contract EIA inventory today natural gas catching a bid at one ninety three jumping through the indices S. and P. five hundred as you see traded down for most of the day then since about noon hanging out at these levels of twenty eight ninety four Nasdaq one hundred little bit of a different story eighty nine thirty three right near those lows of eighty nine ten Dow thirty twenty four thousand one eighty two and checking back if we got any news just yet we'll jump over AMZ and there's your volatility folks their numbers are out and you have Amazon dropping a hundred dollars in the span of a heartbeat from twenty four seventy five down to twenty three seventy five and we'll get the numbers maybe before we wrap up here as we wrap up and jump back to what the market was looking for for Amazon numbers there's your action here's what we're looking for seventy three billion is what they're looking for at six twenty five a share and maybe we'll get into the numbers the market reacting give or take Amazon check out that volatility it should be a cool afternoon tomorrow's trading day Amazon look at that action now trading twenty four twenty five who knows where we end up with by tomorrow morning at three a.m. and Apple shares still awaiting those numbers at two ninety three oh six thanks for joining us folks stay tuned we're gonna have a replay of Steve's program he just did earning season should be an exciting day tomorrow as well I'll kick things off at eight thirty in the morning for the morning market kickoff have a great night


Jinjin State High School, above and beyond. Focusing on the belief that all students can succeed, coaches work one-on-one with middle-faced students in local primary cluster schools, as well as in junior secondary at the high school. Literacy and numeracy needs of future Jinjin State High School students are identified through weekly tutorials in years 6 and 7. Last year at the school's year 9 students topped the North Coast region in Naplan writing. Now above the literacy and numeracy benchmarks for the state, students are on their way above and beyond.


Live from Las Vegas, it's theCUBE. Covering VMworld 2017, brought to you by VMware and it's ecosystem partner. Welcome to VMworld 2017, this is theCUBE. We are live in Las Vegas on day one of the event. A really exciting high energy general session kicked things off. I'm Lisa Martin with my co-host Stu Miniman. We're excited to be joined by two folks from VMware. We've got CUBE alumni, Jan Bing Lee, Senior VP and GM of the Storage and Availability BU. Welcome back to theCUBE. Good to be here. And we've also got Matt Amder, your first time on theCUBE, Principal of VMware Chief Architect. Thanks for having me. We're excited to have you guys here. So, waiting with baited breath, a lot of folks have for what our VMware and AWS going to actually announce product-wise. Really exciting to see Pat Gelsinger on stage with Andy Jassy today. Talk to us about as the world of hyper-converged infrastructures changing, what does VMware cloud on AWS mean for not just VMware customers, but new opportunities for VMware? Yeah, that's a great question, Lisa. Let me get it started. You know, I think my biggest takeaway from the exciting keynote, a couple of things. One is private cloud is sexy again. You know, so we've been talking about cloud a lot, but there is so much opportunity and tremendous growth associated with private cloud. And certainly hyper-converged infrastructure being the next generation architecture shift is going to drive a lot of the modernization of our customer's private environment. So that's sort of very exciting. The other aspect of the excitement is how that same architecture and consistent operating model is extending into the cloud with our AWS relationship. And this is also why I have my colleague, Matt here, because he's been the brain behind a lot of the things we're doing on AWS. Yeah, thanks so much, Ann Bing. And I tell you, for years it was like, ah, storage is sexy, storage is hot. Cloud's kind of sexy and hot. So we found a way to kind of connect storage into that. Matt, a lot of people don't really understand what happened here. This isn't just, oh, we're not layering VMware on top of the infrastructure as a service that they have. Last year we kind of dug in a little bit with Cloud Foundation, talked to us, what did it take to get this VMware cloud onto AWS? Bring us inside a little bit, you know, the sausage making, if you would. You know, I think Andy talked about this a little bit at the keynote this morning where it's really been an incredible collaborative effort between both engineering organizations. And it's taken a lot of effort from a huge number of people on both sides to really pull this off. And so, you know, as we started looking at it, I think one of the challenges that we faced, and Andy mentioned this this morning, was there was this really binary decision for customers. If you had vSphere workloads, you wanted to bring them to the public cloud, there was nothing that was compatible. And so we really sat down with Amazon and said, okay, how can we take advantage of the physical infrastructure and scale that Amazon builds and provides today, and make it compatible with vSphere? And if you look at what we've done with vSAN on-premise as an HCI solution, it's become a sort of ubiquitous storage platform. And it offers customers an operational and a management experience for how they think about managing their storage. And we can take that and uplift it in the cloud by doing the heavy lifting of how do we make vSAN run, scale, and operate on top of AWS's physical infrastructure. One of the things that I found was really interesting this morning was seeing the, I couldn't see it from where I was sitting, the sort of NASCAR slide of customers that were in beta. Talk to us a little bit about some of the pain points that you're helping with the VMware cloud on AWS. What are some of those key pain points that those customers were facing that from an engineering perspective, that you took into the design of the solution? Sure, so I think if you look at it, some of the benefits that we see of public cloud infrastructure that our customers really want to take advantage of are flexibility and elasticity, right? One of the challenges that you have on-premise today is if you need new hardware, you have to order it, it's got to ship on a truck, someone's going to rack it and hook it up. And if you're trying to operate and keep pace with your competition and you have a need to allocate a lot of capacity to drive a project forward, that can be a huge impediment. And so what we wanted to do is make it really easy for our customers to configure, deploy, and provision our software. And so one of the really interesting things about VMware Managed Cloud on AWS is that it's a managed service. So some of the things that, you know, we've talked about VCF and the things that we've done on-premise to streamline physical infrastructure management is taken to the next level. Customers don't have to worry about managing the VCF software life cycle. VMware is now going to do that for them and Amazon's going to manage the physical infrastructure. And that removes a lot of burdens and gives customers the opportunity to focus on their core business.  And you think about moving that same goodness into, you know, the VMware cloud on the AWS. And, you know, really removing a lot of the complexity around managing your own infrastructure. And so that customer can truly focus on their value as through, you know, developing the next generation application that enabled their business. It's been, you know, a great extensions of what we're solving on premise to the public cloud. Yeah, I wonder if we can drill in a little bit deeper on this. So, you know, most customers think, understand, okay, if I needed to set up a vSAN environment, right, I got to get my servers, how long it takes, what skills that I had. Virtualization admins have been doing this for a few years now and congratulations. You've got the number of here in 10,000 customers, which is, you know, great milestone there. Walk us through, you know, when we're saying, okay, I want to spin it up, you know, if I know swipe a credit card and turn on a VM, is it as fast and what is that base configuration, what kind of scale can it go through, you know? So to start with what was announced today for initial availability, you can come to the VM, the VMware portal, so you come to our portal, you give us our credit card, obviously, and then you can provision between four and 16 nodes. So you pick how many nodes you want and you give us a little bit of networking related information so we can understand how to lay out IP address ranges so we're not going to conflict with what you have on-premise. And then you click provision, and in a few hours you'll have a fully stood up STDC. And so that's going to include a vCenter instance that we've installed, all of the ESX hosts we've provisioned from Amazon, we install ESX, we configure vSAN for you. And it's basically like getting a brand new vSphere deployment and you can start provisioning your VM workload as soon as it's ready. And then once it's there, if you want to grow your cluster, you can dynamically add hosts on the order of about 10 minutes and if you want to remove capacity, you can remove hosts as well. So it gives you that elasticity and flexibility from the public cloud. Awesome, so we're early with some of the early customers. I'm curious, do you have any kind of compare contrast as to what they like about, you know, doing it in the Amazon, you know, VMware cloud on Amazon versus my own data center. Of course there's things I can say, okay, I spin it up faster but I can turn it off and then I have to pay for it. What, do they, are we at the point we understand some of those use cases as to why they might do one versus the other? Yeah, I think a lot of the customers interested in this new model really liking that common operating experience. You know, some of the flagship customers you've heard about this morning, you know, Metronik for example, they are a VMware Cloud Foundation customer, they are running entire, you know, SDDC through VMware Cloud Foundation but because they really enjoy that experience and the simplicity that brings, now they're extending that into the cloud. So they're also one of the earlier customer for VMware Cloud on AWS. So having that common operational experience is a big value prop to our customers. Yeah. And I think we really see customers wanting both, right? They're customers, you mentioned before, the private cloud is sexy again. They're customers who have a lot of workloads that makes sense to run in a private cloud but they also want the flexibility of how they can take advantage of public cloud resources. And so depending on the problem that they're trying to solve, they view this as a compliment to their existing infrastructure. And I have to think some of the services I have available are a little different. So things like disaster recovery if I'm doing it and kind of that cloud operating model is a little different. I know of Amazon services I can use and VMware announced a whole, what was it, seven new SaaS services which kind of span some of those environments. Yeah, so the SaaS services, you know, we announced they're truly cross cloud because they not only limit to a vSphere power cloud, they truly are extending into this cross cloud, multi cloud world of, you know, heterogeneous type of cloud environments. And now, you know, you spoke about DR and certainly for someone coming from the storage and availability background, you know, in terms of our be used role that we're playing in our cloud relationship, you know, certainly we are trying to provide the best storage infrastructure as part of our cloud service. But we are also looking at what are the next levels of data related services, whether it is data mobility, application mobility, disaster recovery or the futures of other aspects of data management. And that's what we've been focusing on. You know, we have a lot of customer, you know, even thinking about what's happening with, you know, Hurricane Harvey. I still remember the hurricane Sandy days.  You know, we're seeing the power of a disaster recovery solution. And now with the cloud, you can totally leverage the economics and the flexibility and scalability that cloud has to offer. So those are all the directions we're working on. So we're coming up on the one year anniversary of the closure of the Dell acquisition of EMC and its companies. Would love to understand looking at this great announcement today VMware cloud on AWS from a differentiation perspective. What does this provide to VMware as part of Dell EMC this big partnership with AWS? Yeah, so let me, you know, maybe take it back a step, not just the AWS relationship, but really look more broadly what we're doing together with Dell. And certainly, you know, starting with the storage business, you know, we're doing amazing work around our entire portfolio of software defined storage, hyper-converged infrastructure. And the good thing is, you know, as Stu pointed out, we're seeing tremendous growth in our core business around VCN. You know, 10,000 customers expanding rapidly, but we're truly firing from multiple cylinders of both consuming it as a software model, as well as working with partner like Dell EMC on turnkey appliance, such as VxRail. They're seeing tremendous success. So we are extending into our partnership around data protection. This is why I'll be coming to theCUBE with Beth Phelan to talk about all the great things we're doing around data protection collaboration, both for on-prem as well as in VMware cloud for AWS. So lots of things happening in different parts of the business unit. So, but coming back to VMware on AWS, I think, you know, we're thinking about leveraging the strengths of our portfolios. So this is not just a full VMware stack, but there's, you know, some of the Dell technology IPs that we're pulling in. So for example, data protection, they're part of our ecosystem being one of the very first partner enabling data protection on top of AWS. Yeah, so Matt, anything to add? Yeah, I think, you know, when we look to, when we look to what's made us so successful on-premise, it's been that extended storage ecosystem of which Dell EMC is a huge part of. And we continue to see that value as we go to the cloud. Young Bing mentioned backup and disaster recovery as sort of the obvious starting points. But I think beyond that there, there's a bunch of technology that they have that's equally applicable, whether or not you're running on-premise or the public cloud. And the tighter we can integrate and the more we can take advantage of it, the more value we can drive for our customers. Yeah, so VSAM 6.6 is now out, you know, maybe any other things that we haven't talked about that you want to highlight there and any roadmap items that you can share that are being kind of publicly discussed, you know, here at VMworld. So yeah, 6.6 was definitely a big hit. You know, with encryption and also a lot of the cloud analytics and things we're doing has been really hitting, you know, the hardcore of what our customers are looking for. So going forward with VSAM, you know, we talk about AWS, our relationship with AWS for a long time, but you know, the fundamental product level innovation is happening inside VSAM as well. One of the big focus is really looking at a next generation architecture that truly enables the leverage of all the new device technology. You know, I keep saying, a software-defined product is really driven by sometimes hardware innovation and that's very true for VSAM. So at the foundational layer, we're looking at new hardware innovations and how to best leverage that. But moving up the stack, we're also looking at cloud analytics and, you know, proactive maintenance. I was just talking to one of our customers about what it takes to support, provide support in 2017 is all these automatic intelligence, proactive, you know, you've heard Pat talk about Skyline. This is a new proactive support approach we've provided and there will be a lots of cloud analytics that's driving a technology like that. So, I was going to say, on the analytics side, are you, what are you hearing from customers with respect to what they're needing on analytics? Is they have this big decision to make about cloud, private, public, hybrid? What are some of the analytics needs that you're starting to hear from customers that would then be incorporated into that roadmap? So, from our BU, we're looking at a lot of the infrastructure level analytics. Certainly, there is also a lot of the application level analytics, but from an infrastructure point of view, you know, to Matt's earlier point, you know, customers do not want to really worry about their, you know, the plumbing around their infrastructure. So, we're gathering analytics, we're pumping them into the cloud, we're performing, you know, intelligent analysis so that we can proactively provide intelligence and support back to our customers. I think it really, it helps customers to understand things about how they're using their storage, how they're using their data, what applications are consuming storage, who needs IOPS, who has latency constraints, all that type of data, and being able to package that up and show it to customers in real time and help them both understand what they're currently doing and future planning we see a lot of value in. Matt, I'm curious, one of the challenges you have as a software product is you need to be able to live in lots of different environments.  Without sharing any trade secrets, any lessons learned or anything, you know, that kind of is like, wow, this was, you know, an interesting challenge and here's what we learned when you talk is that the challenge of our time is building distributed architectures and I'd have to think that porting over to Amazon was not a, you know, oh yeah, I loaded the code and everything worked day one, so what can you share? This goes back to sort of the really interesting and tight collaboration from the engineering aspects and it's really been phenomenal to see the level of detail that Amazon has in terms of how they operationalize hardware and what they can tell us about the hardware that they're building for us and so I think it really highlights some of the value that you see in the public cloud which is it's not just about having physical infrastructure hosted somewhere else, it's about having a company like AWS that's understood how to deploy, monitor and operate it at scale and that goes to everything from how they think about, you know, the clips that are holding power cables into servers to how they think about SSDs and how they roll out firmware changes and so from an engineering standpoint it's been a great collaboration to help us see the level of detail that they go to there and then we're able to take that into account for how we design and build solutions. Yeah and we are definitely taking all that learning into how to build cloud-scale solutions that truly empower, you know, cloud-scale operations and lots of the operational learning, you know, that we get from this exercise has been just tremendous. Yeah, one of the bits of news I saw is that VMware's IT is now running predominantly or all on VSAN, right? What can you tell us about that? Are there still storage arrays somewhere inside the IT or is... So we're extremely excited about this and we have a visionary CIO, Baskier. I know he was a CUBE guest as well so he's been really pushing this notion of VMware running on top of VMware so we have 119 clusters, you know, 30,000 VMs, probably close to a thousand hosts and seven petabytes of data running on VSAN and so if VSAN as a product doesn't hold up, you know, I get to experience it firsthand so it's been pretty phenomenal to see that happen. We are also deliberately running a range of different versions of VSAN. There's some that are G8 version. There are some that are cloud-additioned that's yet to be made GA to our customers so this really help us develop much more robust software. If you see what's happening here in the hands-on lab, that's being powered by VSAN as well, behind the scenes. VMware's done a great job of leveraging kind of core competencies like VSAN for the software-defined data center. As you mentioned, 10,000 customers. I think Pat said adding 100 a week, not sure if I heard that correctly, well that's phenomenal. So another thing that he said that was interesting before we wrap up here is we're moving from data centers to centers of data. As customers are transitioning and really kind of figuring out what flavors of cloud are ideal for them, are you seeing any industries really leading the charge with respect to, for example, VMware cloud on AWS? Are you seeing it in, you know, we saw in Medtronic, but healthcare, financial services, any industry specificities that you're seeing that are really leading edge that need this type of infrastructure? I think it's happening across many different industries. So tomorrow I'm going to be in a session called Modernizing Data Center, but there is also a lot of emphasis what's happening on the edge. So I have been exposed to customers from healthcare, customer from airline customers, you know. So we're going to be to probably talk about examples of Airbus 380, you know, the biggest airplane that's been ever built. And they have 300,000 sensors on the plane that's generating a tons of data. And those data are being processed by technology like VCAN. And just the, you know, stories across different industry. And I think that data center to edge stories are very powerful. And this is also why the next generation architecture such as HCI make it happen. Clearly we've seen tremendous adoption in the data center. Now we're seeing adoption in the cloud. And I have to say it's not just VMware cloud on AWS. We have about 300 cloud provider partner to VMware that has adopted and deployed VCAN to different degree. And now we're seeing it go to the edge. As we have some amazing announcement this morning around a HCI accelerator kit that is really providing a much more affordable solution to enable broadly edge use case. Fantastic. Well, tremendous momentum, great growth. We wish you guys the best of luck. Congratulations on everything announced today. And we hope you have a great rest of the show. Yan Bingli, Matt Amdler, thanks so much for joining us on theCUBE. Thank you very much for having us. Thank you for having us. Absolutely. And we want to thank you for watching. I'm Lisa Martin with Stu Miniman live from day one of VMworld 2017. Stick around, we'll be right back.


How are you looking for that first job after graduating? I'm Jonathan Pollinger and in this video I'm going to show you five tips on how you can use LinkedIn to get your first job. Let's get into it. So after graduating you're going to be keen to land that first all important job. So in this video I'm going to give you five tips on how you can use LinkedIn to do that. So tip number one is to optimize your LinkedIn profile. So I'm just going to go through my profile here and give you a few pointers on how you can improve your profile. So first off we have the visual elements at the top. So we have a cover photo here. So this should reflect you as a person. You might not be able to have a photo of you in employment if you still haven't landed that first job but anything that reflects you as a character reflects your personal brand is absolutely fine. Then we've got the head and shoulders shot here. So this should be a clear picture of your face. People do like to see who they are meeting for an interview when they're going to be employing them. So very important to get that right but don't worry about it being too formal or professional as long as people can clearly see it as you and it's a good quality photo. So next up is the verification of your profile. So this is a new feature indicated by the shield and the tick here. So this shows potential employers that it is actually your profile that they are looking at and you need your passport and to go through a process to obtain that verification but very much worthwhile doing. Then we have the headline. So here it is worth saying that you are actually looking for your first job after graduating from college or university and it's worth putting in what sort of job that might be and perhaps including one or two skills. You have got a fair bit of space here as you can see and I've actually used all three lines here that are available for that. Another thing you can do is make sure you've got your contact info filled out. So for privacy reasons you might not want to list your phone number but it is possible to put your phone number on here. Make sure that you've got your email so I've got a business email here. Again if you're not currently working that will have to be your personal email but when you do get your first job do make sure you change that to your business email. That would be your primary email on LinkedIn. If you have got a website or a blog or a YouTube channel perhaps or social media that you want to point potential employers in the direction of then you can list up to three websites or web pages in this area here. Now one really important feature is the open to work feature. So you notice on my profile picture I've got a open to work flash here. So if I click on that you will see that I have got a number of things listed here including the job titles that I'm looking for, location, start date and employment type. So do make sure that you have filled that out on your profile. Then a nice little section that LinkedIn have got is what they call the featured section. So you can feature particular content here. So one suggestion is to feature any projects that are relevant for your first role and definitely feature your CV here in this panel in one of these panels. Now it's pretty handy and flexible because you can upload an image file, you can upload a PDF and you can also link to any website or one of your recent posts on LinkedIn. So if we scroll further down the profile if you have got work experience then add that there along with a description, education so you've just graduated so make sure that you've got your college and information related to that. If you're involved in any projects put those in there, any volunteering likewise and pretty important skills this is going to be a section that you're going to be developing over the course of your career but definitely worth putting some in there. Now it's important to get recommendations so this is really powerful thing on LinkedIn so if it is possible to get any recommendations of people that you've done any kind of like project with whether that's paid work or otherwise then do try and get some recommendations there. If you have published anything you can pop that into the publications section there. So those are the few tips on optimizing your profile on LinkedIn. So for tip number two we're going to look at creating content. It's very important to create content on LinkedIn to make yourself visible to employers and also to demonstrate the skills that you've got to offer and you can do this in two ways. You can do it with short form content known as posts or you can do it in long form content known as articles on LinkedIn. So we're on the homepage here on LinkedIn and you'll see that at the top we've got start a post so to create a short form post we just simply click into this box here and then we can start typing, we can add emojis, we can add photos and videos, we can add an event, we can add an occasion, celebrate an occasion, some other options here are a poll, that's quite an interesting one. That one there shows people that you're hiring which is the opposite of what you want to want to do. That one's quite useful because it's for adding PDF documents and the final one is for finding an expert. So at this stage probably not likely to use that one but the main tools here are the ability to write text and to add emojis and photos and videos or perhaps a document there. Once you've done that you can either schedule that using this clock symbol here or you can just post it straight away. So to give you some ideas of what you might post here so you might want to do an introductory post to talk about yourself perhaps to mention your degree and the college or the university that you graduated and talk about what you're passionate about, what you're actually interested in, it might even be worthwhile mentioning opportunities that you're actually looking for. Another idea would be a thank-you sort of type post looking back on your university degree to thank your professors, to thank your co-graduates, mentors and anybody else that made a contribution to your education there and another one would be perhaps skills, particular skills that you're looking for and you might want to relate that to a particular industry where you want to, in which you want to work. So just a few ideas for short form posts there. So to create an article it's actually in the similar area here and you'll notice that we've got to write an article option. So if I click on that I go into this area here where I can choose who I'm writing on behalf whether it's a company or me but clearly want to write as me as this occasion so I'm just going to scroll down to that. So it's going to make the screen a bit smaller to make that possible so just got too many pages that I manage here. They're going to go on to next and then this is the area just expand that so make it a bit bigger for you. This is the area where you can actually write an article, really a sort of long form or even a blog style post here and this is pretty useful to work with actually. You've just got some sort of standard and relatively straightforward formatting options here across the top and you can add a title, you can start writing and then you can add an image or a design at the top here and then when you're ready you can click on next and then what happens is this actually goes out as a post with a link to this article but people can also find it as an article as well. So that's articles to give you a few ideas, three ideas around article topics. So one would be to reflect on your college experience, your university experience, sort of like look back, look at the challenges, what you learned and really sort of talk about your experience there. There is an industry that you're currently interested in. Another idea would be to provide some insights and some thoughts around that particular industry and keep it personal and talk about why you're looking to work there. And a third idea would be to pen an advice piece to graduates so pass on your experience of what you've actually learned. So something along the lines of title might be three pieces of advice I wish I had known before starting my degree. So just a few ideas there around short form posts and long form posts but really important if you can to start curating some consistent content on LinkedIn. That's tip number two. So the third tip focuses on building your network on LinkedIn. So why is a recent graduate would you want to do this? Well the main reason is quite straightforward. It's that those people that you're connected with might be able to offer you a role or people that you're connected with might know somebody who can offer you a role. But first you need to find these people. Now the best way to do this is using search. Very very powerful feature on LinkedIn. So as an example let's search for the role of chemical engineer. So if we do that we get a number of results that appear on the screen and we've got different categories here. We're concerned with people. So those are the category of jobs which we'll come back to in tip number four but there are some other categories as well but it's people that we're particularly interested in. So let's look at that in more detail and we can do that by selecting the people filter on the top left menu bar there. Now we want to build our network so the best way to do that is to go for second connections because that means that there is somebody in common with the people who are second connections. In other words you both know the same person and you can mention that person when you're connecting with them. So let's click on second and that's going to bring the 282,000 results down to 8,000 results but we can filter a little bit further. We might want to work with this list but let's say that we just want to focus on people in London for example so I can click London there and the results should, there we go, show results should change filter down from 1,000 down to 320. So we can then scan these people here we get a little bit of information we get the name we get the headline and we get their location which should be London because that was the required filter and then we can look at the person in more detail and decide as a chemical engineer whether we want to connect with them or not if that's the kind of industry the kind of role that we're looking for then we might well want their insights. So you can connect directly with them so this means that you get to see each other's content and you have the ability to message one another so this is a direct connection but you can also follow somebody so if I want to connect I can click the connect button there if I want to follow I can just go to more and follow now follow just means that I see their content and that's it no more to it but let's say that we want to connect so what I can do is click the connect button a very good idea to add a note when you're connecting so I can click on add a note and then type in a small message there maybe referencing our mutual connections as I mentioned before so in this case Neil Martin Sally Cope and one other person and then when we've done that we can send off the invite to connect if the person accepts you'll be notified of that and from that time on this case Sarah will move from being a second connection to a first connection so that's how you can find people on LinkedIn and either connect or follow with them so for tip number four we're going to look at the jobs section on LinkedIn so it's really handy that as a recent graduate you have access to a whole dedicated area to help you find a job on LinkedIn so you access this area via the top menu bar where you can see it states jobs so if we click on that there's a number of really useful features in here so first of all there's a panel with suggested jobs which as you can see is based on my profile and search history so they put up a few jobs here and if you want more you can click on show all and then it'll highlight a whole bunch of jobs there and for further details you can just click on any of these roles vacancies and you can see the details there you can save them down to your my job section if you're interested I'll point that out to you shortly or you can apply using easy apply in most cases where LinkedIn will populate your details in the application form so another way that you can use the job section is to actually search for roles so if we search for say an artificial intelligence consultant in Cardiff so a previous search that I've run so I can select that and then up pop some suitable vacancies here works in a similar way I can highlight any of these and get the details on the right hand side so if I'm particularly interested in that kind of search and that kind of role then I can switch the alert on the job alert on you can see that it's already switched on for this particular role so this means that if anything comes up any new vacancies are added to this section I'll be alerted on LinkedIn via notifications and I will get an email pointing that out so pretty handy and similar to the filters that we had on the main search previously you can see that we've got filters across the top to help narrow down our search as well so just going back to the main job section just to highlight a few other features of the section so the my jobs area which I mentioned before this is where your saved jobs are added to so you can see that I've got a saved job in here and other things we've got here are preferences so you can state your job searching preferences here worth going through this little panel and section there little area to help you prepare for interviews some job secret guidance there and this is for recruiters so those two bits there don't don't apply but the bulk bit is for people like yourself recent graduates looking for a new role and it's a really helpful section so for tip number five the final tip I'm going to show you as a recent graduate how to use the alumni feature available on university college and school pages so this is a really handy way of connecting or following with people that went to the same college as you and perhaps have the same career or are working in the same industry that you are looking to work in as a recent graduate so this is how it works so we first of all need the university that you went to so I'm just going to use Cardiff University as an example here and we're going to go straight to their page now part of the page is an alumni section as you can see here on this menu structure along here so if we click on alumni we've got a list of 139,092 alumni people that have been to this college and what's really useful is that we can filter by year and also title keyword or company so let's stick to the example we used for tip number three and put in chemical engineers so this will identify all the people who have been to this college who have a connection in some way with chemical engineering or perhaps they are actually chemical engineers and we've got a list of 71 of those people here so it's worth having a browse of these people because they might be able to give you advice in terms of your career options and who knows they might even be able to offer you a role but you have got that commonality in common the fact that you went to the same college so a pretty handy feature allowing you to find people who went to the same college that you can then follow or connect with so that's tip number five for helping recent graduates to find their dream job hope you found that useful and best of luck with your job search hope you found those tips useful and you should now be in a position to land that first job after your graduation for more tips please like and subscribe to the NILC channel on YouTube see you next time