Welcome to the BC Library's Core Skills Tutorial, Citation 1. Why CITE? The first in a two-part series. This video will explain why it's important to cite your sources, different purposes of citation, and what happens to knowledge and academic careers when citation is incomplete or missing. For learning how to cite, watch Citation 2, How to Cite. When you cite your sources, you show how your work is in conversation with the work of other scholars. This is the essential feature of academic writing, showing your familiar with what's already been said and adding to it, just like you might with a conversation. Citing fulfills several purposes. It lends the authority of prominent scholars to your claims and at the same time gives them credit for their original ideas. It gives you a chance to add your own commentary to existing knowledge and provides a way for your readers to understand the scholarly context of your ideas. Citations also provide all of the information your readers need to locate the sources you have used. In this way, your research keeps the conversation going by encouraging further research. Think of citation as the web of knowledge before the worldwide web. In print, without clickable links, how did people connect related ideas? With citations, it was slow, but it worked. So, with the internet and links, why do people still use it? Because citation is about more than just linking information, it's also about building knowledge with authority, credit, commentary, and context. Here's a quote with an incomplete citation. There's an author, but no publication or date. The source on the photo might seem authentic, but where did this quote come from? You could Google it, but Google can't fail you. The truth is that Churchill never said that. Richard Langworth, a Churchill expert, has published five books of Churchill quotes. Should we trust him or Brainy quote? When you don't cite or citing completely, you add noise, not knowledge. What else is lost without a citation? Credit. The more scholars cited, the more grants, prestige, and job prospects she's awarded. As you might imagine, this prestige process can be quite competitive and tempt people to cheat. Consider Watson and Crick, credited for discovering the double-helix shape of DNA in 1953, who then shared a Nobel Prize for the discovery in 1962. In their April 1953 article in the prestigious journal Nature, they referred to another article in the same issue with similar claims. We were not aware of the details of the results presented there when we devised our structure, which rests mainly, though not entirely, on published experimental data. In other words, they claimed credit for the double-helix idea. Rosalind Franklin's pioneering work with DNA was published on the next two pages in the same issue of Nature. She was a cautious, thorough scientist, and her claims about the shape of DNA were more understated. She wrote of Watson and Crick's concurrent article. Thus, our general ideas are now inconsistent with the model proposed by Watson and Crick in the preceding communication. She credited them, they did not credit her. Her major contributions to the discovery of DNA went largely uncredited until 20 years after her untimely death at the age of 37. When the book made it clear that Watson and Crick had seen her research and data and even talked to her colleague about it. Not fair, right? The historical record has been partially corrected.  But the record of citations and awards still eclipses her. Your citation habits in unpublished papers likely will not have profound impacts on scholar's careers. But by having you practice citation, your professors are teaching you ethical habits that, source by source, build the record of all academic knowledge. It's kind of profound, really. Most of what counts as knowledge comes down to the authority of these troublesome little condensed strings of text, often representing someone else's most significant creative output or sometimes even a life's work. To learn how to mindfully attend to citations, watch the second video in this series. Citation 2, How to Cite.


If you want to sit before you go in Just start when I go in, not whenever I sit If your feet are in there, that doesn't count True, true, true Half the water's out Five seconds Push him right there Seven, six, five, four, three, two, one Go, go, go I couldn't breathe, I couldn't I was trying to breathe and it was like Only short breaths Hey, I'm proud of you man You're so tough


6 Things You Never Knew About Zodway Wabantu, Number 5 Will Shock You. She may be criticized for a lot of things, but being lazy is not one of them. Since Zodway Wabantu stepped into the limelight she has received as much hate as she has received love. The 32-year-old has experienced an eventful 2017 that has opened up many opportunities for her. Though the public may only view Zodway as just that lady who enjoys dancing in clubs with a bottle of Savannah on one hand and the other pointing in the air, we can't deny that the media and public have found a great interest in Zodway's life. Illustration by DAB Andrew in a recent interview with Daily Sun we recently learned that Zodway has been working hard as a single mother, way before the public's interest in her life and way before the dancing in social gatherings. There are just a few interesting. She left home when she was 16. Once Zodway has worked in numerous places, she started off as a call center agent and a barlady. Originally from Soweto, Zodway then moved to Durban due to her job as a call center agent. 2. When living in Durban, Zodway started a business of leasing flats and renting them out to students. 3. She has an 11 year old son, Vuo, who's the reason behind her determination to hustle harder. 4. Zodway failed metric, but that did not stop her from achieving her dreams now life is sweeter than ever. So much so that Zodway even has time to take helicopter trips whenever she feels like it. 5. Zodway waybantu opens up on the lesbian rumors, she is a lesbian indeed. 6. Zodway is living her best life and so should you.


The key objectives of the forum from my perspective were to set up the strategic alliance which you can see beside me to actually bring the three elements of law enforcement, government and military together and most importantly have a strategic output or outcome at the end of it. What we're looking at with the strategic alliance is to bring a coalition of the willing, if you like, together to form a partnership to actually tackle the IED scourge and by doing that we want to put that in an alliance whereby we've got a strategy with a vision which we're looking at is to reduce the IED threat and save lives and then set up a number of pillars that will enable us to do that. The four pillars are information sharing whereby we make sure that we pass information around each other, public awareness whereby we make sure not only the sort of EOD teams and the response teams know what's going on but more importantly the civilians so they know what to look for to look after their own safety. We've got building capacity, capacity building whereby we can build each other's capacity so we become better at responding to the threat and the last one is component control and trying to make sure some of the components that are integral devices or items of the device we can either track them and stop them becoming an integral part of the device or do something about it when we actually know what's in the device. I would see this forum over the next few months the working groups would actually go and consider the four elements of the pillars in detail, present those back and at the forum we would then say right a year ago we came up with here's the proposal of a strategy which is in principle is in general to make that hey this is what we're going to do now so in a year's time I see us being a quantum leap forward in terms of us now being able to go on through the front foot.


Hello everybody, I'm Lance Goyki. Today we're talking about the paused push-up. So we've talked about the eccentric push-up. That's where you're lowering. You're emphasizing the lowering portion of the rep, the eccentric portion being the lowering portion. There's some other parts of it though. So muscle contractions are either lowering, holding length, or shortening. The lowering is the eccentric. Today we're going to talk about the isometric, the holding. So it's kind of like just a normal push-up, but you're going to put a little hold in the bottom to kind of kill your momentum and then you're going to push up out of it.  Now you can manipulate the hold. You could hold for a really long time if you wanted to. And if you're actually trying to train that isometric portion, you're probably not doing a whole lot of the moving part. You're probably just setting up in the bottom and holding for a long time. Maybe you're loading it too. Maybe somebody's putting a plate on your back or standing on your back depending on how strong you are. Don't try that unless you're really confident. People are heavy. Pause push-ups though, one of the I guess the best reasons to use them is if you're not you're just not keeping the control that you need, especially in your midsection. It's a good way to just kill the momentum. I have a lot of people that I'll train that will just rush through reps. And when they rush through it, they don't think about what they're doing. They can't feel when they do it wrong. So they mess it up.  Oh, I did let my shoulders creep up. Now I gotta figure something else out. Okay, I'm gonna try to set them down now. It just gives you that chance to think through that monologue. Yeah, pause push-ups.


Radio's own show, Behind the Mic.  But radio isn't all on the surface. There are stories behind radio, stories behind your favorite program, and favorite personalities, and radio people you never hear of. Stories as amusing, dramatic, and as interesting as any make-believe stories you hear on the air. And that's what we give you. The human interest, the glamor, the tragedy, the comedy, and information that are behind the mic. And now presenting a man whose name since the beginning of broadcasting has been a byword in radio, Graham McNamee. Thank you, Gilmartin. Good afternoon, ladies and gentlemen of the radio audience. Mike presents one of the most versatile character actors in radio. He is casting a show and he wants a man who can play a Scotchman in one part of the show and a pack of wolves in another. He probably hires our next guest. You might have heard him as the villain on the Dick Tracy program one night, and as a funny voice on the Fred Allen show another. As a matter of fact, he plays so many parts that I suggest you be mighty careful about swatting a moth in your closet. It just might be Charlie Cantor. Charlie, exactly what kind of dialects do you do? Well, Monsieur McNamee, I can do a French dialect like this if you prepare. I can also play the part of a blooming cockney from East End with pearl buttons.  But I can talk a little like I've just been kissing the Blarney stone. Maybe you like a little Italian, by the way. Then I play the Scotchman. Like the Scotchman who went to the dentist and asked how much to pull my tooth. And the dentist says $2, and the Scotchman said, OK, here's a buck, just loosen it. Charlie, I suppose you speak English too. My friend, you're asking, so I'm telling you. You can take everything away, but don't take away my Yankee accent.  Oh, yeah. You mean the dopey man who talks something like this, yeah. And the little man who talks way up here like this, yeah. Yes, I do, Graham. Well, a couple of weeks ago, Charlie, we had a man on this program who impersonates animals. Yeah, what does he do? Impersonates animals, Charlie. Do you also impersonate animals? Well, yes, Graham, for comedy purposes. For instance, on one program, I was called upon to do a lovesick chicken, which sounded something like this. And once I was called upon to do a parrot, which sounded something like this. Another week, I was called upon to do a hen laying an egg, and it sounded something like this. I wonder how a program sounds when it lays an egg, Charlie. Well, I hope I never find out. Besides playing dialects and characters on shows, what other unusual things do radio directors call upon you to do? Well, lots of things, Graham. For instance, I'm generally called upon to do funny laughs. One show, I had to do the laugh of a man who was looking over the shoulder of another man who was reading the funnies in the subway, and as the paper doesn't belong to him, it was a sort of a repressed laugh like this. Then there's the timid laugh that I have to do at times like this. And then still another comedy show, I had to do a laugh like a man who was waiting outside of the delivery room in a hospital. His wife is expecting a baby. The nurse comes out and tells him it's a boy. Also a girl. Another boy. When I said he was versatile, I wasn't kidding. Charlie, just out of curiosity, did you have any theatrical experience before you got into radio? Well, Graham, I've been in radio for 11 years, but I did play in vaudeville for quite some time. When I was in school... High school? Well, I won't say it was college, but my brother was a vaudevillean, and he had a comedy act. During the summer, he used to fire a straight man, and I'd substitute for a straight man for eight weeks, and in that way make my school tuition expenses for the whole year. And do you know who the first straight man my brother fired to make room for me was? No, who? Archie Leach, who is now better known as Cary Grant. So Cary Grant was fired so you could take it? That's right, Graham. Well, is there any chance of RKO doing that to Cary now? No, I wouldn't let him, Graham. Gosh, I wouldn't let him railroad me into that. No. I'd hate to play those mushy love scenes opposite Loretta Young. Oh. Or Myrna Loy and Eddie Lamar. Oh. No, a thousand times, no. All right, keeper, I'll come quietly. Thank you, Charlie Cannon. Audities in radio. Presenting odd little true stories that help make radio sounds that help make radio sometimes amusing, sometimes exasperating, but always interesting to the people in it. Audity number one. A few years ago, newscaster Mark Hawley was master of ceremonies on a program for a shoe account emanating from Buffalo. The commercial announcement was done by two women, Mrs. Miller and Mrs. Johnson, who talked over the back fence about things pertaining to shoes. One day the time of the broadcast was changed. Through sheer forgetfulness, the two women who did the commercials were not notified. Hawley and his announcer didn't realize this until just before the show and nothing could be done. When they came to the commercial, there was only one thing to do and the announcer and Hawley did it. They slipped into falsetto and... Uh, how are you this morning, Mrs. Miller? Oh, I'm so glad to see you, Mrs. Johnson. Oh, yeah, how's the family? Oh, everybody's fine except little Willie. His corn's a bothering him, he's got arch trouble. Oh, he has? Yes. Well, you know, George Jr. had the very same trouble and we found the most wonderful shoes of this simply marvel. They went on and on. After the broadcast was over, Hawley, worried to death, got a phone call from the sponsor. Yes. Yes, well, I can explain. I want to know who those two women were. Well, they were just two women who we called in because, well, we were in an emergency. Well, they were... Oddity number two. Years ago in the early days of radio, when NBC was still at 711 Fifth Avenue, instead of its present palatial quarters at Radio City, radio was not quite the almost perfect technical thing it is today. For instance, in those days, there was no emergency lighting system. And if the lights in the studio went out, the studio was dark until the lights were fixed. For a few brief seconds, we take you back to those early days of radio when there was an unwritten rule that if the lights went out when an orchestra was playing, the orchestra would perform Dixie because that was the one number all the boys could play together without looking at their music. Well, one day, Frank Black was conducting his orchestra and the lights went out at the finish of a number. Instead of the next regularly scheduled selection, the orchestra went into... Studio lights were fixed and the orchestra resumed its regular program. Suddenly, the lights went out again. Exactly what happened. All I can say is, if that ever happened to our orchestra leader here, Ernie Watson, he'd drop dead. Audity number three. A few weeks ago, Samuel Kaufman, radio feature writer, hailed a taxi. Hey, Cap. Take me downtown to New York Sun. Know where it is? I know all the ways to get there. Oh, you do, eh? Well, take me the short way. Say, buddy, you got a radio back there. What do you say you turn it on? No, thanks. I don't want to hear the radio. Well, maybe you don't, but I do. Oh, I see. Well, where do you want me to turn it? You turn the dial, I'll tell you. Yeah, that's right, right there. Now turn on the juice. Just a moment and pop my curiosity. But who do you want to listen to? A guy I never miss, Uncle Don. And for those of you who don't know Uncle Don, Uncle Don conducts a well-known kitty program. Thank you, Sam Kaufman. You played the part of yourself to perfection. The upper reaches of New York's theatrical district, where actors are legion, Schubert is king, and Damon Ronion and Walter Winchell are court chroniclers. There is a restaurant which has become as much of a habit with some of your favorite radio stars as worrying about their cross-lead ratings. And for no particular reason, we thought you listeners might be interested in some of the food habits of your radio favorites and what they eat. So we have brought you the man who can best give you this information, please, New York's famous restaurant, Leo Linderman or Lindy himself. Lindy, suppose you start telling us about the food habits of the famous radio personalities who put on the feed bag in your restaurant. Who would you like to hear about, Graham? Oscar LeVon? Yes. What is Oscar LeVon's favorite food? Well, Graham, I think it must be coffee because when he comes into my restaurant, he will drink at least 10 cups. That's probably what keeps him so wide awake on information, please. Then do you know what he likes to do? He likes to steal cookies and macaroons out of the cake box. Naughty, naughty, Oscar. One more swiped cookie and Papa will take away your inside appealing a brek-brik-brikannika. Ha-ha-ha-ha! I can't say encyclopedia Britannica. Did you know that? Well, how about some other favorites? Say Eddie Cantor. Well, Eddie is crazy about well-done hamburgers. He generally starts his dinner with a little dry cherry, and then he's very fond of bologna and eggs. Well, when he comes into your restaurant, does he eat by himself? Oh, no. Eddie is crazy about company. He generally comes in with his wife, Ida, and a party of 10 or 12 people. How would you like to hear about Jack Benny? Yes, I would.  Then you better start eating lots of fish. Jack's favorite seems to be sturgeon and Nova Scotia salmon sandwiches and for dessert, he has. Yes, I know that product he advertises. Boynton Island also like all kinds of fish. Well, how about a real gourmet, like Paul Whiteman? He's not a gourmet anymore. He used to love rich foods. You mean the days when he was known as two sleepy people? Yes, but that was before he went on his diet. Now when he does come in, which is very seldom, he eats things like boiled steak, a lamb chop, gluten bread, and for dessert, stewed food without sugar. So that's how Paul keeps his schoolgirl figure, eh? Yes, Walter Vinshel has a pretty heavy appetite for a tin man. Because of his work, he generally eats dinner about two o'clock in the morning. He always asks if there's anything left over from dinner, and he will have that. He likes all egg dishes and fish, and like Eddie Cantor, he's a baloney and egg feed. He's also very fond of conversation or marinated herring. Lindy, I think we have just about time for one more celebrity diet. What about J. Edgar Hoover? He makes radio speeches once in a while. Well, that's kind of stretching a point, but just out of curiosity, what is J. Edgar Hoover's favorite fodder? He likes all meat and lots of it. Uh-oh. Well, the next time I pass him, if I find myself without an arm, I'll know what happened. But thank you, Lindy. Thank you very much for the fodder fodder out. And how a cab driver became a successful radio and Broadway show writer. Recently, a new musical comedy hit came into Broadway due to the applause of the critics. The show was Hold On to Your Hats, and it starred Al Jolson. One of those responsible for the funny book of the show is a fellow named Eddie Davis, who for the last few years has been very successful as a radio writer. But before Eddie Davis got into radio, oh, but here he is, and we'll let Eddie tell it himself. Eddie Davis. Eddie, before we go into the start of your career, will you please tell the audience some of the radio comedians for whom you've written? Well, for six years, I was one of Eddie Cantor's writers. He gave me my start in radio, and I also written for Al Jolson, Edwin, Jack Haley, Joe Pinner, Milton Byrne, and many others. What did you do before you started writing for radio? Graham, I used to drive a cab, and believe it or not, that cab actually helped me to get my voice radio job. How was that, Eddie? Well, it was about eight years ago. You see, between eight and nine in the evenings, I used to park my cab in front of the New Amsterdam together. In those days, Eddie Cantor was doing his broadcast there. I used to listen to the Canada program, and write down the jokes I thought he should have used on the show. Then, right after the show, I'd go upstairs and see Eddie and tell him those jokes. Most of them were pretty punk. He wouldn't use them, but I kept right on trying. After giving them the jokes, I'd wait downstairs and drive him home. One night, I parked my cab in front of the New Amsterdam theater, listened to Eddie Cantor's broadcast, and I hurried upstairs to the studio when I... Wait a minute, buddy. The only people who can get through this car are the actors on the show. Listen, you're new around here, aren't you? Well, yeah. Then you don't know me. I'm Mr. Canada's chauffeur. I just want to tell him where his car is parked. Oh, okay. Go ahead. Hello, Mr. Cantor. So, I said to the guy, how do you like that guy with... Oh, hello, Davies. Say, look, you mind telling me just one thing? How were you able to pass the man at the door to get in here? Just plain scenario, Mr. Cantor. But nevertheless, I got a joke I wanted you to do tonight. You could open up the program by saying, Jimmy, what do you think this morning? I open up my closet and find a little mort crying. And Jimmy says, wait a minute. Whoever heard of a mort crying, and you could say, well, didn't you ever hear of a mort ball? Well, maybe I could use something like that. Look, I got another one you could have used. You could use it next week. You open the program, you say, Jimmy, what does NBC stand for? And Wallachan says, national broadcasting company. And you say, how do you like that? And all the time I thought of it, nothing but Cantor. Well, that's not bad. Look, look, just on the chance, I might be able to use it, Eddie. Here's a little something for yourself. Can you imagine? I still look like the Cantor. Me, Eddie Davis, a cab driver. I'm something close to Cantor. I gotta go before I faint. Say, look, look, where are you going? I gotta call my wife. Helen, do you hear that? Tell the baby, Evelyn. I still look like the Cantor. How do you like that? Wait a second, wait a second. Maybe you can sell some more jokes to Cantor. I'm doing a routine on daylight saving time next week. I want some jokes on watches. You think you could write a couple? A couple? I'll write a hundred. I'll write a million. I'll write... Say, give me a nick. I wanna call my wife. I still look like... Oh, I'm so excited. I know what I'm saying, really. Wait, wait, you haven't written them yet. Gonna be waiting for me downstairs Am I?  All right, Eddie, take me home. Okay, Mr. Cantor. Say, I've been thinking about those gags. You know, you told me to write for next week. You know, the ones about the watches. Look, Eddie, I'm a nervous man. I've got a wife and five children. Just as a favor to Cantor, please don't turn around when you talk. All right, all right. Well, look, about those watch gags.  And one thing was to say, Eddie, what have you got that watch hanging out in the back pocket for? You say, I can't help but I'm behind times, Jimmy. You like that? Hey, look out for that truck! All right, why don't you look where you're going, you big baloney? I'll flatten you. Yeah. You and her worlds. I've got Cantor in my cab. I'll have him take a poke at it. Go ahead, Cantor, show him how you fight. Go ahead. This is Davis. Listen, I'm a comedian, not a prize fighter. That's the trouble with the cab business these days. These truck drivers think they own the street. Say, I got another watch gag. You could bring out a watch and show it to Wellington and say, you call it, you call it your wool-web watch because it's always five to ten. You like that? Just scrape this friend a little bit and he puts up a big yell. How do you like it? Listen, Davis, as a personal favor to my wife, my five children, and my sponsor, will you please keep your eyes on the road? I'll keep my eyes on the road. Say, how about this one? Show Wellington another watch and he says, Eddie, there's something missing on that watch. And you say, yes, I know.  Well, kid, there's one thing about you. You always keep on punching. I thought of another one. Listen to this one. Hey, look out! Say, Davis, as a matter of self-protection, next week, I want you to work for me at a salary as a writer.  Thank you, Eddie Davis. Thank you. That was a strange beginning of a fine career. Letters from listeners. Each week, we invite the listeners of Behind the Mic to write us questions about radio and the three or four we consider to be of most general interest. We have answered on the air by the radio editor of some outstanding newspaper or magazine. Tonight's questions will be answered by Al Newman, radio editor of the magazine Newsweek. Mr. Phillip N. Lewis of Salt Lake City writes in to ask, how does a sponsor tell whether his program is popular or not? Well, Mr. Lewis, there are certain organizations that specialize in finding out the comparative popularity of programs. This is mostly done by taking a cross-section of various areas in the country and finding out by telephone what programs people are listening to at the moment and what programs they've listened to during the day. The sponsor can sometimes tell about the popularity of his program by the increase of the sale of his product since the program went on the air. Ms. Bula Allison of New York City asks this, what is meant by the expression soap opera? Soap opera, or soap sagas it's sometimes called, is slang for a daytime radio serial. They're so called because so many of these serials are sponsored by large soap concerns. Mr. William White of Saranac Lake, New York, writes in to ask, I have often heard the word stooge used as pertaining to a radio character.  Well, to take the last part of Mr. White's question first, there have been a great many explanations of the origin of stooge, but one of the most logical seems to be this. In the days when Votaville was really Votaville and when an actor needed someone to say a few lines in his act, he'd sometimes hire an amateur to teach him and teach him how to deliver the lines and maybe even how to sing a song. Such a person was called a student. Either through mispronunciation or carelessness, the word became stoogeant and was eventually shortened to stooge. Through the course of years, the term stooge became applied to a professional actor who played a subsidiary part in a Votaville act. On the air, the term stooge is generally applied to a minor comedy character. Some famous stooges of radio have been Parque Carcass, Schlepperman of the Jack Benny program, Beatle of the Phil Baker program, and Tizzy Lisch on the Al Pierce show. Thank you, Al Newman. Thank you for answering those questions. The radio broadcast helped save the life of a great football star. This past July, Ken Strong, former All-American football player and star of the New York football giants, one of the greatest backs the game has ever produced was deathly ill. He was, but we'll let Ken tell it himself. Come on. He'll tell you about it. Ken Strong. Ken, exactly what was the matter with you? Well, Graham, I had a bad case of stomach ulcers, and they had burst. I was operated on at the Flushing Hospital at one o'clock in the morning. The next night, I took a turn for the worse. I felt terrible. Not only physically ill, but mentally down. Not long before, my boy had had a ruptured appendix, and that and my own illness weighed upon me. There were two people I kept asking for. My two closest friends, Stan Lomax, a sports writer and commentator, and Tim Merer, the owner of the giants. About three o'clock in the morning, the doctor phoned Stan, and he said, Hello, Mr. Lomax? Well, Ken is terribly sick.  It just doesn't seem as if he cares to get well. And he's got to if he's going to pull through. He needs something to shock him to fight and live. Isn't there something you can do? I think you can. Stan was a real friend, Graham. The next evening, when he went on the air for his regular sports broadcast, this is what he said. Strong is seriously ill at the Flushing Hospital. You've cheered him on the football field. Here's your chance to encourage him in something far more important. His fight for life. Write him and let him know that you're all pulling for him to win this biggest fight of all. By Cassie of Staten Island, will you tell Ken Strong he's just got to get better. Say, what'll I do with these wires, Miss? They're all for Ken Strong. I'll have them brought up to his room. Look at all these letters, Mr. Strong. Thousands of them from people who want you to get better. Well, Graham, when I found how people were pulling for me, I felt if I didn't get better, I'd be letting them and my family, my friends, and everybody down. And I knew this was one touchdown I had to make. You not only made it, Ken, but you knocked the Grim Reaper for a goal. And you're still with the New York Giants, of course. Yes, I am, Graham. And if any of those people that wrote or phoned the hospital are listening, I'd like to personally thank them from the bottom of my heart. Well, thank you. And the very best of luck to you, Ken Strong, and also to your New York Giants. Gentlemen, if you have any questions about the inside of radio that you wish answered on the air, write a letter to us. Address it to Graham McNamee behind the mic National Broadcasting Company, New York City. As many questions as possible will be answered by mail. And the three or four questions we feel to be of most general interest will be answered on this program. Be sure to listen next week when we will bring you the inside story of football broadcasts, as told by Bill Stern and Swede Larson, coach of the Navy. What happened when Azulu made his appearance on the radio broadcast? How radio brought help in the life and death crisis down in the Pacific Ocean? And more of the human interest, the glamour, the comedy, and the drama that are found behind the mic. This is Graham McNamee speaking. Good afternoon all. Questions about the inside of radio that you wish answered on the air, be sure and write a letter to us. Address it to Graham McNamee behind the mic, National Broadcasting Company, New York City. Now all the questions and as many as possible will be answered by mail. And the three or four questions we feel to be of the most general interest will be answered on this program. Behind the Mic is written by Mort Lewis. Original music is composed and conducted by Ernie Watson. This is the National Broadcasting Company, RCA Building Radio City, New York.


Friends today we are going to study Introduction to Embedded Systems. Learning outcome at the end of this session students will be able to interpret different components of an embedded system. So before starting with the introduction to embedded system you should stop this video here and you should recall what are the hardware as well as software components used in computer as well as difference between microprocessor and microcontroller. What is system? A of working, organizing or doing one or many tasks according to a fixed plan program or set of rules. A system is also an arrangement in which all its unit assembled and work together according to the plan or a program. So generally a system is well structured or well organized task and which is to be run according to a fixed plan or there are some set of rules which are to be used. Example of system we can see as a watch. So the watch displays time and its parts are hardware required for the watch. There are three needles, battery, dial, chassis and strap and this system will work on some rules and those rules are all needles move clockwise only. Second rule is a thin needle rotates every seconds. Long needle rotates every minute that is minute needle. What needle rotates every hour? So there are three needles used in watch that is second needle, minute needle and hour needle and all needles return to the original position after every 12 hours. So the watch is a system which have hardware, needle, battery, dial, chassis etc. There are some set of rules according to which that watch will work. Now we will see what is embedded systems. So an embedded system is one that has computer hardware with software embedded in it as one of its important component. Its software embeds in ROM that is read only memory. It does not need a secondary memory as in a computer. So generally embedded system is combination of hardware and software and that software is to be embedded into the hardware and that software is embedded in ROM memory that is read only memory and it does not require a large memory as used in computers. So generally a software program is to be written and that is embedded into a hardware. So that is an embedded system. So in a figure or in that diagram you can see that small program is embedded in that hardware. Now we will see computer hardware. So generally the computer system will require a microprocessor. So that microprocessor is to be used for computing or to perform different tasks. A large memory that memory will consist of primary and secondary memory as RAM, ROM and cache memory. The computer system includes input units as keyboard, mouse, scanner etc. So these input units are to be used to give some inputs to computer. Input units like monitor, printer etc. So whatever the inputs we have given to the computer system. So that computer system will work according to the input and it will generate some outputs. So those outputs can be given as output to monitor or printers etc. The computer hardware will use some networking units as ethernet, card, drivers etc. And it will use IO units as modem, faxcom, modem units etc. So these are some computer hardware which are to be used in computer. Now we will see components of embedded system. So there are different components used in embedded system. So that embedded system will have hardware and that hardware consist of processor, timer, interrupt controller, IO devices, monitors, memories, ports etc. Next is it has main application software. So which may perform concurrently the series of tasks or multiple tasks. And third component of embedded system is it has a real time operating system which is also called as a RTOS. So RTOS defines the way the system work which supervises the application software. It sets the rule during the execution of the application program. Small scale embedded system may not need a RTOS. So generally these are the three components of embedded system which includes hardware for the embedded system, main application software and RTOS real time operating system. So that embedded system will use hardware and application software and operating system. So operating system will decide a set of rule according to which that hardware and application software will work. This is the figure which shows different components or hardware components used in embedded system which will have power system, reset circuitry, oscillator circuitry, input devices or interfacing circuit, processor, program memory and data memory, timer, serial communication ports, interrupt controller, parallel ports, output interfacing driver circuits and application specific circuit. So generally embedded hardware will require power supply. So if you take an example of embedded hardware as an Arduino board or Raspberry Pi, it will require power supply. So the DC power supply is to be given with the help of that power supply and all the tasks in an embedded system are to be synchronized and for that it requires oscillator circuitry and for that embedded system we have to give some input. So it will have input devices and next is processor. So the processor is to be used to perform those different tasks and that embedded system will have two different type of memories, program memory and data memory. So whatever the programs are to be performed or tasks are to be performed for that program is to be written and that is to be done in program memory and whatever the data is to be required for that program is to be saved in data memory. Timer is to be required in embedded system to perform different tasks based on the time constraints and it will have serial communication ports to send the data and receive the data serially. Out controllers are to be used to interrupt the processor which is to be used in embedded systems. It will have parallel ports to perform parallel communication and it will have output interfacing or driver circuits as well as it will have application specific circuit. So based on different application different circuitries are to be used in embedded system. Next we will see classification of embedded system. So generally embedded systems are to be classified in three different categories. First one is small scale embedded system, second one is medium scale embedded system and third one is sophisticated embedded system. So generally small scale embedded system will have microcontroller which is of 8 bit or 16 bit. So this is small scale embedded system and complexity as well as chip size is small. Next one is medium scale embedded system. So in this type of embedded system the microcontroller used is of 16 bit or 32 bit. So complexity is to be improved or increased as compared to the previous one and last type is sophisticated embedded system. So more than 32 bit microcontroller is to be used in such type of embedded system. So complexity is very high as compared to those previous two types of embedded system. So based on the application we have to use this type of embedded system. So either we have to use small scale, medium scale or sophisticated embedded system that depends upon the application which we are using. In embedded system we have to use softwares like C, C++, .NET, simulator as a MASSAM to simulate and compilers like KIL. So these are the some software components which we are going to use in embedded system. So as I told you that embedded system is combination of hardware and software. So these type of components for the software we have to use. So the programming is to be done in the C language or C++ or .NET and the program is to be simulated in MASSAM with the help of MASSAM and compiler used is KIL. These are the hardware and software part of the embedded system and next is applications of embedded system. So digital electronics, telecommunications, computer network, smart cards, satellite systems, military defense system equipments, research system equipments. So these are the applications. So as we have seen that now these days we are using washing machines, air conditioners, microwave ovens, satellites and all these electronics gadgets. So all these are part of the applications. So everywhere the embedded system is to be used. While preparing this video lecture I have used these references. Thank you.


So the last speaker for this morning is Traml. He's doing awesome research on bootstrapping more secure laptops or servers. And he's doing that basically by moving the root of trust into the right protected room. He's building an open source custom firmware, so big ups for that, and also encouraging the research on this field, which I believe it's super interesting. Thanks. So I'm Traml Hudson with Two Sigma Investments. And for the past several years, I've been researching firmware security vulnerabilities and looking at how they affect systems. Two years ago, I presented my work on Thunderstrike here at CCC. And this was the first firmware attack against Macbooks that allowed an attacker to override the motherboard bootrom. The year after that, I collaborated with Zeno Kova and Corey Kallenberg from Legbacore, both of whom are now at Apple doing firmware work. And we ported a bunch of Windows UEFI vulnerabilities over to the Mac and showed that the software platform, the UEFI software platform, allowed very portable attacks to be done. This also allowed a remote attacker with code execution on your machine to override the motherboard bootrom. But more than just breaking things, what I really like to do is take things apart and understand how they work and document them so that other people can build systems on top of them. And that's what I'm really excited to be talking to you all about my project, Heads, which is a open source firmware and bootloader for laptops and servers. The name is kind of a play on the popular Tails distribution, which is a stateless Linux for when you don't want to leave any traces of what you're doing on your machine. Heads is for the opposite case. It's where you want to be able to trust the machine and you want to be able to trust that the data you store on the machine is safe and unmodified. And let's back up for a quick minute and just talk about why firmware security is so important, that this is the code that is executed by the CPU when it comes out of reset. This is the first instruction that the CPU executes. And so it's in a really privileged position to be able to circumvent any sort of OS or other policies. And there's no shortage of talks that you can watch on interesting attack vectors using firmware-based malware. One that I really liked was last year at DEFCON, the Intel Advanced Threat Research, presented an attack that showed how malicious firmware could circumvent the hypervisors. They then went further and showed how buggy firmware allowed a unprivileged guest inside a virtual machine to escalate into privileges inside the hypervisor. And for that reason, it's really important that firmware vulnerabilities and firmware bugs have a way to get patched. These aren't just theoretical research vulnerabilities either. We know that there are malicious organizations and hacking groups that are selling firmware rootkits to whoever will pay, including nation-state adversaries that are using them for their persistent threats. And they are very persistent because they are in the motherboard bootrom. So you reinstall the OS, they're still there. You swap out the hard drive, they're still there. And some vendors are even bundling these rootkits into their official ROMs. They are using them to install the bloatware or whatever adware they want to put into the OS. So even after you reinstall a clean version of the OS, this particular vendor's system would install its own additions. Some of those had vulnerabilities. They could then be exploited by attackers. This particular case, the vendor received enough bad press that they released a firmware update that patched this vulnerability. And they had to do that. This wasn't something that the users could do on their own. They couldn't update the software in their machine the way they do with their operating system or an application. And in fact, most firmware vulnerabilities never see patches get deployed out to the end user. Part of the reason for that is that the firmware is usually four or five companies removed from the end user. That there's the open source reference implementation from Intel called Tiano Core or EDK2. When vulnerabilities are patched in there, they have to get pulled by the independent BIOS vendor and merged into the IPV tree. And then the BIOS vendor sells that to the device manufacturers. So they have to package up or release the thing gets pulled by the device manufacturer. It has to get QAID against however many motherboards they want to test it on. And then it has to get again pulled by the original equipment manufacturer to get rebranded and whatever value they want to add. And then sometimes it has to go through the operating system vendor to even make it out to the end user. And as a result of this, most of the time products do not receive any updates after they've been sold. There's one exception. In this chart, you can see that Apple builds their own firmware. And in my work with them, I've been really pleased that they've rolled out patches for eight years of hardware, which is above and beyond what any other firmware vendor is doing right now. When EFI was introduced, it brought a lot of complexity. And that the Linux community was very skeptical as to what the value was going to be provided by all this complexity. It's basically an entire operating system's worth of code. And it's not that the 16-bit real mode BIOS was all that much better. In fact, it had its own set of issues. But it was small. It was simple. It did one thing. It did it OK. And it took a long time for UEFI to even become widely supported. But even now, most systems ship with both the UEFI and a BIOS compatibility module. So they've basically doubled their attack surface for potential bugs and vulnerabilities. So the state of the firmware world today is that updates are rare. Patches, if they ever come out, take a long time to make it through the process. Users can't fix things on their own. And we can't see what's inside, since most of them are built with closed source components. And that's not a great state for something that is as privileged as a firmware. So it's my belief that firmware needs to be built with open source. It must be flexible so we can adapt it to our needs for our systems. It needs to be built with software that we understand and we use for in other applications so that it can get widely tested and well tested. It needs to be built in a reproducible manner so that we can be secure against build chain attacks. And it needs to be cryptographically measured so that we can be sure that what we flash on the system is what is actually running on the system. And that's the philosophy behind Heads. It's built on the free software core boot firmware, plus a Linux kernel in ROM that acts as a bootloader, and then a lot of security research and tools that help us try to build slightly more secure systems. Using Linux as a bootloader is not a particularly new idea. Back in the 1990s, when we started building large scale Linux clusters, we were very frustrated with the inflexibility of DHCP and Pixie booting large machines. Even with those frustrations, we built one that was about the 30th fastest in the world on the top 500. Meanwhile, my colleague Ron Minnick at Los Alamos was also building large clusters and had the observation that the BIOS enumerates all the buses, initializes a bunch of devices, finds Linux kernel, and then the Linux kernel enumerates all the buses, initializes all the devices. And he thought, this is silly. Why are we doing this twice? So he had the idea to build a version of Linux that ran in the ROM. He called this project Linux BIOS, and it went on to power the MRC cluster, which was the third fastest machine in the world in 2003. In 2008, Linux BIOS underwent a major refactoring, and it was renamed to Corboot. And Google chose to use Corboot as the firmware on their Chromebooks, which are at this point the only non-UEFI x86-based laptops that you can buy. And they've done really some great work in trying to lock down the configuration and the firmware on the Chromebooks. Ron coincidentally moved to Google in 2011 and is continuing to work on the Corboot project there. There we go. So Corboot has three stages that it goes through as it starts up the machine. The first one is a very small amount of real-mode assembly because your modern 64-bit laptop still boots up in real mode with 16-bit just like it's 1970s. So that's a very small amount of code, about 1.5K. That, in turn, sets up a C runtime environment with what's called Cache's RAM mode, and it calls into the ROM stage, which is about 70K. Heads has moved the TPM initialization early in the ROM stage before DRAM is set up to help measure the boot block and provide a static root of trust that's hopefully a little bit more secure. And because that measurement is done early on, our trusted computing base is actually quite small. This is a fraction of 1% of the size of a UEFI firmware, which is usually about 16 megs once it's uncompressed. The ROM stage then measures and executes the RAM stage, which does the more traditional walk the bus, figure out what devices are on there, but it doesn't initialize them. It just enumerates them and generates the descriptors for Linux. It also installs the SMM handler for system management mode. It then measures and jumps into the payload, and that whole process takes less than a second. So it's able to get into the payload and actually get to the user code very, very quickly. On something like the X230, it's able to go from power on to a interactive recovery shell in less than two seconds. And that includes bringing up the TPM, doing cryptographic measurements, and assessing the state of the system. Because we now have Linux at this point, we have all the flexibility that comes with that. We can implement boot scripts with the full power of the shell or the C language runtime. We're not stuck with the limited functions of UEFI. Linux supports lots of different file systems. It supports lots of different devices. It supports lots of different encryption methods. And this gives us the ability to use any of them for your specific application. In contrast, UEFI, which supports unencrypted, fat file systems on the first drive that have to be in the first one gig or something, it's really, really limited as to how it can find its boot device. There's a saying in the open source community that with enough eyes, all bugs are shallow. And Linux has a lot more eyes looking at it, that the device drivers and the file systems and the encryption have been reviewed by both white hat and black hat people around the world. The UEFI versions of these do not have that same level of scrutiny. So using both the UEFI drivers and then having to run whatever on top of it increases the attack surface. But by putting Linux in the ROM, independent on its drivers, we've reduced our attack surface very dramatically. More importantly, though, core boot and Linux are open source. So it is possible to build custom versions for the device drivers that you need, for file systems that you need. It's possible to fix bugs when they come out and sign and install your own kernels. You don't have to wait for the vendor to get around to doing that. And the third major component of Heads is a tool called KXAC, which is a system call that was added for the Linux BIOS project back in 2003 by Eric Biedermann that allows a running kernel to do a graceful shutdown and start a new kernel without having to go through the reboot process. So this allowed, on their application, it allowed them to do very fast reboots of their cluster nodes. And in the Heads case, it allows us to act as a bootloader, where we can find the real kernel that you want to run and exec it. Because Heads is quite small. It has to fit in four megabytes of ROM. So it's not something that you're going to run as a day-to-day OS. Hopefully this won't explode on me again. Because we have the born shell, most of the policies and the startup scripts in Heads are implemented as shell scripts. In this case, we're able to pass in a new set of command line parameters, a new initial RAM disk. And in this case, we can even start a hypervisor. And all of that can happen very, very quickly, as well as with a good degree of security. So those are the building blocks that Heads is built on. Coreboot, Linux, and tools like KXAC. But it now gives us a really nice platform to begin experimenting with additional security features. And before we go too deep down the rabbit hole of security and threat models, I want to quote my friend Steph, who said that your threat model is not my threat model. But your threat model is OK, as well, that we all have different things we want to protect from different attackers who are willing to spend different amounts of effort to go after them. And the nice thing about having an open source is we can build systems tailored to your individual threat model. So a lot of these things may not actually apply to your specific threats, but the fact that we can build them is a great capability. Last year, Johanna Ratowska reminded us that firmware is not just in our CPU. Firmware is in our Wi-Fi card. It is in our GPU. It is in our SSD. It is in our keyboards. And all of these devices might be trying to subvert the boot process. One way to handle that is to take Peter Studer's advice of just simulating the machine and ripping out anything we can't control. If this is your threat model, his instructions are really worth following. They're really thorough about what pieces are potentially of concern. And right now, you will have to open up your laptop to install heads. It's not quite as easy to install as most Linux distributions, because we have to flash it into the motherboard boot ROM. While we're in there, we take advantage of some features that, to the best of my knowledge, no UFI system is using. These flash chips have a hardware write protect mode, where you can specify part of the chip is write only, excuse me, is read only, right once. And this gives us our immutable boot block, in which to store the trusted computing base, the TCB, so that we can measure the rest of the system. We also then suggest disconnecting the write protect pin from the motherboard, which protects against certain classes of attacks, like the Intel closed chassis adapter that allows external JTAG of the CPU. Depending on your threat model, you might want to cover that chip in epoxy, as well, to frustrate evil made attacks that want to do physical programming on it. Disconnecting the write protect pin also serves to protect from other devices on the machine that have access to those pins. Devices like the management engine, which is a really scary CPU inside the CPU. Rudolph Merrick, two years ago at CCC, called it the Matroichka CPU. And Igor Skoczynski detailed what are the capabilities of the management engine. And they're really worrisome that it runs a opaque obfuscated blob of code, about five megabytes, that the CPU can't see. The management engine can read and write all of main memory. It can read from the keyboard and video. It can receive Java byte codes over the network and execute them on behalf of someone outside the machine. And it's listening on the network, even when the system is powered off. So this is basically a root kit inside the chip set, as some folks have called it. So that concerned me a lot. And I spent some time looking at how its firmware images are built and realized that we can build modified reduced functionality firmware for it that removes all of the root kit functions and just leaves the CPU bring up module. This takes that five megabytes and shrinks it down to about 40k of space. So we don't know exactly what it's doing in that 40k, but we at least know it doesn't have a device driver or a Java virtual machine or a lot of the other functions. And we've successfully done this on both Sandy Bridge and Ivy Bridge, like the X230 ThinkPads, as well as modern Skylake CPUs like the Shell Chromebook. And that's really encouraging that if we can apply this to more modern hardware, that allows us to move away from our five-year-old ThinkPads to something a little shinier. So the management engine isn't the only device that might be trying to separate the boot process. Again, Johanna showed us there are lots of things to be worried about. Intel's UEFI architects, Yao and Zimmer, recommend that firmware turn on the IOMMU, called VTD, to protect against road devices. To the best of my knowledge, since they've written this guide, no UEFI firmware is taken advantage of the IOMMU. So it's a great piece of hardware to have, but it doesn't help if you don't turn it on. Linux, meanwhile, has no problem taking advantage of it. So we use it. Essentially, we get that DMA protection for free by using Linux as our bootloader in the ROM. Another way road devices can try to interfere with the boot process is by providing option ROMs, which are executable code to be run by the BIOS that have a device driver. And this code can do things like log keystrokes and then try to exfiltrate passwords, as we see here. That problem was initially reported in 2007 by John Heisman at Black Hat, again by Snare in 2012, and then again by my work on Thunderstrike. And as of last week, a official fix has finally rolled out for it to close that particular vulnerability. Folks who are using core boot have this as an option that they can say, I am concerned about this threat. Let me fix this. Let me disable this function. And they point out that it might cause degraded functionality, but that's something you can QA on your own system. And in practice, with Linux as your bootloader in the ROM, you don't use the option ROMs for anything. Everything is done with Linux's own device drivers. So you're not dependent on whatever limited functionality the option ROM provided. So now that we've taken our building blocks and we hopefully have protected the boot process and hopefully the code that's running is what we think it is, we need to turn to how do we secure the secrets on the machine. And I'm a huge fan of the TPM, the Trusted Platform Module. And I know in the free software community, it's been largely unwelcome. It has not received a very welcome reception because of the way it's been used for DRM and other user hostile things. Since we control the TPM from the first instruction in the boot block, we're able to use it in ways that we want to. So we don't have to enable DRM, but we can use it to protect our secrets. And the way that it does that is it keeps track of what code is executed as the system boots. And it hashes that code into special registers called PCRs. And the idea is that you can extend the PCR by hashing the next module of code and then hashing that with the previous hash. And this creates a chain of trust that allows us to say if these hashes match the expected values, only the code that we want to have run has run. And then the TPM will only decrypt the disk encryption key if those PCRs match, which means that the code that we want to have run is what has been executed. This means if someone manages to overwrite the non-right protected part of the ROM, that will change those measurements. And the TPM won't reveal the key to them. It also takes a user password. And that password is validated by the TPM hardware itself, which gives us a hardware rate limiting on how often an attacker can try. It also gives us the ability to do hardware-based retry limits so that the TPM will flush the key if an attacker in position of your machine tries too long. That does mean there's now another way to lose your disk encryption key. And there's the old joke about there are two types of people with encrypted drives, those who have lost data due to forgetting their key and those who will. So what Heads does when you generate your key is it takes that key and splits it into multiple pieces that you can then share either to friends or to backup services, where each piece doesn't let you decrypt it, but you can combine them with Shamir's secret sharing to regenerate the cryptographic disk encryption key. We're also able to take advantage of best practices like using the, including the disk encryption key headers in the PCRs that we use to seal the disks. This avoids a certain class of evil maid attack where someone swaps out your drive. May not be in your threat model, but it's easy to do with just a few lines of shell script. So hopefully we now trust that the system is running the code we think it is. But how does it prove to us that it is actually our machine, that someone hasn't snuck into our hotel room and swapped out everything and carefully replaced our stickers to make us believe we're typing our password into our own computer? Some anti-evil maid toolkits will encrypt a secret phrase and then display it to you if and only if the PCRs match. But that's subject to a replay attack. What Matthew Garrett demonstrated last year at 32C3 was using the time-based one-time password used by Google Authenticator to protect the firmware and have it attest to the user that it is unmodified. So when the system boots and goes through measuring all of the various components, the TPM will only release the secret if those PCRs match. The firmware then hashes that along with the current time and generates a six-digit value that it prints on the screen. You compare that to what's on your phone and that tells you whether or not you can trust the machine. It's a great idea and it's implemented, again, as a very small shell script to read the value from the TPM, unseal it, and then compute the hash of it. This also allows us to start making a transition from the TPM static root of trust to a PGP-based trust where, most importantly, this is a TPM key, or excuse me, this is a PGP key that you, the owner of the computer control, not some random vendor or some random hardware device manufacturer that's going to lose the key and allow malware like Stuxnet to use it to circumvent security. The boot script in heads, again, it's a small shell script, is able to use GPG to verify the next stages of the hypervisor at the initial RAM disk and the kernel. And it's also then uses the TPM's counters to help prevent against rollback where someone takes your drive and rolls it back to a previous version, perhaps with a vulnerability that they can exploit. So this allows us to be sure that not only are we running the firmware, excuse me, that the OS that we think we should be running, it ensures us that someone hasn't been able to substitute one that, a vulnerable version. Having the PGP key also allows us to take advantage of an idea from Android and ChromeOS, which is the DM Verity read-only root file system. This hashes all of the blocks and then hashes all of the hashes and so on up until it gets to a root hash in the tree that is then signed. This allows the kernel on every read access in logarithmic time to verify essentially a signature on that data. This does require a read-only root file system, but it gives us even more confidence that the system has been untampered with. Once you're running your OS, it's good to have some security-conscious thoughts as well. Heads is mostly focused on how do we securely transition to an OS, and that's OS you run is up to you. I like Cubes. It's reasonably secure. It's highly recommended by people who know about endpoint security. And the Cubes team recognizes that firmware security is a vital piece of system security. For their next release, Cubes R4, they're going to require the machines have open source firmware, such as Coreboot. And I hope that Heads is going to be a piece of that. I've also been working with the Cubes software and have modified it to work with things like the DM Verity read-only root file system. This now allows the user to lock down the configuration so that someone can't tamper with their setup. It also gives you a recovery mode that allows you to fix things up and re-sign the OS. Reproducible builds are really important so that everyone can verify that the builds match what they should. In the case of Heads, we have a lot of upstream dependencies that aren't reproducible. So we're working with them to try to patch them. We've patched as in. They've accepted that commit. We've also built some tools to let you build initial RAM disks in a reproducible way. This works with Cubes, with Heads, and we're hoping other Linux distributions pick it up as well. All of our tree is cryptographically signed, so hopefully GitHub's not trying to slip in any patches. And it is open source, so we encourage everyone to read through it. No NDA is required, unlike most of the UEFI sources. So that's sort of the state of where things are. It's pretty much in very beta, but it is usable. But there are a lot of areas where we can continue to do research, things like the embedded controllers on Chromebooks are open source. We can use those to help with our route of trust as well. Porting Coreboot to more modern platforms would let us take advantage of things like tamper switches and Intel Boot Guard. I'm also working on porting Coreboot over to server platforms so that we can use it for more secure cloud hosting. Servers have a very different threat model from laptops, and a lot of things have firmware that we have to be concerned about. One collaboration I'm looking at there is with the Open BMC project to be able to take advantage of the open source in the management controller for the servers. And I'm also collaborating with the Mass Open Cloud project that's trying to build secure bare metal clouds. I'm cautiously optimistic about enclaves and how they will help us with security, especially in a environment where we control the firmware, and we can ensure that the enclaves are set up in a safe way. There are a lot of issues on GitHub. Again, please welcome contributions. I hope everyone gets inspired to work on installing this on their laptop. And if you are interested, I'll be hanging out at the Coreboot assembly later today and occasionally this week. The Coreboot team has a bunch of people here. They have flash programmers and can help you install Coreboot on your laptop. Source code for heads is available on GitHub. And a annotated version of this talk is up on my website. And welcome comments and feedback on it. So thank you all for coming to hear about this project. I hope that everyone is as excited about open source firmware as I am. And I'd love to take any questions that you all have. Thanks for your great talk. This is very interesting. Do you have any advice for the 95% of us who are stuck on non-Coreboot compatible laptops? Buy a Chromebook. It's hard to trust the closed source firmware. It's certainly, there are people we have to trust. We have to trust Intel to some extent. And Intel is responsible for both our CPUs and a lot of the firmware. Depending on your threat model, firmware attacks may not be a huge concern for your particular machine. Or they might be grave concern, in which case, even just doing some of the things that Peter Suger suggested. Suger suggested of clipping the right protect pin on the chip, removing things that might be hostile and attacking your system. His guide is a really good one to follow for the hardware security. I was wondering if you also support ARM? Or is it just so Intel laptops? I was wondering. So ARM has a lot of advantages as a CPU. It only has 20 years of legacy baggage rather than 40. And the boot process on it is much, much simpler since it doesn't have to go through real mode to long mode to paging and all the other steps. The downside to a lot of ARMS is that their boot code is on die and outside of the control of the user. Luckily, most of that boot code is fairly simple and can establish, and some of them will establish a hardware root of trust. But in general, the ARM to UBOOT to whatever seems to work out pretty well. I know there's been some interest in can UBOOT be replaced with a Linux BIOS or core boot like thing? And I suspect the folks at the booth would be able to talk more about that. And then just to follow up. So if core boot or lipo boot supports the platform, it heads will work too, right? Essentially, yes. It heads is a payload for core boot. OK. It's there on the left. Thank you. There's a question from the internet about core boot. Core boot has blobs included. And for example, binary blobs from Intel with all the firmware support package and all that stuff. How can we call core boot to cure them in the light of this, let alone open source? So the Intel FSP is a significant concern. This is the firmware support package that is required to initialize the memory controllers on modern Intel CPUs. On older CPUs, such as the Sandy Bridge and Ivy Bridge, the core boot and lipo boot are able to initialize the memory natively without having to go into the FSP. However, if you look at what core boot is doing in the MRC on those platforms, it tends to just be poking a bunch of registers with values that seem to work. And modern memory controllers are so complex that an Intel is unwilling to document them without extensive NDAs. That it's very hard to build any sort of memory initialization. So while we can't say it's 100% free software, we can at least ensure that the FSP is measured and it's unchanging. We can also look at the state of things that it sets up and include those in our measurements. So even if it doesn't give us 100% open source, as far as I know, the only system that does that right now is Bunnie's and Novena laptop, at least we can measure it and we can know that it hasn't been tampered with from what we initially installed. Number four. So this is a great project and I'd like to ask why you did certain architectural decisions, the specific combination of Linux and Shell. So why didn't you choose BSD kernel, which I usually perceived to be more secure and of a higher quality? And why did you choose the Shell over, let's say, Python or Haskell, which are also often perceived of higher quality? So there is a lot of desire to support Python in-heds. The downside is that there's very limited space. The X230 boot ROM, for instance, has four megabytes of available space. The Python interpreters a couple of megs already. The in terms of wide Linux over BSD, the K exec system call is a core component of this. To be able to do a crease will shut down and transfer from the Linux kernel to another kernel or to any multi-boot compliant kernels, which includes BSD, is a necessary feature. If BSD had such functionality that it would be a fine choice for the internal boot ROM boot letter. Thanks for great work. How to perform updates of core boot and its payload? When its binary is used in measurement for releasing encryption key, then when you update core boot, this measurement will change and you will no longer be able to boot the system. How to solve that problem? So migrated encryption keys with TPM requires an explicit step of retrieving the key from the TPM with the current configuration and then resealing it with the new configuration. One advantage of a reproducible build is the hashes of all the firmware stages can be published, can be pre-computed, and then the PCR values can be pre-computed. So you can seal the keys for the new values. In terms of the update process for the heads payload, one of the things that we're working on is being able to have even more minimal heads that has just a USB device driver that you can boot into, copy your new payload, and then install that elsewhere on the chip. And part of that process would involve resealing any of the keys that you need to transfer. Another question from the internet. Thank you. On your web page, you implemented head on thinkpads only. How much work is still needed to translate this to, let's say, non-thinkpads? Thinkpads are really popular with the security community. It's quite interesting to look out at the hall here and see how many thinkpads there are. And as a result, the core boot community has been very supportive of thinkpads. There's, other than the thinkpads and the Chromebooks, there aren't a lot of devices that support core boot out of the box. And that's something that I hope would change. I hope that some OEMs would realize there is value in providing an open source firmware and move to using it, both as a cost saving measure as well as a freedom measure. In terms of the difficulty importing core boot to a platform, I haven't successfully done that yet. But I suspect the people at the assembly would be happy to discuss that further. What do you plan to rework an embedded control firmware on thinkpads? Because it's a remaining closed part, which still has an access to the PC bus and probably couldn't be trusted. So your question is, how do we replace the EC? Yes, do you plan to replace EC with the open source firmware in Chromebooks? So the Chromebook has open source EC. The part of building core boot for Chromebook involves installing the ARM cross compiler to build the EC firmware. And the Chromebooks actually have a really elegant protocol for the EC to attest to the CPU that it is running the firmware that you think it is running. On other platforms, this would require a lot more research. Many of the EC chip sets have data sheets available. So it's possible to read through and see how they work. And most of them have updatable firmware. In the case of the thinkpads, there's a module in the thinkpad BIOS that will do that update. We would need to figure out what that protocol looks like. Yes, I mean, if you have working prototype on thinkpads, probably want to add a remaining bit as open source EC on thinkpads as well at the first place. I'm sorry. I don't think I understood your follow-up. OK. So if you have working prototype on thinkpads and only on thinkpads, will you finish someone soon current existing prototype of open source EC existing on H8 by Linux? Or you're planning to extend your work on other platforms and finish these bits later? Yeah. Right now, I have not personally made any progress on the thinkpad EC. I was looking into it because I have a modified keyboard on my thinkpad that needs an updated EC firmware. But I haven't actually gotten into that. That's an area of open research. Thank you. Two quick questions from the IRC. Are you planning to use SystemD in the boot process? It's the first one. And the second one, let's say you flash your firmware at the Congress right here with the help of a hardware programmer. Can you update when there's a new version? Or do you have to currently need the hardware access to update? Right now, you can update afterwards at great risk because you can leave the flash writable, which would allow you to flash after the fact. We are still working on a good procedure for doing software-only firmware updates once the immutable boot block is installed. And to the other question, did I mention that we are really short on space and we don't want to put any large applications like SystemD on there? That was a good one. Thanks. Thank you all.