Book 5, Chapter 18 of One of Hours.  They had covered eighteen miles that morning, and had still seven more to go. They were ordered to do the twenty-five miles in eight hours. Nobody had fallen out, yet. But some of the boys looked pretty well wilted. Nifty Jones said he was done for. Sergeant Hicks was expostulating with the faint-hearted. He knew that if one man fell out, a dozen would. If I can do it, you can.  This is no march to make a fuss about. Why, at Arras, I talked with a little Tommy from one of those pal battalions that got slaughtered on the Somme. His battalion marched twenty-five miles in six hours, in the heat of July, into certain death. They were all kids out of school, not a man of them over five-foot-three, called them the Bantams. You've got to hand it to them, fellows. I'll hand anything to anybody. But I can't go no further on these, Jones muttered, nursing his sore feet. Oh, you, we're going to heed you on to the only horse in the company. The officers, they can walk. When they got into battalion lines, there was food ready for them, but very few wanted it. They drank and lay down in the bushes, clawed when at once to headquarters, and found Barkley Owens of the engineers with the colonel, who was smoking and studying his maps as usual. Glad to see you, Wheeler. Your men ought to be in good shape after a week's rest. Let them sleep now. We've got to move out of here before midnight to relieve two Texas battalions at Maltka Trench. They've taken the trench with heavy casualties and are beat out. Couldn't hold it in case of counterattack. As it's an important point, the enemy will try to recover it. I want to get into position before daylight so he won't know fresh troops are coming in. As ranking officer, you are in charge of the company. Very well, sir. I'll do my best. I'm sure you will. Two machine gun teams are going up with us, and sometime tomorrow a Missouri battalion comes up to support. I'd have had you over here before, but I only got my orders to relieve yesterday. We may have to advance under shell fire. The enemy has been putting a lot of big stuff over. He wants to cut off that trench. Claude and David got into a fresh shell hole under the half-buried scrub and fell asleep. They were awakened at dust by heavy artillery fire from the north. At ten o'clock the battalion, after a hot meal, began to advance through almost impassable country. The guns must have been pounding away at the same range for a long while. The ground was worked and needed until it was soft as dough, though no rain had fallen for a week. Barkley Owens and his engineers were throwing down a plank road to get food and the ammunition wagons across. Big shells were coming over at intervals of twelve minutes. The intervals were so regular that it was quite possible to get forward without damage. While B Company was pulling through the shell area, Colonel Scott overtook them on foot, his orderly leading his horse. You know anything about that light over there, Wheeler? He asked. Well, it oughtn't be there. Come along and see. The light was a mere match head down in the ground. Claude hadn't noticed it before. He followed the Colonel, and when they reached the spark they found three officers of A Company crouching in a shell crater covered with a piece of sheet iron. Put out that light, called the Colonel sharply. That's the matter, Captain Brace. A young man rose quickly. I'm waiting for the water, sir. It's coming up on mules, in petrol cases, and I don't want to get separated from it. The ground's so bad here the drivers are likely to get lost. Don't wait more than twenty minutes. You must get up and take your position on time. That's the important thing. Water or no water. As the Colonel and Claude hurried back to overtake the company, five big shells screamed over them in rapid succession. Run, sir, the orderly called. They're getting on to us. They've shortened the range. That light back there was just enough to give them an idea, the Colonel muttered. The bad ground continued for about a mile, and then the advance reached headquarters behind the eighth trench of the Great System of Trenches. It was an old farmhouse which the Germans had made over with reinforced concrete, lining it within and without until the walls were six feet thick and almost shell-proof, like a pillbox. The Colonel sent his orderly to inquire about a company. A young lieutenant came to the door of the farmhouse. A company is ready to go into position, sir. I brought them up. Where is Captain Brace, Lieutenant? He and both our first lieutenants were killed, Colonel. Back in that hole, a shell fell on them not five minutes after you were talking to them. That's bad. Any other damage? Yes, sir. There was a cook-wagon struck at the same time. The first one coming along Julius Caesar's new road. The driver was killed and we had to shoot the horses. Captain Owens, he near got scalded with the stew. The Colonel called in the officers one after another and discussed their positions with them. Wheeler, he said when Claude's turn came, you know your map? You've noticed that sharp loop in the front trench in H-2, the boar's head, I believe they call it. It's sort of a spear point that reaches out toward the enemy, and it will be a hot place to hold. If I put your company in there, do you think you can do the battalion credit in case of a counterattack? Claude said he thought so. It's the nastiest bit of the line to hold, and you can tell your men I pay them a compliment when I put them there. All right, sir, they'll appreciate it. The Colonel bid off the end of a fresh cigar. They'd better buy thunder. If they give way and let the Hun bombers in, it will let down the whole line. I'll give you two teams of Georgia machine guns to put in that point they called the boar's snout. When the Bessurians come up tomorrow, they'll go in to support you. But until then, you'll have to take care of the loop yourselves. I've got an awful lot of trench to hold, and I can't spare you any more men. The Texas men whom the battalion came up to relieve have been living for sixty hours on their iron rations and on what they could pick off the dead Huns. Their supplies had been shelled on the way, and nothing had got through to them. When the Colonel took Claude and Gerhardt forward to inspect the loop that B company was to hold, they found a wallow more like a dump heap than a trench. The men who had taken the position were almost too weak to stand. All their officers had been killed, and a sergeant was in command. He apologized for the condition of the loop. Sorry to leave such a mess for you to clean up, sir, but we got it bad in here. He's been shelling us every night since we drove him out. I couldn't ask the men to do anything but hold on. That's all right.  My men will hand out some grub as you go back. The battered defenders of the boar's head stumbled past them through the darkness into the communication. When the last man had filed out, the Colonel sent for Barclay Owens. Claude and David tried to feel their way about and get some idea of the condition the place was in. The stench was the worst they had yet encountered, but it was less disgusting than the flies. When they inadvertently touched the dead body, clouds of wet buzzing flies flew up into their faces, into their eyes and nostrils. Under their feet the earth worked and moved as if boa constrictors were wriggling down their soft bodies, lightly covered. When they had found their way up to the snout, they came upon a pile of corpses, a dozen or more, thrown one on top of another like sacks of flour, faintly discernible in the darkness. While the two officers stood there, rumbling, squirting sounds began to come from this heat, first from one body, then from another, gasses swelling in the liquefying and trails of the dead men. They seemed to be complaining to one another, glup, glup, glup. The boys went back to the Colonel, who was standing at the mouth of the communication, and told him there was nothing much to report, except that the burying squad was needed badly. I expect the Colonel shook his head. When Barkley Owens arrived, he asked him what could be done here before daybreak. The dowdy engineer felt his way about as Claude and Gerhard had done. They heard him coughing and beating off the flies, but when he came back he seemed rather cheered than discouraged. Give me a gang to get the casualties out, and with plenty of quick lime and concrete I can make this loop all right in four hours, sir, he declared. I've brought plenty of lime, but where'll you get your concrete? The Hun left about fifty sacks of it in the cellar under your headquarters. I can do better, of course, if I have a few hours more for my concrete to dry. Go ahead, Captain. The Colonel told Claude and David to bring their men up to the communication before light, and hold them ready. Give Owens cement a chance, but don't let the enemy put over any surprise on you. The shelling began again at daybreak. It was hardest on the rear trenches and the three-mile area behind. Evidently, the enemy felt sure of what he had in Molka Trench. He wanted to cut off supplies and possible reinforcements. The Missouri Battalion did not come up that day, but before noon a runner arrived from their Colonel with information that they were hiding in the wood. Five Bosch planes had been circling over the wood since dawn, signalling to the enemy headquarters back on Dauphin Ridge. The Missourians were sure they had avoided detection by lying close in the underbrush. They would come up in the night. Their linemen were following the runner, and Colonel Scott would be in telephone communication with them in half an hour. When Bee Company moved into the boar's head at one o'clock in the afternoon, they could truthfully say that the prevailing smell was now that of quick lime. The parapet was evenly built up, the firing step had been partly restored, and in the snout there were good emplacements for the machine guns. Certain unpleasant reminders were still to be found if one looked for them.  Captain Owens explained that the ground sounded hollow in there, and the boot probably led back into a dugout where a lot of hunn bodies were entombed together. As he was pressed for time, he had thought it best not to look for trouble. In one of the curves of the loop, just at the top of the earth wall, under the sandbags, a dark hand reached out. The five fingers well apart looked like the swollen roots of some noxious weed. Hicks declared that this object was disgusting, and during the afternoon he'd made nifty Jones and Oster scrape down some earth and make a hump over the paw. But there was shelling in the night, and the earth fell away. Look! said Jones when he wakened his sergeant. The first thing I seen when daylight come was his old fingers wiggling in the breeze. He wants air, heiny does. He won't stay covered. Hicks got up and reburied the hand himself, but when he came around with clawed an inspection before breakfast, there were the same five fingers sticking out again. The sergeant's far had puffed up and got red, and he swore that if he found the man who played dirty jokes, he'd make him eat this one. The colonel sent for Claude and Gerhard to come to breakfast with him. He had been talking by telephone with Missouri officers, and had agreed that they should stay back in the bush for the present. The continual circling of planes over the wood seemed to indicate that the enemy was concerned about the actual strength of Molka Trench. It was possible their airscouts had seen the Texas men going back, otherwise why were they holding off? While the colonel and the officers were at breakfast, a corporal brought in two pigeons he had shot down at dawn. One of them carried a message under its wing. The colonel unrolled a strip of paper and handed it to Gerhard. Yes, sir. It's in German, but it's code stuff. It's a German nursery rhyme. Those reconnoitering planes must have dropped scouts on our rear, and they are sending in reports. Of course they can get more on us than the airmen can. Here, do you want these birds, Dick? The boy grinned. You bet I do, sir. I may get a chance to fry them later on. After breakfast, the colonel went to inspect the company in the boar's head. He was especially pleased with the advantageous placing of the machine guns in his snout. I expect you'll have a quiet day, he said to the men, but I wouldn't like to promise you a quiet night. You have to be very steady in here. If Fritz takes this loop, he's got us, you understand? They had indeed a quiet day. Some of the men played cards, and Oscar read his Bible. That night, too, began well. But at 4.15, everybody was roused by the gas alarm. Gas shells came over for exactly half an hour. Then the shrapnel broke loose, not the long whizzing scream of solitary shells, but drum fire continuous and deafening. A hundred electrical storms seemed raging at once in the air and on the ground. Balls of fire were rolling all over the place. The range was a little long for the boar's head. They were not getting the worst of it. But thirty yards back, everything was torn to pieces. Claude didn't see how anybody could be left alive back there. A single twister had killed six of his men at the rear of the loop, where they were shoveling to keep the communication clear. In Owens, neat earthworks were being badly pounded. Claude and Gerhardt were consulting together when the smoke and darkness began to take on the vivid color that announced the coming of Daybreak. A messenger ran in from the colonel.  He was afraid they had got lost in the bombardment. The colonel says you are to take two men back to bring them up, two men who can take charge if they are impeded. When the messengers shouted this order, Gerhardt and Hicks looked at each other quickly and volunteered to go. Claude hesitated. Hicks and David waited for no further consent. They ran down the communication and disappeared. Claude stood in the smoke that was slowly growing rarer and looked after them with the deepest stab of despair he had ever known. Maybe a man who was bewildered and unfit to be in command of other men would have let his best friend and his best officer take such a risk. He was standing there under shelter, and his two friends were going back through that curtain of flying steel toward the square for which the lost battalion had last reported. If he knew them they would not lose time following the maze of trenches. They were probably even now out on the open running straight through the enemy barrage, vaulting trench types. Claude turned and went back into the loop. Well, whatever happened, he had worked with brave men. It was worth having lived in this world to have known such men. Soldiers, when they were in a tight place, often made secret propositions to God. And now he found himself offering terms. If they would see to it that David came back, they could take the price out of him. He would pay. Did they understand? An hour dragged by, hard on the nerves waiting. Up the communication came a train with ammunition and coffee for the loop. The men thought headquarters did pretty well to get hot food to them through that barrage. A message came up in the Colonel's hand. Be ready when the barrage stops. Claude took this up and showed it to the machine gunners in the snout. Turning back he ran into hicks stripped to his shirt and trousers, as wet as if he had come out of the river and splashed with blood. His hand was wrapped up in a rag. He put his mouth to Claude's ear and shouted, We found them. They were lost. They're coming. Send word to the Colonel. There's Gerhardt. He's coming. Bringing them up. God, it's stopped. The bombardment ceased with a suddenness that was stupefying. The men in the loop gassed and crouched as if they were falling from a height.  The silence was like a heavy anesthetic. Claude ran back to the snout to see that the machine gun teams were ready. Wake up, boys. You know why we're here. Bert Fuller, who was up in the lookout, dropped back into the trench beside him. They're coming, sir. Claude gave the signal to the machine guns. Fire opened all along the loop. In a moment a breeze sprang up and the heavy smoke clouds drifted to the rear. Mounding to the firestep, he peered over. The enemy was coming on eight deep on the left of the boar's head, in long waving lines that reached out toward the main trench. Suddenly the advance was checked. The files of running men dropped behind a wrinkle in the earth fifty yards forward and did not instantly reappear. It struck Claude that they were waiting for something. He ought to be clever enough to know for what. But he was not. The Colonel's lineman came up to him. Headquarters has a runner from the Missourians. They'll be up in twenty minutes. The Colonel will put them in here at once. Till then you must manage to hold. We'll hold. Fritz is behaving clearly. I don't understand his tactics. While he was speaking everything was explained. The boar's snout spread apart with an explosion that split the earth and went up in a volcano of smoke and flame. Claude and the Colonel's messenger were thrown on their faces. When they got to their feet the snout was a smoking crater full of dead and dying men. The Georgia gun teams were gone. It was for this that the Hun advance had been waiting behind the ridge. The mine under the snout had been made long ago, probably on a venture when the Hun held maltka trench for months without molestation. During the last twenty-four hours they had been getting their explosives in, reasoning that the strongest garrison would be placed there. Here they were, coming on the run. It was up to the rifles. The men who had been knocked down by the shock were all under feet again. They looked at their officer questioningly, as if the whole situation had changed. Claude felt they were going soft under his eyes. In a moment the Hun bombers would be in on them and they would break. He ran along the trench, pouring over the sandbags and shouting, It's up to you! It's up to you! The rifles recovered themselves and began firing, but Claude felt they were spongy and uncertain that their mines were already on their way to the rear. If they did anything it must be quick and their gunwork must be accurate. Nothing but a withering fire could check. He sprang to the fire step and then out on the parapet. Something instantaneous happened. He had his men in hand. Steady, steady! He called the range to the rifle teams behind him and he could see the fire take effect. All along the Hun lines men were stumbling and falling. They swerved a little to the left. He called the rifles to follow, directing them with his voice and with his hands. It was not only that from here he could correct the range and direct the fire. The men behind him had become like a rock. That line of faces below, Hicks, Jones, Fuller, Anderson, Oscar, their eyes never left him. With these men he could do anything. The right of the Hun line swerved out, not more than twenty yards from the battered snout, trying to run the shelter under that pile of debris and human bodies. A quick concentration of rifle fire depressed it, and the swell came out again toward the left. Blood's appearance on the parapet had attracted no attention from the enemy at first, but now the bullets began popping about him. Two rattled on his twin hat. One caught him in the shoulder. The blood dripped down his coat, but he felt no weakness. He felt only one thing, that he commanded wonderful men. When David came up with the supports, he might find them dead, but he would find them all there. They were there to stay until they were carried out to be buried. They were mortal, but they were unconquerable. The curdle's twenty minutes must almost be up, he thought. He couldn't take his eyes from the front line long enough to look at his wristwatch. The men behind him saw Claude sway, as if he had lost his balance and were trying to recover it. Then he plunged face down outside the parapet. Hicks caught his foot and pulled him back. At the same moment the Missourians ran yelling up the communication. They threw their machine guns up on the sandbags and went into action without an unnecessary motion. Hicks and Burke Fuller and Oster carried Claude forward toward the snout, out of the way of the supports that were pouring in. He was not bleeding very much. He smiled at them as if he were going to speak. But there was a weak blankness in his eyes. Burke tore his shirt open, three clean bullet holes. By the time they looked at him again, the smile had gone. The look that was Claude had faded. Hicks wiped a sweat and smoke from his officer's face. Thank God I never told him, he said. Thank God for that. Burke and Oster knew what Hicks meant. Gerhardt had been blown to pieces at his side when they dashed back through the enemy barrage to find the Missourians. They were running together across the open, not able to see much for smoke. They bumped into a section of wire entanglement left above an old trench. David cut round to the right, waving Hicks to follow him. The two were not ten yards apart when the shells struck. Then Sergeant Hicks ran on alone. CHAPTER XIX The sun is sinking low, a transport is steaming slowly up the narrows with a tide. The decks are covered with brown men. They cluster over the superstructure like bees and swarming time. Their attitudes are relaxed and lounging. Some look thoughtful, some well-contented, some are melancholy, and many are indifferent as they watch the shore approaching. They are not the same men who went away. Even Hicks was standing in the stern, smoking, reflecting, watching the twinkle of the red sunset upon the cloudy water. He is more than a year since he sailed for France. The world has changed in that time, and so has he. Bert Fuller elbowed his way up to the sergeant. The doctor says Colonel Maxi is dying. He won't live to get off the boat, much less to ride in the parade in New York tomorrow. Max shrugged, as if Maxi's pneumonia were of no affair of his. Well, we should worry. We've left better officers than him over there. I'm not saying we haven't, but it seems too bad when he's so strong for fuss and feathers. He's been sending cables about that parade for weeks. Ha! Hicks elevated his eyebrows and glanced sideways into stain. But he sputtered, squinting down at the glittering water. Colonel Maxi, anyhow, Colonel for what Claude and Gerhard did, I guess. Hicks and Bert Fuller have been helping to keep the noble fortress of Ehrenbreinstein. They have always hung together and are usually quarreling and grumbling at each other when they are off duty. Still, they hang together. They are the last of their group. C. Jones and Oster, God only knows why, have gone on to the Black Sea. During the year they were in the Rhine Valley, Bert and Hicks were separated only once. And that was when Hicks got a two-weeks leave and, by dint of persevering and fatiguing travel, went to Venice. He had no proper passport, and the councils and officials to whom he had appealed in his difficulties begged him to content himself with something nearer. But he said he was going to Venice because he had always heard about it. Bert Fuller was glad to welcome him back to Coblence and gave him a wine party to celebrate his return. They expect to keep an eye on each other. Though Bert lives on the Platte and Hicks on the Big Blue, the automobile roads between those two rivers are excellent. Bert is the same sweet tempered boy he was when he left his mother's kitchen. His gravest troubles have been frequent betrothals. But Hicks' round, chubby face has taken on a slightly cynical expression, a look quite out of place there. The chances of war have hurt his feelings, not that he ever wanted anything for himself. The way in which glittering honors bump down upon the wrong heads in the army, and palms and crosses blossom on the wrong breasts has, as he says, thrown his compass off a few points. What Hicks had wanted most in this world was to run a garage and repair shop with his old chum, Dell Abel. Beaufort ended all that. He means to conduct a sort of memorial shop anyhow with Hicks and Abel over the door. He wants to roll up his sleeves and look at the logical and beautiful inwards of automobiles for the rest of his life. As the transport enters the North River, sirens and steam whistles all along the waterfront begin to flow their shrill salute to the returning soldiers. The men swear their shoulders and smile knowingly at one another. Some of them look a little bored. Hicks slowly lights a cigarette and regards the end of it with an expression which will puzzle his friends when he gets home. By the banks of Lovely Creek, where it began, Claude Wheeler's story still goes on. To the two old women who work together in the farmhouse, the thought of him is always there, beyond everything else at the farthest edge of consciousness, like the evening sun on the horizon. Mrs.  She was reading when the telephone rang. Is this the Wheeler Farm? This is the Telegraph Office at Frankfurt. We have a message from the War Department. The voice hesitated. Isn't Mr. Wheeler there? No, but you can read the message to me. Mrs. Wheeler said, Thank you, and hung up the receiver. She felt her way softly to her chair. She had an hour alone when there was nothing but him in the room, but him and the map there, which was the end of his road. There, among those perplexing names, he had found his place. Claude's letters kept coming for weeks afterwards. Then came the letters from his comrades and his colonel to tell her all. In the dark months that followed when human nature looked to her uglier than it had ever done before, those letters were Mrs. Wheeler's comfort. As she read the newspapers, she used to think about the passage of the Red Sea in the Bible. It seemed as if the flood of meanness and greed had been held back just long enough for the boys to go over, and then swept down and engulfed everything that was left at home. When she can see nothing that has come of it all but evil, she reads Claude's letters over again and reassures herself. For him the call was clear. The cause was glorious. Her adult stained his bright faith. She devines so much that he did not write. She knows what to read into those short flashes of enthusiasm. How fully he must have found his life before he could let himself go so far. He who was so afraid of being fooled. He died believing his own country better than it is, and France better than any country can ever be. And those were beautiful beliefs to die with. Perhaps it was as well to see that vision, and then to see no more. She would have dreaded the awakening. She sometimes even doubts whether he could have borne at all that last desolating disappointment. One by one the heroes of that war, the men of dazzling soldiership, leave prematurely the world they have come back to. Airmen whose deeds were tales of wonder. Officers whose names made the blood of youth beat faster. Survivors of incredible dangers.  Some do it in obscure lodging-houses. Some in their office, where they seem to be carrying on their business like other men. Some slip over a vessel's side and disappear into the sea. When Claude's mother hears of these things, she shudders and presses her hands tight over her breast, as if she had him there. She feels as if God had saved him from some horrible suffering, some horrible end, for as she reads she thinks those slayers of themselves were all so like him. They were the ones who had hoped extravagantly, who in order to do what they did had to hope extravagantly, and to believe passionately. And they found they had hoped and believed too much. But one she knew, who could ill-bear disillusion, safe, safe. Mahaley, when they are alone, sometimes addresses Mrs. Wheeler as mutter.  Mrs. Wheeler knows that then she is thinking of Claude, is speaking for Claude. As they are working at the table or bending over the oven, something reminds them of him, and they think of him together, like one person.  Mrs. Wheeler always feels that God is near. But Mahaley is not troubled by any knowledge of interstellar spaces, and for her he is nearer still, directly overhead, not so very far above the kitchen stove. This is the end of One of Hours by Willa Cather. Recording by Tom Weiss


So, hello everyone, welcome our next speaker in Securited Everyone, Lorenzo Fontana, and his talk about Falco Internals 101. Hey, I feel a lot of pressure just because, I mean, it's Saturday and it's lunchtime, so you're all here to listen to this, so it's a very, very high pressure situation. So, we are going to talk about the Falco project and how we've been able to put Cisco to user space, bring Cisco to user space in a very fast way with very low throughput. The thing is that, I didn't really want to talk about the Falco project, which is the GNSF project I work on, but while doing it, actually discovered that we have been making something very interesting for everyone to listen to. So, I actually wanted to tell everyone. If you already knew me, it would be probably because of my book, Linux Observability with BPF, and maybe because you're involved in the Kubernetes space or the Kubernetes space in some way, and also because I've been engaged with them for the past five years probably. First things first, I want to give you some context to let you understand. Falco is a project that basically takes every Cisco that happens while no one is looking at that. Every Cisco is brought to user space, and with those Cisco's, Falco processes a set of rules that again gives you alerts based on what happened in the system. It has been started four years ago, and two years ago it had been donated to the GNSF so that everyone could contribute and make it better. It's written in C++, which already makes it crazy enough. But we wanted to add Cisco's. Cisco's are very interesting mechanism. It's an API to the kernel. It obstructs the hardware to you so that you can just do things without actually destroying this machine and you can interact with the kernel. If you think about Cisco's, whenever you open a file, a Cisco is done, whenever you establish a connection, a Cisco is done, whenever you do anything, a Cisco is done. Even if you use a very high-level language at some point, a Cisco is done. And the Cisco interface might be abstracted by libraries like GNPC, these things. Cisco's are very scary. Whatever library that deals with Cisco, we'll have to actually map every single Cisco to deal with that. And this already makes... This already creates a very high bar for any security implication because if you have a kernel and you have Cisco's, the next kernel version will have maybe a new Cisco, maybe a new parameter, maybe a Cisco-changed version, these kind of things. If I keep saying the words with AD suffix like changing, it's because I'm Italian and I do that and I cannot deal with that, so sorry. Cisco's are very powerful, are very good for kernel space, but are not very, very good for user space. To bring every Cisco to user space, guess what you have to do? A Cisco. So it's already a very, very hard problem. It's like the kitchen area. And if you don't believe me that the problem is that, try to have a system with a throughput of five millions of Cisco at a second. It's crazy. You have five millions of Cisco's and another five millions of Cisco's to actually deal with the Cisco and so on. And it's not 1998 anymore. I mean, it was like five, but the kernel was very, very simple back then. Things like multi-treading and stuff. And you really need to know that when you want to deal with Cisco's and when you do security tool in general, you also have to deal with time. And guess what you need to deal with time? A Cisco. Nice.  So you have to deal with time for every single architecture you want to support. And it's another maze, like this place. And also, if that wasn't enough, Cisco's are not enough because you get a Cisco that tells you, hey, someone opened this file with these permissions. Thank you.  We're a different world than 20 years ago. And you don't have just a system that runs Apache with some PHP. You might have containers where you have a very complex infrastructure. And you want to know in which container this is collected, in which network namespace. If the network namespace was with a mountain namespace or if the attacker actually did something nasty, maybe they changed the C group of the network namespace. So having container information is also useful. And for container information, you have to deal with systems that are very slow because you are going to take the container information from the Docker demon or from container D or something, like with their API. And those are APIs designed to go at, you know, with a latency of 100 milliseconds. But Cisco's are very fast. Five millions a second. And you want to correlate every Cisco to... It's crazy. To every... We didn't solve this problem yet in a very good way. So how to do that? We've been asking ourselves this question. There's a third answer that we didn't even develop yet, but it's secret. And basically two ways.  Nice. Or when you upgrade your kernel, when you install some modules, imagine having your company with 100 servers pack updates, restarts the machines. And that wasn't very handy. So we also implemented any BPF probe, which everyone knows what is it, because my talk is not done in BPF and they didn't want to explain. You know BPF? Okay, great. Like 20%. So I will explain it very fast.  Pros, you implement whatever you want. It's very efficient. Cons, it will kernel panic your machine and then as soon as you do a mistake, it will start all down. And you don't have a way to reboot them. And, you know, it's very hard. With an BPF probe, the mechanism is a bit more sophisticated. You can't implement whatever you want because there are some limitations, but you can still go to the kernel and ask for information in a very efficient way. So how does this look like? Well, I initially wanted to do this presentation in the terminal. So they had to do diagrams. So my diagrams are not very good, but, I mean, it gives an idea. So you have the kernel space and user space separated. You have the kernel module on the lower bound, and you have Falco in the upper bound. And in the middle, there are a set of libraries and tools that, you know, allow you to process the Cisco in a very efficient way. Let's start from the bottom. The kernel module is the first implementation. It's still there and still works as Falco. And it basically goes to the kernel and attached to every Cisco that gets executed when it starts executing and when it exits the execution. Like, imagine putting a jump at the start of every function and a jump at the end of every function that executes the Cisco. That's it. When this code executes, it sends it to a ring buffer, which we're going to be talking later, that then is consumed in user space profile descriptor, you know, like a device, like the device of your printer, because this is a kernel module. And then this is consumed by another library that enriches all this stuff with container metadata and stuff which is called lib scenes. We will talk about this more in details later. And then Falco can, you know, match your rules. So this is crazy. First things, a ring buffer. A ring buffer is a data structure that is basically, imagine a link at least, but that links to itself. This is to avoid that you have to... What's happening with the microphone? This is to avoid that you have to actually shuffle back the buffer to the starting point of the execution so that you can continue putting elements and, you know, the last element was overwritten, like a first infrastructure. And in Falco, we decided the perfect size would have been 8 megabytes for it because it fits well in most of registers. It's very handy to use both from kernel space and both from user space. Most users that have very strange use case, they adjust this, but it's a compile-time thing. I personally never had a problem. The kernel takes the events and it mem copy the event to the next pointer in the ring buffer. That's why this is fast. So the memory is never, ever copied. It's just copying the pointer of the memory. Sorry, I did the wrong thing and then contradicting myself. The memory of the pointer is copied to the ring buffer so that you have access to that memory. And at that point, you can load this data from user space by reading the dev Falco 0 files. This is basically how the structs look in its header file and this header file is shared between the user space and kernel space. So you basically, what you're interested in, it's in the head and the tail. And then there's some metadata for you to understand if your ring buffer is performing well. I'm showing this because we are all used to very high-level code, I mean, object oriented programming, all the stuff, functional programming, all the interesting things that I love. But when you have to do these kind of things, you actually have to, you have no choice than designing a struct that has everything in it because you have to make it fast.  Dropped events happen because maybe the ring buffer is not fast enough. Remember when I said five million syscalls? Maybe at five million syscalls, events are starting to get in-dropped so there's no memory free in the ring buffer to put them. And at that point, syscalls are not yet ready to be used by your application because, well, you receive a pointer first. Second thing, you go to the pointer to see what's inside. There's memory. And then you look and there's only the name of the syscall and some other, you know, some other data that you don't understand. So we had to make a mechanism that's called fillers that basically goes to every syscall, you know, when I said do this for five millions of syscalls. And it takes, with the fancy functions, syscalls get arguments deprecated because there's no other way yet. It takes the registers and transforms that information to a string or to, you know, in this case. The information was not there, so it just prints out not available. And then, if there have been success, the syscall isn't reached. It's still in the same data structure. So you have to do this for every syscall two times because there's the enter and the exit. And nothing, I just wanted to share this with you all because it's been painful. And at some point, you go to people, you talk with others. You find out that there's EBPF. You find out that people are very upset about having to compile their current module all the times. And you decide to do this with EBPF again. And turns out that it's a much nicer experience. There's no ring buffer involved at all because EBPF doesn't allow you to, you know, to advise and, you know, move memory from current space to user space the purpose of it being safe will be totally, you know, it will be totally useless. But it has a set of concepts that allow you to do that in fancy ways that are called maps. And in this case, Libscap, which was the library that before was just reading the file descriptor, loads an EBPF program to kernel space and says the kernel, hey, kernel takes this object that I compiled for you and the kernel says yes. And then the kernel says, oh, yes, I like this. And then the kernel says, okay, I will send you data. And, you know, all this conversation was the EBPF verifier, which basically makes sure that you don't mess up with the kernel. And at that point, data flows to Libscap through EBPF maps. And guess what we had to do to do the fillers? We had to tell, this is very, very nice, we had to tell Libscap to actually send EBPF programs in the map for the kernel to load them at runtime when they're needed. I mean, you have to see the code. It's very fine. And this makes sure that, again, every syscall is matched with the right arguments.  You want to see, you want to see these to 0777 or you want to see the actual name of the constant, like you want to see SUID, right? And to come back to Libscap just to explain better, what this does, it basically maintains the control loop through the kernel module and to the EBPF map because when you read from that file, you know, it's a device, so you continue to read, right? Because you need to consume it or you lose it. And when you do a security software, you cannot lose data, right? You cannot just, I'm not reading it for a while, so that. And, you know, attacker, very, very happy about you not doing that. So it has the responsibility to do that and we had to actually do a library that does that because the attack surface of that library alone would have to be very, very small. It would have to be just some lines of code. Because at that point, since that, you know, does the enrichment to the next slide has a lot of, you know, code that talks with container runtimes and, you know, other parts that, you know, might be compromised. And this also does a very nice thing, which is the SCAP format, which is a file that you basically can write and read. It's a format so you can avoid when you need to test dealing with Cisco, you can avoid to have a real kernel. You can just write and read from this file. And then, again, since that's the container runtime metadata, and I said this is in C++, so we basically had to rewrite the client for every container runtime. Nice. And we're next to metadata and filtering. And this is essentially what Falco is. Well, it's much more than this because if this won't be, the project will not exist. But it's just a main with a while loop that has an event called since pivant here. And every time that we go to the next iteration, the pointer is reset and sent to the next event. And then the Falco engine applies the rules, the Falco rules to this event to match and there was a treat. And if you want to see a Falco rule, is it okay to see? Yes. This is how it looks like. So you have the rule name. It's very fancy. YAML. No one loves the YAML. Oh, my gosh. And that's the description of the rule and then there's a condition. We... Let me find the very easy one. I don't want one with a macro because if not, I have to expand the macro. Okay. Okay, this is a perfect condition. So in this case, we have a macro which we can use to avoid repeating the same thing. And it matches to the event type execv. So whenever someone executes a process exactly in Cisco, we direction to the left so when the Cisco starts executing, it will actually match and go to the next condition. So that's why we needed to do all this crazy stuff. Another important thing, when you deal with Cisco and when you deal with having to bring them to user space, that was one of the mistakes we've been doing earlier was to actually send all the Cisco that was the initial point of my presentation. You don't actually have to. You just send the Cisco's that match the conditions. So what we did at some point was to take some parts of the filtering mechanism and bring them as close as possible to kernel space so that we could actually just take out the Cisco that we needed with the arguments that we needed. Because maybe there are five million Cisco's but we are only interested in opens of this file. And to summarize, you really want to do an VPF probe when you do a project that does something like this because implementing your own kernel module is never a good idea. And having very well-defined boundaries and interfaces is always a good idea because you can work on something that you... And that's very well-defined again. Like, as I said, this cap format is very useful because you can use that format even to send data to another server in your infrastructure. So it's very easier to, you know, make anything on top of that, like a user interface, like Wireshark, right? Wireshark basically use the pick up format. I could make Wireshark-like interface for the cap format, for example. And if you're interested in learning more because 25 million, I guess it's not enough. And also, I speak very slowly. You can join the community or go to the website or find me on my email or don't do anything because you are not interested. And thanks. We might have time for one or two questions if they will not be too far. Hello. Scream. Hello. What is the performance impact on running Falcon machine? Okay. The first question and the second question is if something maps the filter, is there any way to have an action to take place right away instead of a symbol output or something bad happen? Okay. I'll start with the second question. The second question was, there's any way to do an action when something happens, like, you know, doing prevention like Sea Linux or something like that? Well, with custom code. And there's not, actually.  It's just detection. So it will tell you when something happens. It's in, you know, in that kind of segment of security software where it totally tells you, hey, there's someone poking you, you know, mining some bitcoins on your machine, but it doesn't actually stop the miner from happening. It will send those data to, you know, a server like, you know, a collection mechanism that you use and with those information you can actually take action, like either manually or with a script or with whatever you want. And the first question was, what's the performance impact the performance impacts are very different based on the rules you apply on most of the machines that I personally use because it's an open source project and I don't actually have, you know, myself production machines but, you know, the users have and what I've been noticing in the issue and in the community calls was that it was around one or two percent of the CPU usage. We are almost out of the time so if you've got some other questions please talk. I'm sorry.


Kaj, nekaj, nekaj, da imamo vse, kaj smo tukaj. Zato vzelo, da je tukaj, tukaj basične koncepti v artificialne neuralne netore. Zato vzelo, da je presepton, ko je tukaj specialne neuralne, kaj nekaj zelo, in nekaj zelo, The output, since it can mimic a hand-gate, it can sequence of them can mimic a universal computation. Is a problem, the problem is that these circuits are discreet, so changing the biases and is weights of the perceptrons do not lead to smooth changes of the output, so they are very difficult to train.  Nelzno se nuronov ima vsega zelo vsega intergurstje, vzelo in nezelo in nezelo, nezelo in nezelo, in tk pa za sigmoidj. brew produce is the following so it's a more or less an average side function in fact one can actually prove that these sikmon neurons can mimic perceptrons so ljuboče samostavno, ki imaš površenje, izgledaj. Tako, to je, da je očinšta. Zato, ki smo površenjali svoje zbrane in zelo, skala kakvo prejno se da taj pridizije. Tudi, da je to broj, tako da se taj pričo trajit, ti je tengel in imel, ta bo seš, da je to pričel, ta bo seš, pa nekaj, pakaj, kaj je, Your data is called the input layer. Then there will be an output layer. In this case of this sample is just one neuron, but it can be many. And whatever is in between the initial input layer and the output layer are called hidden layers. And I've already mentioned that the more hidden layers, the more neurons you have, in je zelo, da je nekaj državek zelo, kjer sam je zelo, da je nekaj državek zelo. Zelo, da je od taj državek, ki jih se v tudi sredimo, in je začasno, da nekaj državek prišli od nekaj državek, nekaj nekaj državek, ki jih se v tudi sredimo. In nekaj državek, ki jih se vrade vsem, da je stvar, ki nekaj državek ta delja neče nekaj državek. kako je zelo, da sem vseh nekaj nekaj prehlad. Zelo sam se nekaj prehlad. To je nekaj zelo, da je bi tudi nekaj prehlad. Vse tako je načinčne in začinčno začinje z izgleda z izgleda in začinčno začinje in začinje začinje. Zato je so počke. Zato je začinje začinje. Kako je začinje vseh zrčinje in tudi have other architectures of networks, for example, recurrent ones, but we are not going to see them. Now, let's see an example of how this set of neural networks can be used. This is, for example, to recognize, to classify handwritten digits. Stimulelo pa nični občadni vesel. Genetno, da milim vzelo. Čutak je zašel na del. To je izgleda na daž du ječtneimi i nična. Dinažne imegje pri vse poslede na datacete mnist. And there are black and white. So each pixel can be associated with a number between 0 and 1, and that will be the input of my neural network. And there are enough of them with a label associated to that, such that you can train your network. The network, in network to recognize, to classifyato is handwritten digit do, can look like something like this. So you have an initial set of your input layer that is composed of 784 neurons because the pixel are almost 30 times 30. And these are all the input data. Vo vsehoj na toga strasne, je dobro gol轅ost, ker isto, da je ena stoljama na neuronji. Slijte, da sem neHi generi o 15 ali pa se izpakim dobro 30, 60. Zato nekaj, zelo ne brain, in način srednji stros kot tako, ko povojimo, in ne odličim, da ga ekokratia izstavno in poslednjo. zelo pozbite moj nobelje, zelo gašan trunar, zelo gašan trunar začo do cr. Zelo gašan trunar začo do zelo, zelo gašan trunar začo do cr. interesierti po vzgledaj za 0 to 9, ca ne lumin tendedstvo, ko smoothieu za to. B origine je pobite po obstah na površč可能o vstahu, vse težite izopo obtiv. Ale čestne... Zelo je hristo, asa zelo je nekaj sek. Zelo je 10 n jubalstv. To je svebej hristo oprečenju vseboj vseboja neuralna damita. Zelo čestne je operacija o njimeljihodur, za st toolboxu, za tudi je se veš zašte parametranje.�니다, ker neko se vela naredijo, da se neko naredijo, tako čeeg nekaj neuron vzovec 700 eštečnost in isdski vse, zainemno, še v thosei vzamo, če vse vse neko neko jel stavili, neko se neko nekaj neko, če vse nekaj neko nekaj neuron, So it. More than 20,000. No, bo. I don't know. But, order of various thousands of... No, 12,000, or something like this. So, quite many parameters to optimize. Tukaj je, če obtimizujemo, če je univerzal, je dobro, je pravda potrebna, ali je zelo veliko parametri. Pozivajte, da je tukaj problem. Vse je, da imamo ideje, tudi imamo taj mislj, dataset, ki se počeš, ta imač je 28 pixel x 28 pixel, tudi je to 784 pixel. Taj trening da se počeš, da se počeš, da se počeš In test set, da je vzgleda, da vzgleda akuracije in preformacije vzgleda, je 10.000. In zelo, da se vzgleda, da ima, da ima, da je vzgleda, da se vzgleda, da se vzgleda, da se vzgleda in te, da je delet vo vzgledaj, ko je vzgleda in taj set vzgledaj, ko je delet vo vzgledaj. Tak vzgledaj. Tak vzgledaj. Tak vzgledaj. Tak vzgledaj. taj 784 reali nr. in 0 in 1. As output we decided to have, but this is an arbitrary decision and I'll come back to this later on. We will have our output A that is given by 10 real numbers between 0 and 1. And this output A in the notation that I used this morning is given by my function parameterized by all the weights and with W I include also the biases of the input x. I can be more explicit and put the biases as well. So this is the output of the neural network, but the output that we actually want because these are all labeled by the corresponding digit, the desired output. I can call it y of x and this is going to be given by 10 numbers all 0 except 1. Let's say that these are 10 numbers and this is some jth position corresponding the jth digit. So if my image and written digit was 3, this vector will be 0, 0, 0, 1, 0, 0. Is the notation clear because I'm going to use it? Yes, yes, yes, yes, yes. Thanks. So as I was mentioning before, in order to train it, we have to define a cost function. So let's define the cost function for this case, this specific case. And it will be a sort of distance, as I said before, between the labels, so the desired output and the output of the network. So my cost function, I can define it as a function, of course, of the weights, the biases. And this is an average of all the distances. N is my number of data, so 60,000 in this case. So the sum of, and as a distance, I take simply the Euclidean distance, let's say, between the desired output and the actual output, a, of my neural network. Other cost functions can be used, but we will consider that. And the cost function that you use can determine the performance of your network. So this abbreviated is an average of something that I could call a cost function that depends on x, average over all the training set. Other that can be used are cross entropy, for example. So, and the aim here is, as I said before, but more explicitly, minimize my cost function over the parameters, the weights, and the biases. So learn the parameters. This is also the language that is used. How do we do that? Let's see this stochastic gradient descent algorithm that I was already mentioning briefly before. So if that example was, 2.3, this is 2.4. Stochastic gradient descent. To easy denotation, I'm going to substitute weight and biases with just one parameters, new. One letter to describe my parameters, new. It comprises both weights and biases. And we want a strategy to update new in such a way that the cost function decreases with my after each update. And the notation that I'm using is, an update for the set of parameters new means that new will go to new plus delta new. And I will indicate actually explicitly that these are vectors. And so new will be given by first component, last component, whatever it is, and delta new by the deltas of each component. Now, what happens when this parameter changes to our cost function? In general, the cost function will change and will become the same cost function as before plus a certain increment. And at first order in the parameters, this increment is going to be given by the gradient, sorry, delta C, is going to be given by the dot product of the gradient of C and the increment in my parameters. So where this is my gradient vector, that explicitly means that I'm just taking the partial derivatives of the cost function in respect to each of the parameters. It depends on what was d, I think it was d, yes. We want this increment to be always negative so that this means that the cost function decreases. So we can decide to update our parameters directly following the gradient itself. So delta new, the increment of the parameters is given by minus a certain parameter eta times the gradient. And this eta is commonly called learning rate. Then, obviously substituting this expression into that, we have that the increment in the cost function is going to be given by minus eta, the modulus, the length of my gradient, which is obviously negative, so we are happy. And this rule, star, is the update rule for the parameters used for the network. So now you might ask, well, that's fine. If you can calculate the gradient, then you can update your parameters and you can follow the gradient. There are two problems, of course. One is that your cost function for which you want to calculate the gradient is actually an average over many data, let's say 60,000. So that means that you have to calculate 60,000 gradients, which is already extremely slow, even if the gradients are relatively easy to calculate. And the second thing, well, this is a minimization problem, so how can I be sure that I don't get stuck in local minima. And here is where stochastic gradient descent comes into play, because essentially what is done in training neural networks is that instead of calculating the gradient for all the parameters, for all the data in the data set, we calculate an approximation of this average, not over the full training set, but over only a batch, a part of it. And we call this part of it, typically we call them mini batch. So the solution to this problem is to use stochastic gradient descent. Up to here, this is essentially the update rule of just gradient descent. You are following the gradient, you are descending it. And now we add stochasticity to solve these two problems that I mentioned. So let's use this notation. Let's denote a subset of a random subset of my data, x tilde 1 up to x tilde m, typically much smaller than n, n can be just equal to 1, so in that case it's called a batch, this thing. And they belong to the training data set. They are chosen randomly and they are called mini batch. And the approximation that we are actually implementing, we want to implement, is the fact, instead of calculating my gradient, which in principle is the gradient of this average of cost function over the full data set, so this x i, which by linearity here is given by 1 over n, the sum of the gradient of c x i. Instead of this, I say, okay, I don't care, instead of calculating the average over all the gradients, I just calculate the average over a mini batch. So this is given by approximately 1 over m, the sum of the cost function, not over the full set of training data, but over the mini batch only. And therefore, the update rule, in general was this one, becomes, and I'm going to... Okay, I have it written here. It's going to be given now for the weights and the biases by these expressions. So every weight wk is going to be... Every weight wk is going to change into itself minus this learning gradient divided by m, so m is the size of the mini batch, and the gradients with respect to wk of only the data belonging to the mini batch that I have stochastically chosen. And then, once this is performed, the... Once you have calculated this gradient, you do this update of the parameters, and then you redo exactly the same thing, but for another different randomly chosen mini batch. Okay? So you repeat the update rule, which is above in the slide, for another mini batch.  This is part of, again, the heuristic of training in neural network. You can exhaust all your training data, or you can stop before. Whenever you stop, let's say, when you finish your training data to make it easy, you call this process of repeating this update rule, changing mini batch, and then update, change the mini batch, etc. You call it an epoch. Okay? When you finish it, you say that you have finished an epoch of training. And then you start again. Okay? How many epochs? Again, depends. Okay? When do you stop? It depends. But in principle, you expect that at some point it converges. So ideally, you decide to stop when you have trained the network on the training data in such a way that when you are going to verify how your network works on the set, the test set, you reach an accuracy for which you are happy enough. Okay? So that's more or less what else, how much you have to train. But I will also say something more about that later. Of course, two things. As I said, first it's much faster than calculating the real the real gradient simply because the size of the mini batch is much smaller than the size of training data. And second, since you are doing this stochastically, essentially you are changing the landscape of your function, of your cost function over and over again. So this helps a lot in avoiding local minimum. Was this your question? No. Yeah? There was a question? Yeah. So it depends of how many data you have at this pose. So the larger the training set the more confident you are that if you find a large accuracy for your training set then that means that whenever you receive a new data outside the training set outside the test set a real, a genuine new data then you are more confident that your network is going to give you a decent answer. But in principle if my new data are taken from something that has nothing to do with this is not hard science. OK. A sekund. So in order to answer to this question let me introduce a bit of extra terminology. So for a network we have this W and this B so the weights and the biases. These are what we call the parameters of the network over which we are going to do this stochastic gradient the send. But then correctly there is all the rest. So all the rest means on one hand for example what I told you before so how you load your data etc. But the point is that you have somehow to choose the number for example of hidden layer. The number of hidden neurons you have to choose your learning rate. OK. Et cetera, et cetera, et cetera. So these all the rest of these parameters are called hyper parameters of the network and whereas let's say stochastic gradient the send tells you how to optimize the parameters of the network there are then and this is quite prescriptive OK. So it's relatively easy to implement stochastic gradient the send. Training a network means essentially being able to optimize the hyper parameters. OK. And that is difficult. OK. This is the difficult part of training a network where a lot of heuristics comes in. OK. Kicks in. And so there is for example a relatively basic strategy is to take what I called the training set and divide it actually in two parts. What we continue calling a training set and what we what we call the validation set which is different from the test set. OK. And we change the hyper parameters by finding the ones that gives us better performance so better accuracy on the validation set. OK. So of course one has to come to a certain tradeoff between for example computational time because the more the neurons you have in your networks the more expressive it will be so the expressive power of your network will be will be larger but that also means that in order to calculate all these gradients et cetera will take longer. So at some point you might decide OK my hidden layers my hidden neurons my speed I will give you example now are good enough on my validation set. OK. And so at that point I can use the test set finally. And that will be the accuracy because maybe my hyper parameters are very good for the training set and the validation set but they are not good to the tests for the test set so they are not good for new data. So you have to finally test it on you have to finally assess the performance on the network on some data for which the network has not been trained. Otherwise it can perfectly always you can enlarge enough the number of neurons such that it will always work. So let me give you some examples of training. OK. I think I have it actually entirely this part on the slide. Yes. OK. So this is done using the code that I was mentioning before. So using Nissan codes that is attached to his web book. It's a non-efficient code, highly non-efficient but it has just 74 lines of coding in Python. So it's very short. It can be understood easily and it's not something that you will want to use in your research but it's something you will definitely want to use to learn more or less what what it means to program a neural network. What's happening here? Idu Roma was detected probably. OK. So this is the example of the handwritten digits that I gave you before. So we have an input set of neurons 84, this has been decided and here for example we have 30 neurons in our hidden layer. The outputs are 10. Training images are 50,000 because actually what one is doing is doing this division. So it's taking 50,000 for the training set and 10,000 for the validation test set but for the moment let's not care about it. Actually let's not care about it too much at all. The mini batch size is very small. No, it's just 10. 10 out of 50,000. You have a certain learning rate and you decide to do just 30 epochs. The test images are 10,000 and this is an example of the accuracy over the test set. So after training the network with 30 epochs we arrived to this accuracy. So out of the 10,000 images belonging to my test set 9,534 were correctly classified. And this takes some minutes to run. It depends on the speed of the computer. Of course. It's not something that is very consuming. What, sorry? Yes, at some point let's see. At some point it can reduce. Absolutely. There is no one that tells you not to come back. What do you mean? No. Yes. Not only you can come back, you can do even better. So let's see. Let's say that instead of using 30 hidden euros now we keep all these parameters the same and we use more hidden euros. Neurons, 100. So we do this in final accuracy now of 96.59 so it's slightly larger than this one. So you can increase. And it's even larger than this. By increasing the number of neurons. But one has to be careful because touching these hyperparameters is not always easy. So the number of neurons is an hyperparameter. This going from 30 to 100 was advantageous. But if you change other parameters like for example, the learning rate. Here I changed from 3 to 10 to the minus 3. You can see that the algorithm is much slower. And this can be understood because that was a learning rate so it was essentially how fast I follow the gradient. But no one is telling you in principle what is very slow. Because it depends on the function that you want to fit. So one has really to do this training on a validation set for this set of parameters. But here you can see at least this is so too easy because it's monotonically increasing. So it doesn't decrease. So you can understand that probably I have to speed up a bit with my learning rate. And this final accuracy is quite bad. But then can happen even worse things can happen. So if the learning rate is too if the learning rate is too high then essentially you are not learning anything. You are just wild guessing. Actually a bit worse than wild guessing. And you can see that it decreases, for example. At the first it was really a wild guess then it got even worse. So this increasing or decreasing of the accuracy depends really on your hyper parameters. And you have to do various training and of course there are techniques to improve this. And I will mention a couple. But I don't have time in the details. But yes. This is part of training a network or learning how to train a network. Using for the same digits highly performance codes. So not these neural networks built with codes of bit more than 70 lines. Much higher accuracy on the test set can be reached. So up to an amazingly good level, so something like that. Which means that all the test set images are correctly classified except 21. And this is a sample of those 21 images. They are not correctly classified because also for a human high they are impossible almost to classify. So the label attached to that to me it might look a sort of random label anyway. And this is something we touch upon briefly also this morning. So the labels of your original set of data can be subjective. OK. So now in the last 13 minutes just a couple of things mostly one. Just one is keep it. And it is calculating gradients can be done but is typically time consuming. So there is this technique of calculating gradients which is for neural networks which is extremely efficient from a numerical viewpoint and quite intuitively to understand. So I'm not going to give you a full derivation and a full explanation of how the back propagation algorithms but just an idea of how it works. It's essentially implementing the chain rule of derivations the other way around for activation functions for which you can easily calculate the derivative like the sigmoid for example. And I will explain this intuition using computational graphs. And this is really the workhorse of the back propagation algorithm in stochastic grad descent is what changed the field really sort of 10, 15 years ago. Together of course so these algorithms are learned since 20, 25 years ago they were good but the computers were not good as soon as the computational power caught up then all these business exploded. But they are mostly based so the training of the network is mostly based on the back propagation algorithm together with stochastic grad descent. So I took these slides from these websites so you can go there and have a look because it's quite clear this planation. So let's first consider an easy example so how to do simple arithmetic compute on graphs. So let's assume that we want compute a function e that is given by this expression a plus b times b plus 1. So we can do it in steps we can call this a plus b we can call it c b plus 1 d and so e is then given by c times d and we can represent these multiplications as different nodes in a graph. So I have that originally I have a and b. I put them together here I have c that is given by a plus b and here there is another function that is multiplication that is given by c times d. The label of my nodes tells me what the node actually computes. And these are all elementary let's say computations, multiplications and addition. And so for a specific case in which a and b are equal to 2 and 1 we can follow of course this graph and so we have that c assumes a value, specific value which is 3, d assumes a specific value which is 2 and therefore e is equal to 3 times 2 equal to 6. So we follow this graph in this way. Now this is arithmetics on the graph. We can do derivatives on these graphs. So the numbers here are the same as before so a is equal to 2 and b is equal to 1 and we can label each now of these arrows, so of the edges of this graph with the value of the respective derivative of the the upper node with respect to the parent node. So this will be the partial derivative of c with respect to a. In this case is equal to 1. This will be with respect to b. Also in this case is equal to 1. And this will be d derived with respect to b is equal to 1. Now I give a label also here for these derivatives. This will be the derivative of a with respect to d. So the derivative of a with respect to d is equal to c but c is equal to 3 so I put here 3. And here the same thing derivative of a with respect to c is equal to d, d is equal to 2 so I put here. And with this I can step by step, node by node do my derivatives. So if I want to calculate the derivative of my final output e with respect to one of the two inputs, either a or b I can just follow this graph and follow each path. So if I want to calculate the derivative of e with respect to a I go from e to a I encounter two derivatives 2 times 1. If I want the derivative of e with respect to b, well there are two paths this one and this one to go from e to b so I have to sum over this path and this comes back a bit to one of the questions that was asked before about summing path and path interval. So this is sorry, so one times 2 here on this branch one times 3 on the other branch and I obtain my derivative. So this is really nothing as then the chain rule of differentiation applied on a graph for a simple function. So chain rules is summation over paths. Fine. But we can come into problems when there are many paths, when the combinatorics implies many paths. But we can factual the paths in each of the node then the number of operations that we have to perform drastically diminishes. So for example here if I assume that the derivative of z with respect to x is given by this expression and it's given by this by this graph with the notation that I gave you before so alpha means the derivative of y with respect to x etc. So I have an expression like this that of course can be factored. So factoring this kind of calculation can be very beneficial. And then now on top of that we have two ways with which we can calculate derivatives. The standard way, so this sort of forward more differentiation that gives us, let's say, the derivative with respect to input parameters of whatever I want as an output. So in that case I follow my path from the input to the output. Here there are three paths alpha, beta and gamma. Here there are other three paths delta, epsilon and zeta. Whatever. And so I sum together this and I multiply with the sum of the others. And I obtain the derivative of z with respect to x. So the derivative of my output with respect to one input. But if I do the other way around also I can obtain the derivative of z with respect to x. It's just a mirror symmetry of what I've done before. But now let's go back to the previous example and let's see what it means to do forward or reverse differentiation. So if I do forward differentiation and let's say that I want to compute the derivative of e with respect to the input parameter b. So how do I do it forward? Well I start with the inputs and I have derivative of a with respect to b is equal to zero derivative of b with respect to b is equal to one and then I derive c with respect to b d with respect to b and then finally I have the derivative of e with respect to b. And here in the label of my nodes I have all the derivatives with respect to b of all let's say the nodes that I have here and including also the input of course but I only have the derivative of the output with respect to b. Now here I want to calculate the gradients so the derivatives with respect to all my, did I erase it? Yeah, okay, but yeah, I erase it. But these so here I want to calculate the gradient of my cost function with respect to all the parameters. So these parameters will be input parameters and the cost function will be just the final cost function over which I want to calculate the derivative. Well therefore I would like to have as fast as I can the derivative of the cost function with respect to all the parameters which are not given here because here I am given the derivative of e with respect to b only. Okay? If I do the other way around so I start from here I obtain following again the same graph I obtain the derivative of the output with respect to both the parameters in this case by working this graph only once. Okay? So this is very practical to calculate partial derivatives in this case of the networks of the cost function. And also labeling all these partial derivatives for a network is very easy because this is all sigmoid functions. Okay? So the derivative of one neuron with respect to the former one with respect to the output of the former one is just always the same partial derivative given by the sigmoid function. Okay? It is easy to code because you code the derivative of the sigmoid once and you continue calling that function. And yes, this is essentially how it works. Questions about this? I know that it was very just sketchy. The very, very last thing that I want to mention overfitting it was touched in some of the questions and partially also in my answers. You don't want to train too much your set data. Okay? You don't want to train them a lot because otherwise the function that is going to be competent by your neural network is going to be ideally perfect over the training set but then impossible to generalize. I have very badly generalizations. This can be understood immediately by this very simple example so here I have points on a line obviously. But if we train too much and here we have, in general I showed you an example of tens of thousands of parameters but as I said there are millions of parameters. For Neumann I can move all the trunks that I want with all these parameters. I choose this to fit my ten points whatever how many they are. This is of course this generalize very badly. I'm not talking about generalizing outside this let's say for points smaller than this or larger than that. I'm really talking about something that is between this so here it's if you have a data here the accuracy is going to be very bad. So you want to avoid problems of overfitting your training data. So for example this is exactly the same case that I gave you before and I was training this if you remember otherwise it's written here with 30 epochs and I obtained this result. If I try with more and more epochs so I train more and more over my training data set and to make this even more apparent I don't use all the images but I use just a thousand of them so a small amount of data then what I obtain is that if I calculate the cost function on the training data this cost function seems to decrease a lot with the epoch that I train. So it looks like I'm doing something good better and better but what I'm doing is just that I'm fitting better and better the data belonging to the training set which as I say doesn't make sense because in fact is demonstrated here by plotting also as a function of the epochs the accuracy not over the training set which is 100% here but it's over the data set you see that it stops at 82.2% so it generalizes this neural network generalizes its performance to new data very very badly one easy way and with this I conclude to avoid this overfitting is training with a lot of images if you train with a lot of images so a lot of data, this is pretty obvious then it will be impossible for as much as you want to try this here I reduced also the epoch but it doesn't really change because even if this goes to 100% the difference here will it can go even better in that case but trust me the larger the data set that you have the more difficult obviously will be for your network to fit perfectly that data set so the better it will generalize and with that I conclude no convolutional neural networks I'm sorry and that's all so if there are questions I'm happy to take them here or in the tutorial room no questions I assume


Can supplementing quality night improve the quality of your sleep? Well, let's find out Hey, what's up? Greg here from your inception welcome to my channel If you want to learn top secrets about metropics and supplements then subscribe below to start your journey today We got to talk about quality and night now This is a very interesting sleep supplement that was designed by Nero hacker collective one of the most Fascinating supplement businesses right now now me and my team tested out for a while And what we're gonna talk about today is we're gonna look at the benefits of this sleep supplement We're gonna look at the side effects. I'm gonna share my experience with you and at the end of the video I'm gonna tell you if I recommend it or not. So if you're ready, let's just begin now Quality night was developed to offer comprehensive sleep support. It contains 25 ingredients Nutropics different compounds amino acids vitamins minerals and so on that can improve the quality for sleep So quality night can support you in three different stages The first one is it may help you get more relaxed before you actually go to bed Then it may help you improve the quality of your sleep and help you stay asleep for a longer period and the third step is It may help you feel more energized in the morning. Now, why am I saying it may help you? Well, because the question is does it really work and does it really help you? And that's what we're gonna talk about right now. So for this test my team and I try different things and we actually even use the aura Ring, so this is a popular sleep tracker And we use the watch as well to see if the supplement actually works if we can get some objective data out of those two trackers Before you know taking the supplement and after taking it and comparing the data and what we found out was quite interesting So the first thing is the question was does quality night make you more relaxed? Well, subjectively we felt slightly more relaxed, but honestly we expected a bit stronger effect here Um, and if you search for a sleep supplement that would make you feel super super relaxed in the evening Quality at night probably isn't the one for you However, what's more interesting is what happens during the night now We got lots of data from those two sleep trackers and what we found out is that our deep sleep Dramatically improved when we were supplementing quality at night. What's more we felt more energy in the morning We felt more relaxed. We had more energy. We felt more focused the day after we tried Quality at night and not just that when we compare the data from those two sleep trackers on average The sleep quality improved for about eight percent. So this is quite a big improvement You know just from taking sleep supplement and not a real sleeping pill so because of those results you got we're really positively surprised by the effect and This is what led us to further research to understand What kind of ingredients are really in this supplement and why does it bring such benefits? But we guys if you like this video, please press the like button below So if you're gonna check out the label you're gonna find a lot of ingredients and as I mentioned before there are 25 compounds in But there are a couple of stuff a couple of compounds that I want to mention And point out to if you want to do some deeper research and understand Why quality is as effective as it seems to be of course the first one is magnesium a quite might contains relatively low dosage of magnesium But magnesium can definitely help you relax and it can definitely help you improve the quality of your sleep Then there's LT and in-inside it helps with relaxation without Making you feel tired. That's why some supplements contain LT and in Also for boosting your focus by the way if you want to learn more about LT There's a video up there or you're gonna find it the link in the description Another important compound you can find in quite a night is ashwagandha is one of the most potent sleep metropics supported by lots of scientific research And it shows that supplementing ashwagandha can actually improve the quality for sleep can help with depression And also anxiety so really important compound that probably plays a really big role in the supplement Then there's L tryptophan which our bodies convert to 5 Htp and then this converts to Melatonin the important hormone for sleeping Another in a very important compound that you can find in this sleep supplement And of course there has set 25 ingredients all together different stuff many compounds are very low-dose Because they don't play such an important role in Some compounds are a bit less researched. So For long-term safety or use You know, this is kind of a question of what's gonna happen if you take supplement for a long term But based on my research and the research of my team, I'm very confident This is a very very potent and interesting sleep supplement. So how about the dosage? So we try different stuff different variations But in general the most or the best results we got by taking four capsules of Quality and I we took them in the evening after dinner Basically couple hours before sleep and that was it and if that's exactly their recommendation from the near hacker collective brand as well That's something to try it out You can try to decrease the dosage start with a lower dosage But since it doesn't contain many ingredients that can make you feel super tired Then you can follow the recommendations and you won't probably won't feel any any side effects right away And since we mentioned the side effects here's the thing we didn't experience any kind of side effects We want to have a bit stronger Short-term effects in terms of feeling a bit more tired, but that's you know, that's what we expected Because many are supplements delivered that however near-hacker collective is trying something totally different so they go a bit deeper into research and They're not just thinking about how to deliver the short-term effects But more about how to deliver long-term effects and I think most biohackers who take such supplements are in for the long-term effects and Honestly, I really like that it's Difficult to compare quality to some other popular sleep supplements because of that because they many contain a Synthetic melatonin and in very high dosages and this is kind of a you know There's a supplement to deliver more short-term effects Whereas quality was designed for the long-term effects. So the final question is do we Recommend supplement in quality night. Is this a product for you or not really? So based on our research based on our experience based on the all compounds you can find in the sleep supplement Yes, we definitely recommend supplementing quality night. I think this is one of the best sleep supplements That was designed for people who search for long-term sleep support if you're one of those guys searching for a pill that will knock you out Then you probably in the sleeping pill But if you search for something that will deliver long-term benefits And and try to systematically improve the quality of your sleep Then of course, this is a supplement to try as I mentioned before we use different trackers to get the data out And we're positive surprised by the results and that's why we recommend quality night. All right guys That's it for this video. Thank you for watching if you want to read our full review Then you can find the links below check it out If you have any questions, do let me know don't forget to follow your inception on Facebook and Instagram And I hope to see you soon again. Take care


President and Mrs. De La Madrid, distinguished ladies and gentlemen, it's been our pleasure to have you as our guests this evening. Being here with so many friends from Mexico, I can't help but take my thoughts back to California. Tonight is reminiscent of the gala evenings in old California. The vineyards, the music, the pride and accomplishments of the Hispanic frontier men and women. Individuals who conquered a wilderness but while doing so maintained a phenomenal level of dignity. All of this and more reflects the character of a people whose legacy is now shared by the citizens of our two countries. I'm not certain it goes back as far as the Hacienda days, but I would like to extend to you a traditional greeting that I've adopted as my own just as I adopted California. President, Mrs. De La Madrid, mi casa es su casa. Today we've had frank and fulfilling discussions. President, I hope you agree with me that although we do not see eye to eye on everything, it is clear that we as individuals and our two nations as well remain solid in our friendship and undeterred in our trust. The goodwill between us goes far beyond the transitory issues of the day. Our people recognize that issues, even those that seem important to the moment will someday pass from the scene. What will not change are the many gifts and mandates given to us by God that serve as the basis of our societies. I can't believe that the Lord brought us to this level of political, social and economic development that he located us, the Mexican and American people, in such proximity and did not intend us to be friends. In the last 50 years, when people of bordering countries in so many parts of the world were killing each other or were immersed in envy and hatred, the mutual respect and ever-increasing cooperation between our peoples and governments shined in contrast. Our trade and commerce is a powerful engine for economic progress for both our countries. The cultural and social ties between our people enrich and add diversity and flavor to our everyday lives. Yet the cement with the strongest grip is found in the ideals and values that our people share. President Thomas Jefferson, a man so important to the development of human liberty, outlined in his first inaugural address some of the aspirations of our New Republic. Although spoken 183 years ago, the words still ring true. Our desire in foreign affairs, he said, was equal and exact justice to all men or whatever state or persuasion, religious or political, peace, commerce and honest friendship with all nations. I heard an echo of these sentiments last August in La Paz, when you, Mr. President, said nationalism, cultural identity, freedom, democracy, economic development with social justice and independent foreign policy and defense of our territorial integrity are shared values embodied in our national design and vital bonds that link us all. Mr. President if we can be guided by these principles with our shared values and interests overshadowing momentary disagreements, surely the good will between us will endure and our relationship will continue to shine as an example to others. And now, will all of you join me in a toast to our honored guests, to President and Mrs. Dela Badrid, to their health and to the continued goodwill between our two great nations. Mr. President Reagan, Mr. Reagan, be my first words to thank you, the final cordiality that we have received in our visit to Washington today. President Reagan, Mrs. Reagan may my first words be to express my gratitude for the kind courtesies that we have received during our visit to Washington this today. Tanto en nuestras reuniones de trabajo como en este amable evento de este momento hemos recibido pruebas de una amistad afectuosa, cordial, que mucho estimamos mi señora y mis acompañantes. Both during our work meetings and today during this dinner we have seen proofs of affectionate and cordial friendship that both my wife, myself, and the members of my party appreciate very much. Este tipo de diálogos son siempre fructíferos, nos permiten comparar nuestros análisis, nuestra percepción de la realidad y conocernos mejor a través de verificar coincidencias, acuerdos y también diferencias. This kind of a dialogue is also always fruitful. It makes it possible for us to compare our analysis and evaluation, our perceptions of reality to agree on our similarities and also to know our differences. La geografía nos ha influido mutuamente y nos ha determinado a relacionarnos. Nos ha aconsejado no solamente ser vecinos, que es una fatalidad geográfica, sino hacer amigos, que es una cualidad que deriva de la voluntad y del entendimiento. Geography has influenced both of us. It has led us to be neighbors and it has led us to be friends. Neighbors we are because geography is as it is, but friends is something that comes from our own self. It is a quality of the human being. Los amigos siempre buscan ampliar áreas de consenso y reducir diferencias. Friends always seek to extend areas of consensus and to make their differences smaller. A buscar fórmulas de superación a los problemas de nuestra estrecha, compleja y amplia relación. To seek formulas to overcome the problems that come from our close, complex and very broad relationship. La amistad supone todo esto. Sinceridad y franqueza. Dignidad y respeto en el trato. Cotejo sereno de nuestras discrepancias, pero sobre todo, buena voluntad. Friendship presupposes all of this. There must be sincerity and frankness, dignity and respect in our dealings. Careful examination of our discrepancies and above all it demands goodwill. Differences of opinion are natural and can be explained among human beings. They can be explained among us. Y aunque hemos tenido caminos análogos en nuestro trayecto histórico, nuestra mixtura racial, cultural nos ha dado una diferente percepción de la realidad y una diferente sensitividad. Differencia que por otra parte enriquece al género humano y evita la uniformidad que no es el valor que estimamos los hombres libres. Even though Mexico and the United States have often traveled the same road, even though they stem from the same roots, there are differences in our culture and these differences have made our sensibilities also different. It has come to enrich the human race because it is variation which is needed for this enrichment. It is not good for everyone to be just the same. Los mexicanos nos encontramos ahora frente a frente con una rica y fuerte personalidad nacional y cultural. In this way Americans and Mexicans find themselves face to face with a rich culture and a rich and profound perception of our nationalities. Pero no solamente hay diferencias, no solamente hay contrastes entre nosotros. Las analogías, los parecidos también son evidentes. But there are not only differences among us or between us. Analogies are also evident. Nuestras dos naciones han fincado su sistema político y social con la aspiración de vivir en libertad, construir permanentemente la democracia y buscar la igualdad de oportunidades para todos sus integrantes. Both nations have rooted their political and social systems in the aspiration to live in freedom, to permanently build democracy and to seek the equality of opportunity for all. Ambas naciones postulamos el respeto al derecho y la justicia como norma de una convivencia pacífica y digna. Both nations postulate respect for law and justice as a norm for peaceful and dignified coexistence. Y lo que también hace parecidas a nuestras naciones, señor presidente, es que no somos sociedades congeladas o estancadas, somos sociedades abiertas al cambio. And that which makes our two countries similar, Mr. President, is that we are not societies that are frozen and opposed to change. We are societies that are open to change. Los que amamos la libertad debemos estar abiertos al cambio. We who love freedom must be open to change. No podemos congelar el espíritu humano. We cannot freeze the human spirit. Y por eso también estamos obligados a ser tolerantes. And it is for this reason that we are also obliged to be tolerant. Señor presidente Reagan, nuestras conversaciones han signo dignas y cordiales. President Reagan, our conversations have been honorable and cordial. Están reflejando un propósito común. They reflect our common purpose. Ampliar acuerdos y reducir discrepancias. To extend the areas in which we agree and to reduce our differences. Pero el camino es largo. But the road to travel is a long one. El camino de la vida de los individuos es limitado, pero el de las naciones no tiene horizonte histórico. The life of individuals has a limit. But the life of nations does not have a historical horizon. Lo importante es que en esta reunión hemos renovado la voluntad política de seguir recorriendo este camino como naciones y como individuos con empeño y con buena fe. The important thing about this meeting is that we will have renewed our will to continue to travel that road as individuals and as nations that are living in good faith. Como decía yo a medio día en la comida amable que me ofreció el secretario Schultz, sabemos los mexicanos que ustedes desean vecinos libres, dignos y fuertes. As I said before during the luncheon that was kindly offered me by Secretary Schultz, we know that you want to have a dignified prosperous and strong neighbors. Es importante que una potencia mundial que ha alcanzado un poderío sin precedente en la historia del mundo pueda decirle a las demás naciones tenemos vecinos dignos, no esclavos. It is very important that a powerful nation such as the United States which has been the most powerful nation of all can say to the other countries we have neighbors who are dignified they are not slaves. Hago pues señor presidente Reagan votos porque este trato amistoso, respetuoso y digno que hemos construido los mexicanos y los norteamericanos a través de nuestra historia sea la tónica de nuestra relación. I therefore President Reagan expressed my hope that this partnership with dignity and cordiality that has been built by the Americans and the Mexicans will always be the common denominator of our relationship. Que sigamos siendo capaces para desarrollar talento y voluntad y seguir fortaleciendo de esta manera nuestra amistad en beneficio recíproco de nuestros pueblos. That we shall always be capable with talent and goodwill to continue to strengthen our friendship to our mutual benefit. Este es el pensamiento y la voluntad del pueblo de México y estoy seguro que la misma actitud existe en los Estados Unidos. This is the thinking and the will of the Mexican people and I am certain that there is this same thinking and the same will in the United States. Por ello expreso mis mejores votos y mi seguridad de que las relaciones entre México y Estados Unidos se mantendrán vigorosas porque se fortalecerá nuestra voluntad de entendimiento porque nuestra amistad se seguirá estrechando y propongo a ustedes levantar nuestra copa para brindar por la felicidad personal del señor presidente Reagan y de su encantadora esposa Nancy por la felicidad y por la prosperidad del gran pueblo de los Estados Unidos y por los valores en los que creemos conjuntamente libertad, democracia y justicia. That is why I express my wishes that the relations between Mexico and the United States will always be vigorous, that they may be strengthened by our will to understanding and because friendship and cooperation is what will bring us together. I wish to ask you to join me in a toaster to the personal happiness of President Reagan and his charming wife Nancy, to the happiness and prosperity of the American people and to those values which we share which are freedom, democracy and justice. You have survived all I know is how I feel when it's real I keep it alive the road is long there are mountains in our way but we climb a step every day love lift us up where we belong where the eagles cry what a mountain love lift us up where we belong far from the world we know where the clear winds blow on to used to be live their lives looking behind all we have is here and now all our life out there to find the road is long there are mountains in our way but we climb a step every day love lift us up where we belong where the eagles cry what a mountain what do you think my friend Tom shell at the piano that was so pretty good evening thank you very much thank you very much thank you that's so nice almost got the words right too by some Spanish you really would have heard of us well Gloria Laurie thank you for entertaining us magnificently tonight you know she does more than sing she's an accomplished actress she writes songs she has a sense and a spirit of community and does good things in that direction too and we're just so very grateful so much gracias I have to tell you she does do good things I heard her at a public kind of a thing the first time I'd ever heard her sing and she was doing the national anthem and I said to Nancy after it that's the first time I ever really heard the song