Okay, this is Manoj, the... Shrivastava. Yeah, you can do your surname. I won't even attempt it. He is the Devian Project Secretary and he's going to tell us about multi-winner voting in Devian. Hi, guys. I appreciate you being here, especially knowing that lunch has already started downstairs. I'll try to keep this short because I tried to do this real multi-winner voting strategy talk and then I looked at the amount of math I would have to present and I was able to narrow it down to about 120 pages of equations and I didn't think I would fit it in and I don't think I would have much of an audience left, so I decided I'll convert it into kind of bits from the secretary and where I think what the secretary needs to do should evolve. Status is what's happening thanks to the rest of you guys. The secretary hasn't had much to do this year. We are no longer shooting for maximum GRs in 2008 like we were a couple of years ago. There has been some progress. We have a new victim who has decided to step up and become a kind of backup secretary, in case I get hit by a truck or something. So Malkin has agreed to join in and learn all about the ins and outs of what the secretary does, which thankfully isn't much. All we do is we run votes, we memorize the constitution and have nightmares about it. So, this was a darn short talk. Where should... Okay, devotee. This is the software we use to run our votes. It's not been packaged yet because I could never figure out how to make it a useful package because currently it is very tied into Debian. I mean, it's very useful if you have a GPG key ring, an MPGP key ring, and people in the key ring also are in an LDAP database where they belong to a developer group. If you don't want to run a vote where you have these test criteria, devotee is not very useful for you yet. Whichever I never could figure out how I could package it with a straight face and tell people this is something you might want to install. However, watching synchronized diving on TV in Spanish, a language that I don't understand, I had epiphany. And I now have an idea of how I can modify... Well, actually rewrite devotee to be not just modular, which it already is, but also flexible so that people can create their own votes with different workflows. They can plug in verification methods. They can plug in vote collection methods. So, for example, if SPI uses a web front-end, there are a lot of people who have wanted to run votes using a web front-end as opposed to email signed ballots. I don't understand why.  But similarly, there have been people who wanted not to use the file system as a database. They wanted an honest to goodness real database for, again, reasons that I failed to fathom, but it seems to be something that people really like. So, I would like to take devotee the way it is, convert it into... You can plug in your input methods. You plug in your own checks. Decide which checks you want to actually run, which are just non-mandatory. They will be advisory. You didn't sign your ballot, but I'm going to count it anyway if that's the policy of your vote. It would also be nice to plug in various ways of tallying votes. I really like the way we do our voting. It's a variant of a single transferable vote with all kinds of neat criteria. But there are other ways of tallying up the vote, and it might be nice, and I think people have been doing this for DPL elections for the last couple of years. They take the raw data and they figure out who would have been the winner under various forms of tallying up the votes. So, now that I've taught Malkin all that he needs to know about the current way of running votes, I'm going to go ahead and change it all out from under him. Actually, there was a proposal that I received from a couple of people whom I shall not name who said that when I took on the mantle of the secretary, our previous secretary had gone missing for two years at that point, along with a large chunk of money that was never deposited. So, he didn't take the money away. He just held on to the checks until they became invalid, which is why SPI was created. But anyway, that's the end of the story. But then, devotee, the way we know it, was written under fire in the sense that when the DPL election of 2002 started, the only part of devotee that had been written was the part that accepted mail. The part that actually did something with the ballot was written a couple of days later, and the part that actually tallied the vote was done, I think, two days before the vote ended. So, people have been suggesting that I just kind of yank out the current devotee, pull it out of all the public repositories, and then hand over the job to Malkin and let him start from scratch. You know, proper training to be a secretary. He declined, unfortunately, because I think it would have been great training, write your own vote-taking mechanism, and everybody knows you can do the job. We're still only eight minutes in. I really don't have that much more, apart from the original topic of the talk, which is selecting M members of a committee out of a set of candidates and doing so while maintaining the characteristics of a voting mechanism that we already have in the Constitution. The voting process that we have has some nice... it meets some nice criteria. For example, and this might be getting too much into being a vote geek, anonymity. You want a voting system where it doesn't matter who you are, all voters are treated equally. So, nobody is more equal than others. So, no animal farm. Neutrality, that means that no candidate is more important than any other candidate. They're all treated the same by the voting system. We kind of violate this because our further discussion or none of the above option is slightly special in the sense that it cannot be eliminated. Homogeneity, that means the results depend on a proportion of votes. We don't say that you need to have X number of votes and then you are in. You need to beat the other options. Again, we kind of violate this by having the quorum and supermajority restrictions, but barring that, barring... if we have met quorum, we do meet this criteria. Then there are other little things like majority. If a majority of the voters prefer some option over other options, the other option should not win. If there is a set of these things, if voters prefer options in a subset over every other option, not in the subset, then the winner should probably come from the subset that is ranked higher. Well, there are other things like majority winners, majority losers, condorset candidates, condorset losers, smithset. All of these basically come from the criteria, as I told you, that most people prefer a subset over things not in the subset. The winner ought to come from the preferred subset. There are various ways of stating this. The other thing is all the ability. If you've got a small number of voters, it might so happen that you'll get two people with two candidates with equal votes, and you can't decide between them. But your vote mechanism should be such that as the number of voters increases tends to infinity, the probability that more than one winner would emerge should go down to zero. Pareto means that if there is no voter who prefers candidate B over candidate A, but there is at least one person that prefers candidate A to candidate B, candidate B should not win. I kind of like that. There is monotonicity.  They do not change the ranking of the other guys. So they just take candidate A and move them up the ballot. The probability of candidate A winning should not decrease. And believe me, there are voting methods where that does happen. So we don't like that. Say suppose you take a bunch of ballots where people have voted for candidate A. Now you increase the total number of candidates, and you call them A1, A2, A3, A4. On every ballot, the ranking that was given to A is the same as the ranking given to all these clones, A1 through An. Then this shouldn't affect anybody else. So if candidate B was winning before, candidate B should still win. If some candidate C was losing before, they should still lose. The presence of clones should not affect the Jedi order. So if we go to multi-winner voting, all these properties ought to be preserved. The additional criteria I put on whatever method we should choose is that if the number of candidates M degenerates to M is equal to 1, that means we want a single winner, the resulting method should be identical to what we currently use. There are also some additional criteria we should meet when we are selecting more than one person. Say suppose you want to select four people out of ten, and there is one super popular candidate you know is going to win.  So this is called free-riding. You know that your candidate of choice is going to win. You get a free ride by taking your vote that you normally have given to that guy and giving it to somebody else you want in who may or may not win. So you get one candidate elected for free based on your perception that he's going to win anyway. So there are other ways of free-riding by not voting for the guy you want because they are going to win anyway, that apply to different ways of tallying up the votes. And we want a voting mechanism that is resistant to this kind of voting. You can't ever eliminate it totally, but you make it expensive in the sense that if you don't vote for the guy you want, he might not actually win. The other way that people attack various voting systems is if you give preference to the number one vote that people cast. And there is a party, let us say that, let me pick a proper evil subset. Say the US subset of Debian developers decide that they want four US Debian developers to get into the social committee and the vote tallying method is such that it pays special attention to the way you rank the candidates. Then what you do is you tell those Debian developers, you want these four guys in, one fourth of us should rank guy number one first, one quarter of us should put guy number two first, and then so on so that one quarter of our evil American, North American or clique votes one of our guys first so that we evenly distribute our votes so that increase the chances of those four guys getting into the committee. We want a vote system that is called vote management. This is the simplest of the vote management techniques. There are other ways to do vote management. We want to have a voting mechanism that resists managing the vote by a subset of the people. There is also something called the droop criteria. So there is a droop ratio, which is basically you take the total number of votes divided by the number of candidates plus one, you get a ratio. An important criteria is that one such, say if the ratio is X number of people. So if we want to select M members, if at least X number of people put a subset of M as the preferred candidates in their ballots, for every X number of voters, one of their candidates should be selected. So in other words, this is more important in real politics when you have political parties. This is proportionality. That means if you've got two or three or four parties, then even a small party which has only say 10% of the members should be able to get at one tenth of their candidates in the final selection. So in other words, even a small group of people as long as they are above the droop ratio should be able to have a say in the final result. So it doesn't mean that the largest party gets all the votes all the time. Minority views are also represented in the committee, which I think is one of the first candidates for this kind of voting method might be the social committee. I'm not exactly sure where that proposal stands, but I thought we were going to go ahead with it at some point. And there this was brought up whether we will be suffering from the tyranny of the majority or not. And if we manage to write the voting mechanisms as the droop criterion is met, we will not have that problem. So I do have papers that allow us to select a voting mechanism that meets all these criteria. I wanted to print out the paper and bring it over, but it's 288 pages and about 60% of that is pages after pages of mathematical formulae. I think I have managed to wrap my head around it. I have not yet managed to wrap my head around it well enough to actually implement it in court. I hope to be able to do so before we manage to pass the GR that authorizes the social committee. I'll be happy to post links to all these papers. There are three of them out there. Somewhere once I get back to a working computer again. Okay, 20 minutes. I think I've kind of met the minimal criteria for how long a talk needs to be to justify it being here. So if you guys have any questions at all about what the secretary does or what the secretary should be doing, whether there's something that I could be doing better or if you've got opinions on voting systems or you want to delve into details of how we are going to do the STV Condorcet multi-winner voting, I'll be happy to indulge you. I've got several pages of math here for anybody who wants to go deeper in details. One quick question. I think I brought it up during the last TPL vote on the list but I think I'll just try to ask again.   No, it won't because this is essentially a replay attack and devotee is resistant to replay attacks. A replay attack would be sending the same signed vote back to the devotee but what he's saying is that one person sends a signed vote to Debbie Nevelle and another person replies to that vote with, you're stupid, and signs it with his GPG key. So that's a different signature but the same vote for that person. So it's not a replay attack. It's actually a different vote as far as devotee is concerned. I think you're right. If somebody manages to grab, if the original signature has been stripped off, we do check to see if it is double signed. Yeah, okay, but usually if you reply, then the original signature is stripped off because in any way you would quote it and mangle it so that it's a different message. Right, so yes, you're right. My answer to that is don't do it then. I don't know how to prevent that. I don't know how to build in this kind of intelligence and devotee. Maybe a possible solution would be to share the set of verified signatures from Listmaster with devotee or something because we do keep track of, or we can keep track of all the signatures that are validated to all Debbie and List.  I don't think I follow. Somebody has sent in a vote. I quote it and I sign the quote. Right. And then the same thing is sent to the vote. Right, the question is because it would have already gone to a Debbie and Nevelle list, we could give you, oh, we have seen these signatures. Oh, so a replay attack which is... This particular one would be solved. Obviously it wouldn't stop somebody from sending such a message to any other random mailing list but... I don't think it's worth it. It's just an option. If you guys want to do it but I think that we are happy with, don't do it then. I think you are forgetting that some people actually do send votes to Devel and Secretary at the same time. And that would be a valid vote. So you would be rejecting those as well. Yeah, okay. So that's, I mean, it's a whole can of worms of course. So I think it's just better not to handle it and make sure people are not stupid by replying to votes and signing. If you do want to do this anyway, please just delete the UUID which is in the vote that you quoted. If the UUID disappears, then it won't be seen as a valid vote. Right. Right. I mean, I'm not saying we should fix this but if somebody wants to fix it, one way would be to have unique UUIDs. That is like send a mail or you get as a Debbie and Nevelle personal mail saying, this is your ballot and you can use it only once. And then there would be no problem to send it somewhere else. But yeah, I don't know if it's worth the hustle. Probably not.  Yeah, that would be good if people actually followed the instruction because now what this would require is, see what this would require is each ballot would have to be different. People would have to change the ballot and add a new UUID. Now, every election and every vote so far, even though the instructions say you've got to do, in the square box you put in one, two, three, four, and so on in the order you prefer. I get at least three to four votes where people have just marked X. So if people can't follow that kind of instruction, I doubted that we'll get everybody adding in their UUID to the ballot. Nice idea, I don't think it will work for us. I have been, I think the last four, there were a whole bunch of people who were telling me that my instructions that I put forward for voting were too complicated for people and they should be more intuitive and there have been several rounds of wording proposed to improve my instructions that, and I must confess I've kind of about reached the end of my rope and I'm going to put my foot down and say, look guys, if you can't follow these instructions as they exist now, I'm really not sure that you can understand the concepts that you're voting upon and can actually help Debian by voting. I've tried not to say this because this is harsh and rude and probably not something the secretary should be saying, but for heaven's sake, I mean how hard are the instructions right now? The other thing is I can say that the secretary will never create a new ballot whoever wants to, the DPL candidates can go create their own darn ballot if they want to get elected and anybody proposing a GR can do the same. Unfortunately, while that sounds nice, I think it will end up with ballots that are equally problematic. Some months ago there were proposals, well, many messages about a certain voting system that encouraged strategic voting. Personally, I like that Condorset voting goes against that, discourages strategic voting. What's your opinion on that? It's not right. So Condorset voting, there is a mathematical proof that it does is resistant to most of the insincere voting hacks that people have tried. Range voting, I'm not convinced, meets those criteria because every time I have asked that person to give me some kind of mathematical proof, all that I've gotten back is a lot of hand-waving and saying that I'll give you examples in which it works that way. And unfortunately, you can come up with any kind of examples like that for every single voting system where for given sets of votes for ballots, they do meet the criteria. But giving examples and anecdotes is not actually mathematical proof. So that's why I have not actually, beyond asking for clarification, I haven't replied to that person because he has been extremely persistent and not very amenable to listening to what other people have been saying. But if you do have some concern that our voting mechanism is not proof against some of these insincere voting mechanisms, feel free to read up the papers that I'll put up on that email that I'll send whenever I get back home. I do have one concern, actually. Our voting system actually faves the compromise, which usually is a good thing. But if there can be cases where we have to do one of two things, which are both extremes, and some more gets a vote on the ballot to do nothing, which is a bad thing, then this do-nothing is usually much more likely to actually win the vote because the people who prefer one end of the extreme will say, yes, one first, and the other end of the extreme, I don't want that, and the middle one, well, okay, if nothing else. And the other end of the people will do the opposite. So the middle is much more likely, and I think that can be a problem in some cases because actually our voting system prefers a favor in decision, which I don't think is a good thing. Unfortunately, I don't think it's a voting system issue. I think it's a social issue. Maybe. Because the voting system can only do what it can try to decide between people's preferences. If people are so polarized as to say that my way or the highway, that means my way and further discussion over everybody else's proposition, I don't think you can solve this mathematically. You have to solve it by having people talk to each other. Yeah, I think you have to be careful about deciding what's a problem or what you want to fix. I actually consider it a great feature that if we are still in a situation where the overall opinion of the project is very divided, that further discussion, which is our way of phrasing the choice that says we aren't ready to make a choice yet, is in effect our default behavior. We're having a discussion last night, very late, about the tech committee, which led to some interesting thoughts that I'm sure you'll all hear about before too long since we get a chance to read our late night notes and figure out what we actually said to each other. But one of the things that came up in that process is that driving things to a vote in a particular timeframe is actually okay because if we aren't yet to the point where we're prepared to make a sort of a group decision, it may well be that the answer is further discussion.  And I think that we have to be careful because I think, as Manoj has suggested, some of these things are social issues, not, you know, technical issues with the voting system. And in this particular case, if we have something that's hugely contentious and yet we need to make a decision, I don't think that'll be a problem. We've seen a couple cases in the past where we've come to a decision. If we have something where there are two really sort of polar opposite choices and the project's deeply divided then not making a decision until we figure out an option that leads to more social consensus is probably great. Actually, I like to create a sound bite here. Devotee is not a stick to beat part of the project on the headwind. So if we are that divided, we shouldn't be changing our voting mechanism to ramp through a solution and this affect a large chunk of the membership. Anything else? Any ramps against the way Secretary has been behaving? You seem to be mellowing with age, Manoj. At the end of the talk I gave, I did have Lucas come up and ask if... He had the view that sometimes it may be useful to be able to run polls on various different issues and if devotee could be adapted to allow unofficial polls. Do you think it's devotee's place to do that? The new one that I'm proposing, the modular, creative workflow, sure. The way it is now, devotee has been used by various people to run polls. But the way the amount of checks that we do are kind of heavyweight.  It might not be appropriate for anything else. Definitely, if you want to just have people's opinions, do we really care if they are DDs or if it's a self-selecting group anyway? So you might as well want to have people who are interested in tropic as opposed to people who have been blessed by the proper penguin pee. But sure, the new devotee should be lightweight enough that anybody should be able to do it. I'm hoping that I might be able to add in a functionality that we might be able to offer it to our parent organization, namely, SPI, to be able to fit in using their web front end and yet be able to plug in devotee. Because I don't think that SPI currently has multi-winner vote mechanisms that actually meet all these criteria. The simple thing of select one winner, keep them aside, select the second winner by applying condoset sequentially does not meet several of the criteria. It does not meet monotonicity. It is dissolvable, but I'm beginning to forget. When I looked at it, there were at least three criteria of the list that I had selected which were not met. Especially, I don't think it meets the submit two criteria. So it would be nice if we were able to make it useful even for SPI because I think they do more of this select M members out of more than M candidates votes. And I have had requests from all kinds of Linux users groups who want to use devotee and I have had to say that I'm sorry if you don't have Debian's LDAP mechanism, it's not going to be useful for you yet. Actually, the reason it has been taking me so long was I was trying to create an automated workflow processor where you kind of describe a word saying I want a word in which I want to do these kinds of checks and I want to use such and such a tally mechanism and then I wanted something to compose automatically the order in which the checks were run and marshal all the data from one module to the other and do it all automatically and it turns out this is not an easy problem. I mean it's doable, the grid folks have already solved it but they have solved it with a monster set of packages called Wings and Pegasus. I don't want to bring that into devotee. So I decided that if I needed to create a description of a vote and I needed to create a parser that could read the vote and execute it why not use a programming language interpreter? The Perl is a fairly decent parser of these things called descriptions of a vote in the form of a Perl script. So I have kind of let go of my ambitions of doing a workflow generation system inside devotee and I'm just saying that if you want to create a vote you have to write a Perl script, all the check methods will become Perl classes instantiate a Perl class, pass the ballots to it and there will be example scripts that you can use to base it on. It's not as interesting or elegant a solution as a workflow generator but maybe the next secretary will take that upon and we'll have these features soon. Anything else? I thank you guys again for coming here. This was a fairly dull and boring talk and I do appreciate it. Yeah, one last word before we disappear. Since it doesn't get set off in enough minutes thank you for many years of service as the WN secretary. I at least really appreciate it.


Hello, thank you for joining me. I've just arrived at Tamworth on this class 350s Tamworth on the West Coast Mainline. Today is an episode of Miniature Railway Britain so this is as far as the Mainline is going to take me. What I've got to do I've got to go and find a vintage bus and that is going to take me to where this Miniature Railway is. So I found the bus stop just outside Tamworth station. We're going to Statfold Barn because although most of the railways there are narrow gates, there's now the Meese Valley Light Railway open last year. So because that's miniature that qualifies for an episode of Miniature Rail Britain and the buses are run by the Transport Museum at Wyville or Wyville. There is also a Miniature Railway there. I have been on that in the past. At some point in the future we're going to have to go there and do an episode of Miniature Rail Britain. So I'm going to wait for the bus to turn up now. So I've just got off the bus, I'm in the car park. Now since my last visit it's all changed a bit. My plan today wasn't to do a sight tour. I'm not going to do a tour of the general site because if you want to see that I've looked at my video from last time. But there's this area here and none of this was here when I last visited. So I'm going to do a little sight tour of this bit. This is before we've actually paid to go in. So I'll just let you see some of there's various industrial locos as you can hear. There's some working steam not too far away. So you've got a couple of diesels. You've got this, I've got here a hobbarrow and industrial loco. You've got this one. It's an extra industrial loco from another country, by the way. So you've got some interesting, you've got a crane tank loco. That's standard gauge. In the little diesel in front is two foot gauge. And then you've got another shed here of some interesting vehicles. We'll have a quick look at them and then we'll go inside and hear a steam locomotive. So we've got a few simplex bed for their diesels. A couple of funky diesels. We've got these two. These works in aquarium whales. They would actually had overhead cables for their electric loco. A couple more diesels on these hums. That's probably not that old. That's pretty built in the 90s. It works in Lee Valley Cable Tunnel. And then these are non-rail vehicles. One more diesel loco. And then it's quite exciting. A Land Rover, as you can see. It's on, it's like it's a railway. It's a very good railway Land Rover. You can't drive that down the road. And then just in the corner there's an ex-South Tindale railway carriage. Behind that hedge, as you can probably hear, there's a steam loco on the narrow gauge line. So we'll go over and have a ride on that.  So most of the video of the gala, I'm going to put it in a separate video. And that will have already been published by the time you watch this. I won't be in that video. Just be pure steam, or nearly pure steam action. Just pure action. So anyway, let's go and enjoy this talk. Just arrived at the other end of the line. We've had a trip behind this American loco. So that's really something quite different. There's all sorts of loco's running. As I say, most of this will be covered in my video on the gala. That's for the miniature railway. I'm now about as far away from the site as a miniature railway. It's possible. We'll get back on the train. That'll take us right up around there. If you look across the site, every time I look across, I can see something moving. I can just see the train going along there, which is our dealing carriages. The locomotive sees you for a minute, the railway's over the other side of those trees. So that's where you've got to get the train back to. The loco's finished flowing off. Look at this. This is some funny sort of fountain to see that. And this isn't the miniature railway. It's got all these funny little houses. And it's like they've got like a mining railway.  So that's quite interesting. They have family days here, not so dedicated for infuges. So if you were to come to one of those, you might come and have a look at this. I'm going to go and get back on the train though. I'll say we're going to go for a ride and go and find a miniature railway. So I'm back down now to the other end of the site. As I said, if you want to see a tour of the site, have a look at the video I made last time. Here is the miniature railway. So that's it. Sheds. There's a turntable there and the station is just here. So I'm going to wait for the train to arrive and we're going to go for a ride. You can't, manual. She's hateful. So you know, she'll be all right in about four years. The colour of this train. You know, red. The passenger carriage is a red. What about the front bit? What colour is the engine? The front bit. Can you see where the driver is? I think it's green and a bit red. The day finishes up on a bus. And we're going to go over the level crossing over the miniature railway. It's been a really good day. I've really enjoyed it here.  I'd like to have done a bit more with the miniature railway but there's so much going on on the two foot gauge line. I didn't have as much time I could do with sort of two days here rather than one anyway. We're kind of coming back into the site where I'm about to leave. I got on as he came in and had a bit of an extra ride. So I hope you enjoyed this video. Thank you very much for watching. Do come and visit that fold palm check when they're running because they do all sorts of different days. If you like railways, the gala day is the best ones to go to. And if you like buses, you can have a bus ride. If you want to come here by train, you can use the bus like I did to get you up from the railway station to step on by myself. So thank you very much for watching. Please do feel free to like, subscribe and comment. And from the car park overlooking the railway station over there.


Hello, my name is Dmitry Vyukov. I work as software engineer at Google in the dynamic tools team, and I'm going to talk, present Sysbot and the Tale of Thousand Kernel Box. So first of all, I would like to ask, how many of you know about Sysbot and Syscolor? OK, so roughly half, maybe. So how many of you love Sysbot? OK, about 10 people. And how many of you hate Sysbot? OK, two, three. And how many of you both love and hate Sysbot? OK, a few people all said that would be a majority. OK, so first I'm going to talk about kernel bug disaster. And then I'm going to talk about what we're trying to do with this. And then I will talk about what we're not doing yet and where we need help. So as of now today, civilization runs on Linux. We have 2 billion Android users. We have cloud service, supercomputers, desktops, notebooks, also cars, plants, space station, and last but not least, our coffee machines. And security is critical. Linux protects privacy of more than 2 billion user people and protects car, corp, and government information. It protects safety critical systems. And it's the first line of defense for all incoming network packets, for entrusted application, for virtual machine guests, and also USB and FC Bluetooth traffic. Also for things like cars, phones, and plants, stability and safety are also critical. So you can say that Linux kernel is one of the most security critical components in the world today, or maybe the most. So there are all those bugs with logos and bold headlines, and they can produce lots of noise. People start running and screaming, and then we can fix them, and then number of known bugs with logos is zero, so we're kind of good. But that's only the tip of the iceberg, because kernel has bugs, and it has lots of bugs. And as with no bugs are the source of security issues. So last year, there were 450 CVs registered on kernel, and some of them were classified as code execution, some as gain privileges, but lots of bugs are unaccounted here. And last year, there were more than 4,000 kind of official bug fixes. I think they count them by those fixes stacks, so again, lots are unaccounted here. About a year ago, we deployed a system called Sysbot, which is a continuous kernel fuzzing system, and for the past 12 months, it reports about 200 bugs per month. It reported more than 1,000 now in upstream kernel and 1,200 bugs in Android, Chrome OS, and some of our internal kernels. And before that, we also used the fuzzer manually and reported more than 1,000 bugs for previous two years. So in total, we reported more than 3,000 bugs now. To give you one example, sometime ago, we started testing USB stack from the external side, so from the side of the USB cable connected to the machine. And by barely scratching the surface, we found more than 80 bugs, so all those bugs, there were all kind of bad bugs, including use after free, out of bounds, double freeze, and all those bugs are triggerable by just any cable that you connect to the machine. And we didn't even get past handshakes, so we didn't actually test the main driver code because we just run out of time and had to switch to something else. But so I'm sure that there are two free 500 bugs, actually, more that we didn't find yet. And USB is not special, this flow of bugs is representative for just any subsystem that we start testing, KVM, TCP, UDP, sound, 9P, BPF, you name it. Here you can see snippet from the sysbot dashboard, so now we have more than 200 open bugs, we have there things like use after free, out of bounds. They still happen, they have reproducers, they were reported a while ago, still unfixed. So that's what's currently present in the kernel. Of course, we're getting not just use of the freeze and out of bounds, we're getting submix of bugs. Besides that, things like bug, warning, null deref, initialized memory, deadlocks, hanks, and all other stuff. But the modest estimation that we reported at least 500 security bugs, and this is not counting things like local denial of service. And very few of those bugs have CVs. It's important to note that exploit doesn't necessarily mean a use after free. We've seen a case when a machine was just unresponsive, but after debugging it turned out to be a full guest host escape because there was guest triggerable page reference leak. We've seen a warning that turned out to be inter-process, inter-VM information leak because that was a warning to restore registers in the context switch, and we've seen stalls that turned out to be remote denial of service bugs. But that's not all. So I looked at the number of back ports in the stable releases, so should I say stable? And for the latest active ones like 4.4, 4.9, we have almost 10,000 back ports there. So not all of them are bug fixes, but a sample, maybe 100 of them, got impression that more than 95% of them are actually bug fixes, so almost all of them. And on top of this, we also have some fixes that are already upstream, but not back ported yet. And this happens frequently because there's just no process. We know that there's at least 700 of them, but most likely much more. There are also bugs that are already found upstream, but just not fixed yet, also hundreds, and obviously lots of bugs that we didn't find yet for various reasons. So based on that, I can conclude that every looks good and stable releases that we produce actually contains more than 20,000 bugs. And now it's not getting better over time, so it's not that we can fix this massive amount of bugs and now the code is much better and we don't have them. So if anything, it only becomes worse. And no, this is not normal. But the state of the upstream and even stable doesn't matter in the end because nobody uses upstream, people have own forks of the kernel and that's what they use. So the state of those, let's say distrust, what actually matters in practice. And distro people say that they simply can't keep up with this flow of changes. And there are CVs are filed on very few of those bugs. So the stable process is not fully working and the CV process is not working. And if you ask why, another view for the stable releases this number of backports per month and to make it more apple to apples is split it for the first year of release life and the second year of release life. So you can see that for 4.9, it was 400 first year and then 500 per month next year and for the latest one for 0.14, it's now at about 700 per month for the past nine months. So this is just a huge amount, right? It's like 22 per day each day, no, we can't. So people can't keep up with this. And then, so people don't use upstream, right? Everybody forked the kernels and there are lots of those forks out there. And each forked bug is effectively a new bug for most practical purposes because that's a separate code base maintained by separate people, separate process, separate testing, so bug can be fixed in one but not in another. So say for Google, so if upstream contains 20,000 bucks, so for Google, it already makes it hundreds of thousands of bucks that we need to deal with and if you look at this industry wide, this already makes millions of bucks that people need to deal with. So being on stable helps a lot but it's still huge stream of bugs and you obviously don't want something like continuous deployment to space station, right? Again, you still need to do some testing. And bugs are being backported to stable too and it's significant rate, which is kind of reasonable because bugs are being introduced at high rate and there's a weak testing, so bug fixes contain bugs and those bugs are being backported to stable and there are also stable specific bugs too, like missed backports or just things slightly different. And obviously there are some distributions that have a large number of custom patches and for them any backporting is a pain and work, right? And also those things like board support packages which frequently basically not updated at all after they've been released. And this kind of makes me sad, so it doesn't look like the situation that should, you know, how should things should be for the system that is as fundamental, as as security critical as Linux kernel. So it's say that we need to reduce number of bugs per release by 100, so not just an order of magnitude but two orders of magnitude to get something like 200 which is much more, you know, reasonable to deal with. So there are some defenses which is great but existing defenses are not enough to protect from that many bugs. So there is attack surface reduction which is great but this large surface is still open and most subsystems are still relevant. So for example, USB is not relevant for servers but relevant for clients and namespaces that way around. So in the end we still care about all of them and we have some mitigations like stack protector and ref count hardening but they simply can mitigate from hundreds of arbitrary memory corruptions because usually it's assumed that there are a few bugs and then mitigations maybe can help with that. They also don't mitigate lots of types of bugs like races and initialized memory or if there is a more or less like write what were primitive then it's just game over. And the CFI is also not completely effective in the kernel because for some functions there is very large number of functions with the same signature and for example for read callbacks function there are about 4,000 of them with this signature and any of them can be called. And some mitigations also not back ported or not enabled to some kernels because obviously performance. Then there are things like SLLinux namespaces or FS variety but this is just a logical protection so they simply they directly assume that the kernel is not buggy which is not true and in particular users namespaces open even larger attack surface. They open lots of things that were historically kind of root only and contain lots of bugs. So today it's even unclear if it's a win or not with respect to security. And there's the thing that called hiding buggy code under root so it can help to some degree but things like SLLinux, IMAIMO, module signing they significantly restrict the root and now it simply can't say a lot arbitrary coding into kernel and for example on Android root is just explicitly not a trusted entity. So when people get execution in a process with the root privileges they still go for a kernel exploit and then the end user still needs to do what they need to do so they need to mount an image and it's protected by a root like what do they do? They just say sudo so they start saying sudo left and right and still kind of exercise this functionality. So existing defenses can't help with kind of save us on the security front from that many bugs in the kernel. Okay and that's it for the set part and no not so set part so both what we're trying to do with this so what we're doing is only part of the solution so situation is significantly rusty so it's not that there's just one magic thing that we can do and magically solve this whole problem. So we have several bug detection tools that they called KSN, KMSN, and KTSN. We also have bug discovery tool called syscaller which is system call fuzzer and we have system called sysbot which is automated systematic testing solution. So KSN or kernel address sanitize it's kind of our security workhorse both in kernel and in user space. It detects bugs like use of the free and out of bounds on the heap stack and globals. It detects bugs right at the point of occurrence. It provide informative reports so for example for use of the free it says where the stack where the bad access happens, where the heap block was allocated and where it was freeed, it's easy to use. You just enable config KSN. The tool is based on compiler instrumentation and you need at NGC 4.9 at least to clank. It's also reasonably fast and has reasonable memory overhead of about 2x but that's only for the kernel part of the workload and kernel usually takes small time of the overall CPU time. So in practice it may be close to actually unnoticeable. And it's upstream in the kernel since 4.3. The next tool is called KSN or kernel memory sanitizer. It detects users of initialized values in kernel and in the context of security this means in particular things like information leaks both local and remote. And those are very easy to exploit way easier than all that speculative stuff and gives you much faster channel from the kernel. It also can lead to control flow subversion when initialized values are used in control flow. And it also can lead to data ethics. For example, if we have an initialized user ID and we actually seen such bugs. It's not upstreamed yet, it's on GitHub and at this point it's kind of almost ready. It's already works. It's mostly enabled on Sysbot and finds bugs, it found more than 50 bugs upstream now. But we are fighting currently with the long tail of various false positives and crashes because the tool is quite complex. And the last tool is KT-SAN or kernel thread sanitizer and it detects data races. Yes, and I forgot to mention KAMESAN also requires Clang. So the rest of the tool were ported to GC and this one will not be ported to GC. Okay, kernel thread sanitizer. So it finds data races. So kernel data races also represent security of thread. There is that common type of ethical time of check time of use when you load something and check and then use this thing later assuming that it's the same value but another thread could actually change this value in between. And again, sometimes we see data races on say credentials and also lots of use after freeze and double freeze in kernel actually caused by data races. So we have prototype on GitHub. It was done by an intern and currently it's frozen due to lack of resources. It found about 20 data races. And the main obstacle for deployment is that the kernel is full of so-called benign data races which is strictly saying undefined behavior in C but historically kernel was kind of sloppy with this and so there are lots of unmarked accesses. Yeah, so to deploy that we would need to kind of get rid of all of them. C-scolar, so it's a system called Fuzzer. It's grammar based and it's coverage guided and it's mostly unsupervised. It's also multi-operating system architecture and machine type. So on the first session there was a question about the Fuchsia testing. So we also exported the Fuchsia and it has Fuchsia on C's bot. Well, so there's G-Visor and AcuraS and also all of the BSD flavors also supported mostly by C-scolar. So it's compared to other fuzzers. It tends to find deeper bugs and it also usually provides reproducers and it does decent regression testing and it's scalable to large number of bugs. So I've said that it's grammar based and what this means in practice is that we have declarative descriptions of system call interfaces. You can see example on the slide. So this is mostly like C function and structured declarations so hopefully you can read it. They have just more semantical information for argument types and fields. And those descriptions help to generate much better workload but the Fuzzer tests only what's being described. So it doesn't just magically test all of the kernel, test only things for which it has such descriptions. And from those descriptions, we generate programs in the following form. You can see an example on the slide. So this also more like C program, just a sequence of system calls with actual arguments and that's what actually we execute and mutate and store. And on top of this, we have the C-sport which is a fuzzy and co-automation system. It does continuous kernel and C-scolar build and update so it always uses the latest version of both. It does test machine management, it does bug deduplication, localization and in the end it automatically reports bugs to kernel mailing list and then does bug status tracking so it can understand when a bug is fixed. Okay, so that's what we're doing but we also need your help just because there are too many developers, too many bugs and we simply can't handle all of these ourselves. So first of all, we need more of the system called descriptions because current coverage is far from being complete and the more descriptions we add, the linearly more bugs we discover and fix. We also have poor environment setup for some things like network devices, as Selenux policies and some other. So the problem is that there are hundreds of subsystems in the kernel and lots of them are quite complex and we're not an expert in any of them. But we see things like, say, a CVE that was classified as remote code executions, bad and it was in something called netfilter and at the time we just didn't know that this thing exists or we see the Android use of the free that was classified as high severity is in something called NSFS and we still don't know what it is and don't test it. So adding those description is not hard. There is some learning curve but when you do the second one, it should be pretty easy. And we have lots of examples. The next thing is testing external inputs to the kernel. So currently CIScolor can inject network packets into the networking stack via tune device so they as if came from external site and this obviously gives the most critical box. We have some basic coverage. We have descriptions for Ethernet, IP, TCP and UDP and for few other protocols but I'm sure there are more protocols and they're quite complex and some of them require some networking device setup. So I mentioned USB, we want to revive this work and kind of actually test more of the USB drivers but then there are lots of other things like NFC, CAN, Bluetooth, guest host interfaces and maybe things like keyboard mouse and also the things that I don't know about yet. So some of them may require adding some stub devices like tune that allow to kind of inject the inputs into that system as if they came from external site. Some may already have it. For example, USB have such support and it doesn't require any additional devices. Okay, so we also have lots of open box, hundreds of box that was reported and not fixed. Some of them are just bad vulnerabilities in itself. Other effects stability or deny enough surface type of box but even the rest they still harms the scholars ability to uncover more critical box. So we can expect that we'll find all of the critical ones if we will not start fixing all of them. So we need help fixing those box and also triaging routing, duping, closing, fixed obsolete box. So usually this is considered as part of the development workflow. So if you submit code or maintain a subsystem, please also contribute to those efforts. Okay, so the next thing is related to KSN. So KSN based on compiler instrumentation so it checks only the C memory access and it checks them with respect to KMLX state. So it does not check memory access done in assembly, done in hardware and it doesn't use of the freeze and out of bounds if there is some kind of custom caching or growth or amortization scheme involved. So an object can be freed in some custom cache but it's not free to the KMLX rate to the slab. So it's still considered as allocated and KSN will not catch back on such objects. KSN has a notation for both checking range of memory if it's good or bad and also notating a range of memory is a good or bad. So a good example is SKB. SKB is a coordinate working data structure and it used to hold packet data. It has so-called linear data which is just directly accessible buffer of packet data and there is an API like you can ask for to pull in say two bytes into this linear buffer and then you can access those two bytes but should not access third byte or if you ask for three bytes, now you can access three bytes but the previous buffer can be reallocated so you should not access the previous pointer. But the thing is that SKB use very active amortized grow obviously to not reallocate each time you ask for another byte so usually you can get away with actually accessing more or accessing the old pointers and this is super easy to get wrong and there are lots and lots of such code and it's just a bug nest. I'm sure there are dozens of remotely triggerable bugs which we currently not detect mostly so it can make sense to do more strict or exact grow policy on the case and for SKB so this something that currently is not done. Obviously we don't want those annotations sprinkled through the code base but there can be some things that that's still worth it. For example, something on DMA, I2C, SPI, virtual maybe something common in USB or file systems. So if you have any good ideas know that this is kind of a way to potentially detect lots of bugs there if we add some additional annotations. Then there are some other tools which we do not use on sysbot currently but it would be great to use them. So the first one is KMM leak or memory leak detector and I heard from server people that memory leaks actually the worst bugs out there because they just silently drain machine resources slowly and then you kind of have everything slow for and can understand why. Obviously remote memory leaks also bad but the problem is that the tool has false positives and this means that we cannot use it in automatic systematic testing setting because we automatically report all things that we find and nobody will be happy if this will produce a constant stream of false positives. So it's possible to make it precise and would be very nice to do. The next tool is KUBISAN on defined behaviors sanitizer and it finds some kind of more local cases of undefined behavior and see. It can find intro object overflows. It can find cases where bull or enums have wrong values and surprisingly this can lead to control flow hijacking because you can have a bull that is neither true nor false or both true and false or you can have for example a switch on an enum value implemented as a jump table and then the compiler can eliminate the bounce check on the enum. Also it detects overflows and valid shifts which also can lead to out of bounce access and sometimes in surprising ways. For example, if variable is used as a right operand in a shift operation then compiler can start making assumptions about the range of the values in that variable and a result that can say eliminate some bounce checking. Okay, but I think that the kernel still needs some cleanup for those bugs and more serious problem that lots of bugs face some significant opposition, especially the overflows, the shifts, yeah, so it's kind of makes it impossible to deploy if we need to kind of have some kind of battle for each other bug. And the next tool is KT-SAN which I already mentioned. So I'm sure it will find thousands of hard to localize races in kernel and provide actionable reports for them but we need to say no to the benign races and just mark all concurrent access. So races are undefined behavior and see and they can also, they're super subtle to reason about and super hard to get right. So if you think that it's easier then maybe you just don't see the whole problem. So even the things like aligned int store a lot can actually lead to very surprising things. And the last thing I wanted to touch is kernel testing. So most of the bugs can be prevented with testing and even the fields that we're not doing enough that we can do much better on the kernel testing side. So we had this 20,000 bugs per release, new bugs are being introduced at a very high rate. Bugs are being back ported to stable. Bugs are being reintroduced and nobody can keep up with this flow. And development is also slowed down because there's high reliance on manual labor. There are delayed releases, there are broken builds which in particular prevent bisections that people ask us for bisection but sometimes the kernel is broken or doesn't boot for months. There's also long fix latency. So in most project with modern development processes it's usually possible to say push a critical fix for example for a build breakage within a day or even within an hour and in kernel it frequently takes month. There are also late feedback for bugs to developers. Developer can receive a bug report two or three months after he submitted the change. They already forgot about the change already on the vacation. So I spent some time kind of thinking what to say here because there are kind of some tests somewhere and somebody kind of runs them sometimes and does something with the results. So if I say that there are no tests then or there is no testing then it's false, right? But still feels that kind of there's something to improve for testing. And I think that something as a testing needs to be an integral part of the development process. So it should not be just something on the side done by some other people. So we need tests and treat. The tests need to be easy to write, easy to discover, easy to run and easy to understand when they pass a fail. We need both user space tests and some internal tests with support for easy hardware mocking. We need to add tests for new functionalities and regression tests and we absolutely need automated continuous testing which is a part of development processes and not just somewhere on the side. So we need pre-submit tests and we need say developer waiting for the four plus one from the testing infrastructure before the commit is submitted or even say a thing called commit queue which is now used in some projects is when the changes approved by humans it gets into the commit queue and then robots test it on head and only if tests pass they can automatically commit the change. And the infrastructure also needs to use all of the available tools because frequently we see bugs that could be trivially detected if existing debugging tools would be used. Yeah, but like tools like KSN and LogDep in particular but lots of them still being committed to kernel. And the standard is not an easy to do, easy thing to do and it's not that they have all of the answers and can say what exactly, kind of how exactly to do this but I feel that that's the direction where we need to move. And with this thank you and I'm ready to answer questions. You mentioned that you file bugs. How do you do the figuring out where to file a bug because there's really no clear way of figuring out how to do it? Do you look through the maintainers file? How do you figure out where the bug should be go to be reported? So we send bugs to Maylient list and from the crash report we try to find the guilty file which is kind of usually on the top of the stack trace but we skip some of the top frames like the comment for example if it's mmslab then we skip it. And then we run getMaintainers on that file and that's the list of the people. Do you need this process improved? Do you need a better way to figure out where the bug should be filed? Because I believe I only just looked through the maintainers file there's only like 19 bug where to file the bugs references. But all of them have the kind of CC people to CC emails addresses. Right, but you mentioned that you also track when the bug's been fixed. Yeah, so the kernel doesn't have the bug tracking system per se, right? There's bugzilla but it's not that it's kind of used. So we build the bug tracking process around the existing email kernel process. So the main scenario is that we give the reported buy tag in the email, in the report email and then the developer needs to put this tag into fix and commit. And then we pull the git trees and when we see this commit we understand that this commit fixes that bug and when we see this commit on all of our builders then we close the bug. And then we, so closing bugs is important because only once we close it we can report new bugs that look similarly. And there are cases actually when we can see the bug that looks almost exactly the same. But the new one is reported only when we close the previous one. So while the previous one is closed that they will all just pile into the same bin. I just wanted to know if there's a copy of your talk online. I saw there's a lot of hyperlinks but I didn't say where they were to. So I'd just like to. Yes, I will send this tomorrow today to organizers and I will also post it somewhere online. I was curious what our options are if we want to fuzz a piece of kernel code that's not reachable due to kernel config decisions. I was taking a look at the kernel configs that you guys have. And for instance, it wouldn't be possible to fuzz app armor currently. Is that possible? Is there a way to specify a custom kernel config? You mentioned up armor, right? It's enabled, but SE Linux is used by default. Okay, so there are two things. One is just the syscolar fuzzer which anybody can run locally. It can use say Koyama virtual machines and then you can give it any kernel. And yeah, so regarding sysbot, we have some fixed set of configurations and potentially we can add new ones. And you could handle kernel configs. Yeah, so up armor already came up because it's also used in some of our internal kernels. It's kind of important to us too. So yeah, if you will find me and send me in the mail then we can discuss this. Great, thank you. So as a developer, when something shows up in my mailbox or on the LKML that is clearly in my code, what's the best thing I can do to communicate back to you that we've actually done something with it or that we're not going to do something with it or any kind of interaction that we might have because there are several bots out there right now that are doing wonderful and glorious things for us. But sometimes the question comes up as, gosh, I fixed the code, now what do I do? So with each email there's a kind of link for more information and there you can find the mailing list for CIScaller where you can reach us. And we usually look kind of subscribed to the reports themselves but there are lots of them and we can miss something. So it's like separate proposal for our systems that it's better to send it to our list. It's just CIScaller at googlegroups.com. You can find this email. How large is the testing infrastructure in CISbot? Sorry, can you repeat? How large is the testing infrastructure in CISbot? How many CIScallers are running? How many pixel devices? Because you mentioned that you run also on devices, right? Devices, so CISbot doesn't run at devices now. So the CIScaller fuzzer itself supports several types of machine, in particular Android phones and all Android boards and it kind of can be extended if you want to. So we currently run on GCE in the cloud on virtual machines only for the CISbot infrastructure. And for the Linux, for the upstream Linux kernel we have maybe 52 core machines or something like this. Any more questions? This is a bit more of a niche question but I saw you were talking about can messages. Could you elaborate a little more on what that's looking for? Can you repeat please? With the CISbot you say that one of the things to add later would be can functionality? Can? Yeah, fuzzing for can messages, I believe I saw that. Can, so currently we do something for can. Again, I don't know exactly what because I have no idea what is can and what are the interfaces. So I talked to can maintainers and they had some initial interest in actually look what we're doing and where this can be improved. And there's something for, I think, actually injecting the can packets. I think there was some issue, maybe it didn't work with namespaces or something but they never get back to us. So yeah, we have something but I don't know what. So you can look and we also give the kernel we give coverage report and you can see what parts of this your subsystem we cover and what parts we don't cover and assess how good is it. Okay, I think that's it. Thank you.


Welcome to the Crimson Engine. My name is Rebedi and today we are talking about hard light. How to use it, how to utilize it, and how to make it look good. There's been a big trend lately for soft sources. Larger and larger lights to give softer and softer illumination to your subjects. It makes things look beautiful. It makes shadows invisible. It just gives everything a warm glow. I think hard light and the advantages of hard light are neglected. Not just using hard lights to bounce off something and make them soft but actually using hard light for what it's good for. Creating hard edges, creating a spotlight, creating really punchy, bold, bright images. There are a lot of advantages to using hard light. Practically on set. You can place the lights very far away or you can just use available sunlight. Hard light obviously gives hard edges. It's not as flattering as soft light but that doesn't mean that it doesn't have its own aesthetic that can be just as beautiful as soft light. You do have to know how to use hard light so it doesn't look like you're lighting your set with a spotlight held by someone just off camera or you don't end up looking like an ENG news reporter in front of a hurricane. First thing I would say is that hard light doesn't need to be bright light just because hard light sources like Fresnel's have huge output. They don't need to be turned all the way up. I have a IntelliTech light cannon mini just on top of the camera here. Probably about a foot above and a foot behind the camera. It's on access and it's dialed all the way down. It's still giving me plenty of exposure. I could have this light 50 feet away and totally empty my set of lights and still get illumination but I've chose to keep it reasonably close. A big part of making hard light look good is use the angles that flatter the face. So like this on access meaning almost exactly in front of and above the camera or using hard light to create a Rembrandt style light. That means that the shadows it creates still flatter the face. Don't create competing shadows. Don't mess up the lines of the face and make your subject look beautiful. Hard lights create hard shadows but this isn't necessarily a bad thing. It's a very graphic immediate almost on camera flash look that has an aesthetic that you can embrace. Hard shadows look great when paired with bright colors, strong patterns, bold choices. They can even serve to outline your subject against the background and make things really pop. If you're worried about the shadows that hard light creates you can balance them out. Here I have a young your light stick if I place it just off camera below and fill in the shadows that the hard light creates you get kind of perfect illumination almost another graphic look where your subject is really highlighted out from your background.  But you shouldn't always shy away from the imperfections of your talent. Sometimes it can be really great to place your hard light directly side on and really accentuate the textures of your subject. Danny Trio, a famous actor here in LA has an amazingly distinctive look and it would be a mistake to try and light him with beauty lighting. He really stands out and creates a really more powerful character when lit with hard light. Hard light like the sun illuminates everything evenly and this is kind of why it gets a bad rap. If you're using artificial hard light like an IntelliTech light Canon pro or this light Canon mini you can use it to isolate your subject from the background meaning put much more light you know five or six stops more on your subject than the background and really make them pop out of the background. It's much easier to get a bright hard light than it is get a bright soft light. Hard light can be your friend. It is an amazing tool and you don't need to follow every trend and make every light as big and soft and diffuse as possible. Hard light will really let you say a lot about your characters in film. It will really give you a punchy bright distinctive look when you take photographs. That's my look at hard light. Thank you very much for watching. I will see you next time.


My name is David Banner. Everybody knows me as Dai. I'm from the Rhondda Valley and I'm a manager director of Wales Interactive, a video games company based in Pencoid, Bridgend. We've been developing games in Pencoid for the last five years now. We started the company predominantly tapping into the graduate workforce that existed in Wales and the ambition was really to establish the games in the stream of Wales. I'm delighted to say that we sell millions of games around the world now and entertain the world from games made in Wales. I've been championing the growth of the games in stream Wales for the last 20 years really. I also helped create the games art course at the University of South Wales, nurturing new talent. I also was the project manager of GamesLab initiative to help graduates get jobs in the industry and more importantly keep them in Wales. And then also I was the founder of the Wales Games Development Show. As a proud Welshman once I found out that I was nominated I was shocked, delighted. For me it's nice personally but ultimately it's great that it raised the profile of the games industry in Wales. And on a side note it's proof to my wife that I've got a proper job.