Okay, so it's another subject, top secret, a world of codes and secret. Well, I am the curator, really, of an exhibition at Mondaneum in Belgium. And it will be for a long time from October till June. What is the Mondaneum? Maybe you don't know that. You can go to Wikipedia if you want, and you will see that there it was the idea of Google and Wikipedia. There are 16 millions of files, so indexes and so on. It was done one century ago in Belgium, and it was used in the world. There was also in 1930 the idea of Internet using interaction, remote question, and so on and so on. It was the beginning of TV in fact. So you can see that there. Here is the presentation. And there will be a lot of talks. The first day they are maturing, and a few of them will come to speak about Enigma indeed. We have the support of Google, really, and many other ones. And there will be many subject history of cryptography, old machine, and new ones. The cryptography in Belgium, AESR3, the dark net, and the future of cryptography. We need your participation, it's my last slide. For instance, if you have documents in history of cryptography between 45 and today, and never publish, and so on, you are welcome to send me an email. And we are a community, and we have to prove it at this exhibition. So send me a message about where cryptography is important today and for the future. And we will show it during the world exhibition, and more and more is better. So you are welcome to send me. Thank you very much.


Hello friends welcome to the session I am Malka. We are going to discuss how to form the pair of linear equations in the following problems and find the solutions if they exist by any algebraic method. A problem is Yash scored 40 marks in a test getting 3 marks for each right answer and losing 1 mark for each wrong answer. Had 4 marks been awarded for each correct answer and 2 marks being deducted for each incorrect answer then Yash would have scored 50 marks. How many questions were there in the list? So let's start with the solution. The number of correct answer and let the number of wrong answer be Y. Now according to question 3 marks for correct answer and minus 1 for wrong answer then Yash obtained 40 marks. Therefore it can be written as 3x minus y equal to 40. This is our first equation. Now again from the question we see that 4 marks for correct and minus 2 for wrong answers Yash scored 50 marks. This can be written as 4x minus 2y equal to 50 or it can be written as 2x minus y equal to 25. This is our second equation. Thus the equations are minus y equal to 40 which is our first equation and 2x minus y equal to 25. This is our second equation. Now on subtracting equation second from first we get minus minus y and minus of minus y equal to 40 minus 25. This implies x minus y plus y equal to 15. This implies y by cancel out x equal to 15. Now on substituting x equal to 15 in equation first we get our equation first is 3x minus y equal to 40. Now we substitute x equal to 15. This will give us 3 into 15 minus y equal to 40. This implies minus y equal to 40 minus 45. This implies minus y equal to minus 5 minus minus cancel out. This implies y equal to 5. The two equations are 3x minus y equal to 40 and 2x minus y equal to 25 where x and y are the number of right answer and wrong answer respectively and total number of question equal to x plus y equal to 15 plus y equal to 20. Hope you understood the solution and enjoyed the session. Goodbye and take care.


So once again, I don't think this is something that's standard that to hold up again as an ideal.  This is how it's going to be. So don't be shocked if you have moments in your bliss and in your deep pairs of meditation when you don't feel ill or well or pain or pleasure, you know, when you lose all sense of feeling in the body. Because he's told us a number of places that the body doesn't really feel. The mind just tells the body what to feel. When the body gives up its judgments of the world and gives up its categories and its ordering of thoughts, then it no longer, you know, attempts to tell the body to feel pain or pleasure. Because those both reinforce the body as being real. It's no response at all is in the mind to what the body does. It's usefulness remains and nothing more. So it's used just as solely as a communication device to bring the kingdom of heaven to the minds that know it not and it doesn't feel anything. It's kind of a little snapshot of what the advanced teacher of God experiences. Perhaps you do not realize that this removes the limits you had placed upon the body by the purposes you gave to it. So all the limits you had placed upon the body, in other words, it's got to be fed regularly, washed regularly, closed, housed, you know, all the things that all the rules that you think you got to do to keep the body healthy can be removed, those limits can be removed as you remove the purposes you gave to it. So in other words, that's why it's so important for us to be clear on the Holy Spirit's purpose versus all of the ego purposes. Because as long as I'm holding on to ego purposes, then the limits still seem to be held in place by the mind. As these are laid aside, the strength the body has will always be enough to serve all truly useful purposes. The body's health is fully guaranteed because it is not limited by time, by weather, or fatigue, by food and drink, or any laws you made it serve before. You need do nothing now to make it well, or sickness has become impossible. So it's still at the metaphor level of talking about the body's health, but in the end, you know, it's just kind of saying, you need to take thought for nothing. You need to neither be careful nor careless.  Here we go. Yet. This is what we can always get to. This protection needs to be preserved by careful watching. If you let your mind harbor attack thoughts, yield to judgment, or make plans against uncertainties to come, you have again misplaced yourself and made a bodily identity which will attack the body where the mind is sick. One of the clearest statements there are for why we have to be so vigilant with our mind watching. So those are just the causes of sickness. Yes. He's defining them specifically. That's why it's also, when we get into these subtleties about attack thoughts too, is there are seemingly recognizable overt attack thoughts like thoughts of anger and condemnation toward your brother, but also thoughts of desiring your brother in a bodily sense or attack thoughts. Those compliments we talked about like, oh, I just think you have the best, your body's in such good shape and you always have such a good weight or whatever. All those kind of things that focus attention on the body are attack thoughts. They aren't compliments. They're actually attack thoughts because they're focusing on it. The content below them is that you're a body and I'm a body. And I think it's great that your body has this advantage or you keep it in such good condition or whatever. Or even the brain.  I envy you.  The second one, yield to judgment. I found that people will say things like, oh, you did a real good job, Dorothy. And I'll kind of say, well, I had lots of help. Thank you, you know. And it's odd because lots of times they don't hear that, but I accept that they don't have to. I hear it. I think that's good too because that gives a focus. Instead of getting just away from the compliments is to always put it back to the Father. Or I had lots of help or thank you, Father. I mean, as long as we in our mind keep turning it back to all my gratefulness and all gratefulness that anyone can direct even towards me needs to be directed back to the Father or to the Holy Spirit because that's where the gratefulness truly has a basis. Not for anything that this body has done or said, but just the gratefulness that I am has got created me, kind of a thing. And I like that because it gives it a positive focus instead of thinking about negating the compliments. It really just puts it where it belongs. I think this almost brings us back to full circle on our topic of listening too because when you look at those three conditions that he's laying out of this preserved by careful watching, you'd have to have something to rely on or to truly listen to to go along even. I mean, if you let go of attack thoughts, if you don't, if you attempt to not judge in any way, not to judge what I should do, what I should say, how I should go about solving this problem and that problem. And the last one really is where the trust comes in too that you were talking about Beverly, about making plans against uncertainties to come. It's just like a total giving over to the listening without any care or concern for anything because as soon as the thought comes in, I must do this or else. Whenever it's based on fear of consequences, I mean that's what most activity through the ego's lens, all activity through the ego's lens is based on is it's a fear of consequences. Yes, I'll do this and this and this and this because I know the ego thinks that if I don't do this and this and this, it's going to be trouble. That's where the coercion comes in, right? Feeling that there are consequences to not doing. In the end, I feel that whole section of I need do nothing is the key or the shortcut. In the end, once the mind starts to welcome that light and starts to see that listening is really all that it's about, then I need do nothing becomes the shortcut or the most plain and obvious passage in the whole book because then you don't have to, you can let go of even thinking about the body about what I should do, what I shouldn't do. It's just the mind then is willing and open to just sink into that stillness and accept the atonement, accept the fact of what's there. There's no more restlessness about, oh I have to tie up these loose ends before I can be still and meditate because as long as the mind thinks it has loose ends to tie up, there's still a bodily identity. What loose ends in this projected world could there be to tie up? In the end, that's why I feel this is more in line with the mystical path of just going within. That's been the traditional mystic path, it's just to turn within through meditation. And this is just a course in helping set the mind in that direction that once it can see the value of that, that there's nothing of value, nothing that glimmers anymore in the world to hold it back then that's the obvious thing to do is to just go within. It's no longer wasting time, it's no longer unproductive, you know. It really is what I live for at that point. And that point is now, I mean can you feel that? I mean as we go into this, I mean that's what always we should just arrive at this calm, restful place of clarity right now. It's not about, well I got another piece of the puzzle and tomorrow I'll solve this. But it's like just, there's such a contentedness and that's it. Do you feel, you've come to a calm contentedness about the whole idea of that you started off with talking about the feeling guilty about symptoms and all that other stuff? Does it seem very different now that we've gone into this? It seems different. I don't know if I can say it seems very different. I feel like there's room for greater clarity still. So if you take that thought, I feel like there's room for greater clarity. Is there anything you can get in touch with? What's that thought? I think there's probably a lot of linearity in there for me. I notice I have a disbelief that I can be that clear once and for all and that's it. You feel like you've got lots of evidence as a witness in the past against that possibility? Is that what you mean by linearity? Well I guess what I mean by that linearity is that I don't believe that I can have all the clarity I need right now and remain in that state of clarity. So it's projecting it into the future somewhere instead of maybe the past as you would describe it. Yeah, it's like I couldn't possibly be there yet. Or I couldn't possibly understand all there is to know about this. And not in a continuing kind of way. Maybe like it would seem like it, you know, for like right this instant. It's sure to be gone in a half hour. That's it, yeah. It's actually that same thing I voiced when we, you know, when I came to a real clear point when we were having a discussion about relationship and I said, you know, I don't want to lose this. I don't want to forget this. It's that same theme of not trusting that the clarity is going to be enduring.


Appalachian Wireless is Appalachian Advantage. Unlimited text talk and two gigs of data for as low as $45 a month. Or if you like, get five lines on eight gigs of data for just $145 a month. Sea store for details. Better service, bigger savings. That's today's Appalachian Wireless and East Kentucky Network Company. The Big Sandy Community and Technical College is gearing up for their third annual fall concert series. Tickets are only $10 and all proceeds will benefit the Big Sandy Singers and Band Scholarship Fund, which relies solely on fundraising events. Officials with the event say this is one of their best lineups yet. The local honeys, they are a duo from Berea. They are more of a folk, Appalachian type sound. Two ladies and then that's on October 19th. November 8th is Nicholas Jamerson, local Sunday best, a member of Sunday Best, local singer-songwriter. He likes to use this series as a way to unveil new songs and new pieces he's written. Then we have Grayson Jenkins, November 16th. He's from Central Kentucky, but he plays, he's trying to migrate this area and he's played with Nicholas Jamerson and Sunday Best and some other guys and a really good singer-songwriter. Local singer-songwriter Nick Jamerson says the concert series will provide an experience you will not find at larger venues. It's just a more connected experience for me as an artist giving it and I know that times that I've you know whenever I can catch a show in this sort of setting that I just enjoy it more. Like I think that this area is understanding that the potential for shows like this are right here. We just have to manifest it and that's what Joe Campbell and Clayton Case and the Mountain Art Center and Big Sandy College are making happen. So I'm just really thankful that that's the case. The local honeys take the stage for the first concert in the series October 19th in the Gearheart Auditorium on the Big Sandy Community and Technical College Prestonsburg campus. Call 1-888-MAC-ARTS for ticket information. Reporting from Prestonsburg, I'm Shawn Allen for EKB News.


Good day, fellow investors. We continue with our summary. We are already at Chapter 15. Check the playlist for the first 15 chapters. We are close to the end and close to the most important chapter, which is Chapter 20. So please subscribe. Let's dig into Chapter 15, Stock Market Selection for the Enterprising Investor. Hi, my name is Sven Kerlin. I'm a full-time stock market researcher and I run the Sven Kerlin Stock Market Research Platform. And the question, Graham starts his chapter with is can you beat the market? And he dissects, he says how it's extremely difficult, how most fund managers fail to beat the market. That's a normal statistic. Fund managers, investors make the market, so attach the fees. Most of them will beat, will not beat the market, will underperform. And he says that that might be because of two reasons. First is the efficient market theory that everything that there is out there to know about the stock is already priced in and you can only adjust the models to what is going on and to new information. And of course that a lot of debate there you can check my video on if you need stock market, if you need complex math to do stock market analysis or just to use stock common sense, investing common sense. And the other option Graham gives is that there are market inefficiencies and those are the inefficiencies that an enterprise investor has to take advantage of. Those inefficiencies come from investing there where nobody else is looking at the moment. So undervalued companies under the radar that don't have that market charm that everybody is chasing after. His methods to Graham Newman methods that they used for 30 years when I think they beat the market, they had a great investment with Geico of course. Those methods are arbitrage, buying one security and selling the other that has offered to buy the first one. So when there is an acquisition one company buys the other company you buy, the company that will be both at the premium and sell the other one that would have to give you a risk free return. Liquidations not many of those in this market but the goal is to receive more cash than what you paid for during the liquidation process. Related hedges, of course we are always talking here about very diversified portfolios. All of those things can go wrong and some of those can go wrong and Graham mentioned the 20% expected yearly return in a diversified portfolio. A lot of these are very difficult to find today. Related hedges, convertible bonds or shares with the sale of common stocks. So he bought the convertible bonds that will get him the shares and he shorts those as he can do that and return the stocks later and get the yield whatever is in the convertible bonds. Then the most important thing on what Graham is famous for net current assets bargain issues. Big diversification is what he promotes here. He used to have 100 stocks I think when and he buys when the stock price is below net current assets alone. This gives no value to the plant account or other assets just net current assets. Net current assets are calculated by deducting current liabilities from current assets. It is implied that the book value is above the net current asset value. Find this balance sheet online. So let's see we have assets current assets 149 000 current liabilities 407 000 so the net value of the net assets is 102 000. If we look at shareholders equity the book value is it is above that always look at the tangible book equity so that's what Graham would look at and then if the stock price is trading the market cap is below the 200 100 000 that is the net value of the current assets and he would look for a discount of 40 on that then it is a buy for Graham. So 40 discount on net working capital is extremely difficult to find in this market but if you stick to that you give it a long term there will be another 99 when I think 2000 stocks were not trading below working capital they were trading below cash per share so that was a big opportunity in February March of 2009 so there might be new opportunities if you keep the strategy in mind it might come helpful when the opportunity comes to you don't chase that then there is always secondary companies companies that have no charm to the public he used then the SAP guide back in the 60s to find those stocks I think today we have simply to go through the list of all the stocks traded on the American stock exchanges and then go global to find really those gems those undervalued under the radar gems that will give you a good return immediately and there are some criterias that we'll discuss in a second and great opportunities for the capital appreciation from around the world when it gets under someone's radar let's see this would be Graham's criteria current assets at least one point time 1.5 times current liabilities that not more than 100% of net current assets earning stability last five years dividend record some dividend earnings growth over the last five years at least price less than 120% extremely important and this world in this environment net tangible assets if you want to simplify this if Graham should pick one or two criterias criteria that would be price to earnings ratio and the well diversified portfolio of stocks selling under net current asset value if you can find that in those in this market so in this market this is very difficult but from what Graham was doing and today always value I think over the very long term will beat anything else as it has done in 94% of the cases 10 year returns over the past 90 years and you can check my video here in the end screen thank you for watching this looking forward to the comments still few to go for closing on the intelligent investor then we'll go to margin of safety set Claremont which is also very interesting book see you in the next video


Big City Farms is a part of a recently created what are we referring to as like an urban growers collaborative that we're calling Indigrone that is comprised of five market gardens in Indianapolis. Big City Farms is the largest one. They range from about a half acre to two and a half acres and they've been around for we'll say on average three to four years. So Big City Farms this is one of the two sites that we use the other site is on the about five miles northwest of here still well within the boundaries of Indianapolis but in a sort of a completely different area it's residential and sort of wooded and not next to a highway or train tracks or an old factory. So it's a total of about two and a half acres that is currently under production. We're going to expand this that away over the course of the next six months so we'll be up to three acres by the beginning of next year. So we grow pretty much anything and everything. I don't know how many probably 40 to 50 different crops 100 plus varieties of those most of the produce about 65 percent goes through a CSA that I run. It's a 22 week CSA about 75 members and the remaining goes to local restaurants about four to six restaurants a week from our season runs from we'll say like late April through into December. So it's a pretty nice long season. At the moment we don't do any really established season extension stuff as far as like high tunnels or whatever where I have recently purchased two high tunnel frames one of which will go up here hopefully another will go on the north side. So those will when they're fairly large 85 feet by 18 feet so they'll allow us to do some more winter growing with pretty much all these beds there'll be at least crop twice some of them three times over the course of the year. We just sort of try and churn it out as much as possible irrigation. Let's see so we use let's see the local utility here is called citizens energy. They have essentially we rent a hydrant meter we tap into the hydrants to be able to water stuff. It's not particularly fancy or I mean it's pretty low tech but it works very well and water is super cheap which is very nice and and it's always on and it's always available it's not a well so that's nice. I'm pretty careful about getting soil tests done on from before I start and then probably at least on an every two-year basis just to check in and see how things are going with soil contamination there's I mean I've dealt with it in other parcels and so I've become pretty adept at knowing what to do. There's also an amazing resource if I can do a quick local plug there's a professor at IUPUI this guy Gabe Philippelli who's like a national expert on like urban contamination and how to deal with it and he's been a really tremendous advocate for urban growers whether it's home gardeners or slightly larger market gardeners and his big thing is that it's it's never like a absolute problem it can always be fixed or addressed in some way and so for the most part with the techniques I've used is basically just trying to build up the soil as much as possible


What up boys, this is gonna be the Covenant video and In this video, I'm gonna go through the active abilities for each Covenant and then we're gonna do a second video for Sawbinds and conduits because otherwise this video is gonna be way too long There's a fair bit to get through and then I'm gonna do a third video on kind of ranking the Covenants for first of all for disc for PvP arenas Mythic plus and obviously the raid and Then I'm gonna do the same for holy and we're gonna kind of try and Get a little bit of you know this list going on So the two Kyrion Covenant abilities are summon steward and boon of the Ascended Summon steward summons a dude who Will trade you three files of Serenity when you click on him And he has a five-minute cooldown these files will restore 20% health and remove all Cursed disease poison and bleeds They're on you and It is usable once in combat until you drop combat and then it gets a three-minute cooldown similar to other pots Which get a five-minute cooldown. No, I believe and he also offers you the option to change your talents he will buy Graze and whatnot off you Boon of the Ascended is a three-minute cooldown and this is really powerful And what this does is it replaces once you use it replaces your smite with Ascended Blast and it replaces boon of the Ascended with Ascended Nova Ascended Blast has a three-second cooldown in his instant and Deals considerable damage and are we healing So pretty much want to rotate these every single time they're up So the second Covenant we're going to be looking at is the Night Fae And the first of the abilities is soul shape Which is a 1.5 minute cooldown it's instant and it turns you into a Vulpin teleporting you forward by 15 yards And it will increase your movement speed by 50% as well and Every five seconds or so you can teleport again and it's instant again If you're in a rest area, then it's just up permanently Otherwise it lasts for 12 seconds The second ability is Fae Guardians And this is a 1.5 minute cooldown costs 1k mana and his instant It lasts for 20 seconds And the way that it works is The last target you used either your shadow of pain your shield or your Mandon is The one that has the fairy You don't have infinite fairies you have one fairy of each and it follows the last kind of that spell that you used So for shadow of pain any subsequent spells you cast against the last target you pained will refund the mana The last target you shielded will be granted 10% damage reduction so a kind of masochism and The last Person you shadow mended will get a bonus to their cooldown recovery rate. So the third Covenant that we're gonna be looking at is the Venthyr and in my opinion, this is the coolest one Not just because the aesthetics but because of the dynamic of the abilities that you get So the first one is door of shadows and it's super simple 1.5 second cast one minute cooldown and teleports you 35 yards or up to 35 yards away Very cool The second ability is mind games Now this one is a little bit more complicated It's a 1.5 second cast baseline Costs 1k mana and has a 45 second cooldown with a 40 yard range. So it's a really really versatile spell to use On hit it does a lot of damage It's a shadow spell and For five seconds after it lands it puts a magical debuff on the target This magical debuff will reverse the next healing or damage that the target does So as you can see from the tooltip the next 4.5k damage that the target does will heal their target So you can use it on a DPS or a healer The next 4.5k healing The target does will damage the target any damage or healing that you reverse Will restore mana fourth and final covenant that we're going to be looking at is the necro lords and Their first ability is flesh craft a two minute cooldown It's a four second channel that gives you a 20% of your max health shield for two minutes If you do this near a corpse, then it increases to 50% of your max health It's not a spellable The second ability is unholy nova and it's a 2.5k mana cost instant with a one minute cooldown It launches an explosion of dark energy that infects enemies within 15 yards with unholy transfusion And it heals up to six allies for 1,191 obviously this will scale Unholy transfusion will deal 3k damage over 15 seconds any allies who damage The target that has this dot will also be healed for 40. This was the covenants video. I hope you found it useful Get in you kidding hope you found it useful As I get completely sidetracked, thank you Luna the next video will be on conduits and soul binds So I'm gonna put in a bunch of research to To learn about all the different talents that is going to be available there and then for the third video we're gonna use that research to basically make a tier list for Which covenant is gonna be optimal for disk arena for mythic plus and for raiding and we're gonna do the same for holy Thanks for watching Tony kitten trying to record a video here mate. You got anything to say?


Hi, my name is Colin Eberhardt and I'm going to talk to you today about the software crisis or what the financial crash can teach us about open source. Apologies for the slightly less than cheery title. By way of introduction, as I mentioned, my name is Colin Eberhardt and I'm the Technology Director of a company called Scott Logic. We're a growing UK based software consultancy that works predominantly within the financial services community and I've been working there for many, many years. And some of the experiences that I've had from working with our financial services, our banking clients have very much reflected in this talk. But also to tell you a little bit about myself, this talk is very much an intersection of my day job and my personal passion. Open source is something that I'm heavily involved with. I've been working in open source for more than 25 years now. I think my first project or my first open source project was one written in PHP about 20 years ago and before that I used to write a lot of freeware and shareware software. I also really enjoy data mining and exploring data sets and as you'll see in this talk some of these interests are certainly coming together here. So back to the topic of the talk itself, what the financial crash can teach us about open source. What I want to do is tell you a bit of a story here. For a while I've been getting a little bit concerned about the overall complexity of our open source software. And it's not just open source software that's getting more complex. Software architectures in general seem to be getting more complex. We're gravitating more towards microservice architectures where we take a monolith and we pull it apart into numerous components. Also cloud architectures tend to be really quite complex involving a great many different components and generally speaking this is a good thing. However complex architectures, complex software can be hard to understand. It can be difficult to use safely. Before I use a particular open source project or a library I often ask myself who writes this code? Who maintains it? Is this a sustainable project? And ultimately am I going to regret using it? Is it going to start to fall apart underneath me? And that does happen all too often. So that's the complexity and also the fragility. Complex structures have weaknesses. They fall apart. Security and maintenance problems are prevalent within open source. And finally sustainability. And I'm not just thinking about the sustainability of my own projects that use open source. I'm thinking about the sustainability of the ecosystem as a whole. How do we create a sustainable open source economy? So I decided to do a bit of an exploration myself. I wanted to learn more about this problem. And the best way to learn about it is to start exploring the data and exploring the community. So I decided to do a bit of a deep dive. And the project that I picked is Express. And the reason I picked it is because it's a project that I've used a number of times myself. If you're not familiar with it Express is basically the de facto web server for Node. If you want to create an HTTP server with Node, you'll almost certainly end up using Express. It's clearly an important project. On GitHub it has 50,000 stars. It's downloaded 14 million times every single week. It's also 10 years old. So quite a mature project. So my initial impressions as I started this journey, it's fair to say I was clearly happy at the beginning. I'm a repeat user of Express. And the reason for that is I'm happy with the functions and the features that it provides for me. So what I wanted to do was start learning how is Express constructed? What are the component parts of Express? So I started to look at its overall composition. I started to look at its dependencies. So Express is composed of 49 separate modules. When you install Express, the top level module is installed. And this is accompanied with effectively a bill of materials. And another 13 modules are installed. And then further transitive dependencies are installed. And the total composition of Express is 49 separate modules. This is really quite typical. And it's not specific to the JavaScript ecosystem. We see similar things happening in Rust, Python, and other sort of modern software tool chains. So I was also interested to see how this complexity evolves over time. So I downloaded all of the 163 releases of Express over the past 10 years. And as you can see, the complexity of Express in terms of the number of dependencies that it has, the number of modules that form its total composition is growing over time. If we look back at version two, which is almost 10 years ago, it was composed of four or five modules. Version three, more like 10. And then the number of modules grew and grew and grew over time. Interestingly, at version four, clearly there was some sort of consolidation effort. The number of modules drastically reduced. And then it started to increase once again. And this is reflected throughout the open source community. From my personal experience, our open source software is becoming more modular. It's more sort of composed of disparate parts. So this is clearly the way things work at the moment. But I must admit, I'm starting to feel a little uneasy. If I want to gain an understanding of the maturity or the sustainability of Express, I'm not checking just one project anymore. I'm checking 49. Now, if I want to do something pretty simple, say for example, I need to check that the licenses for each of these modules comply with my own policies. That's relatively straightforward to check. I can automate that. And I must admit, I've used automated license checkers on a number of projects. And it's quite surprising how often you'll find one that perhaps doesn't have a license at all or has a particularly problematic license or is public domain. However, license checking is relatively easy. The answer is somewhat binary. And yes, you can use this. No, you cannot. Measuring quality is a lot harder and is very challenging. I couldn't conceivably check the overall quality of all of these 49 component parts. However, this is effectively the tip of the iceberg. Whilst Express has 49 dependencies, it actually has 195 dependencies in total. The rest form what are known as the development dependencies. These are the ones that you install if you want to work on Express as the product itself. If you want to alter or change Express, you need to download 195 dependencies. And for other projects I've worked on, you'll find more than a thousand development dependencies. So why should I care? Is this a problem? Well, in some senses, the tools you use to create a framework or a library like Express are very much reflective of the quality. You need to pick quality tools to create a quality product. And it can be challenging with so many different dependencies. But also, probably a bit more worrying is the scope for what are known as software supply chain attacks. Express being an HTTP server is something that if I were a malicious individual, it would be an interesting project for me to target. Now, I could go after Express directly or I could go after one of its 49 dependencies. So that already gives me a number of different places that I could attack. But something which is becoming more prevalent at the moment is supply chain attacks. So these are attacks that insert themselves earlier into the overall software development lifecycle. If I were able to attack and deploy a vulnerability into one of the development dependencies, I could insert a vulnerability or malicious code into Express at compile time. And this, as I said, is a problem that's occurring more and more frequently. So yeah, this complexity is starting to make me a little bit nervous. But let's go a little bit further down the rabbit hole. If I install Express, what code is actually being downloaded? And if you install it, do you get the same code? To understand that a little better, we need to understand how these modules are downloaded and resolved. And an important concept here is a thing called semantic versioning. When you first download Express, it comes with effectively a bill of materials. It says, I depend on these other modules. And the way that it declares these dependencies is through a thing called semantic versioning. It's a concept that was proposed about 10 years by one of the GitHub co-founders. And semantic versioning has a provider of formality to how versions are expressed. Major version increments indicate backwards incompatible changes. Minor bit version increments indicate the presence of new features. And patch versions are incremented when you fix bugs. So this is a way of having a formality regarding how you version your software. And as our software composition becomes more and more complicated, a concept like semantic versioning become really quite important. However, I've got some of my own personal concerns about semantic versioning, which I shared in a blog post a little while back, but that's not for now. However, software products like Express rarely depend on specific or explicit version numbers. Instead, they tend to permit version ranges. So I might declare that I want to use this particular library or tool, but rather than saying I want to depend on version 1.2.3, I'll use this semantic range version, this carry 1.2.3, which is equivalent to 1.2.3 and above, but no higher than 1.3. So what that means is the author in this case is explicitly saying, I don't mind if this upstream dependency adds new features, I'm happy to bring those into my builds and I'm happy to bring in bug fixes. However, I don't want breaking changes. I don't want major version increments and this is incredibly common. I must admit, I'm not entirely sure why you would want to permit new features because software being software, a new feature in a dependency doesn't magically result in a new feature in your own product. Typically, you have to change your code to accommodate that new feature. This use of version ranges is really quite prevalent at the moment. So I did a bit of analysis. Looking at Express, I looked at a couple of version numbers of Express itself, version 4.16.4 to version 4.17, the next release, and there was a seven month period between them and I discovered that there were 33 different configurations of Express itself over this seven month period. So whilst Express had only moved forward one version increment, there were 33 different versions due to the semantic versioning of its dependencies and their dependencies. So basically my Express version 4.17 might not necessarily be the same as yours because of the sort of slack or loose nature in this versioning. Yeah, I must admit I'm going to get a bit scared now. So we have complex dependency graphs that are ever changing. Also, another concern is with this ever changing mix of code who holds the keys? Who is it that is allowed to publish these modules to public repositories that are then downloaded onto my machine according to this sort of recipe? So again I did a little bit of digging with an Express and I found that of the 49 dependencies there were a total of 88 maintainers. So what this means is there are 88 different individuals who can create releases which will ultimately affect the software that I install when I download Express. Also, you'll see a funny little colouring scheme here. No Bob and includes Bob. Now what I mean by this is Express has a single core maintainer and rather than calling out explicitly I'm just going to call in Bob for the sake of argument. And what this shows is that for a significant number of the dependencies of Express Bob, the maintainer of Express is also a maintainer. So what this means is Express is complicated. It's composed of 49 different modules. However, the maintainer of Express also has an element of control over a number of these dependencies which I'd say is a good thing. However there are some issues here. There was a survey done where the results were published a little while back and only 9% of MPM maintainers enabled two-factor authentication. So what this means is for 91% all you need is their username and their password and you can create a new release which is a bit worrying. Also as a result of this analysis I have the email addresses of all of these 88 maintainers and I took the first one and I typed it into Troy Hunt's very well known Have I Been Pwned which is Hackerspeak for Have I Been Hacked. I typed it into his well known website and found that our email address had been subject to found in a great number of different vulnerabilities and data breaches. So the very first maintainer email I picked I could find that that email address and an associated password have been leaked as a result of a LinkedIn data breach a couple of years ago and we all know that most people are not that good at creating new and unique passwords and considering that only 9% of these people are potentially using two-factor authentication it probably wouldn't take me to take too long for me to find a reused password amongst these 88 maintainers and this is without even looking at the development dependencies which are four times as numerous. Yeah this is getting a bit scary isn't it? I think we've gone far enough down this specific rabbit hole we've learned about the software bill of materials the process that determines the code we download and execute is really quite complex and we've looked to this complexity and I guess by virtue of that there's an element of fragility and experience has shown yes it is fragile it does fall apart you've probably heard of the left pad incident or the event stream incident I just thought I'd look at the most recent incident I can remember and here's one of them there's a well-known package called is promise and the author made a tiny little change an honest change this wasn't a vulnerability but there was a small error in that that change and that error broke a huge number of other packages or modules it broke fire-based tooling Angular, AWS Create React app possibly many many more but this one change was felt widely now in the article that reported this they made a very good point the bug didn't crash existing projects which is a good thing just because a new module is released doesn't mean everything will stop working immediately so there was no actual downtime but it did prevent developers from compiling new versions of their projects which is actually a bigger issue than you might expect it just prevents developers from compiling new versions it also prevents continuous integration so CICD pipelines from compiling the project so what this means is your whole software delivery sort of life cycle can come crashing down as a result of this tiny little error and this tiny little change so whilst this article was to a certain extent downplaying the issue I do think it is a significant issue coffee time so as I said I think we've gone far enough down this particular rabbit hole it's time to come up from there and look at something else so what about funding Express is a valuable project it's used by a great many people and a great many others how is it funded, how are the people that work on it rewarded many high profile projects are backed by large companies, corporations TensorFlow for example is a Google project Electron is a GitHub project React is a Facebook project there are numerous examples so what about Express nothing if you look at Express there's no obvious funding model and if you look at the commits and the contributions it's clear that it's pretty much maintained by a single individual and as you know beforehand I just called them Bob for the sake of argument I looked deeper into the dependency graph of the runtime that the 49 dependencies and the development dependencies out of all of those dependencies I could only find a single project that had any obvious form of funding and that's a project called ESLint ESLint is part of the development tool chain of Express it's a tool that helps provide consistent code formatting again it's a very popular and very useful tool. Now ESLint uses a project or website called Open Collective which is probably the most popular online donation platform for open source I've used it myself it's a decent website I quite like what they're doing I managed to raise about $50 a month for some of my open source projects which just about pays my AWS bills ESLint is the fourth most funded project with an Open Collective so it's quite successful so does it work? Well again I dug into the data I looked at the 30 most funded projects with an Open Collective and for each of them I turned their annual budget into effectively a full-time employee equivalent you know if I was using that budget to pay my bills and support me or others as a developer how many people would it buy and as you can see from the graph on the right which is on a log scale you can see that ESLint the funding for ESLint pays for maybe one and a half full-time equivalents and ESLint is one of the most well-funded projects on the platform and the most funded project can pay for approximately six full-time equivalents now there are more than 2,000 projects an Open Collective and there's a long tail who have you know similar experiences to myself and I'm not I'm not complaining I'm not attempting personally to use this to fund my work it was more as an experiment however there are a great many projects on there as a way to fund their work and unfortunately for the long tail which is the vast majority of them they get a little more than enough money to buy the odd cup of coffee so really this system isn't working when it comes to making a sustainable ecosystem and as a result people are trying other models some open-source projects collect tips or try to use adverts and again advertising is something that's been tried and has caused quite a stir however funding isn't the be-all and end-all to open-source sustainability there's a much more interesting and tricky and challenging side it's a more human side of open-source and I'm just going to give one little example again on express as a project and I've again I really don't want to point the finger too much to the maintainer who thanked out his name even though I guess it's somewhat futile you could find his name this was an incident where someone raised a security issue against express and there were to cut a long story short there were some pretty big differences of opinion around how it should be resolved and there was also a certain amount of security theater from vendors that there were some fairly aggressive flags effectively placed and black marks sort of placed against express and there was a significant amount of hostility as a result the maintainer on the screenshot of the right basically publicly said look I've had enough I'm sick of the abuse I'm not going to put up with this anymore I'm turning everything off for the weekend I'm deleting my emails taking a deep breath and coming back this is a real issue and yeah this really is quite worrying and I honestly didn't expect to find this much that concerned me and to a certain extent upset me when I started the journey express really was something I picked out at random I wasn't expecting to find such worrying complexity I wasn't expecting to find such fragility and most worryingly I wasn't expecting to see some evidence of a maintainer really struggling project so I guess the only conclusion I can really come to is that the only reason this all works is because the vast majority of people are good it astounds me that this actually works in practice and I think the only reason it does is because most people are are good people most people are good actors but we don't make it easy for them so this this conference where this is the open source strategy forum most of the people listening are not not full-time open source maintainers most of you are from banks so what part do you play well before I get onto that I'll show you the part that we currently play I'm lucky enough to live on the border of Northumberland which is a beautiful part of the country we've got lots of fantastic castles there and this is Annick Castle you've watched Harry Potter you'll have seen part of Annick Castle it was used for Hogwarts now these structures date back to the sort of medieval times and in the medieval times you'd have the poor people the poor working outside farming the land and you'd have the rich folk sitting within the castle and the produce from farming the land would be taken into the castle and you'd keep the riffraff out and you'd try to keep a clean sanitary environment and let the riffraff you know keep themselves themselves outside of your castle and I think I know you might think it's a little bit damning but to be honest I think our relationship with open source is quite similar what we tend to do to tackle these problems is a process of sort of sanitizing and sterilizing we use security scans license checking once we've cleaned and cleaned and cleaned we then take that code and we place it in our internal repositories where it is now safe it is again it's kind of the medieval model it's the Wild West in open source and the best we can do is pluck a code base out sanitize it check it to death and then say yep it's safe we'll use that interesting quote I read from someone an open source maintainer who was also struggling he was at an open source software and bumped into one of the many security scanning vendors and he realized so this means that they charge a 50 person start up a whopping $30,000 a year to help them feel safe using the code that open source authors like me have given away for free it's a crazy situation also some of these scans are now pushed out to the wider community they're not just something that happened within the four walls of some sort of big corporation Dependabot is something which is turned on by default within github what Dependabot does is it goes around hunting for people that depend on modules that have got known vulnerabilities and then it helpfully creates a pull request when it spots one of these vulnerable packages potentially being used and as you can see here it's you can see the semantic version range issue going on it will let you know that you have to bump it from one version to another however there are some big issues here firstly I get lots of pull requests from Dependabot every week but the bigger issue is all it can ever do is demonstrate the potential for a vulnerability now for a vulnerability to manifest itself you have to use a particular module in a specific way if I have a vulnerability in a templating engine but I'm only ever using it in my deployment pipeline within a containerized build that's not the same as if I'm using it on the front end of an application used by my end users it's completely different and unfortunately in my experience of Dependabot not once has it raised a single genuine security vulnerability all it's ever done is to be honest frustrate me and again another quote from that article I briefly mentioned if it's not fun anymore you get literally nothing from maintaining a popular package and this is a growing concern within the open source community that the day to day struggles tend to get a bit too much for some people so what is the solution I think probably the most important thing to do is gain a better understanding of the problem and I must admit I gained a better understanding of the problem through my investigations into Express and writing this talk previously I was of the opinion that funding was the answer and I'd explored with Finos different ways that we can accelerate funding but it's not the answer you have to understand the ecosystem you have to understand the actors and their motivations and one thing you also have to understand is the open source community itself has changed considerably in the past five years and one of the main reasons why it's changed is Github Github has created a centralized community and actually if you really want to get into the details of this I would thoroughly recommend this book which is screen-shotted here it's Working in Public the Making and Maintaining of Open Source Software by Nadia it's an amazing book and I'd recommend that everyone read it what she points out is that Github has created a centralized community in that way it's much more like YouTube for example she also described that the stadium model of open source is becoming increasingly prevalent and to give you a simple explanation there open source projects are more and more often the work of an individual and the stadium model is effectively you have one individual up on stage tens of thousands who are effectively in the audience and whilst Github makes it easier to contribute as a result relationships tend to be more transient you get people having kind of fleeting relationships with projects rather than sort of long-term sort of collaboration and association and probably the most important thing I learned from this book is that attention is the most prized asset of an open source maintainer they have a finite amount of time that they can work on the project and they will seek to optimize that time or will at least wish to optimize that time and gear it towards the things that they fundamentally enjoy doing the most and I've got a great example of what happens when you don't understand this ecosystem so every year DigitalOcean has run a thing called Hacktoberfest a very well-meaning concept every year they incentivize people to contribute back to open source and they incentivize them by giving away t-shirts which sounds great on the surface it sounds really good however this year it fell apart completely and these are these are concerns that have been building for a long time and this article briefly highlights why the author says so far today on a single repository myself and fellow maintainers have closed 11 spam pull requests each have generated notifications to 485 watchers of the repository and each requires time to visit the pull request page evaluate, close, tag it effectively their attention is being consumed by this activity in a highly negative fashion they basically call Hacktoberfest a distributed denial of service attack on the open source maintainer community I really don't want to be too harsh on DigitalOcean they were fundamentally motivated by the right things but clearly they misunderstood the community and how it worked and the whole thing fell apart so what should we do it is challenging firstly don't focus on your own walled garden one thing I'll point out here is I haven't said don't create your own walled garden there is still a need to keep your own and maintain your own copies of open source code for various different reasons but don't focus on that entirely also don't focus your time on sanitizing and securing again I'm not saying don't do it but don't focus on these two activities exclusively without considering the wider impact on the community do learn about and better understand the open source ecosystem read that book that I suggested learn about the maintainers learn about the people behind the code that you're consuming learn how to effectively contribute and again Hacktoberfest is a great example of what happens if you don't contribute effectively there is a considerable amount of negative contribution going on in open source at the moment and the popularity of use of github unfortunately has increased the noise and again github is a fantastic platform and they are trying to tackle this but it's a real issue finally help the maintainers maximize their attention and some great ways you can do this is not by opening up a big pull request with lots and lots of code you can help them maximize their attention by taking away some of the activities that are less desirable to them answer questions on stack overflow you can create examples or help with documentation you can triage issues you can fix some of the gnarly bugs that might have occurred all of these things are significant valuable contributions that allow maintainers to focus on the thing that they want to focus on a lot of these things are better than just adding a $50 tip every month to some open source collection finally allocate time and budget for this and the money that you're spending on some of these tools for creating your sanitized wall garden perhaps you should reinvest some of these in actually helping the community directly and again allocate time and budget it could be budget or it could be time you could just allocate a small fraction of time if for example you're using express as an example of one of your projects built in something into the backlog let's spend a little bit of time helping fix some of these issues rather than creating our own sanitized version. Thank you for listening I hope that's been informative and I hope you've learned something from it I'm going to go back to my day job and back to deleting the dependabot issues thanks so much for listening, goodbye


Zanshaya Abdu Malik won a convincing game against Indian Grandmaster Vaibhav Suri. She joins us in our studio. Zanshaya won at a critical moment in the tournament. The game itself was also quite nice. Yeah. You're happy with the way your prep went and the overall quality of play today? Yeah, I think the game was very smooth. So, and the preparation went really well. Can you take us through the critical moments where you felt black went wrong? I think it was after bishop e3. Yeah, I played bishop e3 and then... Okay, I want to play just bishop b6. Your idea is to play bishop b6 and take on e5. Yeah. And black's next move is not really against this plan. So, were you surprised with this? Yes, actually. But, okay, maybe he was just missing that after bishop b6, queen d7 that I would just take and maybe he was calculating some, knight d5, I don't know. Then take, and I was thinking about taking on, before with bishop or pawn. Okay, for example, just take, take, take, and then I was thinking of bishop g2, king g2 and then queen g4 maybe. Or maybe h4 was also a possibility? Yeah, also h4, but I thought first maybe it's better to attack the pawn and then push the h4. Queen d2, h4 or something like that. Also, like, I can play queen b3 because of knight hanging. I don't know, maybe that was better. Because after what he played, I mean, bishop d5, and then e d8, then it's just, I think, easy for me. Okay, fb8, and I think the b3 move was good. Because first I wanted to take, like... Yeah, but then you can see that the two pawns are hanging. Yeah, black's rook are reactive and this is definitely compensation. Knight h3, but okay, b2 is hanging, so I played first b3.  So the idea of b3 is just that you protect the a pawn and you want to go... Yeah, so now I want to take on b4 and then knight b4, bishop b4, rook b4 and knight h3. Right, and at some point you'll be able to push the rook away from b4 and advance your pawns. Actually, after this strange pawn sacrifice from Weber, he never got full compensation? No, I think he didn't. I mean, okay, he tried, but I think it was just better for me. Right, and you're on 5 out of 7 now. Evaluate your play so far for us. Well, the tournament is going pretty good for me. Yeah, I hope that the last three rounds will be good too. We'll see, I don't know. And this is your second time in Gibraltar. Yeah. Tell us about the experience of playing in Gibraltar. Yeah, I like the tournament, the atmosphere is so good. So I came here with Anna Muzuchuk. So she's my good friend and it's so nice to be here with you. So, I don't know, it's good. I really enjoyed the tournament. That's really nice to hear and it's really good to see you in Good Spirit and we wish you all the best time for the last three games. Thank you.


I'm Dr Shamian Bennett. I'm an epidemiologist at the Australian National University and I've had a research team that's looking at the impacts of climate change on human health. The Australian National Data Service Ground has allowed us to develop a scientific workflow system to access and merge large datasets on our environment, population and health. And we've built our workflows using Keplo. We've called our workflow system SWISH, which stands for Scientific Workflow and Integration Software for Health, and it's freely available to other researchers from our website. To assess the impacts of climate change on health, you need to gather a large amount of data, including weather, definitions of extreme weather events, population data, mortality data including the cause of death, and all within a consistent spatial framework. And all of these steps have to happen before you actually get to the analysis of the health impacts linked to climate change. You can download complete workflows from our website that will set up your connection to the extreme weather events database. In this example, the actor GetWeather SLA connects to the database to locate daily weather data in the statistical local area of your choice. Double click on the string constant box and enter the name of the SLA that you want. In this example, we're looking at Kayleen. Then click commit. The second string constant shows you where the resulting file will be saved, in this case on the C drive in the temp folder. When you're done, click the run button in the toolbar and you'll see the word executing appear in the bottom left corner. When the results window appears, scroll down and check that a CSV file with the suburb name has been created. This workflow takes the data we obtained in the previous example and calculates how many days had an average temperature of above 35 degrees. You can use the search function to locate specific actors. To complete this workflow, it needs one more input using the string constant actor. You then drag and drop the actor into your workflow space and double click to edit the parameters. In this case, our value is 35 degrees. Then connect this box to the greater than actor using the connector arrows. To explore the many swish actors, go to the components window and open the folder called my workflows. Click the small plus sign to find the green actor icon, then drag and drop into your workflow. Here, we are adding an actor to the workflow to display our result at the end. When all of the actors are connected, click on the run button in the toolbar. The results are produced in the CSV file, which opens here in a text box, but can easily be opened in other statistical programs like Stata and R. Accessing data often requires high level programming expertise. Using swish can help reduce those barriers to data access by providing a user friendly drag and drop interface. Swish workflows are a single file, so it's very easy to share with other researchers. This can help us with collaborative research and improve the reproducibility of results. In addition, swish also packages multiple steps using Stata and R into a single executable flowchart that documents your working as you go. I'm Keith Theer. I'm a Biostatistician and Epidemiologist at the Australian National University. In 2007-2008, the Gano Climate Change Review Team asked a group of us here at NSF, the National Centre for Epidemiology and Population Health, to look at how health impacts of climate change might pan out in Australia out of the 2100. To do this, I used several kinds of data from different sources. The demographic breakdown of the Australian population by age, sex and location around the country, daily records of mortality which are collected within each state, and the daily weather records collected by the Bureau of Meteorology. Merging these various sources of data into a final dataset that I could use for a statistical analysis was complicated. I did this initially back in 2007 using scripts in the statistical package Stata which I wrote specifically for the purpose. The final script in Stata that did this operation was quite long, several hundred lines of Stata code. And it took me a lot of time to debug it, make sure that I was reasonably confident it was correct. And even when I was confident myself, it was difficult to communicate it to other potential users of my methods. They would essentially have to start again from scratch. Five years on were now in the process of updating and revising this analysis done back in 2007-2008. And this time I have available to me the SWISH package of data management tools. I can see at least three advantages of using this package over the way I did it back then. First of all, it's just easier to write the code. That means it's easier for me to debug. I can spend less time and effort making sure that it's correct and I can have more confidence that it's correct. Secondly, it means that I can modify the analyses. I can try out different ways of doing the analyses, doing the data preparation and the analyses. And this means that we can be more sure that we're using optimal, efficient methods for the work. And finally, and I think most importantly, it means that the methods can be communicated more easily to others. It's intrinsically better documented and it means that we can communicate the methods we used so that others can use them and perhaps improve upon them. There are five main benefits to using the SWISH system to access and merge datasets. First of all, it improves data access by providing a drag and drop interface rather than relying on complex programming. You can create executable workflows that integrate both documentation and execution. Third, workflows are easy to share for collaborative research and teaching and training. The workflows are also easy to modify and update with new data or to change the spatial scale. Lastly, SWISH workflows allow you to incorporate existing procedures and analyses and use your preferred statistical packages. The SWISH system is free open source software. You can find and download the SWISH tools and tutorials from our GitHub product site. And there's some more information about our project at our blog.


Amanda was born with spondybifida 34 years ago and we didn't know until she was actually born that she was going to have a disability.  But she has reached a lot of milestones. So that was one plus. And as a baby, she was just like any normal baby because she didn't have to do anything. And as she grew, she was still in the pusher and a pram was only until she got a bit older and she went into a wheelchair. And a lot of people didn't even know that she had a disability. But she's changed over probably the last six years. She's been ridden a lot to what she was because she had respiratory failure going back in 2016. And that was a really tough time for not just Amanda but for everybody in the family. You know, we had to move down to Melbourne for three months while she was in hospital to stay with her other daughter. But that is the main, her mate, yeah, spondybifida, which, you know, affects everyone different. But she never could walk and she never will walk. So this year I was able to go and meet with the Johnson family because they had asked CFA for help in working on a fire escape plan. They realised that if anything happened in the house with regards to fire that they needed her to be able to escape. Her bedroom was at the back of the house and the ramps that she uses in her wheelchair are at the side of the house or at the front of the house. I first met the Johnsons through the community safety coordinator Andy Arnold from District 23 where he contacted me and asked me if I'd go around there with him and put up some smoke detectors. Was it an immense help to me? It was absolutely sensational. At least I had an understanding of why we were doing this, why we were putting extra smoke detectors in, but actually getting to meet the Johnsons and actually seeing the layout of the house was absolutely sensational. So if there is any incident that happens to that property, there's a notice that comes up on our pages saying there's a lady in that house with a disability and where she is located. It's not just go in and grab Amanda because that can never happen. She's got to be hoist up with a hoist. So we've got to have the slings under and then a hoist. So we've been practising how long it takes to get her up twice this week. One took us eight minutes and another one took us six. But we'll keep doing it a couple of times a week to see how we go by time. With Amanda's wheelchair we normally keep it out in the kitchen but now we're keeping it in Amanda's bedroom so that that's already up there if anything happened during the night. We've only got to bring it out of the bathroom as where before we'd have to come down to the kitchen and we might not be able to get the wheelchair and then we'd have no hope of getting her up. Home fire escape plans are a critical element of our work. At night time if the fire happens at night time when it's dark, how they're going to get out of the house, the need to have two routes of escape from any room and that can often present a difficulty if there's only one door and a window. The process with the CFA has been actually fantastic since they first did into our house. They showed us a lot of things that we didn't know about, the plans, the equipment we need for the house to help us be a lot safer and we just can't fold it. It's just been 100%. Because she's in a hospital top of bed and she's to exit out of the house we have to put her into a wheelchair. We want to take out her windows, big bay windows when I take the windows out and knock the walls out and put an exit there with a sliding door for the windows and a ramp to run down beside the house.  We didn't even think that we needed one. Now we've got that in place. We've learned a lot since we've got the CFA on board, things that we just took for granted because everyone thinks a fire will never happen to them and we'll just keep you trying to improve it. We'll get guided by the CFA and that's what we'll do.


And welcome to Slydita. Hey everybody and welcome to my desk. I hope everyone is staying nice and cool. It's been hot here in New York, but that means it's time to stay in and have some ice tea and work on electronics, which is what I've been doing. Mr. Lady, do we have any updates, news, things we want to tell people? We'll be doing show and tell this week lots of new products and videos and more surprises. We're pumping out a lot of new products and open source code that'll empower a lot of people to do a lot of new things. Slydita will show you exactly what I'm talking about. There's a lot of folks who like to make things with displays or with Raspberry Pis or with microcontrollers. And we're getting back to some of the really tough projects. I'm going to literally dust off a project. Yeah, literally it's like covered in dust. Yeah. That's how long it's been on my desk. And let's see what's on your desk. All right. Let's go to my desk and we'll check it out. Okay. So here is what I've been working on this week. And this is, again, like a 2020 era project that got just delayed because TFT prices just skyrocketed. I don't know when people remembered, but these displays went from being $5 to $10 to like $30 a piece. And I was like, okay, I can't do any projects with TFTs and chips were unavailable. Diodes weren't available, but everything's really calmed down a lot. And so I'm going to get back to some of the stuff that I designed, but didn't get to finish. So this is your standard box standard 50, sorry, five inch diagonal 40 pin TFT display with TTL. I got called TTL RGB display. So this has eight bits red, eight bits green, eight bits blue parallel, v-sync, h-sync data enable, pixel clock, on off, backlight with a bunch of LEDs and series. And this one doesn't have a resistive touch screen. And sometimes these screens, this is a 4.3 inch one. I think this is 800x480 actually, but it's 4.3 inch. It's a little less diagonal. And you'll see it's got the same connector. It's a very, very standard connector. I call this 40 pin TTL. And it's also got a separate capacitive touch overlay. So this is a separate, totally separate electronic piece. It's glued on top. So you can see there's the TFT just like this. But it's also got this glass capacitive touch screen. And then these are often like focal tech, FT something, something, something. They're almost all compatible with each other. I squared C, capacitive touch chips. And so this is a six pin connector, power, ground, reset, SCL, SDA and IRQ, pretty much. So maybe address instead of reset. But even it says actually, if we can, let me focus in on it. It's kind of nice. You can even see here it says SCL, SDA, VDD, reset, and ground. One thing I will notice is that even though this 40 pin connector is like nearly standardized, the six pin connector for the capacitive touch is like all over the place. Like there are sometimes the connectors over here, sometimes, you know, the connector goes long, sometimes it's flipped, sometimes it's this way. Sometimes it's one pin out, one times the other, sometimes it's six pin, sometimes it's eight pin. And that part's not as a standard. Although six pin is very, very common. So, you know, in the shop, go to the computer, please. I'll show these in the store. So, you know, you have in the store, we have the resistive touch and the non-resistive. I'm going to get capacitive touch now that I'm kind of doing more of the stuff. And I'm like, oh, I should have a capacitive touch version of these displays. And traditionally how you would connect this to something like a Raspberry Pi is there's two kind of known ways. One, you go with HDMI. And an HDMI backpack like this one uses a TFP401. There's actually a couple chips that do this. There's like an AD78 something something or 7644. There's the RT622 series, which has a scalar in it, which is kind of nice, but is otherwise very hard to use.  It's like you've used an AD581 compiler. But one of the annoying things about these, well, these displays work great. What's nice is it's HDMI. HDMI universal, which means you can plug this into your Xbox. You can plug it into your GoPro camera. You can plug it into your phone. You can plug it into your Raspberry Pi. You can put it into your Windows box, your Mac. It always works. But these chips are very hot. They take up a lot of energy. They draw like, I think, 200, 300 milliamps at five volts. And they're not cheap. These chips are also like $8 apiece. They're kind of expensive. Now, they don't know which is why this is like, it's like, whoa, it's so many bucks. Why? Because this chip is like $8 to $10. And then, you know, you add the cost of assembly and the TFT. So even though these work great when you have HDMI, they're expensive. And then the other way you can connect displays is with a the DPI, the display parallel interface on a Raspberry Pi.  It's not quite a hat. It's a little bit less because it uses all the pins. And what this does is it has every GPIO almost from the Raspberry Pi connected to usually not all 24 bits. Usually we do 18 bits. So like 666, red, green, blue, which is still very high quality color. Like most people can't tell the difference between, especially for these small screens, the difference between 18 bit and 24 bit color is huge. And then, of course, the V-sync, H-sync, pixel clock. And you see, you can even tell like definitely when the Raspberry Pi folks designed the Raspberry Pi 2 by 20 connector, you can see that they definitely made sure that they had all the pins available to be able to use this interface because the pins are very fixed. Like you can't change which pin is V-sync or H-sync or red, green, blue. They're like, they're very fixed in the documentation. I think Raspberry Pi DPI pin out. I think they have a, yeah, they have the documentation here. Yeah, DPI. There's a couple different configurations, but for the most part, you know, you can't really change the pins. And not only can you not change the pins, but, well, this one doesn't have it, but like the H-sync and the V-sync are on like the I-squared C-pins. So if you want to do something like add capacitive touch or you want to add resistive touch through I-squared C, you have to do like bit-bang I-squared C and then device overlays and change the pins. And it's like, basically, it's annoying, especially then you're like, oh, I want to connect an I2S amplifier for high quality audio along with my nice screen, you can't because the I2S pins are completely overtaken by the DPI pin out. So the other option is you use the DSI connector. So let's go back to the overhead. I'll show off the DSI connector. So the DSI connector is this thing, which says display. Remember, this is camera and display. The only thing is the Pi zeros don't have this connector. So it's, you know, the one thing basically that got left off. But the, all the Raspberry Pi A pluses and the B pluses have them. They've had them for quite a while. And the CM modules, the compute modules also have access to the DSI, the pin out. And what's neat about this is it's a two-lane MIPI interface that's differential, two lanes. So data one, data two differential and clock differential. So six data lines. And it can control like fairly large displays. Like two lanes will get you I think up to like definitely 720p. But I think you can even get like, you know, like 1000 by 720 pixels or something. You can get fairly large displays, maybe not 4k. I think for that you need four lanes. I don't know the exact math, but you can get, you know, nice little displays. And in fact, that's how the Raspberry Pi, if you go to the computer again, I'll have a lot of back and forth today. So the Raspberry Pi display. So the foundation display, you'll notice if you look at the screen here, oh, that looks just like, you know, it's kind of your standard ish 40 pin. You've got lots of parallel lines here. So it's RGB. And then it connects to this driver board. And the, I think on the back, and then the driver board has the DSI and it also has, it looks like USB power.  And then this is I think panel power. I actually don't know what the USB is for. I know you can power it from you can give it extra power, but yeah, it sits underneath. And you can give it extra power. And then this is the DSI cable. You'll notice that other than the power pins, the GPI is free. And so is the HDMI. Okay, so, and then you have a nice case. So it's a very sweet. This one has capacitive touch. It's quite fancy. So this is, and the chip that it's using on here is I believe the Toshiba TCX something, something, something, which is the Toshiba DSI2 RGB. It is the TX. It's probably something like the TX58778XBG. Wonderful chip. I'm sure it's great. It's not inexpensive. It's a BGA. If you know me, I'm not a huge fan of BGAs because they're like really annoying to rework and pick in place.  Usually you need like a four layer board. So while this chip is I'm sure super awesome, what I wanted to do was instead use the ICN6211 and the ICN6211, which doesn't have great documentation, but we can maybe Google something. And it's by, whoops, sorry, I went to my other tab. Yeah. So this is a also DSI2 RGB. It is a lot less documented than Toshiba, but it does do kind of what you want. They can give you up to four lanes of RGB and then, sorry, of DSI data. And then they can convert it to 24 bit color with HNV sync DEP clock. And it also does I-squared C for control. And then you just have to give it the data and a clock signal and some power. And it's pretty much good to go. The only thing that's a little annoying is that there's there's no good data sheet. There's all these registers, but the registers are not you can see there's one register documented. Otherwise it's like, hey, here's some weird stuff, but for some reason they always tell you how an I-squared C works. And you're like, I know how I-squared C works.  Instead, there's this tool I think that they distribute. And then you tell it kind of what you want for, you have to tell it how big the display is and the front porch, the back porch, the HNV sync width. This is all in the TFT data sheet. So if you go to the data sheet for these, they'll give you not only the pinouts, but at the middle or bottom, they will tell you your timing. Hold on, let me find the timing. Here it is. So each display has their own like, you know, they're kind of loose with it, but you want to get it somewhat close. Basically, the frequency that they want to drive the pixel clock and the porch size is in the pulse polarities. Like some have like a negative h-sync and some have a positive h-sync. So you just have to like kind of look at this up and then you enter it in. This is, you know, what the timing looks like for the different pulses that let the chip in the TFT display synchronize. Yeah, here you go. This is the different porch widths, these little signals. So, okay. So the ICN 6211 is a, hold on, so is that chip in its alternative? And the nice thing about it is it's inexpensive. It's like a dollar or less, which is like pretty sweet because again, that HDMI chip, the TFP 401 is like $6 to $8. So $1 is a really good price. So a longish time ago, I designed a board that would let me control, connect to TTL displays from DSI. So, sorry, let's go back to the overhead. So now I've introduced it, I can actually show it off. So this board has the ICN 6211 and it's got the DSI connector going here and, you know, it just connects from the Raspberry Pi. This is power, and I'm actually also using this to track how much power draw this is taking, and it's like very little, almost all the power is going to the data, to the backlight. I think this only draws maybe 50 milliamps, if that. It's definitely cool to the touch, which is good. On this version, I actually put an AT, at SAMD 21, because one of the weird things about the ICN 6211 is it responds to every I squared C address, like whoever wrote the I squared C peripheral, like kind of slapdashed it. So it can't share any I squared C, like you don't want it on your main I squared C bus, because it'll bash everything else on there, including like your capacitive touch or resistive touch driver chip. So I thought, oh, I'll have like the SAMD set up, because you don't have to set it up on boot. You set up the I squared C commands to configure the display, and then like it would go to sleep. But then I kind of messed around some more, and decided to do a slightly different design, which I'll show. You got a backlight driver here.  It's 25 milliamps, constant current, but you can go up to 100 milliamps, constant current, various I squared C. So there's a lot of I squared C. There's actually I squared C that comes, that comes through the DSI. And so actually what I did on this one is I bridged the DSI to the ICN I squared C because I don't have capacitive touch going yet. So I'm like, well, I'll just take up every I squared C address on the DSI port, get it configured, and then we're good. And actually you'll notice like, Hey, why is this screen all like funky now? That's because actually the screensaver kicked in on the Raspberry Pi. And when it does it, it's the DSI chip doesn't, it definitely doesn't get signal anymore, but there's no communication between the DSI to RGB chip and the backlight driver. So it doesn't the backlight driver doesn't actually know that it should shut off the backlight because it's completely separate from the RGB logic. So there's something that again, you would probably use them. I'm going to use a microcontroller and I've done this before. I'll have it listen to the V sync pulse, because it's supposed to come every 60 Hertz.  That's a really easy way to just be like, it's a little watched, use the V sync as a watchdog timer. So yeah, so this is, if I hit return on this keyboard, it's like pop comes back up.  It's that's the trade off for this chip. It's not super smart. Whereas I like the RTD 2600 series is definitely like, it's a, you're programming the chip inside and you can have it do all sorts of logical things and be smart and all that. So for interfacing to this chip, you do have to, you know, you have to, once you've sent it to the I2C commands, it then just takes DSI to TTL. It does that for you, but you have to set that up. So if you go to the computer, there is a library and we've hired Timon to do this work because there's like this data sheet, there's this weird ass tool, but we're like, ah, can you like make it into like a library and also of course test the hardware and Timon has done some stuff with these chipsets. So he's like, oh yeah, like I know exactly what you want. So he's a great job and he made a library and some example code. And then we, we just run, this is the Raspberry Pi. I run the test on the code to configure it on the Raspberry Pi for now. And then eventually this register right will be done by a separate microcontroller. So this is just the test where we, you configure all the sizes of the back ports. This is being configured to 800 by 480.  So we, I did, we do this board a little bit. This version actually has a separate microcontroller that's going to be driving the I squared C. This one's also set up to drive these square displays. So if you go to the overhead, I'll show this real fast. We'll wrap up here in a moment. So this is like a 480 by 480. And this is 720 by 720. And these are like funky square displays. One has capacitive touch and this one doesn't. And they also have a 40 pin, but the 40 pin is like different than the standard 40 pin, which I understand why, but it's a little annoying. One, the capacitive touch pins actually go into the 40 pin. It's convenient. You don't have that separate, you know, like, hi, I'm like, dangly. You don't have the dangly. The dangly has been integrated into this connector. And there's also a SPI interface and two extra GPIO pins. And the SPI interface is used to configure the onboard TFT driver chip. So not only do you need I squared C to connect and set up this DSI to TTL, this TFT is like wonderfully simple. You send it signal and just starts displaying. With these displays, the square ones, you have to set up a configuration through SPI to tell it, no, no, you're a 480 by 480.  But basically after you set up that initialization, you then pipe in TTL. So like, there's a lot of things to balance. So the last thing before we go on to the great search is I'm going to literally dust off this. So one of the things I worked on many, many, many years ago is I had one of these cool displays. This is unfortunately quite delicate. So this is a four inch 800 by 480. So it's really nice. It's got the same resolution as this five inch display, but it's a nice compact four inch and I even have a version that has a capacitive touch overlay on it. Really good looking.  It's got the same size and shape. And what I did is this display, it has a 40, it also has that 40 pin connector and it has like that funky, you know, it's RGB, but also has the SPI communication. So I used, here you can see like a little trinket, a SAMD 21 that would connect to the SPI and configure it and set it up and then tell it, okay, you can then take RGB data and then over here I had a, you know, Raspberry Pi 40 pin breakout board that I wired all the red, green and blue and clock and data pins and I could get it set up here. And then I did design a board for it as well. So, you know, I'm showing this here so you can see it. Let me see if I can that's a little blown out. Sometimes if they do this, there you go. So, you know, it's a very nice crisp display and you can see the text and it's like IPS so it works from an angle. And this is basically the version of this breadboard, but on a full PCB. So on the back here, so you've got that 40 pin TFT and then there's an at SAMD 09 here. And this is what is communicating with this over SPI and also handles that backlight thing. So again, it listens on the v-sync. And if the v-sync doesn't go, doesn't drop every, whatever, a couple milliseconds, it turns off the backlight because it's like, okay, the signal's gone. And then this was actually DPI, right? Because this was before I had this ICN 6211. So, like every, you can see every single GPIO got used. Like it's a lot of routing. But, you know, at the time, I was like, well, this is kind of as good as going to get.  And then 2021 happened. And then I kind of like, this was literally been sitting on my desk, dusty for the last couple years, but I've now revised it. So, our last thing as we go to the computer, if you can pop to the computer, yeah. So I revised it last night. And so this is the same board, but now instead of having that gigantic 2x20 connector where you use all the GPIO pins, it's all going to a ICN 6211. You can see here through these little resistors or resistor packs. The DSI connector, I put a stomach QT on here and you can switch which port you want to use iSquad C on. And then I've got a AT Tiny 1616 that's going to do the iSquad C and SPI on boot noodling. Like when you power it up, it'll quickly do all the resets, it'll write the data to the iSquad C and SPI ports, and then handle the backlight driving as well. So it'll actually listen over iSquad C and PWM the backlight. So you can actually do dimming and lighting. I don't know if it'll have a kernel driver, but at least it'll be over a very simple iSquad C interface to set up and write the PWM to change the backlight as desired. So you know what's happening. I'm getting back to this.  But you know, I've got all these cool displays, I'm going to get this working.  So that's a lot, but we're getting to it. And then, you know, the last piece is we have to get the device tree overlay going for these. But you know, we kind of took the one from the, this is my setup, I should have the detail open. But we have a, we have a device to overlays basically the Raspberry Pi seven inch slash the ICN 6211 and we kind of mush them together and pull some stuff out and we think we can get something going.  I think this could be super fun. Also for you're making adorable little CM4 products with the compute module. All right, so let's go to the great search. The Great Search brought to you by DigiKey. And if you read every single week, Lady and User Power of Engineering help you. Yes, you find the things you need, Lady. And what is the great search of the week this week? And this actually by a request somebody mailed in. And let's go to the overhead and I'll show what they were asking. So working on this project with the DSI displayed on the Raspberry Pi computer, and actually now a lot of single board computers because they've all cloned the Raspberry Pi, there are these connectors, the DSI, the display connector, and then the CSI camera interface. And one thing that definitely happens, even to me, I'm very careful, is the clip comes out of the connector. And then if the clip comes out the retaining clip, you can't use it.  You don't want to throw away your beautiful Raspberry Pi just because it's got this clip. So let's find replacement connectors. And then we can always reuse the clips. You can gently remove them and replace them for the camera or display interface. They're both the same connector. So let's go to DigiKey. Oh, and I was showing earlier like there's cool weird square displays. Check out previous video if you have it. Okay, so what we want is the same connector for the CSI or DSI. And those happen to be, and I know they are 15 pin FPC, the flex print circuit board connector, flexible connector. We don't want the assembly. We just want the connector itself. Yeah, that's right. It looks like this. I like that they added images, options. Actually, let's just go to the whole category and then okay, so contacts, I think we want the one that has like 19,000 available. Let's see. Yeah, so this is now talking. Yeah, there's different configurations and pitches and pinouts. Okay, so the first step I always because we want to actually be able to buy this we're always going to go with the active and number positions. How many pins? 15. We don't want like half loaded. We want like full 15, so just pick 15. And then pitch. For this, you know, you have to note the pitches. You can use your handy calipers to measure the distance between the pins. There are standard sizes, but like 99% of the time, it's going to be either 0.5 millimeter or one millimeter. Once in a while, there's others, but it's super duper rare. If it's like very close together, it's almost certainly 0.5. And if it's a little farther apart, it's one. And if it's alternating, it's like sometimes 0.3. But it's this one in particular is going to be one. Oh, and then once in a while, it's 0.1 inch, like really fat. There's old stuff. Next up, do we want surface mount or through hole? Well, on the Raspberry Pi, it's a surface mount connector. So you want surface mount and also grab the dash because it could be, there's some that aren't categorized. And let's also say only in stock because we want, we want to be able to purchase this today. So this is what we got so far. Whenever I have like, you know, a couple dozen, that's when I start looking and I'm like, okay, what would we have? Okay, these are starting to look good. One thing is, is that the, for the board of designing, I wanted a right angle so it sticks out to the side. But for the Raspberry Pi, if you want to replace the connector, it's a sticking up style, which is, and you can always see what you, you're like, oh, this is the style I want. And then look to see the mounting type. So that's surface mount, non-right angle. So let's go to surface mount, not right angle. Okay, so only 10 options. So now we're, now we're really talking. Okay, so then you can see that, you know, there's a lot, still a lot of options. One thing is that some of these connectors, you see, they don't have a retaining clip. You can see the retaining clip here and here. It's a little piece that you pull out and then it kind of jams the cable in place. Make sure it doesn't pull out too easily, which, you know, depending on some designs, you want the cable to be able to pull out very easily so the cable doesn't get damaged and it's easy to insert. But in this particular case, we want it to have the retaining clip. So if we look, this is called a slide lock. So these two here are slide lock. This, see, it looks like it has a slide lock, but I guess it doesn't. So we're going to go with slide lock. Okay. And now we're down to our three options. So there's the three options. And then what I do is actually just look at the connector. So let's go to the overhead real fast and we'll look at what the connector looks like. So, you know, it looks like it's kind of flat because, you know, we want to match the connector as much as possible.  Okay, so let's go back to the computer. So looking at these, you know, this one actually looks the closest. The coloring is also the same, too, which by the way, sometimes, you know, you might not get the right color. The color doesn't matter. It's just like it to help you indicate which one you think it is. But it's got the little ear sticking out and it's definitely got, it doesn't have any like extra notches or anything. So I think that this is going to be the closest. And it's only 50 cents. So if you want to fix your Raspberry Pi, you know, I wouldn't necessarily place a whole order just for this connector.  You get 10 pack or if you're ordering stuff from Digi-Key anyways, toss this in and then you'll have it for when your Raspberry Pi connector, if you pull it and you break it, you'll have these ready to go to repair it at that time. I always, I have a couple of these always and I have to fix the one on my desk because I broke the clip. But this is my recommendation. So try it out, FFC 382015G from GCT. Good option, 50 cents. And that's research. All right, that's a show for tonight. Thank you so much everybody. We got a big week ahead. Thanks for joining us. We can't like have big, gigantic eyes. Yeah, we can do it. Absolutely. Yeah. All right. See y'all.