Okay, we're back. We're here inside theCUBE, siliconangle.tv and I'm actually tweeting right now on my Twitter account that we have a secret CTO now live unfiltered opinion here at EMCworld right now on siliconangle.tv. So you go to that site, you're here now and you're going to, we're going to go dive into a format that we've done on the blog. Okay, I'm joining my co-host Dave Vellante from wikibon.org where we've done some segments in the past on our blog where we've had people come to us anonymously who work for, you know, really big companies either government, financial services or something where there's sensitivity around them and explaining who their name is. But they wanted to give an unfiltered opinion about trends, products, companies. So we have here our special guest, secret CTO, secret chief technology who will share with us his opinion on what's happening with EMC, EMCworld and separate the hype from reality. I'm John Furrier, siliconangle.com's founder and I'm joined by my co-host. I'm Dave Vellante of wikibon.org and Secret CTO. I just want to start off by asking you a just a high level question. So you've been an observer of the storage industry for a long time, you're seeing a lot of changes. A lot of, you know, the traditional companies, IBM, HP, EMC, NetApp, they're under fire. There's a new model brewing. You're seeing a lot of these internet, you know, giants like Google and Facebook, they don't use products from these companies. They're starting from a clean sheet of paper. What's your take on all that? And what do you think about the changing landscape of the storage business? The storage business is rather industry because if you think about industry as a whole, the different types of organizations that are out there, whether they're small, medium or they're enterprise class industries, the storage landscape actually aligns very closely to those sex of industry where the products that are available from some of the smaller startups, the higher risk that they're willing to take are not what most enterprises are willing to take. So most enterprises are willing to sacrifice innovation for stability and longevity of an organization. Hold on, if I can interrupt, sorry, secret CTO. For the folks watching, the camera has blurred because the identity of this individual would like to remain anonymous. So it's not broken. So sorry, go back. And I really thank SiliconANGLE for that anonymity. But there are, going back to what I was saying, I mean, if we look at the startups, one of the things that you have to take into effect, if you're going to bet on a new technology, is that it's not going to be there in two years or it's going to be purchased by one of the bigger fish. And again, it may not be there a year after they purchased it. So you have to kind of take the value of innovation and marry that with the value of big business. If I'm running a small shop, I want to be very agile, I want to be flexible. I got a much smaller, tighter budget. I cannot, I don't really have a five-year horizon. My business is probably maybe a two-year horizon. So when I look at two years out, hey, that's my event horizon, I'm good, with my technology has changed by that. By the way, I like to call that the horizon cell phone tax, where you're actually getting a new phone every two years. But technology is that much, it's almost disposable. And storage is one of those interesting areas where it's not necessarily disposable. Take for archive, archive. We've heard today, hundred-year archives, the healthcare industry, most banking industries have 10-year-after-you-lose-a-customer type. Secret, so secret CTO, tell us the reality in your mind that you walk around EMC World today and EMC's laying out really good messaging. Cloud means big data, it's very solid. We've been very complimentary of Jeremy Burden and it's impeccable messaging. But the marketplace is not at that yet advanced. Where are we right now in your mind's relative to the reality of this stuff? Cloud is, I'm hit with cloud all the time. And originally, when the cloud hype came out, I was one of the first people that came out and said, cloud is just another way of saying we're outsourcing you. Because we're moving it from outside my organization to somebody else's organization. Therefore, if we look back historically, it's an outsourced operation. Now, cloud has had to change so that they don't have that stigma of the outsourcing, which I think is very good. And because of the initial hit that they took from a security perspective about how do I get my data over to you and how do I depend on you to secure my data as the way I would secure my data, which really isn't my data most of the time. My data is really my customer's data. So my customer depends upon me to secure their data and now I'm going to depend on the cloud to secure my data, which is really their data. So when you think about it end to end that customer data is sitting out in the ethereal land I think that the industry has done a really good job of at least addressing that and recognizing that and making much greater inroads at enterprise level organizations to... So what you're saying is they've throttled down the rhetoric around cloud Washington. Okay, they talk about non-core stuff putting it on the cloud. You're referring essentially to that, right? Throttled to dialogue a little bit in the rhetoric to not compromise the integrity of the mission of cloud. So yeah, like, you know, if I were to go to a Google or whomever out and at most that cloud service, right? I'm actually, for the longest time, I didn't like what the message was.  If as my organization has a good IT service model and an IT service catalog, I already know that I have those services well-defined. I have my operational recovery services, I have my disaster recovery services, I have my archiving services. Now, at what layer do I want to let the cloud into those services? Do I need them in my core IT infrastructure or is there selected data? But the thing with selected data is now I have to understand my data before I hand it over to the cloud so that way I don't actually move core information that may compromise the cost. So where are we with those tools? Because that's going to require, essentially a whole nother management paradigm for metadata of metadata, right? So, which is new, right? So it's a whole new construct around data. Data about data. Well EMC actually, I think, has a very good overall product set for that. They're acquisition to Kazian, which actually went and did classification of the unstructured data, the documentum product line so that they, you know, you have a combination of, not only a repository, but a way to inspect and determine what of the unstructured data should be there. The other interesting thing about this is structured data. A lot of organizations have a lot of structured data. Some heavier on the structured than the unstructured, but I would say that any organization that they believe that they're very heavy unstructured and they don't have much unstructured, doesn't realize where the unstructured data actually lives and probably lives on people's notebooks, desktops, inflate out at the edge of the environment where it's not managed, so therefore it's not counted. Secret CTO, you just mentioned Kazian as sort of a one area of strength. What about the weaknesses that you see within EMC? Talk about that a little bit. EMC, I think, has been a little bit behind on their storage virtualization story. I think it's a great story inside the box. I really think, and I'll go as far as saying, I love to be maxed. I like the way that, and I'm not gonna use tiers of storage even though that is the buzzword and that is in essence what it is, but to be able to have an area that we actually have high performance requirements, standard service requirements, low IO requirements all within the box and letting a policy actually determine what is necessary and what is not necessary to move up and down or just like being left right in the middle. We heard today where 15K drives that have been the staple for the industry is now actually being squeezed out by flash as well as SATA, but it still has a place because it's that standard level of service that may provide the right level for the majority of it. Now you step outside that and you try to virtualize multiple arrays. I think EMC is playing catch up. That's a Vplex it's all about, right? That is what Vplex. And so have you had experience with that and you have a critical assessment of it? My engineers have had some experience with that. The report that I got back from the engineers they felt that it was a very good product for what it did at a very small scale level. It'd be perfect if we had say maybe an array from Atachi or from IBM, an array from EMC in our test lab that we really didn't want to have a skill set to manage those individual arrays, but yet we could throw that to Vplex and let Vplex deal with it on a small enough scale. The report went back for the enterprise to say do this for the enterprise and by the way, bet your bank.


Hello! This is the third episode of Ask an Analyst with Fabian and Sarah. Welcome! Hello! Hello! And today's topic is a very interesting one, in my opinion. It's about our career and how to become an analyst and how to balance this with your life. So we will be starting with the easy questions first, or maybe for me. A college code asks, are there any certifications that Mervi analysts must have? No. Yeah, probably not. Some jobs do require it, but I don't think it's in this... Not everyone has to have it, and you can always find jobs where you don't need to have it. I mean, most of the people I know don't have them. I personally don't even have a school degree, so there's that. And I'm not alone in that. Most people didn't visit college. Most people...  But in general, those certifications didn't exist even a couple of years ago, so nobody really requires them. And if you look through them, most of them teach pretty much basic stuff, which is kind of pointless. And you can easily learn those yourself. So yeah, I don't think the certifications are required. Yeah, same here. So most of my colleagues don't have a certificate and certification. And some of them also don't have a degree of any kind. Yeah. Another question from College Code. What kind of skills, experience are employers mostly interested in when hiring a new malware analyst? So, Sarah? It kind of depends on what level you're going into. So if you're going into the most basic malware analyst, you don't need that. You just need experience compared to... It probably goes for most of the job, but you just need experience with knowing how to find out what malware does. And that's mostly what you'll be doing at the lowest level in some companies. For other companies, it might require you to have more experience in actually looking at the assembly and reversing malware. So practicing that is always a good idea. Fabian, you are a CTO, so you have kind of a say in who might be a new employee for your company. Yeah, I do. But to be honest, I'm very... How should I put it? I'm more interested in the problem-solving and learning skills of people compared to what they already know. Because if people are good problem-solvers and easily pick up new stuff, then you can always teach them in a relatively short time. So those skills are way more important to me than someone who knows every single opcode in the Intel instruction set, for example. Do people actually know that, though? I doubt it. I doubt it. But I mean, you don't really have to, right? All you need to know is how to read the Intel reference manual, and then you can always look it up. I guess when you're talking about reversing malware, being able to reverse a sample you've never seen before, like problem-solving kind of thing. I guess that's what you mean, in a way. Yeah, I also think that's more an attitude than a skill. Yeah, it is. It really is. Yeah, definitely. Also, if you never ask for help or any questions in an interview with me, then you're definitely doing it wrong. Because the questions in the interviews I do are usually designed for you not to know the answer, because I want to know how you will react if you don't know anything. Oh, that sounds mean. Oh, it is. But it kind of sets you up for the work environment where you should be comfortable with asking for help if you need it. Yeah, of course, but if you're in an interview, you wouldn't ask for help, would you? Yeah, you should, though. I mean, I tell them to simply ask if they don't know anything, so I can explain it to them, so if they don't, then... I thought it might be better to try for a bit, and then if you really don't know to say, I don't know, rather than sitting there just kind of feeling really awkward. Yeah. I guess that would be better. I mean, there are some people who don't admit, but you just know that they are googling it right now. It's very interesting. I have an addition to make. At one point we got an application from someone who told us he writes malware, and this is really a no-go. I don't know why a lot of people think this is an advantage. The problem this creates is that the AV industry already has this reputation problem that some people think they create malware, so they can secure you from that malware. Which is amazingly dumb, because there's plenty of malware out there we don't need to write anymore. Exactly. It's a little bit similar to the pharmacy industry. If people are sick, there will never be the case that people are not sick, and still people believe the pharmacy industry makes us sick. I doubt that though. So yeah, I would say even if you at some point have written malware, I think it makes sense at some point if you write malware and just to test it for yourself and see how it works and learn from it. But if you say to people that you did that, your employer will assume that you also tell this other people, so they have really a reputation problem if they take you for the job. So don't do that. Yeah. I mean you could say that you've done like a kind of proof of concept. I guess it's how you word it. Saying malware kind of assumes that you've kind of spread it or maybe used it on someone, whereas if you say I made a proof of concept where I did this thing, I know someone made a ransomware in macros for Word documents and it doesn't have any files, which is quite interesting. But he has to be careful about what you say in terms of being kind of a black hat as such. Yeah, I agree. I think it's also like just the wrong assumption that in order to be good malware analyst, the easiest way to do that is just to start writing malware. I mean, I don't see any trauma surgeons out there running around shooting people. So you don't have to do that to learn your, well, the ropes of the job, really. So somewhat related to that question is Kali, I'm sorry if I pronounced it wrong. Kali and Kumar asked what are the top five topics beginner analysts must learn. So what do you say Fabian? I think like in so many cases, it really depends. There are malware analysts and research jobs out there that never have to do with any code because all this huge phishing and support scam ecosystem exists. And you need completely different skills for those than when you actually reverse engineer ransomware, for example, or some actual malware. I think just, well, large exposure to malware in general is always helpful. Like if you know how to remove malware without just running a tool, for example, it's quite helpful. With that usually comes a good knowledge about like a Winston channel, Dragon 3, all that stuff. It's always helpful if you know how to program, preferably in C or C++. But just if you know the abstract constructs of programming languages in some kind of scripting language, if it isn't necessarily JavaScript, then you're pretty well off as well. Then it really depends on what area you're going to work. If you want to work with Windows malware, then obviously you have to know the ropes of the PE executable format and all that stuff. If you want to do Linux malware, then you obviously have to know ELF. So it really depends. But most of the time, as long as you know one programming language and know about malware in general and the operating system internals, then you are pretty well set in my opinion. I also had the basics about malware. I mean, I think that's kind of obvious. Sometimes people forget about that, that you have to be able to classify malware and to know how basic malware detection works and what typical behaviors are and how you classify it based on that. So all right, now there are more interesting questions, at least in my opinion, about balancing family learning and work or balancing university, infocyc learning and work. So I think, Sarah, you have probably something to say about the letter. That question is from Fernando and he asks, how would you balance work full-time university and infocyc learning? Yeah, it's interesting. I think it's just kind of dividing your time between what you have to do and what else. So I work part-time, kind of. So I basically do it whenever I have free time too. So that gives me a bit more flexibility compared to having a job where I have to work X amount of hours. So that's quite nice, which kind of comes with, I guess, the whole kind of job. But yeah, I think just make sure you have enough time to get through school and supervising and everything like that. And also just making sure to not get overwhelmed. So taking some time off just to relax as well is important. Yeah, I personally, I have also never worked full-time besides while I was studying at the university. But I had a part-time job. I was student assistant and I also had my son by then. So I had a little baby and I was studying. So my advice is that you can try to kill birds, two birds with one stone by combining the subjects that you can choose with infocyc-related stuff. For instance, if you have a project where you can choose a topic, someone, then do something that you like that's related to infocyc, if that's what you like. And choose the subjects according to that. Then you might want to inform the pros professors of your situation. I really learned this the hard way because I knew one pros professor of mine who was very sensitive if students didn't show up to his courses. And I had my son and my son was in daycare and the daycare closed at 4 p.m. So every course after 4 p.m. I couldn't attend. And for some reason I just assumed it would be okay. He wouldn't care so much because I don't know, I just didn't tell him and thought that would be okay. But it turned out when the aura exam came he was very upset about me and I got bad grade because of that. He actually said that to me. And at that point it's too late. If you are already at the aura exam and tell your professor, oh, but I didn't come to your course because of that and because of that, then he's not really open to that anymore. So please tell that before if you have kind of a rough situation there. So they understand it better and don't angry about you. Yeah, also I use the time while I was traveling from home to university to learn in the tram. I also think it's important that you don't expect to perform at your best level. If you are handling so many things at a time you just can't be perfect. Don't expect this from yourself.  So be lazy on less important things and don't feel bad about it. It's just the way it is. And concentrate on passing the exams, not on making them well. Also try to understand that if you get stuck in some subject and you try to solve this on your own it will be much more time consuming than getting help from somewhere. So don't be afraid to ask us your professor or whatever. Ask other students, but don't be afraid to get help and it will be much more effective if you do that. So that's my experience. Fabian, do you have anything to add to that? Not really, but that's mostly due to the fact that I have no idea how to balance my work and my real life. I'm simply a workaholic, so I work all the time. The other question was how do you balance family learning and work? So that's just what I'm doing now. Yeah, I mean I'm kind of talking too much right now I think. No, it's fine. It's fine, yeah. So to answer that, I'm not sure if I should give tips or if I should talk about myself at this point. We divide the childcare evenly, my husband and me. We don't have any relatives nearby, so sadly there's some support missing. But it still works.  To stay sane, I don't have to separate the work from my free time because I love it so much that I enjoy doing it, I have fun doing it. So I also do this in my free time and that's why I don't get stressed out about it. But if you feel stressed out from your work, of course you should separate it more. What's also important for me personally is exercising because I feel much better about my body and about myself doing that. And yeah, I think it's really good for you to have better concentration if you exercise. So yeah, now I talked so much. Is there anything you want to add? No, I don't think so. Just if you enjoy doing your work, don't worry about spending lots of time on it. But if you feel stressed, go ask your boss or something, be like, hey, I'm feeling a bit stressed at the moment. Just let them know. They'll probably be okay with it generally, just if you let them know. Yeah, letting people know what was important always. No matter if the professor or the boss. Yeah, I mean, usually people have been in the same situation as you before. So they usually tend to be very understanding. Yeah. Mr. Graham asks, what is something that noticeably improved your skills in this area? So I guess in Melvia analysis. Fabian. Honestly, I mean, I am kind of an autodidact. So I learn by just doing things. So just go to one of the many tutorial sites that post a lot of crack me's and then have a go at them. I mean, often they come with solutions as well. So after you crack the crack me, you can look how other people did the crack me and maybe find more efficient or different ways, which is always helpful. So yeah, just go out and do lots of stuff pretty much and don't be afraid to not know anything. Just try it out. Sarah. I guess just like reading a lot of different articles and lots of different malware because usually antivirus vendors and other like security researchers will put out kind of analysis blogs occasionally. So they're really good to like read through and then you can see, oh, look, that malware did that and that's interesting for me to know. Yeah. When I started out on my analysis, I had already my computer science degree or almost done. And I think these foundations were a good prerequisite to, well, learn the other stuff very fast. Yeah, I know how to do software development and I knew the basics and computer science so that made it quite easy. And I also think learning by doing is the best you can. It's a bit like learning how to drive a car. If you just read books, you will never learn it. So do it and start with it. The J-hacks asks if you could go back when you first started out. What advice would you give to yourself? Sarah. I mean, I don't really have a perspective on this because I'm just like, I'm quite young and I'm just starting out. So I guess just like, if you want to do something, go for it. Just don't like, hesitate, I guess, and just do it. Also, don't wear a pumpkin costume for Halloween. Why that? Oh, it's it's a cute story. No, it's not. Yeah, it is. No, the question is, do you want to tell the story? There's not really a story behind it. It was just one Halloween. I didn't have a costume. So my friend gave me this like pumpkin costume and it looked really bad. In my opinion, it looked very cute. Okay. And it was hindering your progress in starting out with my analysis. Definitely. I can't get over it to this day. Wow. Whenever she sees malware with the pumpkin icon, she just gets triggered and thrown back into those times. So that's why you were put off by the Trump ransomware because it also looks kind of pumpkin-ish. Yeah, it's scary. It's just scary. I understand. Now, what I would do to answer the question, what I would do, say to myself is, please don't pursue a job or degree or education just because your parents want you to. Because that's what I did at first. I was, I learned how to be a kindergarten teacher because my mother kind of wanted to me to be there. And she also gave me, well, the impression that I can't do anything related to math or computer science because I was perceived as a girl.  But I still believe it was the right thing to change my path and just do what I like and do what I want and not do things because my parents want me to. Your parents don't know what's best for you. They don't. They just believe what would have been best for them most of the time. Or they are afraid that you might not... That's very true.  They might be afraid, but really fear is not a good advisor. So do what you like and you will be good at it if you like it.   Okay. So it's very typical. But why? Yes. I mean, while the school degree isn't really important for my job, I would still like to have one. Yeah, so you don't feel... How should I put it? So you don't feel kind of at a disadvantage, I would think. Plus, if you ever actually go for a higher degree or like a college degree or university degree, then you will just have to redo all the school stuff again and that would be pretty much a waste of time. It's like the only reason why I don't pursue a university degree is because I don't... Well, I can't be bothered with going to evening school for like three years here in Germany to get my Abitur. Yeah, it's harder to go back to school once you're already out there. It's not that, to be honest. It's just like a huge time commitment. I mean, if we had like the UK model or like the US model where you can just take a test, then I would probably just do it. But here in Germany, it's a lot more complicated. Yeah, of course. When I made my hostel called the Abitur. Yeah, Abitur. It's like a high school degree or the A-levels in the UK. Yeah, when I did this, I also did this after I had done the kindergarten apprenticeship. So most of the people there already had jobs before they got their degree to be able to study. And they really said to me, they have a lot of difficulties after being out of school for so long. They had difficulties to sit in school all the time and to be again in this position that there's an authority figure telling you what to do. And so, yeah, it was kind of hard for some people to do that and go back to learning again. I can't imagine it's difficult. Okay, so now I guess we can go to the next question now. Schallnach asks, what guidance and advice would you give to people who wish to pursue malware analysis? And where would you want them to begin from? And related to that is college codes questions. Can a fresh college graduate get a job in the malware analysis field? And if so, do you have any tips you are willing to share? Fabian. Yes, fresh college graduates can get a job in the malware analysis field. Although I don't necessarily believe that the reason for that is because they have a college degree. You probably would have gotten in without it as well. Yeah, I think the most basic problem solving skills are necessary and the basic learning skills, critical thinking skills. It's always helpful if you have a little bit of background, if you got involved with open source projects that are related to malware. Like, for example, if you participated in a honeypot project or if you participated in something like Cuckoo, for example. Or really any programming related stuff, especially if it's kind of security focus. Like maybe you contributed to Mozilla in some way or another, or maybe you reported some vulnerability somewhere. Last but not least, it's like just try to integrate yourself within the community. That's always helpful. One way you can do that, for example, is just to join a community like Sleeping Computer and get some training malware removal. So you know how current malware infections look like. Or you can simply be very active on Twitter or try to simply seek out and find new compromised websites on the web that spread malware and report them and stuff like that. So yeah, those are like the three big things that will definitely help you get a job in malware analysis. Sarah, you also got into this with Sleeping Computer, right? Yep, that's pretty much true. So I met Fabian because of Sleeping Computer and then eventually he offered me a part-time job. So that's kind of an example of how getting involved in the kind of Sleeping Computer malware removal and also getting involved in like ransomware helped me to get a job. Also, if you have like, I guess kind of indication of like, reversing malware. So like for example, if you wrote a blog post about a certain malware where you showed off some skills, that's quite useful. And also the whole Twitter thing and just getting involved in the community is also quite great because they'll help you try, usually help you try and get a job as well. I also think that the project is like the best starting point. You have some kind of project, doesn't matter what it is. Like, yeah, you named the examples. And you can then use your project to build connections. Like, it's no use if you're on Twitter and you have nothing to show for. That's true. I think starting out on Twitter, if you have nothing like, not saying you have nothing, but like it's difficult to style if you don't have something like to present to the community. Yeah. And that's why I would also say just just start a project and then share it and build your connections. And that's the best thing you can do. And the project will also show. Yeah. Yeah. No, you can continue. It's fine. I will just my stuff later. Okay. The project can also show your future employer that you are motivated and interested in the topic. And I think that's more interesting to them than your degrees. Fabian? Yeah, pretty much. It kind of shows your employer that you know how to follow through and how to actually complete something, which, to be honest, is quite difficult sometimes. There's also another aspect. I mean, there's this idea in many people's heart that there's something like the perfect software developer, right? Like the genius programmer that writes code that is so goddamn beautiful. You want to print it out and put it on your wall. And it doesn't have any bugs. Yeah. It doesn't have any bugs and it's just kind of a piece of art, right? That's untrue. That person doesn't exist or maybe it did exist, but I'm pretty sure that person died like two weeks ago. So it doesn't exist anymore. All labels have really simple software, I guess. If you write complicated software, you will find that it's a lot more difficult to make it pretty and you will find that you make bugs. Yeah. But the main thing is when you do a project, it's very important that you share that project because you have to get into a habit of showing your code, not to be afraid that your code may be perceived as like stupid or silly. Terrible. Terrible, yeah. I know I used that word before and I still regret it. Anyway, just get into a habit of doing this so you overcome this fear of sharing your code early. Because it's important, I mean, you may think that you have this perfect idea and you have this perfect implementation. And if you shared your idea early, someone could have pointed out you a better way to do stuff. But if you disappear in a cave for like three months and, well, hide away from humanity and just do your thing there. And then after three months, you show up and say, here I am. And this is my project. Look at it and someone else goes, oh yeah, by the way, you could have done this way easier because there's this that exists. And you could have just used that and saved yourself like two months and three weeks. Then yeah, you feel pretty silly. And I get why people do it, right?  But the reality is everyone wrote horrible code at least once in their life and everyone knows that. So yeah, just get over yourself and share the code that you wrote around. Let other people read it and let them give you feedback so you can grow as a software developer. It's pretty important. I also think you can reframe criticism. Like, most people think if they get criticized, they are doing a bad thing. But actually if someone criticizes you, they take their time to write you that. That means they care about your project and that it turns out good. And that means they see a potential in that. So please reframe that. Criticism is a good thing. It means people are interested. And it means you can grow. So it's a good thing. Yeah, do you want to add anything, Sarah?  Obviously if it's not like your code sucks, then that's not very helpful from that person. You can probably just, I guess, ignore that or like ask them, hey, what part sucks? And then learn from that. It's a learning experience. Take that chance, I guess. Yeah, also understand that you are not your code, right?   You have nothing to do with code.  There's no reason to get all defensive and just, oh my God, he just insulted me and stuff like that. No, they just criticized your code and that card has nothing to do with you as a person. So the last question for today, or do we want to take in the security questions as well? Yeah, we can do the other ones as well, my guys. Then it's not the last one, but it's the last one in the career topic by Andrew. What was your biggest hurdle in your career and how did you overcome it? So, Sarah? Since I'm just starting out, I already have that much, but I guess it's just making sure to put yourself out there and not be worried about what people think about you. And if you have something to share, share it. You might think, oh, it's not that important, but maybe other people like what you do. Fabian? For me, it's... Yeah, I'm personally not a very big social butterfly that flies around and makes friends easily. Yeah. We never would have guessed. Yes, yes, I know. Because I have such a lovely personality, right? Anyway, for me, it was just connecting to people, which is very important because you all work together. Also, if anyone finds a cure for imposter syndrome, that would be pretty nice. Please contact me. That would be quite helpful. And I know imposter syndrome is something that a lot of people struggle with, especially in the software area. Me too. It's like kind of... I think it's like a general problem. Yeah, it's just... Imposter syndrome is horrible. It's just horrible. So how did you overcome that? Oh, I haven't. I legitimately haven't. I guess you don't really overcome it necessarily, but you can change kind of how you think about it. I mean, that's just like a kind of hypothesis. I haven't really tried that out, but I feel like if you change the way you think about what you do and like, I guess, ask people, hey, what do you think of what I do? What can I improve on? And what do you like about what I do? Then that can possibly help. Yeah, also just taking in the evidence, right?  They looked for like over a week when debugging this problem that I just solved in five minutes and you can just put it off as luck and you can even put it off as luck when it happens twice or three times, right? But at a certain point, you just have to admit to yourself that, oh, well, now it happened like 20 times in just one year. So maybe there's some kind of skill involved and it's just not luck. So yeah, but it's overall, it's kind of interesting what kind of tricks your mind plays on yourself sometimes. Yeah, for me, it was also my own insecurity even in starting out. I mean, we mentioned that already. But at one point, I think even if you are afraid and even if you think you can't do it, you should just try. You will never know unless you try. And that means, for instance... You may be surprised. Yeah, for instance, it means if you read a job application and there are requirements that you don't fulfill, please apply nevertheless, try it. The people who write these job applications are often the marketing people who have no idea about it and ask a technical person what they need. So they have expectations that are just not possible to fulfill. And even if they are realistic, you still might get the job as I did. I got a job and I had no idea how to debug malware. So why did they take me? Because I fit into the team and because I had the right attitude to... I will learn this. I convinced them that I will learn this stuff. It may also mean that you pursue a degree although other people think you can't. You won't be able to make it. Try it. And it also means that you should do things that are difficult and you should expect to fail. Failure is something that pushes you forward. So if you fail, you should be happy that you learned something and just try again. In a lot of things that you do, analyzing malware, you have endless tries to try again. And that's what I think you should do, just try. Do you have anything to add to that? Not really. Just as you already said, most of the drop... If I said drop announcement, it's more like a wish list than a list of requirements. It would be perfect if you did this. But to be honest, if you can convince me that you can pick those skills up in a reasonable amount of time, then I will still hire you if you have the right attitude. Being open to learning new things or being open to learning new things and just kind of expanding on your skills is a really great thing. So that's it with the career questions. There were... I mean, if there were enough questions for this topic for security, I would have done another podcast with it. But it's only two, so we just take this in here. And Ora asks, is there something you would like to see from the InfoSec community in 2017? And do you have anything you want to see, Sarah? That's a really difficult question. I don't know, just... It kind of depends because the InfoSec security is such a wide thing.  So I guess just expanding into other groups would be quite good because then you get to see a different side that you might not have seen. I mean, that's not really what I would like to see, but what you can do to kind of see different things. Fabian? A couple of things, to be honest.  It's just horrible and it's annoying. Also, I would hope for a little bit more communication, to be honest, especially. I mean, there are a couple of AV winners out there now that do decrypt us, right? But there's legitimately no point in releasing your decryptor for the same ransomware family that has already been broken like two or three weeks ago, when you could have instead worked on a completely new ransomware family. And I kind of get why people do it. I mean, it may be awkward for a vast support engineer to recommend an MCSoft decryptor or vice versa, but the reality is most AV vendors aren't perfect.  I mean, personally, I wouldn't even mind to remove all the MCSoft branding from all the decryptors, to be honest, if it would mean that, well, a vast, for example, or Kaspersky would just use that tools and break other ransomware that hasn't been broken yet instead of just rehashing the same. I mean, they usually tend to focus on different ransomware. Yeah, they do that. Because we do talk with someone at Kaspersky, so we sometimes know what is happening before it actually happens, with them doing ransomware. Yeah, just a simple Twitter message or an email like, oh, by the way, we are working on this one. So I know and everyone else knows that there's no point in doing that. They have that covered. Just focus on something else would be really, really helpful. So basically, you want that people work more together so they don't do their work twice. And I also believe that it's a good idea. I mean, when I started out being a malware analyst, I was already surprised that A.V. companies work so closely together. They share samples. Yes, they do that with samples, but they don't really do that with anything else. Yeah, but I still was surprised about that, though. I thought that, well, they would be like any other company just doing their thing without ever sharing anything. But, yeah. And I think it's beneficial for everyone if they work more closely together. So I agree to that. All right. Another security related question, and that's the last one for today by Corey. If someone has no idea where to start on protecting their computer, what steps should they take? Sarah. Well, I say, first of all, making sure you have all updates installed. That's really important. Unless, for example, your work requires you to have an outdated version of Java. There's no reason to have an outdated version of Java. Or if you don't use Java and install it. So that's probably the first step. And then I know some people would disagree, but installing an antivirus, if you have no idea where to start on protecting your computer, chances are you might not be the most technical person. So having an antivirus just kind of, they're not perfect and sometimes they will fail. That's just the nature of the work. But usually they'll protect against a lot of different threats, especially pups, which sometimes even people in the industry can get distracted and accidentally install them. So it's quite useful to have that. And then three, I guess, would just be keep an eye on security news because you'll find out about new techniques. For example, recently there was a Chrome font technique where they would kind of hijack a website and make it look the text called gibberish and then be like, you need to install this font pack, which was like an EXE, and then you ended up getting ransomware. To be honest, just don't read any technical advice online. Just keep the defaults, which are pretty secure on Windows 10. Also use Windows 10 even if you don't like it. Just use it. It's a lot better than all the Windows versions that came before. It's a lot more secure. And yes, you may be annoyed that Microsoft may want to install updates for you and it may come at an inopportune time. But just do it anyway.  So, yeah, just do that. What's all on that note? Make a backup and check your backup. Make multiple backups. Make sure, well, it's great that you do backups, but also make sure that you know how to restore your backups and make sure that you can actually restore them. Yeah, make sure you can actually restore them because in some cases they may have got uncorrupted and I know that's happened to a couple of companies. And that really sucks because at least you made the effort to backup, but you didn't check them. That's almost just as bad. Yeah, this is also important not only in regards to ransomware because even years ago when I had no idea about malware, when there was a problem with the computer and what I do, I just reinstall the operating system and got everything back from backups. And what also happened to me what was the reason that I did backups was my hard disk drive just died from one hour to another without any indication that it would die. So it just happened like that and since then I had no trust anymore in my hard drive. I backed up things twice to two different devices so I had it three times. Also just this one more thing since it's going through the press at the moment again and I'm pretty sure it will go through the press again and again because it's just cool and tipped to do it. Nobody will blow a zero day exploit to get your vacation pictures people. I mean it's not anything to happen. I mean if you do have material on your system that is so critical that maybe the NSA or the CIA or whoever would be interested in getting their hands on it it's just so much easier to just grab you on the street and break a couple of your fingers to get the password instead of just doing some kind of zero day on you. People don't really realize that the zero days are just extremely expensive like we are talking hundreds of thousands of dollars here and they simply won't do it for large-scale attack on home users to get some vacation pictures or to install some ransomware to maybe get a couple of bitcoins it's just not going to happen. I fully agree to that. A lot of people who talk about zero days don't know what it actually is. Yeah, it's kind of interesting. Yeah. So that's it. You want to add anything? Yeah, I guess just like a lot of the people who talk about zero days tend to be browser vendors they don't necessarily have a perspective on what the average user is like so fair enough if you're in a company and you have really sensitive data I mean you probably shouldn't be running Windows and I would have really good security and obviously that would be thing but for the average home user you don't have to like worry about that because it's not it's probably not going to happen. It makes great news and it's good conversation on that kind of thing but it's not the most realistic. Yeah, it's a bit like securing your door while you have a hole in the wall. Just fix first things first. Personally I would also be interested since Mozilla and I think Chrome as well said that antiviruses so greatly interfere with their security efforts. I would be interested if there's any research into that like concrete evidence which of the vulnerabilities that were found in their products and that was abused by malware was made possible by antivirus software. I mean they just say we kind of stand in their way of securing their products so they must have some evidence that points to this vulnerability could have been fixed if we didn't have to accommodate for certain antivirus software. I'm just interested in that because at the moment it's just like a whole bunch of finger pointing and I do agree that the antivirus industry has to catch up in some aspects when it comes to exploit mitigation techniques but I don't necessarily think that someone I mean I know that people on Twitter can be kind of hyperbolic sometimes but if someone tells you oh I'm not going to tell you what to do better because you don't even do that it just sounds childish to me. Do you even lift kind of thinking so yeah that's an interesting topic in itself with those you could probably make a whole podcast about talking about that indeed and also invite some browser winners for that would be interesting I think it would be interesting to have an actual conversation between some industry experts in both fields and to actually come together and have a conversation about it I think that would be interesting okay it was quite long and interesting and thank you for joining this FAQ so yeah I wish you a nice day and see you again I hope so yeah hopefully thanks for having us yes definitely thanks for having us as Sarah just said great and thanks as well bye bye bye


We're here at the IT TechX show with Mayant, with Alaria and with Gaggin. We're going to hear a little bit about the sort of the products they're launching, some of the work they're doing in smart textiles. So can you tell us a little bit about Mayant and what you're sort of working on, what these products you're showing today are? Yeah, sure. So Mayant is creating a platform that is textile based and Skin is our consumer brand. And we're launching the first product in 2018, so fairly soon. This is one of them, it's a bra. And then right here you can see the men's and ladies underwear that we are all actually at Mayant already using. Sure. So yeah, like Alaria mentioned, our consumer brand is Skin and we're focused on integrating technology into everyday clothing. We think that in order for people to continue to use wearable technology, it needs to be in a natural form factor and we believe clothing is the most natural form factor there is. It's something that we all use every day and so by embedding technology directly into clothes, we think we'll get better adoption, we'll get better compliance in using the products and we'll also be able to embed a lot more sensors all throughout the body. And it's great. So we're launching this product you saw earlier next year, sort of coming out when this will be available on the market. And this is kind of an everyday apparel underwear product, but I guess within this textile platform it offers so many options beyond just apparel, right? So can you say about, so I know you have some other work going on, your sort of broad platform basis for textile computing. So can you tell us a little bit about some of the other work in those areas? Sure. Do you want me to take this or do you want to take it? I can start. I just want to say that a lot of our other work is R&D work, so there's not a lot that we can say, but yes, anything to do with functionalizing textiles for the purpose of connecting self to or humans to self or to others or to AI, we do it. So and most of our product is bidirectional, which means that we not only record or sense but we also record and analyze and actuate. And so what actuate means could be something like, for example, in that mannequin we have, it can sense temperature and deliver heat at the same time, depending on the body temperature. That's just one example. Right, so almost building those feedback loops into the way the system works and then being able to really, as it's sort of an intelligence interface to the body that can then react through and sort of sense and then also actuate in one intelligent system. Right, exactly. James, I just want to say that the purpose is really to try and connect everybody to the world of technology or the digital world, because we feel a lot of people are being left behind right now and textile is something that we all wear and access and it's not expensive. Absolutely. And so at the show here today, yesterday evening, you're awarded with the best new wearable technology device award for this product itself. So certainly our judges and also ID TechX, we're extremely impressed with the work you're doing. It's great that you come every year and support the show. How's the event been for you guys so far these last couple of days? I think the event's been fantastic. We've connected with a lot of people that obviously in this space that are working on some really interesting tech that would work very well with our skin platform. So we've made some great connections here. We've talked to a lot of people that I think are interested in purchasing the product when pre-sales start in January. So on both fronts I think it's been a very good show for us. Well that's fantastic. Great to hear. Well thank you very much for being with us here today and thank you for telling us about your products. Thank you. Thank you.


We've seen a lot of like folding laptops and things like that with like two displays and you unfold it and you get to both of those displays. This one is interesting because it is a dual screen laptop but they revamped it for 2024. So now it has two equally sized 14 inch screens and it has a lot of different configurations. So you can have two screens arranged vertically or horizontally with the keyboard and the trackpad on your desk. I was also able to see it with a digital keyboard like a on display keyboard. This one we do have a price point for it's $14.99 and it will be available in the US. We don't have a date yet. Sometimes you see these demos in the booths and it doesn't necessarily work very well but this one worked really, really nicely. So it felt really good to use. And I was like, oh, I can actually see a lot of people buying those.


Hello and welcome to the session. My name is Mansi and I'm going to help you with the following question. The question says integrate the following function that is x minus 3 into e raised to power x divided by x minus 1 the whole cube. So let us start with the solution to this question. Let the integral i be equal to integral of x minus 3 into e raised to power x divided by x minus 1 the whole cube dx. Now this can be written as integral of e raised to power x into x minus 1 minus 2 divided by x minus 1 the whole cube into dx where x minus 1 can be taken as one term and minus 2 as the other term. x minus 1 minus 2 is same as x minus 3. Now when separating this numerator we get integral of e raised to power x into x minus 1 divided by x minus 1 the whole cube minus 2 divided by x minus 1 the whole cube dx. This is equal to integral of e raised to power x. Now we see that on cancelling x minus 1 with one of the x minus 1 in the denominator we get 1 divided by x minus 1 the whole square. This cube becomes square minus 2 divided by x minus 1 the whole cube dx. Now we put e raised to power x into 1 divided by x minus 1 the whole square to be equal to t. So we will have e raised to power x into minus 2 into x minus 1 raised to power minus 3 plus 1 divided by x minus 1 the whole square into e x the whole into dx is equal to dt. Now let us see how do we get this from this. We have differentiated both the sides. Here we have applied the product rule so we will have first function that is e raised to power x into differentiation of first second function. Differentiation of 1 divided by x minus 1 the whole square is minus 2 into x minus 1 raised to power minus 3 plus the second function to differentiation of first function that is e raised to power x will be equal to dt by dx then we have taken dx on the left hand side. So this is how we get this. This implies that e raised to power x into 1 divided by x minus 1 the whole square minus 2 divided by x minus 1 the whole cube dx is equal to dt. Now we have seen that i was also equal to this in this function that is this function. So we can write that i is equal to integral dt integral dt is equal to t plus c. Now we put back the value of t that was e raised to power x divided by x minus 1 the whole square plus c. So our answer to this question is e raised to power x divided by x minus 1 the whole square plus c. So I hope that you understood the question and enjoyed the session. Have a good day.


Okay, so the next talk is why would you consider a student driven learning by Peter Smith's so go ahead. Thank you very much. So there we go. Cool. Yeah, my name is Peter. I'm from Dream. I'll spare you the elaborate introductions just that apparently in the Netherlands we love silent eyes. So we just said dream and just Peter with an extra eye. I'm passionate for stimulating intrinsic learning motivation in students and today I'd like to talk to you about that topic briefly. So let's start with the question why are we teaching? So why are we educating our students? One of the biggest reasons of course is to help prepare our students for their future career. So to improve their employability, their career readiness. Another motivation of a teacher instructor might be to see the lights in the eyes light up when they explain something and students get it. However, we know that teaching and preparing there our students is getting more and more complex in a situation in which we currently are also seeing the previous talk and other changes in society not only caused by technology innovations but also through climate changes. Globalization would lead to a lot of unpredictability in the sense of what we are preparing the students for and what and how to design our education. So we don't really know what the future occupations of our students will look like. We do know however that change as a constant requires a lot of flexibility not only on our end as teachers, as instructors, as educators but also at the end especially at the end of our students that are learners and also it requires a lot of responsibility at our learners and to be responsible for their own learning process. Therefore we are putting an increasing amount of importance to lifelong learning and lifelong development. Then asking why our students are learning ideally the answer would be also to help prepare for a future career, to help achieve goals but if you ask for the honest answer a lot of students will admit that they learn because they are expected to. We see that during their educational journey students learn more and more especially after primary secondary education going into further and higher education. There's a lot of focus being put on extrinsic motivation of students and we see a decline of intrinsic motivation along their learning journey. And a quote that is exemplary of this is something like I'm not going to this class as it's not mandatory because I'm sure it will be boring. Which implies that the students experience their education as something that they consume as a consumer rather than something they direct as owners. And also many of our current practices really inhibit this intrinsic motivation so we do things like grading assessments, big data that is available since the rise of technology and technology-aided learning, digital supervision of course and infamously proctoring during the pandemic. On the other hand we're trying to counter that with practices like more personalized education, more flexible education, more self-reliant learning and then the question is how can we do better in that. I'd like to do a quick check-in with you guys. No, I'm not going to do that. I'll save the time for the next quick check-in. So I have another one planned. First before we dive into the how. No, not before we dive into the how. I'd like to include some theory on designing for intrinsic motivation really help stimulate the intrinsic motivation of learners when you design your education when you design learning experiences especially when you design learning experiences that are partly digital. So there's this taxonomy from an old study already. I think this study has been carried out before I was born so more than 35 years ago but still very valid and still very valid also validated lots of times afterwards and in order to help design for intrinsic motivation there are a couple of strategies that you can use and in your design of your education. The first one is challenge offering challenge to the students which is quite an obvious one. So really offer them a way to be challenged so not too easy not too difficult ideally the perfect flow for them and it's also translated into they should have a 50% chance of succeeding meaning it's not too easy not too hard. The perfect place between anxiety and boredom work with a lot of proximal goals so if you set goals for the students or if you help students set their own goals thank you. Make sure these goals are achievable and not too far away so not a goal that's only there at the end of the third year when you're starting in your first year and also if you giving feedback to the students on their performance make sure it's very obstative obstative is a very nice word we don't have in the Netherlands unfortunately but it means self-referential so if you give feedback don't compare the students performance to a norm nor to the group of other students but give feedback based on their previous achievements their previous performance that's really important. Also if you think of awarding or nominating best performing students you could do it like you could choose to do it like a top three performing students of your class which is very demotivating for the majority of the rest of the class. You can also choose to personalize that similar to when you're running a race you know who's in front of you you know who's behind you but you don't know and you don't want to know who's all the way at the front because that's unreachable but you might want to know who's right in front of you because you can maybe learn from them in the learning context but also overtake them or improve your own performance. So to elaborate on that there's this two by two achievement goal framework that explains how we are motivated in the sense of challenge so we are either approaching happy things or avoiding negative things and it's either compared to your own performance to yourself or sorry it's either appealing to your ego so comparing to the performance of others or compared to the task you're doing compared to yeah self-referential competence and the left top quadrant is the best place to focus your achievement feedback on. The next one is curiosity, stimulating curiosity by surprise discovery and the way you can do that is providing a sense of inconsistency in content. When we see some inconsistency that's the thing we're focusing on so if you imagine having a roof filled with these tiles might be 200 tiles in a roof that only needs to be one missing and that's the thing you're noticing you're not noticing the rest there's an inconsistency there that's what your focus is on so that's a really powerful motivator to help resolve that inconsistency there's also something you can do in your learning content that you bring to the student yeah I think my example was more related to incompleteness but you get a sense so to really stimulate their curiosity about what you have and what you present them with. The next thing is also quite obvious, provide them with a sense of control and this control must be powerful and meaningful so if you're talking about an online environment if you let them choose the background color that's control but it is not meaningful if you let them choose what they what goals they set of or what steps they want to take to achieve that goal that's meaningful that's powerful and that really helps intrinsic motivation and the last one is fantasy and then I'm not talking about unicorns as opposed to the image might suggest I'm talking about appealing to what the students their their mental space mental picture of their worlds so that you can do using real world examples things they can identify identify with they can imagine they can relate to and also appeal to personal interests of the students so these four strategies help to build intrinsic motivation and also can be elaborated on and thanks can have a perfect place when you design student driven learning so in student driven learning it's the ideal way to offer not only personalized flexible and self-recorded learning but also account for all these four strategies offer challenge spark curiosity provide control and trigger fantasy but then there are of course a few challenges to self-recorded learning and offering a lot of control and freedom to our students so now I'd like to you to answer this checking question no which is the next one well I was asked to use VVox but then I want to go to the next one that don't seem yeah it's the same it's not this one it should be not a one well uh seen the time I'd like to just continue so I hope your answer would have been to this question something related to the same word I already used unbreakability so one of the challenges or all the challenges that you will face with giving students a lot of control a lot of self-reactedness is another factor of unbreakability of how your students will learn what they will do and what their outcomes will look like and for that purpose you can employ a student's own portfolio so e-portfolio which you can scaffold and help set boundaries in which students can take control what control they don't have especially when it's integrated with your VLE and really use such a portfolio digital portfolio for assessment as well as development allowing for authentic assessments flexible challenge personal control and reflective learning as well so really a tool that offers ample facilities for adequate scaffolding one of these tools is portflow and portflow offers a student-owned portfolio integrated with the VLE built on these principles I just explained so it's a ritual to appeal to this intrinsic motivation it teaches students to take ownership of their education rather than being consumers of their education and it also harnesses their flexibility to deal with unpredictability of their future it addresses diversity by promoting individual strengths competencies then rather than focusing on their weaknesses and their skill gaps and also allows you to be a holistic view get a holistic view of the students performance students strengths including their extracurricular extracurricular activities and learning experiences in the Netherlands we have quite a few institutions universities of all levels using portflow already and also employing port for specifically for this reason to deal with unpredictability to empower students to take ownership of their own education scaffolded in combination with the VLE we can tell you all about it on one other moment afterwards upstairs or tomorrow again and yeah that was my presentation I'll wait until you kind of pass the question no no questions okay can you tell us just sorry can you tell us a bit how would this tool work in practical terms so any case studies that you can kind of draw on yeah so um we do have a case case study upstairs I also brought some with me and so we see that more and more institutions are focusing on skills to help prepare students for their future career and skills that are not bound to single courses so skills that are learned and acquired throughout the entire curriculum or also even in older chosen activities and then this portfolio is used to allow students to collect evidence of their learning experiences into one single place share that with peers people within their institution and also outside of the institution friends family external experts to give them feedback on their progress towards their goals competency skills and then for example in this case this program has transformed their curriculum towards more of a holistic set of goals that students need to be working on and then they get feedback a couple of times during the semester from various people and then at a later stage they do a high stakes assessment based on all the previously received feedback students okay any other question there's one question over there yeah I'll come over gonna make it my steps in thank you I can see your basings around students be intrinsically motivated but is this therefore quite good for students who are intrinsically motivated but what about students who have never really experienced so much agency before and so much ownership yeah how do we get them to get involved without continually prodding them yeah yeah that's that's a very good question so I think that's where the scaffolding comes in so a lot of our students have been spoiled maybe by their previous education getting used to being told what they need to do to get their marks get their grades past the exam and not being used to taking ownership of their own learning so the scaffolding we have included in this tool but also is included in in many digital tools is based on the idea that you can I would say that provide guidelines guide rails to for example help students set their goals you can offer templates that they help them set their structure of their portfolio help them set the proximal goals and then you can really differentiate that based on the students needs if you notice a student is more ready to take ownership you can for example leave setting goals up to them fully or give less of a template let us less of scaffolding okay any other questions okay thank you very much to both of you very interesting