Welcome to the broadcast. I'm David Feldman, DavidFeldmanShow.com. Please remember to friend me on Facebook, follow me on Twitter, go to DavidFeldmanShow.com to do all your Amazon shopping and for only $5 a month or more, depending on how much you want to give, you can become a monthly subscriber and gain access to all our premium content. We have a YouTube channel. It's only audio so far, but I'd like you to subscribe to it. I've mentioned this before on the show. The YouTube channel is our show as a YouTube video. Very easy to share. It's a post on Twitter and Facebook. On today's show, it's all great comedy writers. Vic Berger from Super Deluxe. Vic Berger is more than a comedian. He is a surreal video artist whose YouTube page you just have to go to or go to the Super Deluxe YouTube page and watch his work. On today's show, he talks about getting discovered by Tim and Eric and how he's able to take what appears to be a simple video clip and turn it into a bizarre truth. A truth that is more true than what the clip originally was. The Steve Harvey having a meltdown on Family Feud video is beyond genius. Go see his work. It's amazing. We're also joined by one of my heroes, Dr. Katz. Jonathan Katz joins us via Skype for a meandering conversation about daughters, wives, and joke writing. Speaking of joke writers, Steve Young is back. Steve is a comedy writing legend. We've talked about him on the show countless times, just David Letterman's show. He wrote for David Letterman since the beginning. He is a comedy genius. We plug a gig on today's show that he did earlier in the week. We were going to originally run this conversation with him on our Tuesday drop, but because of the Muslim ban and the horror show coming out of Washington DC, I just felt we had to play it today on Friday. So we're plugging a gig he already did. Steve is the co-author along with Sport Murphy of Everything's Coming Up Profits the Golden Age of Industrial Musicals. It's an illustrated history of musicals written for company conventions and sales meetings. It's a book. It's soon to be a documentary. And it's also a traveling show. And that's the gig that Steve did in Brooklyn earlier this week, which was sold out. He didn't need to plug it on my show. Also, Tony Zaret, very brilliant young comedy writer joins us. It's going to be a light show. So there's good news. There's good news. People are making their voices heard. I'm a broken record. I talk about fivecalls.org all the time. The number five calls.org. Simplify your life. Turn off the TV. Turn off CNN. Turn off MSNBC. You need a digital detox. You need a television detox. Go buy a hard copy of The Washington Post or The New York Times or The Nation magazine or The Progressive magazine or your local newspaper. Hold paper in your hands.  A digital detox three times a day. Go four hours without your phone on. Go four hours. Each day without looking at your computer. Read a book off paper. Read the newspaper off paper. It allows your brain to focus for long stretches of time without interruptions. There's a form of PTSD going on when you're trying to focus to relax. Just read. And then all of a sudden a message, a phone call. After a while your lizard brain starts shooting adrenaline because you just never know when you're going to be getting an alert about another crazy Trump decision. Focus. Take a deep breath and go to fivecalls.org. This is a legal uprising that's going on in our country. There's been an awakening. This is bigger than the Tea Party. Echoes of Occupy Wall Street. People know what they want and they're making their voices heard. Fivecalls.org. And there's been good news. Uber, very controversial company. We did a story about Uber on our show about two years ago. The episode is entitled Uber Sucks. Travis Kalanick is the immigrant owner of Uber. It's still a private company. They're about to go public. The chief executive of Uber, Travis Kalanick, met with Donald Trump in December along with all the other Silicon Valley tools and he agreed to sit on Donald Trump's Economic Advisory Council. But then the immigration order came down Friday where Americans are going to have a moratorium on accepting refugees from seven Muslim majority countries. And protests broke out at JFK airport over the weekend. The taxis went on strike. Uber responded by getting rid of surge pricing. Surge pricing at Uber is, no matter who picks you up, the driver's name is Surge. No. Surge pricing, if you don't use Uber, when there's a big demand for cars, they triple, quadruple the prices. Uber unfairly got accused of dropping surge pricing to capitalize on the taxi strike that was going on to protest Trump's decision to ban Muslims from seven countries. In all fairness to Uber, they dropped the surge pricing after the taxi drivers ended their strike and went back to work. It was only a one hour strike. It was on Saturday. It was just a one hour strike. But people overreacted. People are gunning for Uber and rightfully so. They play hardball. They do whatever they want. They introduce driverless cars in San Francisco without any permission from the city council. They act like Donald Trump, build the building with the violations and then pay the fines later. That's how Uber thinks and that's how Donald Trump thinks. Well, there was a backlash to Uber and 200,000 customers deleted their accounts after Lyft donated a million dollars to the ACLU and the New York Taxi Workers Alliance sent emails to various news organizations accusing Uber of being in bed with Donald Trump and a protest. The New York Taxi Workers Alliance organized a protest in front of Uber's New York office out in Queens. Well, there was a meeting on Tuesday that Travis Kalanek had with the Uber employees and he said, any questions and two employees raised their hand and they both said, why don't you quit Donald Trump's economic council? And on Thursday, yesterday, Travis Kalanek quit. He quit Donald Trump's economic council. Elon Musk, an immigrant, sits on it. He's the founder of Tesla and SpaceX and Mary Barra of General Motors also sits on the president's economic advisory team. GM, as you know, has had a lot of problems with the Obama Justice Department with their ignition switches. I'm sure with Mary Barra of GM sitting on Donald Trump's economic advisory team, she expects special treatment from the Justice Department, which she was not getting from the Obama administration. 200,000 apps, 200,000 Uber apps were deleted because Uber had a whiff of collaboration with the Trump administration. So they can't count our votes, but they can count our money.  You got to keep an eye on where your money goes. Knowing that Elon Musk is normalizing Donald Trump by sitting on his economic advisory team, I'm not buying any rockets from SpaceX. I refuse to go into outer space using any of Elon Musk's engines. The Tesla, we have to ask ourselves, if you can afford a Tesla, would you buy it knowing that Elon Musk has normalized Donald Trump? Will you buy a GM car knowing that Mary Barra is normalizing Donald Trump? You cannot give Donald Trump and Steve Bannon any quarter. We have to legally stand up to these fascists. We have to challenge them. The only way to stand up to them is by going after the one thing they care about, money. They only care about money. Be careful how you spend your money. Pay attention to who's in bed with Donald Trump. Matthew McConaughey just gave an interview in London where he said, you know, we have to hug Donald Trump. That's not all right, all right, all right. You know, Matthew McConaughey, you think it's okay that we have to give Donald Trump some time and give him a hug? No, you have to punish fascists by voting, by calling your congressman and making sure you're not supporting the collaborators. Matthew McConaughey is a collaborator. If he says we have to hug Donald Trump, he's a collaborator. If Mary Barra of General Motors meets with Donald Trump and sits on his economic advisory team, she's a collaborator. And they'll always say, well, you know, we want to seat at the table because on the inside, we can really, if you get a seat at the table on the inside, we can really affect change. No, no, you don't sit at that table. Nobody sits at that table. Nobody. There's a big white tie charity ball tomorrow, Saturday at Mar-a-Lago. That's the Palm Beach club that Donald Trump bought in the 80s. They just raised the dues to $200,000 in order to join Mar-a-Lago. Now you have to pony up $200,000 to join Mar-a-Lago. Trump, who lost the popular vote by $3 million, is flying down to Mar-a-Lago this weekend. And while he's there, the American Red Cross will be holding their annual fundraising gal. It's a white tie charity ball to raise money for the Red Cross. Good organization, right? That's what you think. It's the first charity that everybody goes to when you think of giving money to a charity. Oh, let's give to the Red Cross. Elizabeth Peneman, she's the Red Cross' vice president of communication. She would not come to the phone today. We called. I couldn't get her on the line. She said that the event at Mar-a-Lago had been booked many, many, many months in advance. And she was asked, well, if you knew that Donald Trump had gotten elected president, would you still hold the event at Mar-a-Lago? And she said, well, we're not, we're not political. We're just trying to raise money to help those affected by disasters and people who need blood. And we want to support our military and their families and provide international humanitarian aid. That's what she said. She said the Red Cross is all about providing international humanitarian aid. Meanwhile, while they're busy raising money to provide international humanitarian aid, they're holding a ball, a charity ball at Mar-a-Lago, one week after Donald Trump said there's going to be a 120-day ban on Muslim refugees from seven countries. There's going to be a ban on their coming into this country. But the Red Cross normalizes Mar-a-Lago. They are pretty much giving their imprimatur, their stamp of approval to Mar-a-Lago to Donald Trump by holding this event at his showcase resort, Mar-a-Lago. Not only is the Red Cross making Donald Trump look benevolent by holding the event at Mar-a-Lago, they are feathering his nest. The Red Cross is not getting Mar-a-Lago for free. Donald Trump isn't donating Mar-a-Lago. According to the Associated Press, the event is going to raise $925,000. Well, that's a lot of money, right? You're pulling in a lot of money for one day's event. But Mar-a-Lago is charging them $400,000 to put it on. Okay? So do the math. What's $925,000 minus $400,000? What is it? It's $525,000, I believe, right? They're raising $925,000. It costs $400,000 to put it on. They're hiring Mar-a-Lago's chefs, their waiters, the band, the rental fees for the room. Donald Trump is not donating that $400,000. He's charging the Red Cross $400,000 because he sees charity as a way to make money, which is why the Trump Foundation, the money donated to the Trump Foundation, was used to hire somebody to do a nine-foot portrait of our fearless leader. The Red Cross does not spend your money properly. In fact, my friend Rob and Adams found this for me. It's an article from The Washington Post from March 4, 2006. The headline, Red Cross gave ousted executive $780,000 deal. Former Red Cross chief executive Marcia J. Evans received a severance package valued at about $780,000 after she was fired in December of 2005. Bernadine Healy was the chief executive of Red Cross from 1991 and was forced out in 2001. She had been receiving a $2 million a year salary plus a severance package. $2 million a year to run Red Cross. If you're making $2 million a year, you get fired. You're always thinking about your next job. Of course, you would hold the event at Mar-a-Lago and pay out $400,000 to put it on because that tells the plutocrats who are showing up for this black tie event that you play ball. The money's getting spread around. It's not going to where it's needed. It's going into the pockets of people like Donald Trump. The money is getting moved around. That's the idea when you work for these big charities. $2 million a year is a lot of money for anybody to be paid, especially an organization that requires donations. Go to charitynavigator, charitynavigator.org. These are the 10 highly-rated charities with low-paid CEOs. The charitynavigator says the median compensation for all registered charities is $150,000 a year. It's a charity. You're not supposed to get rich off a charity. When I donate money to a charity, it's not supposed to go to the executives. People say, well, how are you going to get a great executive if you don't pay them what they're worth? You know what? There are people who will do the job for $150,000. You don't need $2 million to do the Lord's work. If you need $2 million to do the Lord's work, you're not doing the Lord's work. The top 10 highly-rated charities with low-paid CEOs are the Gospel Mission. That's number one. It pays its CEO $50,000. Disciple-makers, global health ministries, Nepal Youth Foundation, House of Bread, Food Bank of the Albert Morrow, United Way of Southern Chautauqua County, North Country Food Bank Incorporated, Valley Outreach, International Children's Fund. International Children's Fund, they pay their CEO $63,000. Charitynavigator.org. Before you give money to any group, go to charitynavigator.org to make sure you're giving money to the right charities. Make sure the charity you're giving to doesn't pay its CEO, their chief executive, $2 million a year like they paid Bernardine Healy, who was fired in 2001. I don't know what they pay the current CEO of Red Cross, but if they were paying Bernardine Healy $2 million a year in 2001, I bet it's double. I bet it's a lot more. If you go to charitynavigator.org to look for charities with perfect scores, you won't see. You will not see the Red Cross under International. Nope, Child Aid, Direct Relief, Kids Alive International, Meds and Food for Kids, Palestine Children's Relief Fund, Houston Food Bank. Nope, don't see. Don't see the Red Cross. I see the Red Cross going to Mar-a-Lago. I see the Red Cross holding a big party at Mar-a-Lago this Saturday where they're going to spend $400,000 to raise $925,000. I see them giving a stamp of approval to Donald Trump, who's banning Muslims from entering this country. When the Red Cross is all about providing international humanitarian aid, and yet they're in bed with Donald Trump, you have to punish these people. You can't allow this. You can't sit back and allow this. You have to give to other charities, and it's not good enough that you give to other charities. You need to let the Red Cross know. When you write the check to another charity, you have to send a note to the Red Cross and say, because you're doing business with Donald Trump, because you gave him your stamp of approval, I am no longer donating money to the Red Cross. The Red Cross has a brand. It's a brand. It's the name you always go to. Everybody donates to the Red Cross first. Article in the New York Times about how to help the Syrian refugees. Who do you give your money to? Well, the New York Times about seven months ago, and they really do vet charities. These are the charities that they recommended. Hope for Syria, Catholic Relief Services, Islamic Relief, USA, Interaction, International Rescue Committee, Oxfam America, Doctors Without Borders. I don't see the Red Cross here. I see the International Rescue Committee. I see Save the Children. I see the World Food Program. I don't see the Red Cross in this list of reputable charities to save the refugees. 60 million people around the world were displaced from their homes in 2015 due to war persecution. It's the largest number of refugees since World War II. The Syrians, 11 million Syrians have been displaced. That picture of the three-year-old Syrian boy dead on the Turkish beach in September of last year. We remember that, but it's not just him. And I don't mean there are other refugees who died. I mean in his family, that boy's father lost another son and his wife when they crossed the Mediterranean into Greece to get away from Syria. Right now in Lebanon, at least a quarter, maybe a third of Lebanon's population, is Syrian refugees. The United Nations High Commissioner for Refugees say that 4.4 million Syrians have had to leave Syria, while 6.5 million Syrians have just been displaced from their home and are living somewhere else in Syria. This is a crisis, a magnitude that's almost incomprehensible. And what does America do? We take 10,000 refugees. We take 10,000 Syrian refugees. And then this president is installed who says, we're not taking anybody. We're not taking, he gets into a fight with the Prime Minister of Australia over the weekend. We're not taking anybody. This is grotesque. And for the American Red Cross, which says that it's dedicated to international humanitarian aid, for them, a week after this travel ban has been announced, for them to stage this ball at Mar-a-Lago and spend $400,000 to raise $925,000, the math isn't there to justify that. ProPublica, ProPublica has an article about the Red Cross. The Red Cross, which Saturday is holding this big event at Mar-a-Lago. The Red Cross, according to ProPublica, I'll link to this on my website, ProPublica wrote a piece with NPR, speaking of people who waste donations. But ProPublica is a good organization. ProPublica, here's the headline from this article, how the Red Cross raised half a billion dollars for Haiti and built, how many homes do you think they built for half a billion dollars? Six homes. You may not remember, but back in 2011, there was a massive earthquake in Haiti. The Red Cross received a flood of donations, half a billion dollars. The leader of the Red Cross said, we are on this and we are going to save the people of Haiti, collected half a billion dollars. And according to ProPublica, they squandered all the money and lied about it. According to ProPublica, the Red Cross claimed that it provided homes to more than 130,000 Haitians. That's what they told us. The investigation by ProPublica shows they only built six homes. ProPublica goes on to say that it's part of a larger problem, that it's not just Haiti, that they botched delivery of aid after Superstorm Sandy. Even though it's the charity of choice for most Americans and corporations, they are unable to take that money and distribute what's necessary after a disaster. The Red Cross, they need to be put on notice. If you give money to the Red Cross, instead of the other charities I'm recommending through the New York Times or Charity Navigator, you are throwing your money away. I recommend that you go to charitynavigator.org. If you, God willing, have any money to give, make sure you go to charitynavigator.org and give your money and then send a note to the Red Cross telling them that you gave to, I don't know, doctors without borders because of the Red Cross doing business. I do mean business with Donald Trump. There is a protest outside the gates of Mar-a-Lago for Saturday. It's called March to Mar-a-Lago for Humanity. 1000 people say they plan to attend the march. There's a Facebook page. If you want to find out more information about the protest, the Facebook page is called March to Mar-a-Lago for Humanity. And that protest is this Saturday tomorrow outside Mar-a-Lago. And as the Red Cross pulls up and the 500 plutocrats show up, you will make your voice heard and shame these people as well they should be. FiveCalls.org, the number five, calls.org. Call your congressman, call your congresswoman, call your senator, and fivecalls.org will tell you what to say and who to call.   It takes one minute. And if you've been following this, you know that the staffers, their ears are ringing. We're doing good. We're doing good. Well, I was going to talk about this raid that Steve Bannon ordered five days into his presidency that left a Navy SEAL dead and an eight-year-old American girl was killed in the raid. Nobody's really talking about the eight-year-old girl. And I just want to mention who she is. This was a disaster. The Navy SEAL Team 6 did a raid in Yemen. It was five days into the Trump presidency. The Obama administration was reluctant to go through with this plan because the last time they tried an operation in Yemen was in December of 2014. SEAL Team 6 stormed southern Yemen to free an American photojournalist who was being held hostage by Al Qaeda. But the raid was a failure. The kidnappers killed the journalist and the South African who was being held with them. So the Obama administration was a little reluctant to go through with this mission. But Steve Bannon was salivating to do something. They went in. Chief Petty Officer William Owens died. A $75 million aircraft had to be destroyed because it had been shot down. This is the story that is just getting buried. We heard that an eight-year-old girl had been killed in the raid. But they're really not telling us that she is the daughter of Anwar al-Awlaki. He is the American-born Al Qaeda leader who President Obama killed in 2011 with a drone strike. This is an extrajudicial killing of an American citizen. I believe they also killed his son later. Somehow, now, the eight-year-old daughter of Anwar al-Awlaki was killed in this failed strike. They killed an eight-year-old American girl. Now, this was not a successful raid. Everything that could have gone wrong went wrong. This was a raid that the Obama administration did not think was a good idea. And yet afterwards, Donald Trump said it was a tremendous success. This raid that was approved by Steve Bannon and Jared Kushner and Defense Secretary Jim Mattis on Sunday, Trump said this was his first counter terrorism operation. He said it was a tremendous success. He claimed that SEAL Team 6 captured important intelligence that will assist the U.S. in preventing terrorism against its citizens and people around the world. But we're hearing otherwise. The reason I mentioned this, there are two reasons.  We also killed the American son of Anwar al-Awlaki.  That's the first thing. Secondly, this was not a successful operation and Trump is lying to us and saying it was a success. We're learning otherwise. When his approval dips even further, he's going to take us to war. And I said this after the inauguration, when the president looks at aerial photos of his inauguration and says there were more people at my inauguration than there were at President Obama's, these photos from the Park Service are lies. These photos from the press are lies.  There's going to come a time in the not too distant future when Donald Trump is going to address America from the Oval Office telling us why we need to commit troops somewhere, someplace. Are you willing to believe him? Can you trust him to send your child into battle?  As long as it's not our children being victimized by not just the lies but the incompetence, we will give Donald Trump a chance when he addresses us from the Oval Office and tells us it's time to go to war. Are you going to let him take us to war? Are you? Are you going to believe him? Bring back the draft. Let's have some fun. You're listening to highlights from the David Feldman show heard nationwide on Pacifica Radio or as a podcast on iTunes, Stitcher, and now YouTube. Please subscribe to this channel for more information. Go to davidfeldmanshow.com. Thank you for listening.


So, this is a talk about science gateways. I'm going to do a quick introduction and definition about them. Just to show you that this is not a niche market. Actually, there are quite a lot of people all around the globe looking into this. So, what's a science gateway? A science gateway is a set of tools, data and applications that are integrated in a web environment, behind a web portal usually. And usually these web portals are connected to larger infrastructures to support big computations or large data storage. So, there is now an international coalition on science gateways. It was launched just before summer, actually. And all the major funding agencies and continents have structures for this. It's Canary in Canada, but there is EGI in Europe, sciencegateways.org in the US, Nectar in Australia. So, it's really a big thing at the moment. In your informatics, I guess you are familiar with some of these systems, but the number of science gateways is also increasing every day. And as we speak, I guess, it started at the beginning of the 2000, but now most of the projects and different domains are developing there on science gateway either for computing or for data or in general for both. So, we can name, and this is just a reduced list of projects, we can name the Agave platform in the US, the AMC science gateway in the Netherlands, C-Brain in Canada, the HBP, of course, in Europe, the Lonnie pipeline in the US, Negrid in Europe too. Also, commercial companies have started to go into this business. I'm thinking of Flywheel in California, for instance. And we had, of course, a presentation during the session before on the neuroscience gateway. Regarding data, the situation is more or less the same. There is Coins, Gearder, Lonnie, Loris, Redcap, and XNAT, just to mention the main ones. The thing is that all these platforms are being developed usually for specific purposes, so either subdomains or they have specific features. And it's becoming more and more of a challenge to actually integrate them and to make them interoperate. So, in the next few slides, I'm going to focus on VIP and C-Brain, which are the two platforms on which the remaining of the talk is based on. So, VIP is a platform that we developed at CNRS in Lyon. It has a web portal basically offering two people a way to... So, I'm not sure if this is working. So, it has a web portal offering two people a way to start applications and monitor them. It's based on the European Grid Infrastructure, so it's a big computing infrastructure with more than 100 sites distributed in Europe and beyond. We consume about 30 CPU years every month, and we have applications in a variety of domains related to medical imaging, including neuroimaging. So, the project started in 2009, and as of today, there are more than 900 registered users who use it and publish with the platform on a regular basis. C-Brain now is a project started in Alanevan Slab at McGill. It's basically an integration platform for tools, data, visualization software, and high-performance computing sites. The service in Montreal is based on the leverages the Canadian Grid Infrastructure, so you can see a snapshot of the various sites on the top right of the slide. And it also includes a variety of different tools for data processing and simulation. So, in case you're interested in systems architecture, this is how C-Brain works. It's a very conventional 3D architecture with APIs and clients at the top, so you can access C-Brain either as a human just by clicking on the portal or as an application by using the REST API. The middle layer then has a variety of services. So, to store data, there is a central catalog to keep track of your data distributed on different sites, to keep track of your tasks, to keep track of the provenance information in case you want to see exactly what happened on a particular dataset, etc. The bottom layer then is the resource layer. So, this is one of the features of C-Brain to be able to flexibly adapt to different computing or data providers. So, there are plugins for the main batch computing systems like PBS, SGE, etc. For Amazon Web Services too, in case you want your analysis to run 100% on the cloud. And for the major data providers like, you know, SFTP, SCP, etc. It also has a plugin architecture, so if you need to install it on your infrastructure, but there is no connector for this, you can easily develop one. C-Brain is being used now for the Open Science project at the Montreal Neurological Institute through a connection with the Luris data platform. So, the data collected at the MNI is going to be stored in Luris and then will be processable in C-Brain through the rest of the API I was talking about. Finally, another feature of C-Brain is that it's 100% open source and not only just open source in the sense that you can download the code and die with it, it's also pretty well documented. So, you know, if you have even a small infrastructure in your lab with a few computing servers and data storage distributed here and there, C-Brain can help you manage this infrastructure for your own needs. So, this is all available on GitHub. So, that's it for the advertisement page. So, now I would like to focus a bit more on what are the big problems related to science gateways for new imaging at the moment. The first one I would like to talk about is reproducibility. Actually, a question that I think science gateway developers and users should wonder about when using such systems is how to not break it with a science gateway. Okay, so we are talking a lot about reproducibility, but what can we do at the science gateway level? I'm going to refer to Roger Peng's definitions on reproducibility. So, we talk a lot about reproducibility sometimes with different meaning behind it. So, basically, what I'm aiming at in this presentation is to take the same data to analyze the same data with the same software again and to try to get exactly the same results. So, this is different from replication where independent investigators are going maybe to require another data set to try to replicate the same scientific findings. Here, we focus exactly on the same data set, same software, and we hope to get the same result. So, how can you basically screw it up with a science gateway? The first thing you have to care about is anonymization or de-identification of data. This is a paper published last year from the social sciences, but I think most of it also applies to neurosciences. And this paper shows that the conclusions that one can draw from a de-identified data set are significantly different from those that would be drawn when the original data set is used. Why is that so? Well, basically, when you want to de-identify data, you're going to remove personal information, and then you're going to do two things to generalize, which means, for instance, in neurosciences to replace the date of birth with a year of birth because you don't want information to be too specific and to suppress data sets that are too easily identifiable. For instance, if there is a single subject who is 102 years old in a data set, then everybody is going to know who's going to be the subject because there is only one, so you'd better suppress it before you make the data available to the public. So that's a risk. If you are using a science gateway that implements de-identification for you, you should wonder about it. I don't have a slide on it, but other anonymization methods that could matter, include defacing in medical imaging when you remove the face of the patient or subject so that it's not recognizable, then you may have issues in terms of reproducibility. Another maybe trivial but still important point is about format conversion. This is a paper published, I think, in May this year showing how the conversion from daikon to nifty can create reproducibility issues and can actually disturb a data set. So again, if the science gateway promises to convert your daikon data to nifty, you should at least do a visual inspection of the result to be sure that it's okay. Next reason for reproducibility to be disturbed by the use of a science gateway is the handling of software versions. So this may look like a geeky topic, but it's actually very important. This is a paper published in 2012 showing the effect of the free-surfer version on actual findings, and it was showing that depending on the version of the software that you're using, you could have very different results in your study. So the conclusion of the paper was that users are discouraged to update to a new major release of free-surfer during a study, so you should fix a version. I would add that you should make sure that the science gateway precisely identifies software versions and are not going to make updates without your consent, basically. And I would add another message this time to the software developers is that actually software developers should be encouraged to use version tracking and tagged releases as much as possible because if we're trying to share code in a science gateway and this echoes what JB was saying in the previous talk, if we're going to share code and this code is not even properly version tracked, then we are really running after problems. Well, of course, you're going to say, ah, but everybody uses version tracking. This is so obvious that we're all using it or whatever other fancy version tracking system. Well, this is not quite the case. I've recently worked with the frontslide imaging team on two MIKI challenges related to the segmentation of multiple sclerosis images and PET images. We've integrated 24 pipelines over summer into VIP and among these 24 pipelines, only four use version tracking and zero use release tags. So really, this is a message to developers. If you want your code to be integrated in a science gateway, go to Git, I mean, use Git, use GitHub and you can see even more practical tips in this presentation from Pierre Bélac. As a science gateway, developers or administrators will also hold a responsibility for this. The slide is not very nice, but it's the beginning of our application porting workflow to Cbrain and VIP. Basically, step zero is to check exactly that so that your application is versioned, portable and properly documented and if it's not the case, then we basically advise people to try to improve their code. Still on reproducibility, what else can go wrong? So after anonymization, data conversion, software version tracking, well, there is also something to say about the operating system, the effect of the operating system itself on the results. So this is a study that we published last year comparing the performance, well actually the effect of the operating system on a variety of neuroimaging pipelines on two of the main Linux distributions. What we can conclude from this study is that basically the shorter the pipeline, the less likely it is that there will be reproducibility issues. It's explained by considerations related to numerical stability. So basically if you take a very short pipeline like the FSL fast that I'm showing here, where the goal is to classify brain images into four classes, then we see some differences between operating systems but they can mainly be considered as noise. So what you see here is it's a map showing the sum of binarized differences between the classifications obtained on two different operating systems. So I mean like for instance a red dot of this color means that and this is sorry, this is a sum of 150 subjects. So a red dot means that among 150 subjects one subject had differences at this voxel. So you can see that it's really a noisy pattern. If you take a longer pipeline and the example is on FSL first here, so segmentation of sub cortical structures, you can see that differences can actually be more important. Especially if you look at this yellow region here, you can see that the segmentations are really different under two different operating systems. We measure DICE coefficients down to 0.6 which I mean given that the variable was the operating system is actually quite worrying. We made some detailed analysis to try to explain why, where these differences were coming from. And if you take an even longer pipeline, so we took three surfer in this case and you compare its execution on two different operating systems, then we can even reach statistical significance in some regions. So this is also a bit worrying if the studies is run on multiple operating systems. So that's a message to Science Gateway users and developers that the operating system should really be fixed when conducting a study. So fixing the operating system is not actually so easy, especially if we are talking about systems that use high-performance computing sites and many of them, because the Science Gateway developer or administrator doesn't always control the operating system that are deployed on the different sites. It's up to the system administrators on these different sites. So how can we solve that? Well, the current answer to this is containerization. So it's actually a way to avoid reproducibility issues and I'm going to say a few words on this. So containers have been around actually forever since the 1990s or even 80s, I think. There are very early projects on that, but they recently emerged, especially with the Docker system that I'm sure you've heard of. So why are containers so interesting and useful? Containers provide a virtualization framework at the level of the operating system, which means that to the contrary of regular virtual machines, you're not booting a whole complete machine, but you're using the already booted system, the Linux kernel in most of the cases, and you're just switching the context on top of this booted system, which means that you can deploy a complete operating system on top of an existing booted machine. So why is it nice? Well, basically, containers are booted much faster than traditional virtual machines, which means that we can actually boot one container per task. It only takes a fraction of a second to boot a new container. So this is interesting because you don't have to actually wonder when and how to deploy your virtual machines. You just boot one container per task. This is true especially for Docker, but the ecosystem is very easy to use too. It's available on most systems. It's well documented and actively developed, which means that tool developers can package their own tools as opposed to Sanskrit administrators doing this for them. And containers are also easy to share and search. So many projects have emerged. So Docker was one of the first ones. Today we are talking about singularity and others, and all these projects are federated in the Open Container Initiative. However, containers are not perfect. If you don't like computers, maybe you should check your email now because this slide is going to be a bit technical. So this is just an illustration of how things can still go wrong with containers. So here you can see a very simple Docker file where we build a container from the MR Tricks application. So this doesn't do great things. You just install some packages, then download the MR Tricks code and install it. These are the commands to actually build a container. And this is an example of the container running on one particular machine. So this command is Docker run.  Everything goes well. You have your data at the end, and the files are here. Now this shows the execution of this container on another machine. So we run exactly the same command. The container is transferred, and then we have an illegal instruction, error message. So this actually breaks reproducibility, and we could wonder why containers behave differently in these two machines. And the answer is actually because the compilation step was architecture-specific, so it was very dependent on the hardware. And as I was saying before, the hardware is not virtualized in containers. So this is one of the cases where containers can go wrong. Based on that, we have started a year and a half ago the Boutiques initiative to help people share tools between different science gateways. So Boutiques is a framework that aims at reducing tool voting time and enabling tool sharing across different platforms and improving reproducibility in science gateways through containers. So the principle of Boutiques are as follows. Basically, all the tools are supposed to be implemented into a container. So we support Docker at the moment, but we are talking about supporting singularity and other types of containers. So this is one thing. You ship your implementation as a container, but still this is not enough because you need to describe to how the executables in the containers are going to be invoked. So this is the role of the second part of Boutiques, which is a JSON language to actually describe what are the parameters of your application, how they are supposed to be invoked, what are the dependencies between these parameters, etc.  Actually, the reality is a bit different because tools can be very complex. Most of the tools that we use in your imaging now have dozens of parameters. These parameters have dependencies between them. Like if you use parameter A, then you are not supposed to use parameter B unless parameter C is defined, for instance. These parameters have types. You can have complex types, like lists of various types. And these parameters are also grouped into consistent sets related to a particular aspect of the application. So our assumption with Boutiques is that we should extensively support this because if the application is well described with all the constraints on the parameter, then it means that we can do more validation at the same schedule level, and it means less errors at the end of the day for the users. So this is just a simple video snapshot showing how FSL-BET was implemented in C-Brain before Boutiques. So we could see that, for instance, for this parameter, users could enter negative values while this is not permitted. So first of all, we had a reduced number of parameters, and there was no real consistency checks between the different flags because it takes time to implement all this in effort, and there are a lot of tools where this is required. And with Boutiques now, so I should say that this is all automatically generated from the JSON descriptor of FSL-BET. You can see that we have much more parameters. We have more checks as well. I'm not sure if it was clear, but if we put a negative number, it's automatically detected that this is wrong. We have also, I'm going to show this, maybe we have parameter groups, and if we click on a flag, then it automatically disables the other ones, et cetera. So the message is, if we all share our tools and describe them consistently, then we can have better validation at the same skateway level. I'm going to conclude the talk by a few words on interoperability. Starting with the note that, okay, let's be realistic, not everybody's going to use the same skateways. The software has an expiration date. At some point, it becomes obsolete. It requires a lot of maintenance, and it just makes sense that different groups are going to still develop their own science skateways for their own needs. So what can we do with that? One approach would be to say we could all adopt a centralized platform for reproducible science. So there are actually a few systems that advocate that at the moment. Of course, it's easy if we all use, let's say Google Doc, like a central system, it's very easy to share your data or your documents with others because everybody's using the same system. You can easily share code, of course. It's easy to rerun analysis because everybody's basically using the same computer, I mean the same platform. However, there are also important scalability issues, sustainability issues, what happens if this platform dies, privacy and governance issues. So do we really want to give control to this central place? Maybe not. So instead, the model that we are looking after is really a model similar to what the web is today. So it's a decentralized network of science skateway platforms. So we envision a common network where different science skateways could emerge and connect to this network and provide maybe different kinds of services. So the types of services provided in this network would be actually different depending on the domain, on the type of data addressed. We could have data storage platforms, computing platforms, tool repositories. Search engines, of course, are critical in this respect. And in this model, the game becomes a little bit different because everybody could start their own science skateway if they wanted, connect them to the network. Of course, it doesn't mean that there wouldn't be central hubs with more power and importance, but things would be more open and decentralized, which I think is required in an open science environment. So what do we need to do this? We basically need two things. We need common repositories of tools and data, and we need common interfaces, so common APIs to consistently and uniformly access all these different science skateways. So there is, of course, a whole talk to make about common repositories and common APIs. I'm just going to mention, again, the boutique system. So tool sharing, I mentioned it before, has a way to facilitate the tool integration in science skateways. Actually, it could also become a way to share tools between different science skateways. Today, we have connectors from the NIAC and NiPype frameworks to boutique, so you can export tools from NiAC and NiPype to boutique, and once the tool is available in boutique, you can import it in VIP, in C-brain, and in the Pegasus workflow engine. A final word about APIs. In the frontslife imaging infrastructure, we are designing a common API for science skateways related to neuroimaging developed in France. So this API is called Cormin, for a common web API for remote pipeline execution. It's still work in progress, but it already allows clients to consistently start and stop pipelines in different platforms to monitor their executions, to access files and directories, to access study, and to administer users. So having common APIs is useful for interoperability. I asked this question to the speaker at the previous session, but I really think that INCF could maybe play a role into standardizing APIs in the different science skateways. And it also opens a whole new set of services. Basically, once these science skateways are connected into a global network, we could think of common benchmarking services, like to benchmark the execution of a tool in different science skateways. We could think of credit services, like for instance, if you want to know which tools are used across the network, we could have services for that, et cetera. So it would really open a whole new set of services. So I guess I'm going to stop here. I just want to thank all these people for their work and support and contributions, and of course you for your attention. Thanks a lot. Thank you very much Christophe, for the comprehensive overview of the issues that are facing us. Questions for Christophe? Thanks for the talk. Very interesting. I definitely agree with you that we need some kind of a re-executable docker container or any other technology, but if we take a pragmatic approach of that right now and say, I have my tool packaged docker container, I want to run it on AGI, on Biomed, or on an HPC cluster. There's no the courage in running on these infrastructures. Do you have any solutions for that right now, or did you start thinking about this kind of stuff? Yes, of course. Thanks for the question. So there are various aspects to it. First of all, there are solutions to run docker on high-performance computing clusters. In Canada, we have one cluster with, I think, 20,000 nodes supporting docker. So I think one of the things we can do is to try to convince system administrators to install docker. The second answer, if it doesn't work, we can still use clouds. I mean, clouds are also emerging, including in AGI. There is the AGI federated cloud where you can basically be root on any virtual machine. Therefore, install docker and run it if you want. And the other aspect is docker is not the only container system. Singularity in particular has been developed, especially for that, so to simplify the deployment on high-performance computing clusters. And there are also other initiatives that allow you to deploy containers without having to have administrative access. So the question is now, today, what type of container system we should use? It could be a bit worrying and, you know, stressing to make a decision now and what's going to happen in a few years. The good news is that the Open Container Initiative really standardizes the ways that containers' formats can be translated from one to another. So, yeah. Thank you very much. Just a little bit controversial. We went to the same problem, we're planning reaction, and like a difference in the operating system. Yeah. But compared to the other products, I guess, the Dyson Dex is very small because the Elibnura is very small. Compared to other products, people relaunching analysis with different parameters and all those things. Do you have a point for why is it really important compared to the other products? Yeah. Compared to the other products, okay, for the Elibnura, the Dyson Dex is very small compared to the other products. I cannot see that as a small part of the problem. I just agree. Yeah. So, I definitely agree with you that this is a small part of the problem, but as infrastructure developers, I think we should get it right and solve it because there will be a problem, and this I can guarantee, that there will be biological problems where this could completely screw up the analysis. Like, you know, if we are talking of die-square efficient of 0.6, I mean, this is really not supposed to happen. So, if you're studying the Amidala, and if you're using, you know, sense gateways that doesn't get it right, then probably your results are going to be completely, completely wrong. So, I mean, I'm not saying that this is a whole problem. It's only an aspect of it, but we should get it right.


Thank you for joining our session on securing S3 backups against ransomware. So as we get into this, just a bit of an introduction. So I'm Michael Cade. I'm a senior technologist here at Casting by Veeam. And I'm joined by Tom. Hi, everyone. My name is Tom Anvil. I'm director of engineering here at Casting by Veeam. I was on the founding team at Casting. Awesome. Tom's going to be giving the good news later on. Before that, I have to put in some of the doom and gloom around. Well, just the reality of why do we need to protect our data against things like ransomware? So I'll get into the bad bits first and then Tom can bring it home later on. So the first thing that we want to touch on is, well, what is the need for a mutual backups? And as much as we're talking specifically around Kubernetes' clusters and Kubernetes' data, the actual premise here actually resides in any other platform. So whether it's virtualization, whether it's cloud-based IaaS workloads, whether it's on-premises physical machines, all of these play a reason why we need and we should be considering that immutability within our backup chains or off-site copies as well. So just to quickly run through what these look like. Accidental deletion, and I'm going to come through and put some of these into specific use cases later on. We know people make mistakes. And if we were going to look at the analysts who are constantly speaking to you guys and understanding what happens from a failure scenario point of view, accidental deletion is always in the top three things that are causing for data loss. Then you've got policy gaps in terms of, well, I thought you were backing this up. I thought we were backing that up. And there's that confusion gap around what is actually being protected and what actually is being backed up to a different location to prevent those failure scenarios or not being able to recover from those failure scenarios. And then probably more and definitely over the last 12 months is around security. So both internal security threats, there's a growing number of inside a malicious activity going on. And I'm going to touch on this a little bit later as well, as well as that everyday newswire coming down around external security threats and namely around ransomware. And that's really the point where a ransomware attack is going to try and get into your system. It's going to try and encrypt your data at a very one-on-one level. But there's so much more to ransomware. Rantomware is getting so much more advanced in terms of being able to understand a lot more about your environment. Like I said before, you've probably got different platforms within your infrastructure, within your environment. So ransomware could wreak havoc understanding what that looks like and it's getting even more intelligent that way. So the whole prevention is one thing, but the fact that ransomware and cyber attacks are getting more advanced in how they're attacking their victims just really resonates that we need to be thinking about how we store that backup data in that immutable fashion so that it cannot be modified both from an internal point of view.  And then also legal and compliance, especially in certain sectors, verticals, they have the requirement about, well, this cannot be touched, this cannot be modified. And whilst the other four that I've mentioned before are really important, the legal and compliance obviously in some verticals are also business threatening as well from that point of view. So just to really hit home and really touching on some of those targeted Kubernetes use cases here. So I first mentioned around security or external security threats. And this in particular, this Hildegard happened at the very beginning of this year. So we're talking January 2021. So very new, very topical. And really the premise of this is that it's going to target cloud and container infrastructure. So your Kubernetes or cloud native environment, and it wants to inject itself in there and start mining for cryptocurrency. It's going to leverage the underlying hardware that you're paying money for, especially in the public cloud. And it's going to leverage that to gain that cryptocurrency to mine that. How it does that is via deploying malicious code that targets exposed Dockerdemon APIs. It's been active since that very early 2021 that I mentioned and the potential to exfiltrate sensitive data. So whereas I mentioned around ransomware in the beginning years and years ago was all about encrypting and holding you from ransom. And the ransom was a monetary value that you would pay probably in some sort of Bitcoin. That's not always the case anymore. And actually the data is somewhat some could be more valuable if they were able to exfiltrate that out of your environment. So then we touch on and hopefully this is the worst it gets from a ransomware point of view. But then we move on to more of that insider threat, which is actually maybe a little bit more scary in that all of us work for companies that are obviously looking or have adopted cloud native or at least some sort of infrastructure platform over the years. And we probably have some responsibility when it comes to that. And just to touch on the ransomware side of that is that well, ransomware is quite a hard process in that it's all well and good being able to write the ransomware or the threat. But then you have to find an entry point into the business or into the vertical that you're looking to attack. You've then got to find some way of compromising the user accounts, finding misconfigurations or vulnerabilities to be able to gain more of a footprint within that environment. Whereas this is where it gets really quite scary is over the last again over the last 12 months, maybe due to the pandemic or not is that there's been the ability to buy network access over the Internet. And that could be anywhere between $300 to $10,000. And this kind of gives you a pick and mix option to be able to, well, I want to target this particular vertical and I want this particular access because this is where my ransomware could really work. And you might have also heard the term ransomware as a service. Well, this kind of coins and goes into that same bucket. And this is the scary bit of disgruntled employee, an employee that is leaving. And this is really playing into that internal security threat and that we should be thinking about that least privileged model, making sure that the people only who absolutely need access have access, leveraging things like role-based access control, leveraging things like policy-based access as well. All key things that we should be considering. And I think from a Kubernetes point of view, that's very much front and center of mind, but it still obviously has to be implemented. It doesn't just happen. And then we get back onto that accidental deletion. Now, people do make mistakes. It doesn't matter what platform you're on. Human errors are absolutely bound to happen. And you can prevent as much as possible around how that doesn't happen. Kubernetes is obviously largely made up of code. So it takes away that human impact or that human error. But still, there is that chance that the accidental deletion process could take hold. And in particular, I found this on Stack Overflow. So accidentally deleted my Kubernetes namespace. And funnily enough, there's not that many answers in there because there's not much you can do about that if there's no backup or the ability to bring that back. And something that I've coined here or many people have coined is this code 18. And again, this is applicable for any platform across any environment, is the code 18 being 18 inches from the screen, user error type error. So just a couple of points before I pass it over to Tom to bring in the good news of how can immutability help in these instances. And some of the preventative tasks that we can put together or help with around making sure that our operating systems, our software is all up to date. It's using the correct patches, et cetera, that have been shipped out on a daily basis, regardless of what platform you're on. But also then routinely audit those access lists that you have, making sure that still the people that need to have access have access. And probably a broader because not everyone... I consider that IT or at least the operators, the developers have a good understanding of what ransomware is, what phishing attacks look like from a wider scale. But maybe the HR, maybe the finance, maybe other business sectors, maybe even sales, if you're not in a tech-orientated company, then maybe we need to educate as well and continually educate because ransomware has changed dramatically over the last three years. It's become more mainstream and more vicious in how it attacks. And also much more intelligent in how it attacks as well. And then finally, the backup. Backup is super important and that's really what's going to lead us into what Tom is about to speak about, is making sure that we've got a copy and the final point that I'll raise is around mastering the 321 rule. And again, this methodology works regardless of platform. And it basically means three copies of your data on two different media types, one of those being off-site, air-gapped and immutable away from any malicious activity, whether it's inside out, whether it's external. And with that, I'll hand it over to Tom. Thank you, Michael. Given the number of entry points for attacks, the possibility of accidental data loss, and the complexity around governance compliance requirements, immutable backups are an important part of any data protection strategy. Object storage has become a popular destination for backups in the cloud-native ecosystem. And so we'd like to demonstrate how object storage can be used to create immutable backups. The scalability, simplicity, and the robustness of object storage has made it the perfect target for backups in the cloud-native space. Objects, also called blogs, are accessed via simple requests, which have been wrapped by a number of tools and libraries. Many databases have object storage support built in. Their backups are automatically pushed to object stores. In addition, for data protection vendors, supporting object storage as a backup target has become table stakes. You can also find several open-source projects that make it easy to backup to object storage. Kobi is my personal favorite since my team is actually contributing. Many projects treat blobs as immutable, never updating a blob one-third. This has become a best practice to help deal with the consistency provided by object storage and our passion layers. In the simplest scheme, one blob can map to a single backup. However, more advanced projects will split a backup across multiple blobs, enabling better performance. Treating blobs as immutable is an important requirement when implementing immutable backups. However, this is not sufficient since your code may not be the only one attempting to write to the bucket. The only way to ensure immutability is to use the primitives provided by the underlying storage. Let's take a look at what the S3 API provides. Although it's not the only API for object storage, the S3 API has become the most prolific and includes all the primitives needed for creating immutable backups with a feature called object locking. In order to use object locking, you need to make sure that your bucket is configured with object versioning. Based on your requirements, you'll need to set object lock and parameters in your API requests. For the most basic schemes, using S3 object locks will be similar to using any S3 bucket for backups. I'll go through the changes needed in the API requests to configure immutability. In order to use object locks, your bucket must be configured with versioning. Any request that modifies a blob in a version bucket will create a new version of that blob. The previous versions may still be accessed. Deletes will create a delete marker that indicates a delete was issued. The availability of previous versions of an object depends on the retention settings for the blob. The behavior of object locking is determined by the retention mode. There are two retention modes. Governance mode is more permissive. To bypass the retention setting, users must have permission. In addition, the user must explicitly set a special header. Compliance mode is more restrictive, and one set of retention period cannot be reduced. In AWS S3's case, the only way that an object may get deleted within a retention period is by completely deleting the AWS account. There are two ways an object can be retained. The first is by a mechanism called the legal hold. A legal hold may be set or released by any user with the put object legal hold permission. An object cannot be modified or deleted when a legal hold is set. The second mechanism is a retention period. An object cannot be deleted or modified until after the retention period expires. A retention period may be configured by default at the bucket bubble, at the blob creation time, or maybe extended via a separate API call. Let's dig into some of the APIs. When creating a blob as part of a backup, you'll want to ensure that the retention period is set long enough so that the backup cannot be deleted or modified for an amount of time determined by your retention requirements. Since a bucket requires versioning enabled, the result will have a version ID for the blob. It's important to save the version ID since you'll need to query for this version of the object. If you don't specify a version ID when querying a blob, the latest version of the blob will be returned. This works well for the simpler backup schemes, but it's not sufficient for the immutable backup use cases. Blobs may be over an accident or by attackers, and therefore blindly using the latest version isn't safe. For this reason, you'll need to track all the versions of all the blobs for your backup. In addition to being cost-effective, deleting back was maybe required for legal reasons. Deleting blobs associated with a backup in a version bucket requires deleting a specific version of the object. If the blob is currently object-blocked, then the delete will fail. For immutable backups, it's best to always specify the version when deleting the blobs. If not specified, then the latest version will be set to a deletion marker, but older versions of the blob will still continue to exist. You may not know upfront how long you'd like to retain a blob, and a blob's original retention window may not cover the lifetime of the backup. This is especially a common occurrence with the duplicated products where a blob may be referred to by multiple backups. To handle these situations, you'll need to extend the retention period of blobs. Using the put object retention API to reset an object's retention settings. Since this will create a new version of the object, you will now need to track the latest version ID. The previous version will still exist. Hopefully you'll now understand what immutable backups are and why you may need them. The APIs provided by S3 make it easy to implement simple backup schemes and make it possible to build more advanced schemes as well. Whether you're interested in building immutable backups yourself or would like to take something from off the shelf, we'd love to hear from you and understand how immutable backups can fit into your data processing strategy. With that, we'd love to take your questions. Thank you.


Team configuration allow a small group of users to work together sharing some aspects of the system as a group and then having some of their own individual settings. A team can be as small as two in the case of a close partnership or it can be as large as 15 team members or even more. You can configure your team many different ways to give each team member individual rights and individual access. For example, a team of two might be set up like this. Here they will share all of the contacts and both will have full access to all aspects of the system or you may work in an office where you are all on the same team. In this example you would all share and work on the same contacts. Or maybe you have an office where each team member has their own contacts and works their own deals. For those of you with a complex team structure, you can create a team with each team member having unique access to the system. Some having their own database while others share their database with other team members. Here's a quick overview of the team member levels. The account owner is the team leader and has full control of all aspects of the system and of the team. The account owner owns their entire database and pays for the monthly subscription. There is only one account owner on the team. The system administrator can do everything the account owner can except cancel the system subscription or change any of the subscription billing options. Administrators share the account owner's contacts and deals. There can be multiple administrators on a team. A team player has limited access to the system and shares contacts and deals with the team leader. The team player will not have a lot of flexibility to change system settings. Independent users also have limited access to the system, but this team member has their own contacts and deals. Finally, the power user manages their own contacts and deals and has their own advanced system templates. A power user can even manage other team members, where this mini team will all work the same contacts and deals. Contacts can be reassigned from one database sharing group to another. Team members can share their email and letter templates with the rest of the team. Tasks or to-dos can be assigned to different team members and the best part is that the account owner or team leader has full control to see what each team member is up to. You can start as a single user and build your team at any time. To start building your team, log into the system, go to settings, then account settings, then team settings. This is where you will add and configure each team member.