My name is Eddie Zaneski. I work for a company called ChainGuard, where we do software supply chain security for containers and all the cool Kubernetes stuff that's out there. But today we're going to talk about an awesome thing called OIDC. And of course, I had to come up with a fun title for this talk. So I can't sing it or else they will cease and desist the LF. So just sing the song in your head for a minute. So a quick bit about me. I'm a software engineer at ChainGuard. I mentioned that. You can find me on the internet at Eddie Zaneski. I live in Denver, Colorado, and I like to climb big mountains. I'm a maintainer for the Kubernetes and SigStore projects, so I work on Kube control and all things CLI, so you can at me. In SigStore, I work on a tool called GitSign, which we'll take a look at in a bit. And I am not a cryptographer or a security engineer, just throwing that out there, right? So take all of your advice as it will. And again, I need to do a disclaimer. I know nothing about this except that it's fun and cool, and I've spent a lot of time playing with it. But again, don't take advice from me in a production world. So the first thing we have to talk about is, I'm sure I've seen slides in almost every talk for this, is authentication versus authorization. A folks familiar with the difference here, we don't spend too long on it. Okay, we'll mention it. So authentication is generally who you are. Authorization is what you're allowed to do. Akta has some really good docs on this, if you want to check those out. And I have a link to the slides at the end. But it's that specification. So we usually call this authN and authC. And so rewind back to 2007. This is also from an Akta blog post. But this was how Yelp would check your contact list for if your friends were also signed into Yelp, right? This is before the days of OAuth, and you would check your little email service provider, give them your username and password, which they would just make requests directly and scrape a bunch of stuff, probably. We've come away since then. There's obviously a problem of doing it this way. And so that's what led us to something we like to call OAuth, right? And so you've all probably used OAuth before, right? I'm assuming everyone has. You've signed in with the service provider before. So here I am signing in with my Google account. And you can see the scopes and all the things that this app is requesting. So access to my calendar. All these things are just scopes in a docs file that this app pulled in and said, I would like these permissions on behalf of this user. Same thing here with Spotify and GitHub. Spotify is asking for permission to read my email and my play history in there. And GitHub can request all the orgs that I have access to, right? So basic stuff that we've all worked through. OAuth, to me, was scary for a long time, was one of those things that you touched as a kid in a hackathon and didn't really want to understand or have to deal with again. But it's really not that bad. But the real thing behind OAuth is that it's designed for authorization. It was not designed for authentication, which is what a lot of providers and a lot of websites have used it for. The idea is that there is some resource provider that has a resource, typically owned by another user. And OAuth allows you to access that resource on behalf of that user, right? So this user grants you permissions to do that. There's different flows as part of OAuth, and some of these I didn't actually know about till I started researching it. Authorization flows, the one that you're most familiar with. This is where you go through that consent form where you can get a code back. And that code either has like a refresh token that can be used to refresh and make long-lived requests. Client credentials are machine to machine identity. So this is where your OAuth application would authenticate just to the API and get a token it can use, so not accessing user's data. Device flow, so if you've ever had to type a code in from a thing on the command line which says open this thing and type this code in. Or if you've signed into Netflix or Hulu on your Google TV or something and it shows you the code that you can go to netflix.com slash activate and type in, that's actually the OAuth device flow behind the scenes. And then there's the implicit flow which is for client side applications. This is typically discouraged because it's all client side. This is where you don't have secrets that you can keep from the user. So the industry is trying to move away from this implicit flow. All these OAuths requests have these things called scopes. They are just arbitrary strings to the provider that they make up whatever the hell they want and they represent certain permissions. So the user read email is from Spotify. That's one of the scopes you can request. If you're using octa, you can octa.users.read as a scope.  So completely arbitrary things that the provider decides on. And if we look at this, these are the Google Docs. They have all of their scopes in a single doc which is really cool. So you can come in and find the service that you want. See the different scope permissions that you can get. You can access read-only, fitness data. So it's pretty cool that it's all in there. And then a OAuth URL, so that authorization flow that you've all probably used at some point. This is what one of those URLs looks like. So this is kind of the magic behind the scenes is your web server would construct this URL. You can see that there's the path in there OAuth 2 slash V2 auth client ID, which is kind of a username for your OAuth client. It sticks in a redirect URI. That's one of the other confusing things when you're a kid at a hackathon, you don't understand how it works. So that's kind of just where Google is going to redirect the request with your actual code that can be pulled out. And response type code, some other scopes in there, right? So if I click this link, you'll see that it will bring me to a very similar pop-up. I have to pick a Google account, and then I have to allow permission to use my Sheets app. Cool, right? And so if I click allow, this is going to 404, because it's redirecting me to a web server that's not actually listening. But in the URI here, there is a code that my web app would grab and trade for an actual token. So kind of the back end part of this secret state. Cool, makes sense. You can't talk about OAuth without talking about OAuth. And so if you ever go and create an OAuth app somewhere, this is creating one in Okta, you get that client ID, which is kind of your username and identifies your client. That's public. And then the client secret, which is locked and kept on the back end. That's what you would use along with that front-end browser code to trade for an actual access token. And you can see here, there's some of those callback URIs that you'd have to specify. So this would be your production web application callback. This is a documentation of what that flow looks like. Also from Okta, they have some really great docs. Glance over it pretty quickly. You hit that authorized endpoint, redirects you back. You get that consent, which is the pop-up I showed. You got that authorization code. Server will post that to token with your secret from the back end. You'll get that access token back and refresh token, so you can renew it once it expires. And then you can use that access token to make API requests on behalf of that user. So that's what you would save. Pretty straightforward. And so I have a quick demo of that. So I have a Spotify Webflow here. And any Go developers in the room? Yeah, quite a few. Go has some really great, unique OAuth libraries that are part of the standard library for the most part. I got secrets in here that I'm going to delete afterwards, so whatever. And so it's pretty simple. I hit that OAuth URL on my slash login. I hit that redirect. It's going to redirect you to a URL that's constructed from my provider. That's going to take me to the browser. Browsers, after I consent, is going to send me to this OAuth callback one. I grab the code out of the URL parameters. Do some error checking. Call this magic exchange method, which is what takes my secret and posts it for that token. Cool, cool. And then I'm hitting the slash me endpoint on Spotify, right? So very straightforward. So I'm just going to run this. So we'll hit local host. Log in. Right, there's that prompt. I'm going to agree and allow. And then we get my profile information. Cool. Very straightforward, right? So that's a regular OAuth flow. That's a regular OAuth application. So what is OIDC? That's the flow we went through. Just a quick diagram of it if you want to look later in the slides. Oh, one more thing. Git sign demo, right? So Git sign is a project from Sigstore, which is artifact signing. And so I have a Git repo here that I can commit. And it's going to use Git sign, which will sign my Git commit with Sigstore. And this is something you'll see in a lot of developer tools, where you'll do something. It'll pop out a URL, open your browser. What it's actually doing is running a local web server listening for that callback, which is really cool. So you use OAuth a ton. You might not realize it. So I'm going to authorize it at Google. It's going to, well, that's a new page. That's nice. And it's going to give it back to Git sign, sign that commit. Cool, right? GCloud does this, too, if you log in with the GCloud CLI. A lot of tools use this mechanism to get a code to a CLI tool from your browser. Very neat. And then, so there's issues with OAuth. It was, again, originally designed for authorization, not authentication, which is what a lot of people started using it for. I don't actually want to access resources on your behalf. I just want to know who you are and give you an easy way to log into my application. There are no standard scopes, as I showed before, right? Arbitrary strings. You don't know what one provider is going to do. Some have different crazy stuff in there. There was no standard who am I endpoint, right? That endpoint that I hit from Spotify was like slash api slash v1 slash me. There was no standard way for you to know who you had an API token for. And again, these are long-lived credentials, right? So the root of all evil, we all know this. We don't want to provision these things and have them sitting around, right? I already leaked my Spotify credentials by showing you that file. And so discovery is another mechanism in here. There is actually OAuth discovery, which I'll show you a bit later, but that matters a bit more with OIDC. Spotify has this endpoint that you can hit. It's a well-known OAuth authorization server, and this kind of tells you about their OAuth provider, which is neat. This isn't used as much, honestly, as it is in the OIDC world, but here you can know that's where you send a user to get a token. And there's a slash token endpoint somewhere here that tells you where you would post this to. So a bit of an afterthought. Cool. So enter OIDC. So OIDC stands for OpenID Connect. OpenID was another form of authentication that kind of got shut down by a lot of people. It was a way to have federated logins, but it kind of was replaced with OAuth and then brought back again through OIDC. It is an extension to OAuth, so it's a thin layer built on top of OAuth. It uses JSON web tokens. It has this concept of an ID token. So along with that access token you would get back, you would get back an ID token. And this is supposed to contain information about the user by itself as a standalone. It also introduced a standard user info endpoint. So everything that's OIDC compatible should have a user info endpoint that you can hit with that access token to get back that identity token and information about a user. It comes with a standard set of scopes. OpenID is the scope that you introduced. That's pretty much the only magic behind getting an OIDC token from an OAuth provider usually is you have to stick in the OpenID scope, the profile scope. And I mentioned discovery before. So OIDC has well-known discovery. Which I'll show in a second. Quick breakdown of JSON web tokens you may have seen before, usually called Jots. There's three big sections in it. It has a header. The header contains the algorithm, the key ID, what it was signed with, all that jazz. It has a section called payloads or claims. This is actually what is assigned. So this holds the information about the token, who it's for, who created it, how long it lasts for. And then there's that signature, which you can see together and kind of sign with an RSA signature. The claims section. There's some pretty standard claims that we use everywhere. Subject or sub, this is the client ID that you would usually use for OAuth. So this identifies who this token is for, who owns this token. The audience field, this is who the token is intended for, so that OAuth server. So who should accept this token? The issuer. This is who minted this token, so accounts.google.com, accounts.spotify.com. Issue that timestamp. Expire this timestamp. And then this jsonwebtoken.io site is pretty great. So you can come in here and paste the token in and see the breakdown of what it looks like to code it. So you can see the algorithm that this is signed with, the type of token, the subject, arbitrary field called name, and then when this was issued. And then you can verify the signature. So, cool. That's the jsonwebtoken. There's also step CLI, which is rad. If you want to do this on the command line, you can use a step CLI, the folks over at step. Crypto, jsonwebtoken, and inspect, insecure, because we're not going to verify the signature, and it will print out the same thing. So those are tools that we're going to use. And then I have an octa demo to show what this looks like. So I stood up a development environment for octa, very straightforward stuff. So this is a full proper two-spec OIDC flow, right? So this shows the OAuth endpoint URL. It's got my client ID in there, response type, blah, blah, blah, callback. And then the scopes. It shows profile, open ID, and email. Start up a server. Same thing as before. Callback at that code. Trade it out. More credentials to leak. Grab the access token. Grab the ID token, right? So you get both back when you have these in your scopes. And then I'm making a request to that standard user info endpoint. So let's run that. And we're going to go localhost login. It's got a semi to octa. This is just a development instance. So there's nothing actually in here. Don't actually leak this one. This is important. There we go. Sign in. Callback. Cool. So here we have the access token that came back. So we can take a look at that. Octa actually uses a JSON Web token as their access token. There's nothing wrong with doing that. It's just using that as a mechanism instead of sending you some arbitrary API key. So we can pop that in here. See the key ID that it was signed with. The algorithm. Information about me. Here's the issuer. The scopes that are on it. The subject. That's my email. Cool. And then we can look at the actual ID token that came back. Which we'll have a bit more. I sat down and compared the two. Again, octa is a special case where they used the JSON Web token for both. But this has a bit more information about me as a person. So it has my preferred user name. I was trying to get like my city to identify me as a user. Same kind of stuff. There's the audience. That's my user ID in octa. The subject. So, cool. And then below was that user info endpoint. So pretty much the same stuff that's in there. Just turned into a JSON Web token. See this one has more info like my time zone stuff. So, oh IDC. I mentioned this concept of discovery. This is where it's really cool and how it's pretty compatible for anybody. This is where you can go check out the open ID configuration for any sort of provider. It's just public information. I like showing Googles. So Google shows their issuer. Authorization endpoint. Same thing with the OAuth I showed before. But it's really cool. So I'm going to go ahead and I'm going to go ahead and I'm going to go ahead and change my idea I'll use a bit more but it's used a lot more in OIDC so if you go to attach this to a service or provider and say trust my identity provider it's going to grab this and take a finger print of it and save and register if anything changes. A couple other bits. There's a token endpoint. The claims that it supports. Some providers don't do this and some don't respect the claims in the first types that your hands out, JSON web baritoken, right, all that stuff. Where's the field I'm actually looking for? Ah, here you go. The JSON web keyset ID, right? So that's the next field that's in here. So the JWKS, this is what the, basically the public key ring of that provider. So it has to tell inside of that well-known configuration point where the consumer should go to get their keys, and that's how it does it. So Google's is actually at this URL, same kind of deal. This is, again, a JSON web keyset as a key type, key ID. These are the parameters to generating that key, right? The exponent, all that jazz. These rotate, there's a whole bunch of magic and procedure behind how this rotates. You're supposed to keep the old one around for a little bit, so I think that there's two, yeah, there's two in here. So here's the one that they're probably using right now to sign, and then here's the one that's being deprecated and phased out. All this is tied under an umbrella called Josie or Jose. JSON object signing and encryption, so if you want to know more about how this works, check out those RFCs and specs. I actually had to implement a few of them from scratch in Python, it was miserable. But that's where all this is umbrella under. And so why do we care about OIDC? And so this is the point of the talk, is this concept of federation. Are folks familiar with federation? Yeah, maybe a little bit. So federation is just kind of like a magic trust relationship between an issuer and a resource provider, right? Google provides a service called Workload Identity Federation, that's rad. But what it really is, is just like a trusted person sitting in a cardboard box that takes a token from this one and hands it out this side. There's no like actual, you know, spec or RFC behind any of this works. It could be solved by a person in a box. There's no long-lived credentials with federation, which is great. And so this would be, I'll show you a demo in a second, where your CICD provider injects a unique OIDC token into every pipeline run. That can be traded out for a GCP credential, an AWS credential. So you no longer have to provision those long-lived identities, store them as environment secrets inside of your CI provider, and have to worry about them leaking or anything. There's no certs. It's just trust. Usually the provider, what will happen is it will take that OIDC token, hand it to the trusted source, so go to Google Cloud, and usually assume a roller identity. So this is tied to an actual service account. It's super auditable. So all of this is auditable. You can track who assumed that identity, where it came from. In the case of GitHub, when they issue tokens, you know the pipeline ID that ran. You know the repo, the time. What caused that pipeline to start? Where can you do this, and where will you find these? So I mentioned CI CD, GitHub GitLab, CircleCI, I think Semaphore, a bunch of different providers. So this is becoming way more prominent now. Injecting this token into every run, which is cool. There's a Jenkins plugin, if you're using Jenkins to get OIDC tokens issued. Cloud resources will accept this. I mentioned that. GCP, AWS, Azure, they all do some sort of workload identity federation. Google got lucky and claimed the service name that makes a ton of sense. But calling a workload identity federation is like a good umbrella name there. Kubernetes clusters do this. So I have a Kubernetes demo somewhere. I showed you SigStore signing. With SigStore signing, I showed doing it manually, and I had to go through the OAuth flow. But if you're doing, say, a GitHub action to release a binary and you want to sign a binary as part of an action pipeline, you can take that OIDC token, trade that for a SigStore signing certificate without any pop-up or OAuth flow, and it gets tied back to that actual workload. So you know the provenance of where that artifact was built, and all that's signed in a testable. So this is a GitHub action token. This is injected. If you set a, I think it's like token write true or something in your permissions for your GitHub manifest. Same kind of deal. You can see the subject here. That's going to identify the repo, the environment. Actions has a concept of different environments that you can use for different secrets. Audience, who this is, the repo is for, the ref of that thing. So very unique stuff to a CI provider, but they can all get put in there. Actor ID, bunch of other stuff. So very cool. The issuer is issuer or tokens.actions.githubusercontin.com. So your cloud would trust this. So I have a GitHub demo. Find it. Does anyone know how long I have? Let's see. I have no person or timer. Thank you. Perfect timing, actually. So I can come into my GitHub here for this project, show you what this manifest looks like. So this is a manual dispatch. There's that permission. So this is how you get the token injected. I just have that job, blah, blah, blah, runs on. So this is going to check out the repo. It's going to set up that Google off. So that's actually the magic thing that happens here. So I have a trust relationship set up in GCP that it's trusting this particular pipeline and this action. So it has the mapping there. And so this action will set up and trade out for a token, which I have a manual workflow for, too. And then it has the service account that it's assuming inside of GCP. And then it's going to run that G Cloud CLI and just kind of list out who I am. So let's kick that off. Run workflow. Let's see. It's going to start. So you can imagine this being you tagged a release or you cut a release at a certain commit and now you want it to build binary, sign them, and ship them. Setting up G Cloud, this is the longest step. It's got to download the binary. It's already set up the credentials. You can see it created credentials file at this path. So it already has the token exchanged. It's going to run that who am I? There we go. So you can see that it is actually assumed that service account. So that works. Cool. So that's inside of your CI provider. Kubernetes demo real quick. So if I do something like K get raw, QPCTL get raw, slash dot well known, open ID configuration. So every Kubernetes cluster that's in a managed service will have an OIDC provider that's usually backed by their IM. So GCP will tie this to service accounts inside of IM there. Same thing with EKS. You can do this in your own clusters too. You can provide your own OIDC provider or Kubernetes will run one on your behalf and tie it. But you can see here is the issuer for my cluster. It's tied to a specific project in a certain region and the cluster name. There's where you could find the key store for my cluster. Let's see. Is it public? That's a private IP. What's supported, right? So every Kubernetes cluster has this, which is really cool. So if you have your workload run in Tecton actually does this. Does anyone use Tecton for CI CD? Tecton is a open source project for CI CD that's Kubernetes native. And it will use this provider to do all of your federating and signing and testing. So it's really cool. So that's with Kubernetes. So I've been calling this OIDC Wave 2. Everything I just showed you, that GitHub action pipeline, my Kubernetes cluster. None of those are actually attached to OAuth at all. And I'm sure there's someone out there who will have a better explanation or definition of what this is. But for my naive self, this is an extension beyond what OIDC was intended for. This machine-to-machine authentication. GitHub actions was really the first provider to do this, where they are injecting these tokens into those runs. There is no OAuth involved at all with how they mint those tokens. It is a machine identity, right? This is where we're all moving towards. I don't think we'll have time to talk about Spiffy Inspire, but the idea of having your trust relationship between a identity provider and a resource consumer or a producer is just that implicit trust. So there's no long-lived credentials on either side. So it's just interesting to see how this has evolved beyond the need for having OAuth attached to it. And at the end of the day, who do you want signing your releases? Do you want your releases signed to a eddie at chainguard.dev that may have been signed like three years ago, but I haven't worked there for two years. So is that still a valid release or signature? When I leave, do you have to rotate out who's signing it? So having it signed by a service account, a system identity, is a much better approach, right? You can have it signed by release at kubernetes.io. With all things, you need to trust but verify. The fun thing is that anyone can actually mint a valid OIDC token. There's nothing that really says otherwise. The claims actually matter that are inside there. You can put whatever you want in that audience and subject field. Issue subject audience are really important ones that you want to make sure are verifiable. What happens if there was a service who were to issue tokens with whatever? I went and built one for fun. I called it just trust me.dev. And so this is a service that you should not use for anything real, but it's fun. And so it will just mint tokens with whatever you pass in as the URL parameters. So here we have a token that, let me toss this debug parameter in the URL. Right, so I have issued a token that is, the audience is sts.amazonaws.com. Cool. Well, let's see. What if we change the issuer? So let's say this was issued by accounts.google.com. Cool. Still a valid token. Well, what if I also have the subject in here of something like admin at cncf.io? Right. So if I hand this, this is a valid token, you can totally verify the signature.  What's to stop them from actually knowing this is forged? Well, thankfully, smart people have figured out how to prevent this. Though there are definitely services out there that are not checking the fields and they're just getting a valid token with the issuer and they're definitely not verifying that it's who it's for or where it's coming from. And so I had a quick AWS demo where I can do AWS simple token service, a zoom role with web identity. I have a, a, a role in here, session name, duration, cool. And then I just have to pop in this web identity. So let's say, go back, token, we give it the subject of demo, grab this, I think that's all I need for it to work. No, see, it knows. So it's missing a required claim audience. So let's toss in an audience in there. Incorrect audience token. Yep. audience is supposed to be demo, what did I put? Oh, Eddie. demo, there we go. Try it again. Right. So I have a trust relationship set up. It's just going to trust whatever I said. In this case, this, this is what it's supposed to happen. But the, the way that the cloud provider gets around this is you actually have to specify outside of the token who your audience is for, right? So it's just another step here. The protection it gets. So verify token and claims. You want to make sure you're actually matching that issuer to the issuer's key, right? So the key shouldn't match if you do it in correct way. You want to pass the audience alongside the token. So Google Cloud does it cool too. They have the docs right here. The token Amazon's the same way. So you have the token here that you would pass. But you also specify the audience as well. So the audience and the request should match what's in the token. And that's how you can ensure that it's for the correct project. Dex is a front end for other apps. I don't think I have much time to talk about it. But if you go through that Sigstore OAuth flow and where I showed signing that git commit, that's actually Dex that's running behind the scenes. So Dex can federate those different identity providers to a different application so it can handle all the attaching and plugging in. Spiffy spires for machine identities. I'm not going to try to explain that because I'm running out of time. The one last thing I wanted to show was how this workload federation works behind the scenes. So this is grabbing an OIDC token. This is a valid one for my service. So GCP is set up to trust me. And so if we look at what that token looks like real quick. So you can see that the audience is my GCP identity pool that I set up, issuer and the subject. Google actually takes that and it gets traded for a federated access token. This is kind of like a secret proprietary. This basically marshals into a protobuf. And so your service gets back this identity token after it talks to Google. You have to take that then and you have to take hit another end point that says, Hey, I have a federated identity token. Can I please have an access token on behalf of this user? So Google will go and mint that. And that's actually the token that you can use to hit that who am I endpoint. So that's what this is showing. So with that, I am most likely out of time. If you want the slides, you can take a picture of that. That's the QR code for the slides. And I'd be happy to answer any questions up here. So thanks for listening to me ramble about OIDC.


Hello everybody and you're very welcome to our first of our parallel sessions and today I'd like to introduce Mark Brown from Dublin City University who will be introducing his first session and we've got 20 minutes so Mark would you like to take it away. Well, thank you very much. Hello everyone. Nice to get things underway after the introduction this morning. This is a joint paper with Maread and Ayman but for simplicity reasons I'll present on their behalf. You can see that I've customised my badge and those of you who want to figure out what ARCO means, A-K-O, then I suggest you do a Google search but it has a little bit of a link to the Māori language in New Zealand, my country of birth. We have an interesting title and it's borrowed from Dr Seuss. Of course Dr Seuss is a little controversial at the moment so we were very pleased to note that the book that we've borrowed this title as a metaphor is not one of the ones that was identified as containing racist images but it might be something we have to be mindful of in the future and also tells us that we have to also be very careful about the kind of metaphors we choose and the language we choose because what today might be seen acceptable in times in the future may well not. The particular book and the metaphor we've borrowed here is about how reading, how knowledge if you like opens the world and takes you places. In this context though we're really referring to sort of open scholarship and we want to share with you a study we've been doing for the last five years but just to put a little bit more context on the title the particular page from the text that is our inspiration is I'll read it to you. I can read in red, I can read in blue, I can read in pickle colour too and then the next page says you'll learn about Jake the pillow snake and all about Fufu the snoo. So what we want to do is try to demystify a little bit about Fufu the snoo and the time available. I don't have the chat box in front of me now so we'll pick many feedback up at the end but I have a little task, second task, you've already done hopefully done a Google search on Akko what's your number one go to source for professional reading to keep you up to date. Share that resource with each other in the chat box as I keep talking here. What I want to begin with is by establishing that open access publications in the field shall we say of educational technology I'll use that as a catchall for e-learning open education technology enhanced learning and so forth has a well I guess you could say we're just drowning in the number of open access publications. This particular journal article which analyzed them identified 270 it's a few years old now and just last week I added two more new journals to this list that we keep on our website if you haven't come across previously of course there's lots of different websites with these listings what we don't do on this website is try to identify the ones we think might be more useful for particularly doctoral students. So we're drowning in openness in many respects and all of us need to develop filtering strategies because there's just no possible way you could read all that literature let alone even just glance through the index or contents pages of the journals but at the same time it's essential that we do have a scholarly culture of academic reading and that's part of how we build community and share knowledge and disseminate new information new ideas and insights so that reason way back in 2016 the team we have in the National Institute here in Dublin at DCU just paused for a minute because I should have put in the embedded sponsorship piece there but I'll keep going since I've now done it anyway in 2016 we launched an activity where we said to ourselves so what would be the top 10 journal articles that we've read open access articles for the year. Truthfully at the time I was a little concerned that we didn't have enough reading going on amongst our team we were experimenting with having reading groups and having a hot topic monthly sort of talk but I'm not sure that people were aware of actually the literature they should be reading so we went through this exercise identified 10 articles posted them on our blog with a little bit explanation and then the following year we wanted to continue this but it raised a number of questions about the criteria the methodology who we actually involved and we've written about this on our blogs that the criteria are published and we've continued to do this in quite an inclusive way amongst our team with an internal strategy of trying to get more people engaged in the literature and an external strategy of hopefully making a contribution to the community by the hundreds of articles that we go through to identify what we call our top 10 we're not going to say that these are the 10 best articles they're the 10 that we've selected that we think are in inverted commas good reads I don't know if you've seen last year's we published it in early January if not I invite you to take a look and I'm just going to quickly go over a few of the publications from what we identified last year actually what we did was we had two lists of top 10 because there were so many articles coming out focused on COVID-19 or the COVID pandemic that we didn't want to skew our regular top 10 list from those publications of course even in the first three months of this year there'd be many more publications so we had two dedicated lists on the website what we've done on our blog we've created why we've chosen them but just from quick facts and because we've done this for five years we have a nice set of aggregated data that we'll be working with in a future publication forthcoming but in this year's list of top 10 good reads there are 28 authors more women than men that's been a trend actually originally there were more men than women of course you have to take these things with a green assault given the small sample albeit that we looked at a larger population of articles so of around about 250 that went into the selection of the top 10 a little US centered this year only three from Europe only two single authored publications and that's been a very common trend that most of the articles we select are jointly authored this is the very first year that the Australasian Journal of Educational Technology and not due to my down under roots but it's the first year it hasn't taken the number one place so for four years running it had the top journal that we rated and this year there were four new journals fresh to the list although our methodology and criteria does place a focus on finding fresh and new content so here's what we chose as our number one article for those of you who have more of a research focus or for those with a practitioner focus we chose this you can see the little bit of the creation that comes from our blog because of the call for research that actually matters that research actually has a practical application rather than just theoretical research and I think that resonates with many people that the practice focus still our number two and three articles similarly coming out of US based journals a review of 10 years of research through co-citation in part we selected that article with a very innovative methodology in its literature review current trends and missing links our criteria is always looking for things that are missing things that you might not come across because we see that as our contribution two more just to share with you very briefly the first one now number four was very interesting because again in many respects we selected this because it taught us a lesson it looked in an innovative way at low or unsighted publications we tend when we do literature reviews to look for the highly sighted publications this look for the things that hadn't come out of the shadows so very interesting analysis and again in the spirit of saying let's find where the new and fresh ideas are perhaps the last comment before I move on is in this slide we wanted to emphasize again consistent with looking for fresh ideas here's a UK based journal and a new journal contrasted with our number eight which is the international journal for educational technology and higher education if you're not familiar with that journal that is now the number one ranked open access journal in the field based on Scopus rankings it's actually now the number 27 journal ranked in all education publications I'm quite proud that we sponsored the journal and co-edit that journal but the reason I've got it there only one publication showed up from that journal compared to the other ones that we've shown you so we were not privileged if you like with the mainstream a takeaway message just on the time with about five minutes to go so I think I'm alright on time is that despite our strong focus here on open access publications and those publications as widely as we can it is a commentary that much of the literature that we might want to be reading is still restricted or behind close firewalls subscription models that many developing countries would perhaps not have access to and this is just one example and then another aspect to it is despite what I said about the journal that we support most of these open access journals are not rated from a Scopus point of view and an academic promotion point of view so there's a real tension here between the open and the restricted apart from the fact another takeaway message is we're seeing a blurring of the boundaries some clever scholars are beginning to make available their pre-publication journal articles as open access before they go behind the firewall so I think there's a lesson there for you because ultimately why do all this work if no one reads it and the truth is that many of these restricted publications actually get very little readership very briefly to kind of come towards the end probably talk too fast I just wanted to share some of the COVID articles that we selected we didn't put these into a rank order for 1 to 10 and I can tell you that rank order causes us no end of angst amongst our team and debate but that's actually also the good part of why we have this exercise we just didn't think it would be appropriate to rank them but to share you our top article and you might want to I invite you to read the reason why we ranked this number one partly because it came out on the 27th of March very early in the pandemic and gave very good advice from a learning design perspective on how we move perhaps beyond emergency remote teaching to online learning many of you are familiar with this publication it's been widely cited at the same time tongue and cheek in the curation in our blog for this what I'm cited as saying is I just wonder if we flipped things around I'm a little bit weary of all these top 10 checklists actually there are dozens of them we have a website that lists them all these top 10 checklists if all of a sudden we were at the norm teaching online and we had to move in a crisis to suddenly have it teach face to face I wonder how comfortable we would be with turning face to face teaching into a handy checklist of 10 items given how challenging and idiosyncratic and so forth it is so the message for me there in a critical sense is good teaching can't be reduced to a handy checklist of hints it's a socio cognitive process a couple of the articles we selected one you might be familiar with it was done quite early and it's a case study I think about 30 different country case studies there's a small piece on Ireland that I contributed to there and on the other side of it we wanted to single out what we considered to be one of the most interesting and thought provoking provocative journals post-digital science and education which I hope you're following because there's some excellent publications coming through in that relatively new journal returning with a couple of minutes to spare to the metaphor of foo foo the snoo this exercises I've indicated to you we've done for five years we've done it initially because we wanted to get some conversations internally in our team but over the five years we've had a lot of feedback on our top 10s it's actually the single most popular blog based on analytics every single year but my question for you is to post a link to what was your top read from 2020 it's a pretty difficult question to answer it's actually often a question I ask when I'm interviewing candidates for a job what is it that you used to filter your analysis your reading of the literature is it the name of the journal is it the author of the publication in my case I frequently all scan through the references to just see if there's anything I haven't seen but the trap is that if you stick with what you know in terms of the mainstream publications including Alts Journal then maybe you'll miss a real gem that's published somewhere of course this whole exercise is biased towards English speaking publications which is something we acknowledge and then what tip would you provide particularly for new and emerging scholars, scholar practitioners PhD students to help them engage with the literature without getting drowned and that's I guess an ongoing conversation in many respects but it's certainly one that we want to support our colleagues and then in a wider sense our community so wrapping up on the places you'll go well we really want people to be reading more to be writing more of course telling their stories and I shouldn't ignore the fact that there's a lot of grey literature in addition to the journals that I've shared here as open access publications and perhaps that's what you've identified as your very best reading source so hopefully that's of interest and if you haven't seen the blog I'll post a link in the chat box now I can get back into the platform environment thank you thank you very much Mark loads to think about there I love this resource it's really really useful and I think I'll just let Mark catch up on the chat there if you can see it in the text window so we've got a couple of questions coming in already I think the first one was from Teresa was that around does looking for new ideas include those published in languages other than English and I think you've answered that but do you want to take that Mark yes indeed and I mentioned that and we acknowledged that as a bias our criteria which I didn't take time to show you the criteria what we tried to do is one of the criterion is around inclusivity and so we're looking for publications from developing world from journals that we may not or in the service that we're trying to offer here journals that you may not have come across previously so particularly one of the journals we chose in this year people probably may not see it as a top read but it had Terry Anderson everyone knows Terry Anderson but it had a doctoral student from Spain and it was published in a Spanish publication albeit in an English open access Spanish publication so that was one of the reasons we chose that publication great thanks I've got a question from Tom Farrelly as well are they listed on the DOAJ even if not on scopus well of course what we have to do is be careful we don't play the academic game here now I say that because those of you are in academic roles there are constraints that you face these are the sort of barriers that we need to push through the actually I think these are the things we need to challenge our sacred gals post camp COVID because the irony is someone like in my own role about being too egotistical about this at a professor level you tend to be allowed to play by different roles but I have colleagues and staff who are working their way through academic promotion where scopus rank publications seem to matter I couldn't give a damn in many respects about scopus rank publications I'm more interested in the impact and that doesn't mean the impact score that's about who reads it how they use the reading so there are lots of different metrics we can use I guess if you are caught in that bind between restricted publication and promotion guidelines you have to have a foot in both caps you can't ignore some of the traditional metrics great thanks yeah lots there around promotions around learning and teaching and how we measure impact my question mark would be around what do you have any then any reading groups is there any ways that you bring together your staff to kind of discuss and debate some of the reading that you're going to be implementing them towards yeah it's a a good question we've experimented over the years with a number of things just two weeks ago I think it would be I've probably got some colleagues here keeping me honest we reintroduced a reading group more focused on sort of mainstream teaching enhancement it's one of those paradoxes the time that it takes to do that and get people to read the article and engage with it when we are all busy but we all agreed when we did this two weeks ago wow that was great we saw so many different things in the article compared to if we just read it ourselves but the truth is we don't do enough of that and I would still be concerned my colleagues know that I'm an avid reader I'm constantly sharing publications with my team but at the same time I'm very conscious that actually can be very overwhelming for them and maybe less is more here and I would be very happy if everyone on our team read the top 10 and the top 10 COVID and I couldn't put my hand in my heart and say that everyone's done that to be truthful yeah absolutely and I think that I really like to get your point towards the end there but the problem with top 10 lists and I think there's a danger in when we're introducing colleagues who may not be familiar with this literature or indeed educational literature in general nevermind education technology stuff that they don't kind of accessing it through the top 10 lists and not actually understanding there's a wealth and a history of literature behind the practices and the research that have been going on so I think that's that this is a really good way to introduce people to the richness that is there we're just at 20 minutes past so I'm afraid I'm going to have to wrap that up sharp and sharp thank you very much Mark for keeping it to time we can move over to discord if anybody's got any further questions from Mark but other than just that thank you very much everybody thank you to all the people in the chat and we'll sign off from this session thank you


It's Diddy Canem back today with another spark video. She just tells everybody to subscribe, make sure you subscribe, but give me a thumbs up and do not skip those ads. It is June 10th and it's time for us to get to this bag. In this video, guess what? We got our goal in five and a half hours. We left that mother shower just like this rain. We did our thing. If you want to buy some of the merch, read it from the brand. The best brand on the planet, if you ask me. All you have to do is to email me at grosshouseviewsfdvo.com and let me know what you're trying to do. Are you ready to get busy, baby? Oh, give me one more thing. If you just now tuned in to this video, just so you know, I move fast, talk fast and get cash. Let's have a blast to the end of time. Let's go. Morning. I got you. How you doing? Good, and yourself? I'm living a dream. I can't complain. So I have Richard, which would be number two. I don't know which one it is to be. 21 items. This one's good. This one? Yeah, this one. This one is it. All right, I'll do it. And then I can just put the thing for Richard. Thank you very much. How you doing, sir? Get busy, baby. You can hear it jump up all the way. It's up to the maximum. And we're going to do it. Just in case you want to come over here and get busy. So this is where I put it in there, bam, bam. Then we got that box. And we own to the next room. All of them to the next room. Put the box right here. So we got enough room. I don't know if I'm going to spend it right there. Step back, it'll throw your noodles. Order 8.5 miles for $33.74. It's time for us to get this dough. Let's go. Order number three. It's time to get this cheese. Walmart shop to deliver two items, 5.4 miles for $27. We are holla. We pop in our car. And it's the plan stand. We actually going to do order number three before we do order number two. So we're going to go here. Shop and deliver to get these two items. Then we're going to drop those off. And it's going to get us closer to where we got to pick up the other Walmart order anyway. It's time for us to get this cake. Let's go. Sit, shop and deliver, baby. No smoker. I'll be pouring this down. Oh, that's from Taco. Hello. Here you go. Thank you. I really appreciate it. You have a good one. Yes, we got an extra three ski, baby. So for that order, we got $30. That was an easy order. Let's go get this other order and get an order, baby. Let's go. Throw up this order to get an order. Shop this down, no. So the rear one is on this side, right? So they say on the left side. So I'm guessing this would be it. All right. I appreciate you, boss. That's why they won't follow me. They ain't got time to be playing games. This cereal, baby. Like it's hot. Like it's hot. Bop, bop. Look at the photo. You already know, though. So, man, let's get it. Drop off order number two, what it do. Somebody has to come back and take a tour. I might have to do all this for one trip, baby. Put it on the arms. Mm, that tissue can be it. And grab this. Put this under this arm. Whimp. My fault, guys. I hit the camera with this tissue. I'm just going to come back, baby. I ain't got time to be playing games. I'm trying to do my thing. I got a piece of bag, guys. I've been holding it since we picked up this order. But we're in a rush because we were running behind because we did that order number three before order number two. So. Hello. Hello. How you doing? Right here. This is the last thing. You're welcome. You have a great one. Order number four. We going back to the store. It's order to get an order, baby. Let's see if we can shake. Let's see if I can be one trip wrong right now. This joint got no weight to it. Bop. Oh, I don't know, guys. It's looking ugly for me. Looking ugly. Because I got this. I'm going to be two trip wrong. I'm going to get these two in this hand.  Yeah, I'm taking this, baby. I ain't got tunnel playing no games but a door thing. I ain't trying to drop nobody's stuff, baby. Tough. Let's act a little rough. Act a little tough. And get it done and get on the run, baby. Drop that right there. I'm going to drive over there. Waiting with the ice tea. Don't give me doggies. Just in case they want to come on and get busy. Because we're about to move kind of shifty, baby. I didn't get that much stuff. It's a decent amount. It's just the reason why I had to take two trips because some of those items were bigger. They were bigger items. So I come grab them in my hand to get these bins, you understand? They put all this stuff in one bag. Come on, baby. Y'all got to be shmorting. You got to be shmorting. Yeah, baby. You got some pieces, too. I don't know if I've ever had red robin pieces before. Comment below and let me know if you have any. Comment below and let me know what you think about it. You got to go back. Get these last few things so we can get this green. You know what I'm talking about? Nothing in between. You got some chips. I don't know how this box is not open, but it's open.  Remember when we used to be sneaking stuff? I used to be sneaking. Sneak something real quick. Sneak something. Open it a little bit. We used to get them groceries. We used to want to eat one of everything. My mom used to get the grocery. Get that link card drop. We need it all. We're trying to get something of everything. Let's go. Order number five. We're back for the prize. 1 by 2 or 3.6 miles for 1788. It's time for us to get this cake. Let's go. I'm doing great. I can't complain. You want the lyrics back here? I think that's wrong. I think that's not mine. Vanity In Clarissa, maybe they put Oh, this is Clarissa, but maybe they You don't got these numbers right here? Oh That's 33 Where would it be at on here? It would be at the corner of Ramari. Yeah, that's the one. This one? It's just in their different names. Oh yeah, sure. Yeah, I'm putting this one in the car. Put it in the trunk. You been up there chilling? I'm always back here. But like, you know, sometimes I'll be putting these in the order. Oh, okay. So you get the order together. See, we've been having some shopping deliveries in the other areas now. So you pretty much shop the order and put everything in the basket. Oh, they do that now? Yeah. It was just here first. But then they started doing it like in Round Lake, Waukegan and the Eniak Walmart to Anzion. That's no more. I don't know because they be moving me around now. So before, they only had Spark and this Walmart. Now they got it all by all of them. So when the orders come in, yeah, when the orders come in, they just come in when they come in. And they just send you to different Walmart. You already got one. Appreciate you, Waukegan. Yes, sir. Hopefully y'all still here when I get back. Hopefully I come back. Yeah, this is where I started it. You know I can't forget about the bottom. Yes, sir, you be smooth. This order to get in order, baby. The door is literally right here. So we can take a future of that off the roof. It's on tomorrow. Right there, baby. Man, doorbell.  Oh, our pregnancy. The only reason why a lot of this stuff can fit in the bag is because most of it was like boxes and stuff. How are you doing, boss? I'm all right. Yes, sir. These noodles. And this whole bag for it. For the two of these. Yes, sir. This bag, we're just here to know. I got one more trip for you. We're going to be going. We're going. All right, you have a good one. Yeah, baby, we here to drop off order number two. My flow is thick like the float. I'm an animal. I need to be in the zoo. Drop it like it's hot. Get the doorbell.  Step back. Let's go. This one is not going to make us rich. 4.3 miles for 1229. We're getting to this money and we ain't dropping a dime. Let's go. Here, baby, drop off this order to get an order. Put everything in this green bin so they can get in. You have the green bin ready for us, baby. I got to put this right here. Oh, this one needs some milk. Put the noodles in there. And then have a few bags. What else to put this? What's right here? Step back. I'm going to take him to the thing. He's right at the door. Let's take him this, y'all. Get him close to the door. Dang it. I'm tweaking. Let me slow it down. How are you doing, sir? You can just leave it there. All right, you have a good one. Order number seven. Thank God for his blessings. We have two orders. 15 items, 10.3 miles for 33. 53. It's time for us to get this cheese. Let's go. Let's get it timely. Let's go. It's office max order to get an order, baby. They say go in here and go up the stairs and then turn the glass. It's a lot of instructions on this joint. I'm guessing it's there right here. There's a place between here and there. These three. Come on. 14. That's 14. Let's see what this is. It's 12. Oh, we gotta go one more. I'm going to go to get this dough. You know what I'm talking about? Order number two.  This joint, I don't know, a little hefty. A little hefty. Oh, we got it, baby. It's got that protein. This one says handed customers. That's exactly what we're going to do right now. It's right here. I'm getting the heavy stuff first. Hello. Here you go. You're welcome. You're welcome. You have a good one. It's an order to get an order. This is going to a business. We're about to get busy. Make sure I put the thing all the way on there. Put the water on that joint. Then we got some paper. Paper. Paper. Let's get this on the arm. Roll, roll, roll. Gently down the street. Get this cashew hyperblast. Like a butter dream. I'm making up something. I got to try to get it all straight. Let me see if I can get that joint. That's it, baby. I'm going to get it to the dough. It's kind of weird. Wait, wait, wait. Let's go. Y'all don't know how weird I'm walking right now. How you doing, sir? I'm trying to do it all in one trip. I saw that. I looked out the window and saw you struggle a little bit. I thought you could come out here. I did it.  Which way am I going, sir? You can just drop it off. Yeah, right over there. I'll take care of the rest. You just turned the rain out of nowhere. It's going good now. Back to the rain. I think it's supposed to rain the rest of the day, too. Thank you very much. I just need a signature. Here you go. Thank you. You guys have a great day. You're welcome. Guess what? I'll see you guys on the next one.  The money is to stay out there all day. So we got that cake and we go to the next one. I'll see you guys on the next one. Be going, be going, be throwing. You already know I'm the DDK and I'm on my way.


The government won't get more desperate and try to ban Bitcoin completely for example 10 years jail for trading Bitcoin I Know plenty of governments that are going to do exactly that started with China followed by India Ecuador has already passed a ban like that and guess what many of the people in that country don't give a shit because In places where the rule of law is weak bans like that happen easily and are impossible to enforce Guess what you bribe the police officer in when they come to your house to arrest you for having and trading Bitcoin You bribe them in Bitcoin because that's how you know they're reliably corrupt in Soviet Russia When a police officer asked for a bribe they would always ask for US dollars for the bribe Why because that was a signal that said I am so corrupt I will accept my bribe in the currency that's banned and And of course so will the politicians and the military in fact in those economies Bitcoin will become the blood of corruption Not because they didn't ban it but precisely because they did ban it so they stopped the class from having it So by definition the only people who could have it are Criminals who are already breaking laws that will put them in jail for 10 years. So they'll break one more What's the difference? How do you suggest to get out of the go? Okay? Let me let me also go back and say you don't need to undelete that But let me also go back and say in countries where it's not so easy To ban because the rule of law is strong if you just say let's ban Bitcoin That becomes a very interesting political and judicial question because Bitcoin is a form of speech It's a form of money in the US Supreme Court They've said repeatedly that money is a form of political speech and therefore you cannot control its use in political campaigns It's actually why we're in this terrible mess because political campaigns are not regulated in any way in the United States So which government is going to have the guts to take that question to the Supreme Court because that's exactly where it's going and Not know the outcome because if the outcome is we have money money is political speech Bitcoin is money Bitcoin is political speech. Sorry. You can't regulate it. They're fucked They have a constitutional requirement that tells them they can't regulate it's not even a bit That's gonna be an amazing decision now that may not happen We might see much more totalitarian control in places like the United States.  I don't know you never know what happens Germany what's what's to create its own blockchain? Ah very good Government created blockchains or as they're called central bank digital currencies are going to come I was actually expecting governments to create digital currencies before corporations But Facebook is smarter than governments apparently so They're going to do it And you have to ask the same questions that you have to ask about all of these things You probably know where I'm going with this. How many of you gonna recite them with me? Is it open? Is it public? Is it neutral? Is it transparent? Is it auditable? Is it immutable? Is it censorship resistant? Is it borderless? Is it? Bitcoin is To one or greater degree on all of these categories Bitcoin is all of those things and that's what makes it magical So when Germany makes its own blockchain, will it be open? No, will it be publicly auditable? Maybe will it be borderless?  Will it be censorship resistant? Absolutely not. Will it be immutable? No Let's be neutral. Of course not. It's a political institution. So will it be crypto? No, it will be Theat on a database that they call a blockchain because it sounds better than database That's all it is and it will not do anything innovative. It will not bank the unbanked. It won't break the banking regulations No, it will give greater control and surveillance and it will be one step closer to the eradication of cash Which think hard German people are resisting fiercely and better than any other country in the world So good job on that This is the only place where every time I go out for a meal I have to ask do you take credit cards and usually the answer is no To what extent is Bitcoin politically ideological? It seems to me that a large amount of the crypto community is what could be considered as economically right wing For example in favor for moving taxation and welfare zero regulation for businesses moving towards an anarcho capitalist system Well, I can see how Bitcoin strength could enable this type of society. Did you think that's the only political system? Bitcoin-centric economy could shape can Bitcoin ever be compatible with democratic government? and One of my favorite responses just below is a comment by someone who said left-wing or reporting for duty I think Bitcoin is compatible with any non corrupt form of government no matter what it is is Bitcoin is politically ideological because money is politically ideological and Bitcoin is politically ideologically predisposed towards Individual empowerment and freedom now if you think that's a right-wing principle or a left-wing principle That says more about your political worldview than it does about Bitcoin Bitcoin is predisposed to individual freedom over any form of oppression censorship or control by others and The degree to which you believe control by others is a good thing You will find Bitcoin contrary to your worldview and your political views But that's not a left-right spectrum the left-right spectrum is defined in industrialized societies based on a battle between capital and labor and really doesn't say much about about control and freedom and oppression as This monetary system is that is a modern perspective on political ideology left versus right is The 19th century political spectrum and if you try to pigeonhole Bitcoin or the internet or any of the other Modern movements that our society is experiencing today Or technologies that our society is experimenting with today You're going to find a hard time or you're going to simply project your own opinions and paint These technologies with your perspective in order to kind of squeeze them into a left-right divide That doesn't really apply to a modern globalized society where information rather than material goods Are the primary? Economic values in many societies So, you know the battle between labor and capital was very much about production of agricultural and industrial goods And if you think that's as relevant to a modern digital Economy, I think you might be missing the point. I don't think Bitcoin is left-wing or right-wing I think Bitcoin is individual freedom. Could you implement a system? With Bitcoin that supports democratic government? Absolutely, could you implement a system that supports taxation? Absolutely, you could you could build systems like that on top of or in parallel to Bitcoin And use Bitcoin as a neutral blockchain that supports individual freedom within such a system If that system is contrary to individual freedom, then you can't implement it clearly So I like the answer Which is I think Bitcoin is compatible with any non corrupt form of government because ultimately all Corrupt forms of government tends to try to control the individual and enrich those who are in power They can be left-wing corrupt. They can be right-wing corrupt They're still corrupt. So does Bitcoin support corruption? No, it doesn't and it doesn't support other people controlling you So that's the political ideology of Bitcoin. It's different Maybe you can enjoy it with me