Each year, as part of the media award presentation, we hear from an influential figure in the media industry. This year, I'm speaking with Peter Costello. Peter was, of course, a long-serving and distinguished Treasurer of Australia. He's now the Chairman of both Nine Entertainment Corporation and the Future Fund. Nine is one of Australia's leading media companies, the assets of which include the Nine television network, radio stations, online properties and, of course, major mastheads, the Sydney Morning Herald, The Age and the Australian Financial Review. Peter Costello and I sat down earlier for a conversation about the state of the Australian media, China, COVID and the economy. Peter Costello, thank you for speaking with me today. Good to be with you. Let me begin by asking you about journalism and the media industry in general. Obviously, foreign correspondents have to be paid out of the general revenues of media companies. So, tell us a bit to begin about the economics of the media industry in Australia at the moment. Well, the media industry is under intense competition. You've seen a situation where big international tech companies in particular have come into the market. They've been very successful at getting online advertising. That has affected the advertising that commercial operators can earn. And you've also seen a situation where people are now able to consume news on the Internet for free. So, this has put enormous pressure on commercial operators. Of course, I'll leave the ABC out of this because it has guaranteed funding. Enormous pressure on commercial operators. And over the last year, we've seen many jobs disappear. I estimate probably about 2000 in the last year. Many of them in regional Australia, but not all. Many of them in television. Fortunately, in our operations at nine, very few people because we've been able to hold our revenues by diversification. But the end result is there are fewer jobs now for journalists probably than they've ever been in the commercial sector. And that affects not just regional and local news, but of course it affects the ability to get international correspondence. Now, it looks like the government is minded to introduce a mandatory code requiring the platforms to compensate news media for their use of the product that you produce. In May, I think you said that Google and Facebook should pay 10% of their Australian revenues to traditional media companies to compensate for the free news that they are using to generate advertising and that would represent about $600 million. Where do you think that issue will land? Well, the government referred this matter to the ACCC and the ACCC has come up with the idea of a mandatory code, which we support. It's a code which would say if Facebook and Google are able to come to agreement with media companies well and good, but if they can't, that there would be an arbitration. The arbitration at the end of the day would be an arbitration of the value that Google and Facebook get from taking product from media companies and putting it up on their platforms. There's a very important point here that Google and Facebook don't employ a single Australian journalist. They just don't. What they do do, however, is they do put up on their platform news which has been prepared, authored by Australian journalists and that attracts eyeballs and those eyeballs attract advertising. Now, at the end of the day, if they were to take all of the advertising then the people that employ those journalists wouldn't be able to have them in the field. There would be no product. And so the ACCC did an investigation. It said it's fair that Google and Facebook share some of the revenue they get by putting this news up on their platform. We think that's only right. They should share some of the benefit that they get and what's more, it's in the interests of Australian news because if we can't get advertising, we can't employ those journalists. So those figures are $600 million. They're the figures that come from the ACCC, but there's quite a way to go. It'll either be done by agreement or hopefully if the parliament agrees and I think it will, arbitration in the final analysis. All right, let me come Peter to the question of foreign coverage. As chairman of NINE, you preside over a network of foreign correspondence based all over the world including in Washington and Jakarta and until recently in Beijing. How important is foreign coverage as a component of NINE's journalism? How important is it for you to provide an Australian angle on these international stories rather than taking the news from the wires or from the BBC or the New York Times? Well, I think this is the point about international coverage. If all you're doing is relaying facts, people can get those from the internet. They can read the foreign press. You can read the New York Times. You can read whoever you want to. So what is the purpose of having an Australian correspondent in a foreign country? Well, the purpose is to give surely an Australian perspective. It's not just to say CNN reported the following or the New York Times reported the following or the China People's Daily reported the following. If people want that, they can go direct and interested readers do go direct. So the purpose is to say, what does this mean for Australia? How will this affect Australia? Why is it an Australian view in relation to these things? And I think in places like China, I think it's a very distinctive Australian view. Unfortunately, we don't have journalists in China at the moment. We had to remove our last one quite recently. I think in the US presidential election, for example, they're not just there to relay the latest in the Biden v. Trump debate. I'll be more interested in some analysis. What does Biden mean for Australia? What does Trump mean for Australia? How would it affect our relations, our trade? How would it affect Australia's interests in the world? That's what's distinctive and that's what you're looking for in a foreign correspondent. But having foreign correspondents is expensive. So how do you balance the need for that Australian angle against some of the revenue issues you mentioned earlier? Well, it is expensive and that's why we don't have as many as we'd like to have. We have people in Los Angeles, we have people in London, we have up until recently people in Shanghai, Jakarta, places that are important to Australia. And it's quite an investment to do that, frankly, quite an investment. And it has to pay for itself in a commercial opera. We're not the ABC. We don't get taxpayers funds in a commercial operation. It has to pay for itself. And I think it does. I think in television news it's very valuable and in print it adds to the product. But it's always under pressure. As I said, the advertising model is being pressured all the time and being pressured by new entrants. Once upon a time, we at 9, we thought our competitors were 7 and 10. These days we have competitors like Facebook, Google. We have competitors like Netflix. Even in our publications, you can get the New York Times here in Australia. So we're competing on a global scale now and that's tougher and it's harder. And you've got to work harder to keep your readers and you've got to work harder to keep your advertisers. What about the other competing imperative and that is protecting your foreign correspondence?  How do you, obviously that's got to be, I guess, your number one priority in relation to those personnel. Sure. We've come back to China in a moment and we had to withdraw our last correspondent from Shanghai. We had television reporters covering the Black Lives Matter demonstrations in the United States that were caught up in those demonstrations. It was very difficult. And you send reporters to cover riots. Sometimes they can get caught up in them. You do feel a special responsibility to make sure that your employees are safe but they want to get the story. It's always been thus, war correspondence. It's always been thus. You want them to get the story but obviously you've got to make sure that they're safe. So we do, from an employer's perspective, put a lot more time and effort into making sure that they are safe. You've got to have security assessments and all sorts of things and make sure you're prepared for all of these situations. And then sometimes you get caught up in geopolitics, which is what I would describe the China situation as. And you've got to make sure that your people have a means to get to the airport and to take it out at any particular moment. So let's come to China. There's no country probably in the world that's more important to Australia's future. There's no country that's changing our external circumstances faster than China. And yet we've lost our eyes on China, haven't we? How much of a problem is it for us that at the moment I think there are no Australian journalists working for Australian media organisations in China as of today? Yeah, no Australian journalists in China. I think this is the first time in as long as I can remember 30, 40 years or something. And the first thing that tells us is what relations between China and Australia are like, which is not good. That's why we've got no journalists in China at the moment. The second thing is it makes it harder for the public, I think, to understand what's happening because we don't have anybody on the ground that can report an Australian perspective. And I think there is a unique perspective that Australia has on China. We don't have the perspective of the United States on China. The perspective of the United States on China is superpower rivalry. Two superpowers who are rivals. The US perspective on China, that's China's perspective on the US. Australia's perspective is different. We're not a superpower rival to either of those countries. We don't aspire to be. We don't see ourselves in a race for hegemony in any particular part of the world. We're a medium power. We want to maintain an open trading system. We want to trade with both of those countries. We understand that our values and our security interests and our alliance lies with the United States. But we don't want to contain or rival China. So we do have a different perspective. And we can't just take our news from American sources. Obviously wouldn't want to take our news from Chinese sources, which are barely critical of the regime. And so it is a disappointment that we don't have Australian journalists now that can give you that kind of view on what's actually happening. Peter, you and I are speaking remotely because of the coronavirus pandemic and the lockdown and the travel restrictions. So let me ask you about COVID and the economic implications, in particular as a former Treasurer and as Chairman of the Future Fund. What do you think is the outlook for the Australian economy? Obviously the federal government has thrown the kitchen sink at the problem in the budget. It looks like the recovery has been underway for some months. What's your view on the medium term for the Australian economy? How confident are you? Well, you see, what is unusual about this COVID is there's the virus and then there's the government's government's principally state government's response to the virus and then there's the economic impact. It's the response to the virus that has closed down the economy. We have not been in a situation before where governments have deliberately closed the Australian economy. I didn't even do this during the Spanish flu. There was a deliberate closure of the Australian economy. Now, whether you think that was necessary or justified is not really to the point now. The point now is to open it up again. Fortunately, a lot of Australia is opening up. Unfortunately, some states are lagging. The sooner you open it up, the sooner you open up the borders, the sooner life resumes as per normal, the sooner the economy recovers. And I think if the state governments open up, properly open up, then we can recover. We can recover quite properly because this was a government-ordered close down and it will respond to a government-ordered opening up. Now, in the meantime, yes, we'll have a terrible budget deficit. Yes, we'll have to borrow a whole lot of money, but the extent of the recovery will be determined by the extent of the opening up. And hopefully by Christmas Australia will be back at work. If not, then this will have more permanent damage to the economy and to people's lives and people's livelihoods. In the states, worst affected and Victoria, obviously, is the worst affected. This is affecting businesses. Many businesses are not going to come back from this. But the sooner they open up, the more businesses can come back from this. It sounds like you think the state governments got the balance wrong between the health imperative and the economic side. Do you think that the state governments in Victoria in particular closed too soon? It was too harsh and they've held it for too long? Well, some states have done far better than others, obviously. And I'd say New South Wales and Queensland have done much better than Victoria. I think that's obvious. I don't think anybody could dispute that. I think it's important to allow the virus to escape from the quarantine hotels. And as a result, to have to go into this very severe lockdown has affected, well, I think Victoria has three quarters of the cases and 90% of the deaths. And that speaks for itself. Three quarters of the cases and 90% of the death and still in lockdown. Now, hopefully that's going to end in a week or two. And as it ends, hopefully the economy recovers. Final question, Peter. What about the international economy? Obviously, the outlook depends on the virus as it does for the Australian economy. When we get a vaccine, how quickly other governments open up. But how do you feel about the international economy in the medium term? Well, interestingly, it looks like the Chinese economy is growing again. Not as fast as it was. But if we can believe all the statistics out of China, and we'll just park that assumption for a moment, they seem to have more or less got rid of coronavirus and reopen their economy and growing again. The US economy is bouncing back. There's no doubt about it. The US did not lock down. It's had many more cases than say Australia, but its economy is bouncing back as a result of that. So I would think absent a big new wave of corona and fatalities in their wake. I think you'd see the global economy starting to edge back next year. But of course, all of this is going to be contingent on what happens with corona. I don't think we're going to have a vaccine anytime soon. But if we can learn to live with it, so-called COVID normal, and keep businesses open, we should start to see the international economy coming back. And of course, Australian foreign correspondents will be telling the story, the international story of COVID as they do, as they cover all those international stories so well. Thank you, Peter Costello, for speaking with me today. Great to be with you. Thanks, Michael.


I'm here at Jollibee Restaurant, which is a huge fast food chain here in the Philippines and around the world. They're expanding to Canada for the first time, and we're here to encourage Jollibee to find its way to British Columbia because everybody in British Columbia wants to have a little Jollibee in their life.


Right, hello, and welcome to the Road to Zero CVEs, People and Technology. I am Andy from Control Plane, very proud to be involved with the CNCF's tag security as a co-chair, where we help to assure software as it rises through the CNCF for graduation. I'm also CISO at Open UK, where we try and prevent government foot guns with advisory into the UK government, various other pieces of authorship. And this is my esteemed co-presenter. Hi, I'm Mike Lieberman, I'm co-founder and CTO of Kusari, software supply chain security company. I'm also co-author of Securing the Software Supply Chain from Manning, and there's a QR code to the book with a discount. I'm also co-lead, I was with the co-lead of the CNCF Secure Software Factory reference architecture, which is what sort of was the precursor to Open SSF, it was an Open SSF project called Fresca. I'm also a member of the Open SSF Technical Advisory Council, member of the Salsa Steering Committee, a lead on the CNCF tag security, working with Andy quite closely, and also co-creator and maintainer of Guac and Open SSF Inc. Baiting Project, and if folks are interested a little bit more on that one, giving the talk after this one, where I'll be giving a demo on that. And now handing it back off to Andy for the next few slides. Wonderful, I'll try and move these out of the main line. Okay, so let's start with a definition. What is a CVE? It's something we didn't expect that does something bad, an untested code path with a security side effect, which is then known as a vulnerability. So, the problem space that we're looking at, supply chain attacks are on the rise, these are introducing vulnerabilities. We have recent attacks from nation states around the world. We see dependency, confusion and typoscorting on all of the major package repositories. These are intentional attacks that are sometimes difficult to detect or difficult to notice without embellishment and tooling to identify them. And we have as a result of the proliferation of open source software and increasing reliance on the dependencies and transitive dependencies, and therefore the trust relationships with those authors of those pieces of software that is proliferating through governments and, of course, financial services. The problem space is significant. It is large because supply chains are complex and multi-dimensional. We can see this from physically the way that ships are built, the way that medicines are shipped, the way food is produced in software terms, the way that software is composed, the artifacts that we use, the materials that they're made from. And it's not just in terms of technology. The weakest link in many supply chains are the people, the socio-technical issues that rise from having humans. And if there's a second thing that computer security teaches us, it's people are often the biggest threat, with or without intent, and often hopefully have compliance and governance requirements. So we have all these ominous storm clouds of security brewing and in-steps. The governments, the US and the European Union took the first steps into helping to supply the secure, the supply chain, but with also seeing efforts throughout Asia to robustify and secure these things. Regulations and legislations are being developed like the US Executive Orders, the European Union Cyber Resilience Act, and these are not just regulations, governments are actively trying to help provide guidance to people building and utilizing open source software. Biden SBOM ordinances, infrastructure as code mandates, and general secure software development guidelines are excellent examples of sensible and security-focused legislation. And the UK isn't doing too badly either, which is where I'm from, I'm from London. We have guidelines for secure AI development out of the National Cyber Security Centre, and there's more than 20 of the world's leading organisations collaborating in that space, including Japan's NISC. Sadly, we were unable to stop the CRA, which has recently achieved political approval as of December the 1st between the European Parliament and the European Council, and now goes into a process to become law. However, according to early reports, the draft, which is not publicly available, states that non-profit organisations that sell open source software on the market and reinvest all of the revenues in not-for-profit activities were also excluded from the scope. This seems like a very good thing. This might be the greatest victory for open source in Europe in the last few years, so it remains to be seen when that draft is published if we have actually, through lobbying and pressure and the open source community in general, made that massive change to the wording of the legislation. Fingers crossed, I remain hopeful. So one of the pieces of legislation that will cause some concern for those of us that have been patching our software in open source for the last 30 years is zero CVEs. Is this a technical impossibility? Zero days will always perpetuate they are by their very nature undiscovered and there's no effective way to entirely secure any piece of software in the same way that it's not possible to entirely secure anything physical. So the path to zero CVEs is not a destination but a journey. Despite our best efforts, vulnerabilities and attacks will always be present. Fort Knox is technically impregnable but an archetypal James Bond bad guy will normally find some way to burrow in underground or skydive directly in. And as we've seen with supply chain attacks over the last few years, even a secure supply chain can be attacked by dependencies outside of this immediate purview. So we do our best. We practice good hygiene, we implement the necessary guard rails and effectively attempt to address issues that arise along the way. It is about building resilience, staying one step ahead of the ever-evolving cyber security landscape and software supply chain resilience is key as we all know. Composition analysis and an understanding of what comprises, which materials comprise the packages that we ultimately build because there is no such thing as secure software. Software that stands still dies and software that is new has a higher chance of untested code paths which as we know may lead to insecurity. We want to take advantage of new features new features bring those risks of vulnerability once more and companies that don't ship features will be beaten by less risk averse competitor. Our poor security teams. We struggle with new software, vulnerability scanners bring variable results as do S-bomb generators which sit in broadly the same category. Build materials have trust issues, VEX which gives us a way to run those things in an insecure things in a secure manner also rely upon the producer consumer quandary and we don't always know what's going down in production. So while vulnerability management is important solely focusing on it can be a losing battle. The process of prioritizing vulnerabilities can be time consuming and may divert attention from fixing underlying issues. It's a game of whack-a-mole for many larger organizations. It's crucial to strike a balance and allocate sufficient resources to address vulnerabilities promptly and efficiently but burning out security teams with a constant stream of patches isn't an effective strategy and the reality of vulnerability management is that a secure configuration and sandboxing can allow vulnerable software to run in production. This is the dream of VEX. So it's not all bad despite the proclamations that software should be shipped without vulnerabilities they are a fact of life and with rapid innovation this new feature delivery brings bugs and vulnerabilities however this guy is still patching orc after many, many years and the rapid pace of open source innovation requires security maintainers to patch and features and quash bugs or a rival project may beat their adoption curve. So this isn't just related to the CVEs that are raised for your packages. It's a very broad stroke and software CVEs often don't tell you if the way that you're using a package makes it vulnerable. So modern vulnerability assessment is scan a package, panic, guess it exploitability, raise an exception and deploy the thing anyway and running through a log for shelf example for a large organization is a prime example. As we know, everything is potentially vulnerable. Any software that can be run has the potential to be exploited. So how do we fix this techno social issue and get to zero CVEs? It may seem unobtainable giving the ever evolving nature of cybersecurity and the ominous threat landscape and it's also important to recognize zero CVEs does not guarantee complete security. Insecure runtime configuration means a misconfiguration for example the classic open S3 buckets or an open relay from a trusted domain or leaked private keys or an upstream compromise of a trusted producer or provider, sorry, with remote access to your systems. The octabreaches of prime example can compromise a system that apparently is secure with no public current CVEs. So we should view this legislation as a starting point and focus on developing a holistic approach to a more all-encompassing, data-driven and continuous improvement practice and include that configuration as part of the supply chain. Consider the humble container. A container with no CVEs with immediate remote code execution vulnerabilities from web or public facing sockets is theoretically secure.  What is apparently secure based on the CVE scanning landscape today does not mean it is secure tomorrow or indeed that it's secure on that almost zero day. So when one turns up, a remote attacker is able to compromise that container, gain local access. Now that might be from bashing a container which we know we shouldn't do. They could also be for a ROP chain. Once you have a remote injection capability into software there's really very little that you can do. So it's about building out defense and depth. The policies in that container are its last line of defense. We're talking Linux-based security contexts, APRMA, LSMs, SC Linux. We're talking network policy. These things just come one step before intrusion detection. Preventive, detective and remediative practices ensure that even with no CVEs we're still focused on ensuring the depth of defense for when the inevitable, that being too doomy or gloomy, relentlessly occurs. I will now step down from that particular soapbox and hand over to Mike. Thanks, okay. All right, so now that we're embarking on sort of the path to zero CVEs, let's look at what we actually need to do. And the first step is really build some guardrails, right? After panicking then we need you to institute some guardrails, right? Make sure it doesn't happen again. And so really when we kind of look at this problem, right? Before addressing actually first whether or not you're dealing with any CVEs, right? You wanna understand, am I pulling in the right code in the first place, right? And what am I actually, when I look at the landscape and I'm like trying to figure out, hey, what packages should I download? Am I downloading from the right place? What are the sorts of things I need to do there, right? So you need to start building a deep understanding of your supply chain. So you start leveraging tools like Sigstore, Salsa, Guac, Policy Engines, that sort of thing to ensure sort of the integrity and security of the software you're producing consume. And really this is a great diagram from Isaac Hepworth. Supply chain, he's one of the co-chairs of the Supply Chain Integrity Working Group in the OpenSSF. And so when you start to really look at this problem, you start off with a trust foundation, right? Who is doing what in my supply chain? Whether it's a bad actor or a good actor, who is doing what? Then you want to be able to kind of say, what sorts of claims are being made about my software, right? Who is building that software and what are they claiming about how it was built? Who is claiming what dependencies, what things depended on what, right? What information about, you know, for example, VEX as Andy brought up before. And then you want to be able to take all of that data, you want to aggregate it all, you want to analyze it, and then you want to be able to build sort of policy and insight on top of that to then actually action on it and understand, you know, am I blocking that bad stuff from getting into my environment? Am I only pulling in stuff that I expect? All right, so it's also important here to recognize that not all practices will apply universally to every vendor or open source dependency. We will explore alternatives and suggestions tailored to different contexts, ensuring that even if you are not using specific frameworks like Salsa, you can still adopt secure practices when consuming software. So this is stuff like OpenSSF S2C2F, which is a framework that looks at like, if you're not using the latest and greatest, what sorts of things can you still do to protect yourself, especially when you're ingesting software, right? And the ultimate goal here is to enhance security across the board. Now, you know, as we embark on the journey to zero CVEs, you know, we're gonna make a couple of assumptions here, right, you have some sort of SDLC, you're using some sort of CI system, it might not be the most secure CI system, but you're using something, you know, you have a source repository, you have some sort of package cache that you can use to actually do the stuff.  You have something.  And you wanna make sure that those parties are trusted, that, you know, they're reliable, all that good stuff, right? Now, ideally these packages should be signed using frameworks like Sigstore, you know, using stuff like Tuft, which is the update framework to ensure their authenticity and integrity. If that's not feasible, you know, you might wanna consider building from source or performing checksum validation and that sort of thing, right? Trusting software providers requires a thorough assessment of their security hygiene practices. Ideally, software should be built using frameworks like Salsa. You should be scanning the repos with stuff like OpenSSF Scorecard. You should also be potentially using in Toto, right? Like to essentially validate the end-to-end integrity of how that software was, you know, written, how it was built, how it was packaged, and so on. And then alternatively, you might wanna consider building from source, conducting source and package scans when you can't do that sort of thing. Now, you know, so next up, right? So when we start to look at understanding your sort of software ecosystem here, it's crucial, you know, really, at the end of the day, a lot of this is about understanding what's in your environment and understanding what's in your supply chain. And so you want to be able to maintain an up-to-date software inventory. This can be achieved through tools like Guac, which is now an OpenSSF incubating project.   And you wanna be able to sort of have some way, really, of managing and tracking your software assets. And each of these things really is building on the last. And, you know, a key note here, right, is keeping track of everything is important and only figuring out if you're impacted when a major CVE is discovered is bad, right? If we go back to log for shell, the word, you know, you should not be looking at where do I have log for J in my ecosystem? When log for shell happens, you should know where log for J is in your ecosystem. And when a log for shell happens, you should be able to say, great, I know it's running on these servers. This is what needs to be updated. So next up, you know, when we start to look at, so finally, one of the final pieces really is you wanna now, now that you have an understanding of your, you know, what's in your ecosystem, what's in your environment, you wanna be able to start establishing consistent policies and rules to actually action on what's in your environment. And this is really crucial in minimizing vulnerabilities, an ideal approach involves using policy engines like OPPA or Keyverno, which query sources of truth like Guac in conjunction with stuff like artifact proxies. Now, an alternative here is, you know, you still have, you still need to have something like an artifact proxy. You really want to avoid the situation where, you know, in production, you're just pulling software down from the internet with little to no verification because who's to say you're downloading from the right place, who's to say you're downloading the right version and that sort of thing.  It's really, you know, if you're not doing anything else, sure do something like manual enforcement where you're improving each individual package manually and saying, yes, this is allowed to go through. That really does not scale. Try and start using something, you know, try and start building those automated rules quickly. And really, it's about, you know, you just don't want to blindly come in and address issues as they come up. You should really be building processes around this. All right, so I know this is a little bit of a dense diagram, but don't worry about like, if this is just an example here, but basically, right, when we look back at a reference sort of supply chain pre-build, here we'll focus on gathering supply chain metadata from all trusted available, sorry, from all available and trusted sources. This may include things like software bill of materials, additional documentation such as the VEX docs, you know, for understanding the real world impact, what is, you know, as well as, you know, where there might be exceptions. So another thing that's actually mentioned here is guac, and we'll take a look at that in a moment. But all this information really, that's coming out of here with like the S-bombs, the VEXs, the Salsas, the et cetera, really needs to be analyzed to understand if there is actually a risk, just because, you know, something has a vulnerability, doesn't mean it could be exploited, that sort of thing. In addition to this, when you start to look at stuff like scanning, you want to also essentially ensure that generally, are there any code smells? Because once again, it's not just about CVEs and it's not just about the known vulnerabilities, it's about really understanding inside of your environment, is there something that's suspicious as well? Okay, so now, hey, let's start a project, right? What does that project look like? As we talked about before, it's about people and technology, right? You can't, you know, without people, you don't have any code, you don't have any software to begin with, and if you just have the technology, I mean, if you just have the people, obviously there's no technology to actually do anything with. So when it comes to the people, you really want to make sure you have something akin to a DevSecOps culture where, you know, security needs to be a key component of development, not just a gatekeeper, right? Security should not just purely be the thing at the end, saying yes or no, it needs to be baked into the design. You really need to have openness in communication, right? Security issues and things like CVEs sneaking their way in are often the result of poor communication.  And you also want to have clear responsibilities, right? We're all human and developers are being asked to do more and more each and every day. Developers are being asked to understand everything about configuration, whether it's open tofu or being asked to understand front end development, back end development, all that great stuff. And honestly, being asked to also understand Salsa, S-bombs, et cetera, VEX is going to be very difficult, so make it easy. And so when we kind of look at technology here, really it's about, you know, you want to have a secure source repo that means really be building stuff from a repo template that is secure. You want to be able to use those source scanners as we were talking about before, like SAST and DAST. You want to be following best practices in just general code writing. You want to be able to, when you look at securing the build, right? You want to be able to protect what are the build pipelines in the first place? You want to be able to protect the build control plane, and you want to be able to actually go and say, is the workloads themselves being protected? And then when we look at the packaging, right? You want to be able to essentially say, hey, are the output signed? Are, you know, am I getting that provenance in some way, Salsa, whatever? And then you also want to essentially scan the package still once again for issues.  That's really the most important thing because the way that these CVEs often get in is you just didn't check. Okay, so now that I talked about it a little bit abstractly, why don't we actually talk a little bit more once again to reiterate what are the actual things that we're trying to hit here? What are the specifics? So that means like small cross-functional teams with security capabilities baked into the team as opposed to it being something sort of tacked on at the end. Security should be part of sprint planning. It should be part of how you look at how you look at sort of budgeting, how you look at how long a feature should take, right? That sort of thing. If you are starting something that's going to include a whole bunch of new dependencies, are you taking the time to understand whether or not you are pulling in stuff that is secure? You want to make sure you have enough people with enough expertise. You don't want to have a team that is completely stressed out that is doing too much. They're going to cut corners. They're going to include software that perhaps hasn't been fully vetted, hasn't been verified, all that good stuff. And then probably one of the most important things is you really want to make sure you have leadership with the motivation to contribute to the open source community. Something like 95% of all code is open source or depends on open source, I should say. And so really when it comes down to it, you want to make sure that you have, you're contributing back to the open source community because by doing so you are just lowering the overall CVEs in the first place. And so now looking at the technology here, we have in Toto and TuF for secure software supply chain and secure updates to reiterate here, like you want to have a source repo with security enabled. So if you're using GitHub, make sure you have branch protection rules, all that good stuff. There's a lot of great best practices coming out of groups like the open SSF. Using things like Wolfi for base images or things like that. You want to be able to look at security focused build tools like Tecton and Tecton chains, Fresca, et cetera, for the build, using something like SIF to generate S-bombs, right? Using things like GRIP for that initial vulnerable management but really that's not the end. You really want to make sure that you're also pulling in and looking at data sources like OSV and depth.dev also from open SSF as the data sources and you want to also then make sure you're keeping track of all that stuff, right? Because you don't want to lose track of it because once you lose track of it, then you have to go back and re-scan, you have to go back and pull all that information again. So you want to use databases like Guac for ingesting and analyzing all that data. And then you want to use policy tools like Kiverno, OPA, et cetera to actually enforce policies to make sure you're only pulling in stuff that you expect to pull in, that stuff that meets those requirements, that meet those regulatory requirements going back to that. All right, so now finally to kind of tie it all together, what are some of the key takeaways here? So you want to have security hygiene activities, these sort of tend to correlate with improved security health. There was actually a pretty good talk from Eddie Knight from Sonotype who's done some, and Sonotype has done some research on this that said, hey, if you're following best practices, if you're doing things like adopting scorecard, using Salsa and similar sorts of practices that are coming out of groups like OpenSSF, CNCF, et cetera, those sorts of things are correlated overall with lower CVEs as well as increased, sorry, lower mean time to remediation of vulnerability. So these open source projects that are adopting these practices, even when CVEs are discovered, they're being addressed much, much quicker. Regulations and legislation are positive steps in the quest for better security, though there are potential shortcomings in their current implementation, CRA as an example here, and really, really, really it is about the data. It's hard to prove that you have zero CVEs when you don't have comprehensive knowledge of vulnerabilities or even know what's running in your environment, because having zero CVEs is, or at least having very few CVEs is important, but knowing you have zero CVEs or very few CVEs is just as important. And then the journey towards zero CVEs really you should be focusing on the journey. It's not, the journey is just as important as the destination here, right? It's, you should always be striving towards zero CVEs. You should not look at, as soon as you achieve zero CVEs, you're like, great, now I can sit down. Nope, you are continually going back and addressing these things, but really it's about that mindset that really values a high level of security, that values doing all the right things, that values investing in open source, that values investing in security, that values investing in developers to make sure that they have the time to do what they need to do to build features securely. And then back to Andy. And this is the shameless plug for Hack and Keepin' Thatis. It's available for free for the download. Thank you very much for listening to our presentation. And I think I'll give this a moment for questions. Yes. Yes. Oh. I've been asking pretty mean questions since lunch. So let me give you both one that's a little more, I don't know, spicy. So one thing that I've noticed when it comes to CVEs is some projects effectively go and say, oh, well, our threat model is we just don't care about this. And so therefore there's no CVE because we've changed our threat model to say that security's not our concern. And I've seen other projects that say, oh, yeah, we're really concerned about this and they've built very intricate mechanisms to protect against it. And then they get a lot of CVEs filed against very subtle attacks on those very intricate, intricate little mechanisms. So can you comment on the quantity of CVEs and what that says about a project in the light of my question? Okay. So I do wanna first preface it where we did say CVEs are the best we have. They're not. Yeah, okay, so the specific issue is it's very much related to S-bombs and vulnerability management. If I depend upon something and instead of releasing a CVE against a vulnerability, they just release a patch version that everyone's gonna keep on running that vulnerable piece of software without being aware of it and updating it. So I mean, that sits at the heart of trying to keep the system secure. There is a perverse, reverse incentive for maintainers to not accept CVEs, as you say, because they become lightning rods for vulnerability researchers and people looking to make a name, to some extent. I mean, Bug Bound is kind of a happy-ish medium where things are triaged in an objective way, but then to stand that up for an open-source project is quite potentially expensive or not something that the maintainers have time to do. So yes, misaligned incentives, I would agree. Yeah, I mean, we see that even now, right, with you look at a lot of the CVEs that are being... It's, there are bad actors on both ends. You have projects that are turning down real CVEs and then you also have vulnerability researchers looking for every single bug in some test code or every single bug that is... Every single edge case in a regular expression that can only be hit in highly specific circumstances and wouldn't really affect much anyway. Which is kind of why I think we keep kind of going back to the thing where the focus is more about understanding what's in your supply chain, really looking at it more holistically, really applying things that we have seen correlated with actual security, things like what we've seen in Scorecard and various OpenSSF best practices and so on and things that we see in the CNCF and the threat modeling there. But right now it's still the best we have and we understand that it's kind of like, if you don't have anything, you have nothing to really point to. And I guess the secondary point that we lost over is VEX, the vulnerability exploitability exchange format, which kind of goes some way to this. So let's say I raise a spurious CVE in Mike's project and instead of having the time to debate it with me, he's just like, yep, fine, okay, we can patch it, it's easy. And then it updates the version. He or another security researcher could then publish this VEX document saying you can actually still run this version because the exploitability of that bug, I mean it's in a piece of test code, it's a prime example, we either tree shake or we don't ship tests to production or something of this type. There is a whole different set of concerns that come with trusting somebody to bypass your security scanning and if it's a third party, I mean then who do we trust in that case? If the vendor produces a VEX to say something deep in my transitive dependency graph is actually not vulnerable, well then you could probably trust the vendor but then they've got some work to do. What about security researchers who are third parties in this question and then one has to establish a trust relationship with those researchers as well. So yeah, I'd love to see VEX take off a bit but that question of fundamental trust is unanswered. Any other questions? Yeah, if there's nothing else, thanks for coming and if folks are interested in guac, I'll be giving the talk right after this on guac.


Good day everybody, Dr. Sajja Sanyal, Professor's Department Chair. This is going to be a demonstration of the superficial muscles in the calf. So this is the prone catamber, this is the left side. The narration and the camera person, both are from the left side. So we can see the superficial calf muscles on the left side here. This is the gastropemius. The term gastro means bellies, therefore the gastropemius has got two bellies, and this is the one which gives the rounded appearance of the calf. So this is the medial belly. And we can see it takes origin from the posterior aspect of the medial femoral condyle. And it merges with the lateral belly. The lateral belly takes origin from the posterior aspect of the lateral femoral condyle. And the two of them, somewhere in the middle of the calf, they become a flat aponeurotic sheet. And this aponeurotic sheet then rapidly converges and becomes the tendocalcaneus. The tendocalcaneus then gets inserted onto the posterior aspect of the calcaneus. The action of the gastropemius. The gastropemius, because it takes origin from the femoral condyle, it has got a weak action of flexion of the knee. But the most important action of the gastropemius is plantar flexion of the foot through the tendocalcaneus. However, the gastropemius cannot perform both the actions simultaneously to the full extent. In other words, if the knee is fully flexed, then the gastropemius does not participate in plantar flexion. The gastropemius is type 2 white muscle fiber, fast twitch, easily fatigable. Therefore, it is used for running, jumping and doing all sorts of vigorous activity because it gets rapidly fatigued. The medial belly of the gastropemius, as you can see, is a little larger than the lateral belly. The medial belly is the one which is responsible for maximum number of clinical correlations. The medial belly can sometimes entrap a popliteal artery. Either because the popliteal artery is too close to the medial belly, or an abnormal origin of the medial belly compresses the popliteal artery, or an abnormal slip from the medial belly compresses the popliteal artery. These are all various constellation of syndromes which are referred to as the popliteal artery entrapment syndrome. The medial belly can be responsible for pain in the calf, and the medial belly can also sometimes rupture in the condition known as tennis leg. Between the medial belly and the posterior aspect of the femoral condyle, there is a bursa, and that is referred to as the gastropemius bursa, which communicates with the knee joint. Similarly, between the medial belly and the semi-membranous muscle which is shown here, there can be a bursa, and that is referred to as a semi-membranous bursa. This is the x-ray of the knee to show a sesame bone under the lateral head of the gastropemius called the febela. I've cut the medial belly here, and I've cut the lateral belly here, added its attachment to the tendocalcaneus, and I'm going to reflect. And when we reflect, we can see the under surface of the gastropemius, and we can see the various branches from the tibial nerve are supplying the gastropemius. The muscle that comes in front of us after reflecting the gastropemius, this is the soleus. The word soleus means flatfish, because it resembles a flatfish that is seen at the bottom of the ocean lying on its side. Origin of the soleus. The soleus takes origin from an inverted U-shaped line, and we can see that inverted U-shaped line on the posterior aspect of the tibia here. This is called the solial line. So attached to the solial line and below that is the soleus. And attached above the solial line is this muscle here, which is the poverty case. This solial line curves up like this, and then it forms a tendinous arch. We can see it here, which bridges from the tibia to the fibula, and this is the tendinous arch. This is referred to as the tendinous arch of soleus. And then the attachment continues on to the posterior aspect of the fibula as we can see here, and then it comes down on the posterior aspect of the fibula here like this. So therefore the origin of the soleus is an inverted U-shaped. The insertion of the soleus is along with the gastropemius to the tendocalcaneus, and we can see that very clearly here. From here the tendon becomes rapidly tendinous and it becomes known as the tendocalcaneus, which I shall describe just now. The action of the soleus. The soleus is the most powerful plant reflection through the tendocalcaneus. The soleus is type 1 red muscle fibre. It is slow twitch, it is not easily fatigable, and therefore it is used for strolling. So therefore we say we stroll with the soleus and we run and jump with the gastropemius. The soleus, unlike the gastropemius, is a one joint muscle because it does not cross the knee joint, it crosses only the ankle joint. Sometimes there can be an accessory fibre of the soleus, and that can be responsible for a painful ankle condition in excessive use of the soleus. Now we can see yet one more muscle between the gastropemius and the soleus, and this one here. We can see it is taking origin from above the origin of the gastropemius lateral belly. This is the muscle here, and this is the lateral belly. So I have reflected it here to see this muscle. This is the plantaris muscle. The plantaris muscle rapidly becomes a thin, long tendon, narrow tendon, which moves from the lateral to the medial side between the gastropemius and the soleus, and it merges with the tendocalcaneus tendon. This plantaris tendon does not have much functional use, however it is used for tendon grafting whenever it is required. It is also referred to as the fresh man's nerve, because when a resident surgeon, when he is dissecting here, he may mistake this for the tibial nerve. That's why facetiously it is also referred to as the fresh man's nerve. Sometimes this plantaris tendon can rupture with a painful snap while playing, and this is also one of the conditions which is responsible for the so-called tennis leg. However nowadays it is believed that it is more often due to rupture of the medial belly of the gastropemius which I mentioned earlier. So that brings me to the concept of what is known as the triceps sure. The triceps sure refers to the two heads of the gastropemius and the soleus together forming the tendon. This is the triceps sure. Some books say that triceps sure is composed of the gastropemius, soleus and the plantaris, but that concept is not really believed to be true because plantaris does not have much functional use. Now let me mention a few quick words about this tendocalcaneus. The tendocalcaneus is a very strong and a very powerful tendon and you can see it starts as an aponeurotic sheet. It's a combined fibers of the gastropemius, soleus and the plantaris, and it rapidly becomes a tendon and it gets inserted onto the back of the calcaneus. There can be a bursa deep to the tendocalcaneus and that is known as the deep calcaneal bursa. There can also be a bursa superficially which is referred to as a superficial calcaneal bursa to prevent friction. And this can be a cause of pain in bursa it is especially when wearing new shoes. This tendocalcaneus is the most powerful plantar flexor of the foot and it is due to the combined action of the gastropemius and soleus as I already described. This is a unique tendon because not only is it a powerful most powerful tendon in the human body, this is the only tendon which does not have its own sign of its sheep. Instead it is covered by this membrane which we have retained here on this side and on this side. This is referred to as paratinone. This paratinone is very important for the nutrition and for the well-being of this tendocalcaneus. If you look closely at the fibres of the tendocalcaneus, you will notice the fibres which are coming from the gastropemius. They are the superficial fibres and the fibres twist a little bit 90 degrees such that the fibres from the gastropemius they face laterally. Deep to that are the fibres of the soleus. They face medially. It is postulated that this twisting gives extra springiness and movement to the gait and to the action of plantar flexion. That brings me to a very important clinical correlation pertaining to the tendocalcaneus and that is rupture of the tendocalcaneus. When the tendocalcaneus ruptures it is as bad as cutting of the foot because the person cannot plantar flex the foot and therefore the person cannot walk. Therefore it is mandatory to repair the tendocalcaneus and we do it by means of a procedure which I have demonstrated here known as Z-plus. When the tendocalcaneus is cut, we have to convert it into a Z-shaped incision like we have shown here. We go approximately one and a half inches above this insertion and we convert the straight cut into a small horizontal cut, a longitudinal cut and again a small horizontal cut and this is called a Z-shaped incision. And thereafter each section of the cut is sutured separately by means of non-absorbable sutures. So one set of sutures will be here, another set of sutures will be here and a third set of sutures will be here. And after that it is mandatory to cover it up with the paratinoin and suture it and then after that POP cast has to be put above the knee joint to below the ankle joint for three months at least. The reason for doing this type of Z-plasty is to break the line of tension because if it is a straight cut and we try to suture it like that the tension will cause the sutures to give way. Therefore we break the line of tension by making it in the form of a Z and this is the way to ensure the integrity of the anastomosis of the tendon. So these are some of the facts which I want to mention to you about the triceps sure, the gastrointemius, soleus, plantaris and the tendocalcaneus. Thank you very much for watching Dr. Sanjay Sanyal signing out. David over the camera person if you have any questions or comments please put them in the comment section below. Have a nice day.


Good evening and welcome to town meeting televisions continuing coverage of election 2022 November 8th is election day And of course you have the opportunity to vote between now and then you don't have to wait till election day You can send in your ballots. So hopefully you have not yet made up your mind or maybe you have about This particular district chitin in 24, which is s6. It's s6 district s6. Yes, exactly And so we have two candidates we have an incumbent elisa black who's a democrat and roger jerry Who is republican and we welcome you both and we let people know that you can give us a call at 862 3966 if you have any questions for the candidates, we're very happy to hear them But we've also prepared some which we have provided in advance So we're going to start with you elisa just to start Tell us why you're running for the state legislature and what qualifies you. Well, hello. Good evening Thank you for having us in today. I'm representative elisa black I am currently serving my First term as a legislator It would just be an absolute honor for me to be able to continue into the next biennium During the past two years I've advocated and I voted in support of key economic recovery efforts for our state And taken action and voted to ensure that we have a vermont that works for all of us If elected again, I plan on continuing to build on the foundation that I have created continuing to listen develop continue develop relationships within the state house And represent the values of our community There's a number of really key critical issues that are on the horizon coming up issues such as climate action gun violence prevention housing Access to affordable health care and affordable child care And of course reproductive liberty and that's just naming a few I think our community will really benefit from having a study Now experienced and thoughtful leader and someone who shares their values to represent them That's why i'm running again for reelection. Thank you elisa black. Thank you Roger jewelry. Tell us why you're running and what qualifies you for the position of state representative. Hi lauren. Thanks for having us today Well, my name is roger jewelry. I'm a father of three boys all in elementary middle and high school I'm a 36 year veteran of the vermont army national guard I have activated three times one in homeland defense right after the 9 11 attacks The second was in afghanistan as an embedded trainer training the afghan national army And the third was as a medevac company commander helicopter commander in iraq. So i've had some experiences with multinational work And of course a homeland security work I I offer my experiences in collaborative leadership for the for the voters of esx and For for this november. I don't have all the answers But I do promise to listen to multiple points of view before casting any any votes if elected And do you have any particular issues that are driving you to the legislature? There's nothing really particularly driving me to the legislature. I felt it was a Just the next step in my in my career of public service Okay, awesome. Well, let's start with the next question which would begin with you and that's about education The legislature can make impacts on how education is funded statewide I don't think we've ever stopped talking about how education is funding And so do you see a need to change the formulas how we do it? And how would you use the office to move that? education financing agenda forward Well, I think most vermonters will concur that our current tax model is It's pretty difficult to follow and I am still learning a lot a lot of the ins and outs about it So I'm intrigued about a concept of moving to more of a income based solution But I would want to learn more how it would affect the second and third over effects on on vermonters On on the agricultural You know on farmers as well as folks who live more in the towns I No matter where or how we choose a tax model for the future I would like to see the legislature leverage a little bit more on alleviating Some of the administrative burdens that I that I feel are on our schools And help them reduce costs that way. All right. Thank you very much Alyssa tell us your your approach to education financing and how you move it forward Well, first of all, I believe that you know fundamentally we have a collective responsibility for ensuring equitable outcomes for all of our students And moving forward on some of the work that we did in the legislature this year Last session we updated the weights Including significantly higher weights for multilingual and students and those that are living in poverty the weights are You know, they acknowledge that there are certain students Who are more expensive to educate? And pupil waiting not pupil waiting. Yes And I think that in the upcoming biennium we're going to have to work on Tweaking refining all of the progress that we made last year I think it's just really important that we are creating our next generation to become productive and Successful members of our community it benefits every single one of us So we've created in vermont a system of funding education That is actually really tax progressive However, it's also really confusing and people don't understand it I did a three-day webinar just to be able to understand the basics of how our system of education is funded I am in favor of simplifying it And in We had several studies that were put in in this year and they'll be coming out soon One of those is Looking at income based financing rather than property tax based financing of our education system I'm really looking forward and interested in seeing that one come out Um, you know, I also know and I trust that our committees on education and ways and means Are going to be doing looking at this very hard and doing their due diligence on it And I look forward to the possibility of possibly moving towards that type of financing system Thank you. Well, let's move on to the health care question because again health care is the largest Um budget item that we have in the state in many respects and whether it's our personal budgets or the state's budget And I wonder what you would like to pursue in terms of alleviating the cost of health care for vermonters Well, I could probably spend the whole 30 minutes on this topic. Um Can I do a real quick psa? Um as we're getting ready to go into open enrollment here There are much higher income qualifications currently in order to be eligible for tax subsidies And helped pay for premiums If in the past you have not qualified for these tax premiums, please please reach out to vermont health connect Because most likely if you weren't in the past you are now so psa over So I wanted to talk about health inequities a little bit during 2021 We established a health equity advisory commission And one of their charges is to provide guidance Coming up in the next year for our newly created office of health equity The commission is has been meeting and continuing to meet and next session We will be working on moving forward with their recommendations Um, we also have renewed partnerships with the federal government cms center for medicare medicaid services This is federal money that we are going to be able to use to provide More resources to vermonters I mean including, you know, we are receiving funding for wraparound services That are connected to housing, you know, keep people in stable housing Um, you know, I sit on house health care Um, my overarching goal when I sit in that committee room and I listen to testimony Um, I'm constantly asking myself is this equitable? Are we providing the right care at the right cost in the right place? and the right setting in the right time and um You know, we talk a lot about what our values are And we say and we talk about what services and types of care that we value And i'm always Are we prioritizing these things in our budgets?  Thank you very much Roger jerry, why don't you tell us your approach to addressing the inequities in health care and The financing model for the state Well, as far as the financing component goes I I don't have a lot of experience in how the state is funding their their health care I do have uh, I have spoken with some some experts in the field I can't tell you that I can pair it back everything that they have told me But one of our our biggest challenges Is the individual accepting ownership for their own health care And i'm not talking about paying for it and I understand we've got some some solid programs that can that can truly help people What i'm talking about is heart disease diabetes Those types of Self inflicted and I understand that some of it can be hereditary But we are eating ourselves To death in this nation And we need to be able to provide some sort of incentive and whether it's Jim memberships or whether it's Just making sure that when someone goes to the doctor that they are truly Following their doctor's advice Those are the what I see and what I hear are truly driving up health care costs not taking care of people We're going to take care of people But we've got to help folks take some ownership in their own health All right. Thank you very much. I'm going to just remind people you can give us a call at 8 6 2 3 9 6 6 That's 8 6 2 3 9 6 6 We'd love to hear from you if you have any questions for the candidates for state rep from Essex Criminal justice reform next question for you roger. How does chitney county address crime in your view? Do you think there's a problem with policing that needs to be reformed? And Another very big question. How would you address community safety? I believe we've created Several knowing situations between crime and law enforcement right now with our prison situation I believe we have well-trained police. I believe they're hard working and under staffed and there's several reasons for that Our politicians have created a situation where citizens do not trust the police and There are some understandably reasons why but at the same token Putting up red rick calling our police names Defunding them is not the right and proper way to address some of the problems that we're having I support Uh, excuse me. I support our police But we need to create a situation where Criminals understand that there are repercussions for their actions And I don't feel that in chitney county. We truly have those repercussions Now that being said I fully support restorative justice. I think it's an important component in law enforcement as well as Paying back to the community that being said we still need to trust our police and keep them well resourced All right. Thank you very much Your response to the question about community safety and police reform Yeah, so this is one of those questions you get and you think oh goodness So one thing you learn immediately when you enter the legislature Is you can't be an expert on everything? I am not an expert on this But I am really really fortunate that I serve with four other absolutely remarkable women as part of our Essex delegation And we rely on each other a great deal To be able to represent all of the constituents in our community And utilizing the strengths of each of us on this issue I rely on representative Karen Dolan. This is her issue. She guides me on this I trust her on this You know in chitney county. I think we're very fortunate every county is different But we have a really large tool box in to address crime Restorative justice like you mentioned we have drug courts, you know the traditional sentencing court diversion probation Having all of these tools are really essential Because crime is a really complicated issue The overwhelming majority of crime is nonviolent and It's really rooted in You know the gaps of care that we have in our communities poverty mental health Just inequitable system access We need to address crime and community safety by filling those gaps And creating a more equitable system of justice Thank you very much All right, our next question has to do with the ballot issues ballot questions one is proposition two and the other is proposition five What's your position on those two and maybe you could shed some light on what they are just as a matter of public education So I fully support both these constitutional amendments proposition five Will enshrine reproductive autonomy health care in our constitution Proposition two Clarifies remove some ambiguous language that's currently in our constitution around slavery So I will tell you I remember The day that I voted on prop five I remember waking up in the morning and just sitting with my coffee And this you know the enormous weight And responsibility of my vote on this And what an honor it was to cast that yes vote I just kept thinking Forever more that house journal is going to say Representative elisa black of essics Votes yes It was this enormous feeling of pride and I Wish that every single voter that walks into that voting booth or fills out your ballot at your table Is able to sense the same amount of pride that I was able to feel when I made that vote on the house floor Enshrining reproductive liberty and the removal of this ambiguous language and clarifying Slavery related language from our constitution is absolutely essential and I encourage everyone to vote yes On both these constitutional amendments. Thank you very much Roger jewelry your positions on proposition two and proposition five Well, my position truly relies on on the verminers The vote will be in the verminers hands. It won't be truly in roger juries hands That being said I've done a little bit of analysis on it and As far as prop two I I agree with you. I I think it does remove some ambiguous language I've read a few essays on it And I at first I won't pull any punches I was very concerned that it would affect our restorative justice programs Where it wouldn't allow for community service Some of the essays have come back and said that won't be the case because it's a mutual agreement So I can get fully behind prop two and and remove that ambiguous language Prop five I disagree with it Hold hardly I'm concerned that an amendment that is designed to protect abortion Does not include the word abortion in it at all and it enshrines itself in reproductive liberty It's not defined It's leaving it up to the courts to define and the legislature I feel did a punt where they could have simply said We want to enshrine abortion and the legislature will make no laws Restricting abortion. They didn't do that. They chose the language very specifically. So it would go to the courts I don't know where that would come out of but I don't think that that's something the court should be handling personally I am a pro choice republican, but I am Against prop five All right, may I respond just a little bit? I just want to clarify something It is really important for people to understand You know the language of proposition five or article 22 Um These rights are already in statute what Changing what adding article 22 to our constitution does Is it takes it out of the hands of future? fickle legislators to Remove and do strike calls from our statute That is why we are putting it in our constitution It changes nothing from what Current law is it just makes it so that current law cannot be changed So can you just clarify without going through another constitutional amendment? Yeah, so the the proposition doesn't mention abortion. Um, can you just talk a little bit about Why that is it removes the government from the decision making around reproductive health It is a decision between a family a woman Her husband her partner It is a decision between healthcare providers and that person It removes it from governors and legislators and courts or anything else That's what it does Just the last line In the proposition says unless otherwise deemed by the state So the state is retaining the ability to make changes as it see fits for the for the fickle For the fickle legislators I trust the people of vermont to continue to vote in legislators To uphold their values. I don't believe we need to add this ambiguous language in it All right, let's move on to the next question. Shall we? Language access what is the value to vermonters in supporting language access to information about health local government and education issues roger I think it's an incredible benefit to make sure that new vermonters can have access to services So I would I would support it in in many ways Feasible and reasonable you were telling me just before the interview some of the ways that you guys are taking care of it I think that's absolutely wonderful I do think it's equally important though that we provide english as a second language for those who would like to like to take it Mike's experiences in afghanistan were were kind of Unique and fun where We would have we would work through interpreters and our interpreters had Every good intention to trans translate as best they could But as americans we sometimes would use some idiomatic expressions that just did not translate well And there is a there's a benefit to being able to to speak the local language Then that's not it. That's not a dig. I just want to encourage and figure out ways that we can allow that to happen So you mentioned that you're translating into 16 different languages I barely speak english I'm going to have a hard time speaking with with vermonters or sx constituents who can speak You know another language than myself But if they have the ability that we can at least communicate somewhat And through google translate or any other Options I would love to see that happen. All right. Thank you roger Alyssa So language access benefits absolutely everyone and I have learned over the last two years So at the beginning of the coveted outbreak In multi-lingual communities the health flyers press releases press conferences. They were only in english I mean there were entire families that lost their income Our health department And our hospital resources were incredibly impacted by this and stretched Because there were entire communities that weren't receiving the information People got sick people died because of this I personally worked on a bill in 2021 to expand access to dr. Dinosaur for pregnant women and children Regardless of their immigration status We allocated money for coverage in the first year for that The problem is it wasn't utilized Because there was no strategy to be able to communicate it to the affected populations I mean there were women who could have had coverage for their pre-humanatal care and they didn't get it And it's not just languages This year the health care committee did a bill on expanding coverage for hearing aids While we're taking testimony We realized that the deaf and hard of hearing the very community that we were trying to help They couldn't be at the table Based on the current setup we had for communication We thought we were being accessible by being on youtube, but if you can't hear us that's not accessible We ended up bringing in sign language interpreters that was that was actually a lot of fun So you know, I mean when everyone has equal participation in our government our schools The health care system It absolutely benefits everyone if we can ensure that every voice has a seat at our tables. Thank you very much We're going to go to the lightning round. So Alyssa, why don't you tell us what your top priorities are for the next biennium? We have 30 seconds So if re-elected my top two priorities that I personally I'm going to be working on our gun violence prevention and suicide prevention I actually am already already working on these things in anticipation And hopes that I'm re-elected very good. Thank you. Roger. How about you? If the speaker of the house provides me the opportunity I would love to work on encouraging emerging emerging technologies into Vermont Our citizens truly care about the environment And I would love to capitalize on that to see how we can do anything from hydrogen generation To some of the the high-temperature salt storage For for energy I'd also like to see us Working more on encouraging more more housing development The median income in Essex is 77,000 You know if you use Dave Ramsey's model of 30 expenses for housing and taxes We're looking at mortgages of about 275,000 there's not few there's not houses that are 275,000 in Essex We need to figure out ways to reduce those costs and get those houses built. All right. Thank you So let me ask you this on coven 19. What are your top takeaways? On what you saw enacted during the pandemic either improvements or things that you learned that you think should be brought forward into policy I think we witnessed an incredible state response in in getting multiple resources to bear from the food support To the financial support to just the the messaging. I think I think our state did a very good job Uh, I got to put a plug in for the Vermont Army National Guard and the Vermont Air National Guard for the efforts that they did For immediate action response and for building that That secondary hospital over at the fairgrounds the That being said I I also know or believe that truth has a daytime group And as we as we learned and we as we learn more about this disease I think that we could have done a little bit more to open our economy and our school system sooner But that's using hindsight. All right. Thank you very much. Alyssa black. You're learning takeaway from COVID. Oh, well My my biggest thing was the benefits of telehealth For health care access mental health care access that has been incredible um Also, you know the need what we just talked about the need for language access And that we've also had this incredible transparency in governing with zoom access I mean I am on youtube every single day when I sit in committee and that will be there forever and ever and ever For anyone to watch at any time that they want It will be if they are private properly. That's true Quickly we'll have one more of these opiates and addiction. Do you support safe injection sites in vermont in chitin county? Yes, absolutely. I do. I support anything That will lead to less deaths. All right, roger. How about you? I do not Nations and other states that have tried this are pulling back on it. It's a failed model Okay, so why don't we go to closing statements? Oh, yeah, I know we have two minutes left So roger, we're going to start with you if you don't mind roger dreary Republican candidate for state representative in chitin in 24 Well, I really like like to thank you and the rest of the channel 17 staff for for having us over here today Uh, this has been an incredible opportunity. I thank alissa for for her time Uh, we're not going to agree on every issue There are multiple issues and lots to learn that are about this the whole processes But I do promise that I will always listen and take multiple points of view and account before making any decisions Looking forward to the opportunity. Thank you so much Alyssa black your closing comments. Yeah, and also I wanted to thank you for the opportunity to allow us to come in And roger for being here. It's always great talking with you You know, it has been my greatest honor to serve as a representative I mean, frankly, it is one of the most important things that I've ever done in my life And I hope to be able to continue to represent our community our values and Montpelier I'm humbly asking for your vote on november 8th or beforehand with your malin ballot And I want to really be able to continue the work that I feel like I'm just getting started on Wonderful. I want to thank you both for joining us. This has been very interesting I love doing these forms and I appreciate that you're both here tonight. Alyssa black is a democrat and she's an incumbent And she is running for reelection roger dreary is a republican and he is the challenger and we are talking about today the district 24 it's hard to imagine that there's so many districts in chitin county But there are and we are also wanting to encourage you to be sure to vote On or before november 8th and of course to tune in to town meeting tv's continuing coverage of all the candidates in chitin county And also election night results on november 8th starting at 7 30. So thanks for watching. Have a great evening


Ie, mae'n amlwg hwn nifer o'n mynd adnod o bobl a chdiwm anod ar draws. Mae hyn yn defnyddio'r gwaith i mi a chael bwysig iawn i ddau cyfaint o ddael y Feesol Llywodraeth. Maehereb yn ei ddelfwng gyda'r ddweud o of жadag o odd yn ff Berkeley. OFE yw oes i gweithio'r ddechrau i ddim yn rhoi'r gwasanaeth ar gyfer Mthlwys. Mae'r adnod o dechrau erth myl i bobl yn rhan o'r moll gwrsfwrdd ffordd, felly mae'n rhoi'r ymarfer a os ydych chi'n ddweudio'u ddeunydd yn ysgol fadhau yn yr arfer.  Felly mae'n gweithio'r ddiddorol, oedd yn ei ddweud o'r ddiddorol yn ei ddiddorol, fel ydy'r cadmai yn cael ei ddiddorol. Mae'n amlwg i ymddangos i'r awdurdod IOCAN, i fewn i'r FFWI yn yr hyn sy'n i'r llwyddiadau. Mae'n amlwg i'r ddiddorol i'r ddiddorol i'r ddiddorol i fewn i'i ddiddorol. Duncan Rudd erion i ddau sy'n gwaith cerddur iawnentrech arnyn ar shelvesau ffordd, sydd wedi bod'r hyn hyn sydd arloedd ac yn i ddechrau'r slesiwn. Duncan, ddau'r wneud i fynd i'w bwysig gyda'ch gydag i'w adeiladol. Dyfodd, mae'r rhai'r wneud hynny yw hynny yn gallu geddwynd ddechrau. Yn malg. Dyfodd, ddau'r wneud i'w bwysig, sy'n gydag i'w bwysig. Openers and Innovation, a report of the first Open Forum Academy conference. Now, what is the, up, down, this one? Okay, what is the Open Forum Academy? It's an independent programme. Graham already indicated that established by Open Forum Europe. It has created a link with academia and industry in order to provide new input and new insight into the key issues which impact openness on the ICT market, on the IT market. It does briefings. It does round table events. Insights events. It produces reports. It tries to drive thinking to stimulate thinking around openness, open innovation. I was a bit less aggressive. I said we have 30 plus fellows, but we are approaching 40, I think, currently appointed. It's a broad mix of academia and industry, and it's really a high profile think tank. And so yesterday, as Graham mentioned, we had the first fellows conference on openness and innovation. So now, if you think that we are a homogeneous group of people sitting there, reconfirming each other of their nice positions and how great openness is, you should have been there yesterday. We are really a broad spectrum, and we come from different areas. We have academia there. We have industry there. We have representatives from organisations there. So we tried to approach the topic of open innovation, of openness, and its importance, out of different angles, different perspectives, different dimensions. Really trying to bring together the people and move towards this common topic of openness. So openness, of course, is at the centre here, and we are looking at open innovation, which you could say is the highest level, including something like open standards. Very important topic out of my perspective, since I'm a standardisation guy. Open source technologies. And we were trying to address the aspects of society, the impacts, the challenges, the opportunities of openness, open innovation for society, for economics, and in a broader global context. Personally, I think it's unbelievable that we still need to talk so much and justify so much openness, that there are so many people still around who see openness, open standards, open innovation as a threat. There are all the policy discussions going on. I was last week invited as an expert by the German Parliament, which has set up an enquête committee to discuss about the digital future, and we were discussing whether openness is important there. What can you do? We are all using open source all the time. I believe almost everybody has already used, or is constantly using Firefox browser. We are used to it. We have seen the innovation potential that is in openness everywhere. It's astonishing that we still need to debate so much about it, but we've also seen today there are many more aspects and areas where we need to address, where we need to create awareness, where we need to move forward. What did we discuss yesterday? I want to give you a little idea about the topics that we discussed and the points that were made. First, openness and economics, open innovation and economics. We diagnosed there is a paradigm shift towards openness. Openness in the economy is primarily a reaction to the movement towards openness that we have seen in society, to the transformation of society. Collaboration, crowdsourcing, they are already a normal thing today and it's a reaction that industry tried to take it up in some way, tried to leverage the benefits. So it's important to open up for openness. Collaboration needs to happen across organisational boundaries in order to innovate, in order to create better results. Everybody is seeing this, be it government agencies, be it industry. Organisations need to find their way, establish their processes to open up for that. We need new metrics for calculating TLC. New parameters are needed, including what are the exit costs. If we talk about assessing open products, open approaches towards close proprietary approaches. It needs to include exit costs. It needs to include the ability to take up innovation. It needs to include aspects like lock-in and network effects. So new metrics here are probably needed and some researchers needed on this. And open standards are of key importance, especially for software interoperability. They are a driving factor here in this area and need to be made...


A video can be an extremely effective way to market your brand and attract potential customers, which is why many businesses have started making them. What are some different types of videos brands can create? How-to videos provide step-by-step instructions on how to do something. They can be beneficial in marketing your brand, because they allow you to show off your products or services in an informative and entertaining way. Plus, you can use how-to videos to drive traffic to your website or blog. Product marketing demos showcase a product in use. They aim to give viewers an idea of what the product does and how it can benefit them, and allows potential customers to see the product in action. Demo videos can be used on websites, social media, trade shows, or events. Customer testimonial videos are powerful marketing tools to promote your brand When creating a customer testimonial video, highlight your products or services' key benefits. Animated explainer videos are short, engaging videos that explain a company's product or service. They're one of the most effective types of video advertising, because they can communicate complex information in a simple, visually appealing way. Animated explainer videos can also help increase brand awareness and boost sales. Event recap videos are short and highlight reels of a recent event your brand participated in or hosted. Company culture videos are an effective way to market your brand and connect with potential customers. By showcasing the people who work for your company and what they're passionate about, you can create a strong emotional connection that can lead to customer loyalty. Remember that your company culture video doesn't have to be about work. Expert interview videos are marketing videos in which an expert is interviewed about a specific topic. This can help market your brand by providing viewers with valuable information and establishing you as an authority. If you can find an expert willing to speak positively about your brand, you'll have created a valuable asset that can help boost your visibility and credibility. Viral videos are short clips shared online, often through social media channels. Live stream videos are broadcast in real time. They can be used to market your brand by providing a behind-the-scenes look at your company, or by holding a live Q&A session with customers. Live stream videos are an excellent way to connect with your audience and create a more personal relationship with them. A live stream video offers brands a unique way to connect with their audience. User-generated content videos are created by someone other than the brand itself. This could be a customer, a fan, or even a random person. The key to making this video effective is ensuring it's appropriately branded and aligns with your company's overall message.  Using different types of videos for marketing is a great way to spread the word about your products or services. They provide an engaging and visual way for customers to learn about your company. So what are you waiting for? Get started today. Keep your audience in mind when creating marketing videos and make sure they are relevant to them. For more information, read the full blog post at NewHorizons123.com.