Great. Welcome to the last set of news. My name is Rob, and today we've got a lot of things to go over, so let's just jump right in. You're here maybe because of the title, which is really taking a look at the big picture. And I think as we get into these bear markets, which we are right now at the bull markets, I think there's a lot of noise to actually separate and look into. So first, we'll take a look at the big picture. Are we missing it? We'll do a little market recap. Then we'll take a look at Bitcoin at 12K. Cycle bottoms, wallet indicators, institutions, are they flowing in or out or just being stagnant? Also, we'll take a look at there's going to be a Voyager Town Hall meeting tomorrow, which I will be at. Then we'll take a look at wallets being turned off, specifically USDC and Tether. And lastly, we'll take a look at a story about Mark Cuban and Cardano. So before we get into it, just so everybody knows, I'm still feeling a little bit fatigued on the weather, so we'll see how the Q&A goes. But the doctors will, I'll be doing a bunch of appointments moving forward, but I'm not a person just to sit around and do nothing. And if you know just anything, I mean, I've done as much as I possibly can do, so we'll see how it all works out. But I know if you've had a back injury and just laid around forever, it actually gets worse. So the only thing you can do is just push through, just like this crappy market. So anyhow, let's take a look at the big picture itself. And this story kind of brings it home for me and maybe for you. This came through from Twitter. And it talks about a story about in 2009, a stand for business professors split her class into 14 teams. They gave each team five bucks in two hours. They told them to get as much ROI as possible and said they'd give a presentation at her finishing. So just two hours with five dollars. Do something with it, make a lot of money. Here's what happened. So let's talk about the teams that lost. So most of them tried to flip the items. They bought something for five bucks to store, sold it for eight bucks in the street. That's kind of like what I would probably think about doing. So I'm like, I can make a quick buck and only got two hours. One team got more creative. They realized that the five dollars was mostly a distraction. So they just thought of ways to make money in two. They ended up making reservations at a restaurant and selling them to people who didn't want to wait in line. Not too bad. And their ROI was a little bit better. But this is where it takes the cake. The winning team got even more creative. They didn't just realize that the five bucks was mostly just a distraction. They realized that there was a value asset hidden in the challenge and that's time. So what they did is they reached out to local companies, offered them a three minute slot as ad space for their presentation. And after some negotiation, they closed the deal for 650 bucks. ROI of 12,900%. So the really big thing, the really crux of it is you have to take a look at what's going on. And just think to yourself, am I missing the big picture? It's just something that I'm just not thinking about. And that, I think, is the bigger story than what we're diving into superficially. So let's just jump into the market and keep that in the back of your head as we go through these stories. So today is the down day. Not a big deal. Down 3.6%. 4.9% for Ethereum. Nothing goes up forever. A little bit of pullback and that's healthy. And you can see that's over the last 24 hours. Everything's pretty much down. So not a big deal. And that's the market itself. But there was this interesting piece from joko.btc at Blockwise. And he put out some data which says he or she realize the price of addresses holding 10 to 100 Bitcoin have acted three times as key support. And at the moment, the realized price of the category of addresses is $12,780. So if you take a look at this data piece, just say, well, addresses holding 10 to 100 Bitcoin, this is the support levels for these addresses. And over time, 2020 or 2019-18, it was $3,100. In 2015, $185. In 2013, whatever, $2. Think of these, just keep this in mind. 3,100, $12,780, $185. If we go back and we take a look at where Bitcoin has been. So this is kind of eerie. In 2015, 2013, during the high, because this is all about four-year cycles. You know, I believe in that. The price, the top, the tip-tip-tippy top was $1,127. And the price right here, $172. Kind of interesting, because you had it at $185. And that's an 85% reduction from the top to this local bottom for that four-year cycle. We move forward. December 15, 2017, it was $19,665. And then just a couple months later, the bottom was $3,200. 84%, $3,200. $3,200. $3,110. Interesting. And if we move even forward into today, you'll notice that the high for this cycle was $67,145. And then it went down to $19,047. This is from CoinGecko, so take a look at the grand assault. But I could have sworn we hit around $17,500. Correct me in the comment section. But if you take a look at $67,000 and $19,000, that's only 71% reduction.  And that is not what has been the last two cycles. Does that mean that it absolutely has to go down? No. But it's something to keep in the back of your mind when you try to cut out the noise of the short term versus the long term. So that is also leads me to this part. So there's some negatives there, which was put over here for all these addresses holding 10 to 100 Bitcoin. But you got to remember this. These are all the Bitcoin wallet holding one Bitcoin or more. And I want you to notice something right here. We are at an all time high. Never in the history of Bitcoin and crypto has there been addresses of over one Bitcoin totaling $892,123. Today is the day that it is an all time high. So something to think about as you cut through all this noise. Also, there's also going to be things as far as short term versus long term. This was an email I got from looking at Bitcoin and says, hey, take a look at active addresses, sentiment indicator. We're entering an overbought area potential for price atop in the coming weeks. And we take a look at this. First of all, what the heck is that? What is an active address sentiment indicator? It compares a 28 day change in price, the 28 change in active active address for a short term sentiment indicator if you're into the short term. Dotted red line is upper, dotted green line is lower, orange line is 28 day price change. So again, it's always the same thing on looking at Bitcoin. We did a video about this a couple of days ago for taking a look at cycle tops and bottoms. As you can see here that, yes, we are above this red line. So in the short term, it could go down. Might not. But again, cut through all the noise. Look at over here. Here's a red line looking retroactively. If you would have got out on December 20, 2020 and said, well, it's about this red line. Look how far up it went. You would have missed out on some pretty impressive gains. The big thing that I want you to know is this. When in doubt, zoom out. Take a look at all of the different wallets that are out there. Here's the NUPL. And one thing I want you to notice is that once we dip below this green area of capitulation, and you can find all these charts at looking at Bitcoin. It's 100% free. That's why I love using them. You can see that it dropped down below the 4500 mark and then didn't retrace back in. Same thing going on over here. I think we could dip a little bit, but then go up. So again, are you a short term or a long term?  Here's another piece that you might find interesting. Novogratz. We talked about him yesterday.  And of course that collapsed.  I got to tip my hat to him. At least he still shows up unlike a lot of people. Novogratz's doubtful Bitcoin will push through 30,000. And what he says here is this. There hasn't been significant inflows of institutional capital into the space. So he says. And I'm like, well, that's not good, but it's not that bad. He says, be happy if we're in a 20,000, 22,000 or 30,000 range for a while. We're not seeing huge institutional flows in. But to be fair, we're not seeing anyone back away.  So do I think this could be a big thing later on? Sure. But the thing is you have to remember is this. Look at the big picture. Is this awful that we're not hitting all-time highs all of a sudden? Is it bad that we can't? Or is it actually a pretty good thing? If you take a step back and go, well, I'm not a billionaire. So it's going to take me a little bit of time to dollar-cost average and get into these positions. And maybe in three, five, 10 years, things will work out for the best. I think that's the bigger picture of what people might be missing. So let me just think about that in the comments section. Let's look at our next piece, which if you're going to look at things that you can change and avoiding noise, these are things that you can actually get into. So this is the Voyager Town Hall. So just so you know, this was put out by Voyager UCC. And they are the official committee of the unsecured creditors of Voyager Digital, which will be like people like me, potentially people like you. And they're having a town hall meeting today, Wednesday. Shoot, it's Tuesday. Two days, excuse me. Thursday, August 11th at 5 p.m. Eastern time, depending on where you're at in the world, it might be a day ahead or two days ahead if you're in Thailand or something like that. But just so you know, there is a link in the description. And if you follow me on Twitter, you can find this as well. It's going to be a live town hall. You can put things in the chat and talk about what could potentially happen. This is where you can take control of things. I linked the video in the description so you can check it out. But just so you know that who's putting this on? It says McDermott, Will and Emory. Well, who the heck is that? It's just a law firm. It's a law firm that is part of the committee and there's a bunch of different people within it. So if you have some of your crypto like myself, which is still on Voyager, it might behoove you to come in here and figure out what's going on and what the next step are. Again, the big picture is things that you can actually control. So that's just a little public announcement of PA.  I know people are freaking the F out about this and I can see why.  The Treasury Department is sanctioning DeFi mixing service under a cash. The move is the agency's second sanction of a mixing service and arguably the first design to take down a DeFi protocol. That's not good. Treasury accused tornado cash of laundering more than $455 million for North Korea's Lazarus Group. Well, that's a bummer. Unfortunately, they didn't shut everything off for North Koreans, just Americans. And just so you know, Infero and Alchemy are now blocking access to tornado cash and this is where it all hits home. Which is responsible for U.S. D.C. freezes U.S. D.C. funds and tornado cash is U.S. Treasury sanctioned wallets. Here's what it comes down to. Circle as blacklisted some tornado cash wallet addresses. The U.S. D.C. and the affected wallets is now frozen. Centra, the consortium behind the U.S. D.C. coin stablecoin has blacklisted wallet addresses controlled by tornado cash following the U.S. Treasury sanctions against the crypto mixer. Centra stopped the movement of at least $75,000 U.S. D.C., which is $75,000 by blacklisting tornado cash wallets in the sanctioned list. Let me say that again. Centra stopped the movement of at least maybe more, $75,000 U.S. D.C., $75,000. Circle is regulated company and conforms to sanctions, compliance requirements, that's from U.S. D.C. By blacklisting the wallet addresses, tornado cash will no longer have access to the U.S. D.C. funds in those wallets. This is because when Centra blacklists an address, the owner becomes unable to receive or transfer funds. The consortium formed by U.S. D.C. issue where Circle and exchange platform Coinbase also froze about $100,000 in U.S. D.C. belong to a wallet address in July 2020. Wouldn't that be a great reason to get into Tether? Hold on. Tether has frozen 653 addresses on Ethereum over the last few years, just so you know. Taneo cash's site appears to be down. Its GitHub page has also disappeared in the hour since the OFAC announcement, so here's the thing. I know people are freaking out because they're like, this is the beginning. This is where it all comes down to. This is the start of awful regulation as they shut everything down. And maybe it will be. I don't know. I have no idea. I don't think anybody really else does either. So I know 75,000 is quite a bit of money to lose, especially if that's one person. That is the truth. But is it the end all be all right now? But Rob, as you understand, this is a slippery slope. Before you know it, shut down Bitcoin wallets and everything else just like Canada did and everything. Maybe I don't know. I can't control that. I know what you can control though. If you're in the United States or any part of the world, you have a representative that you can contact, right? So if you don't like what's going on, maybe instead of worrying about it and freaking out, why don't you contact your state representative or your government representative of wherever you're at and say, we don't want this. We want to move forward and we don't want stifling regulation. So again, you can sit here and freak out about it and worry and whatever else or you can take some action. So that will leave me my next point. Mark Cuban and Cardano. So there is this great interview over on Altcoin daily. And Mark said some things and I got to be honest with you.  But you have to get rid of the noise and cut through the truth. Dogecoin is more potential application than Cardano. I'm not going to get into Dogecoin. I don't really care about that. So this is what Mark Cuban said. You know my thoughts on Cardano because he was asked, what do you think about Cardano? He goes, my thoughts on Cardano are the same as they are on polygon and Ethereum. There's got to be a there. I don't know what the heck that means. There's got to be a there there. I'm sure that means something. Cuban says he looks at the number of transactions on a blockchain calling it a bellwether of success. I guess the people in Africa are not using Cardano as much as they expected because you don't see the transactions. You don't see the fees. So before everybody starts yelling at the screen, especially Cardano lovers and Ethereum lovers and everything else. Let's look at some facts just to be sure. If we take a look at if this is true, there's a great website. He always talks about actually crypto fees.info. I linked in the description. You can find it's pretty simple. If we take a look at the one day fees for Ethereum, 2 million, 17,000, $12 and 74 cents. And the average is 2.6. Oh, it averages seven days. So what's two times 30? I expect 60 million a month. Good for them. And of course Uniswap and Ave. And they are, of course, built on Ethereum. Binance Smart Chain, Bitcoin, a different. Solana is different, Avalanche. Well, Polygon's Layer 2 solution. And of course, people will say, but Rob, Ethereum fees are crazy high as opposed to Binance Smart Chain, Bitcoin, Solan and Avalanche, which is true. And actually, if you take a look at the average price, this is Ethereum gas tracker. I didn't link this in the description. You've got to find it. Do some work. You'll see that the low today between these three places, open C, Uniswap and USDT, about two bucks, 250. Uniswap, for some reason, is super high, $650. So like around four bucks, I guess, right? $4 for gas fees, which would probably lead to you a lot of higher prices. I get that. And then there's this part here. You know that there's going to be a merge coming up. And just to be clear, that's not going to help much of the transaction fees. This is just the second step in the eventual ETH 2.0 transformation. And Vitalik comes out and says, look, Layer 2 solution makes crypto payments make sense again. And he states this, so today with rollups, transaction fees are generally somewhere between a quarter and a dime. And in the future with rollups, all the improvements to efficiency that I talked about, the transaction costs could go down to a nickel or maybe even like two cents. So much cheaper, much more affordable, and a complete game changer. And the Ethereum's co-founders view, Bitcoin and other assets will soon be able to provide this use case once again as scaling solutions and not to be outdone. Don't forget, lighting network for Bitcoin, that makes the transaction fees super low. Gradually bring the cost down to a fraction of a cent. So if you take a look at what Mark was saying, you know, if he wants to say it's the bellwether, which is fees and transactions, I mean, that's one part. I think as time goes on, Ethereum won't be expensive. But don't get all high and mighty Cardano holders, just wait for this. On this channel, I'm not here to give everybody the great news that they want to hear. I try to give you the information that you need to hear. And this is one of them. So let's go down that hole. So here, first of all, I just want to make mention of this, XRP transactions. And this is also Bitcoin and Ethereum. I linked this also in the description. You can check this out. But if you can see right here, the XRP transactions are in orange. They are like much, much higher, not much, but a little bit higher than Ethereum, kind of on the same level, right? And then, of course, in blue is Bitcoin. These are the transactions. Not that many transactions, but this is okay. And Ethereum's got a lot. And if you notice one thing about the crypto fees over here, you have to scroll down pretty darn far to find Ripple. And if this is correct, that's insane. $568 per day when you got as many transactions as Ethereum? Well, that's something's not right. Well, XRP is pretty cheap. I won't say that. But then just notice, I want you to notice this, that in the red, Ethereum transaction says 1.25, 1.2, 1.4, and then around 1.16 yesterday and today. There's this great website called Masari. I link that in the description too. You can find it, verify this stuff. And this is all of Ethereum's transactions. Because remember, Mark said about there's fees in those transactions. That's the bellwether of success. He's right. It is. Ethereum, you're looking at transaction count 1.6, 1.4. Roughly the same as the other one. 1.16, 1.2, 1.459. There's a lot of transactions. That is true. So even if we go through and we talk about Cardano and how inexpensive it is, transactions are not there. That's just the truth. Take a look at Masari. Transaction count, $74,000, $68,000. That was a big spike over here. November 22, 2021. But it's still pretty low. So to go back, and even though what Mark said, I was like, this son of a gun, he's right. He's right. Cardano doesn't have a lot of transactions. They don't. Ethereum has a lot of transactions. Ripple, XRP have a lot of transactions. So if that's the bellwether of success for right now, unless I'm missing something, it could sound off in the comment section, but that's just the truth. Now, does that mean that Cardano can't make it up and have a ton of transactions moving forward? Sure. Why not? But at this point in time, and the amount of money that's being moved around, of course, transactions for Ethereum are much higher because it's so darn expensive. Now, transaction fees are low. But if you look at the transaction count, just by the transaction count, it isn't there yet. So I have to take a look at that and say to myself, well, Mark was right on that one. So that's all we got.  I have invested in Cardano. Hell, I've even got a stake pool. But that doesn't mean right now that it's on par with Ethereum. These are the facts that you have to accept. When in doubt, zoom out, take a look at the data, and are you missing the big picture? The big picture for right now is that's what's going on. That's what I got. Let me know what you think about that in the comment section. Let's move into some Q&A so everybody can roast me.


This is Think Tech Hawaii, Raising Public Awareness. Oh, my name is Stephanie Mock, and I'm co-host of Hawaii Food and Farmer Series. Think Tech is important to our community because it provides a platform for all the important issues in our society. For the first time, Think Tech Hawaii is participating in an online web-based fundraising campaign to raise $40,000. Give thanks to Think Tech. We'll run only during the month of November. Then you can help. Please donate what you can so that Think Tech Hawaii can continue to raise public awareness and promote civic engagement through free programming, like mine. I've already made my donation and I look forward to yours. Please send in your tax-deductible contribution by going to this website. Thanks for ThinkTech.causebox.com. On behalf of the community enriched by Think Tech Hawaii's 30-plus weekly shows, thank you for your generosity.


The study evaluated the feasibility of recruiting and randomizing Medicare-certified nursing homes for a pragmatic cluster randomized trial comparing high-dose versus standard-dose influenza vaccine for their facility during the 2012-2013 influenza season, using minimum data set, MDS, 3.0 and vital status records for pre-specified clinical outcomes. The study randomized 39 nursing homes, coordinated vaccine delivery, implemented web-based data collection, and accessed MDS data, demonstrating feasibility. There were no differences in decline in functional status, but a lower adjusted relative risk of all-cause hospitalization, 0.680, 95% Ci, 0.537, 0.862, P equals 0.001 and NH mortality, 0.834, 95% Ci, 0.678, 1.027, P equals 0.087 in the high-dose group compared to the standard-dose group. This article was authored by Stefan Gravenstein, H. Edward Davidson, Lisa F. Hahn, and others. We are article.tv, links in the description below.


My name is Harold Smith, I'm one of the co-founders of a company called Monkton. At the core of what our business does is we developed a platform where government agencies can build mobile applications that conform to NSA's NIAP standards. So NIAP is mandatory for national security secret and top secret systems. Our goal was if we can build a product that satisfies TS environments, that can roll all the way down to FO, UO, CUI, SBU kind of environments as well. So by going, tackling the hard problem, it's a lot easier to solve the simple problems. Along with that, we have built in support for NIST AAL-2 and AAL-3 credentials. So AAL-2 and 3, it defines hardware tokens, like so if you work for the government, your CAC PIV card, we can support those tokens, the soft cert versions of them, as well as Yubi Key and a few others. So we actually were part of Yubi Key's recent iPhone support, so they rolled out or rolling out the 5CI keys, which can go into the Lightning ports. We can do PIV, NFC and OTP off that, or I think it's OTP off that. So our whole goal is, could we give this SDK platform to the Candy Crush developers and could they build classified mobile applications? That's sort of our criteria of how we actually do all of this. So to prove our claim, since any vendor can claim conformance to anything, we decided to take our product through the NSA's accreditation process, which is called NIAP, which is an extension of common criteria. It's a National Information Assurance Partnership. So if you want to be a component that can run in an NSA secret or top secret environment, you have to go through formal validation with the NSA. So that involves hiring a common criteria test lab, which is authorized by NIST. They do an evaluation on your product, and the NSA then validates that evaluation. It takes about, you have to be done within 180 days, but the average is about 90. If you aren't done in 180 days, the NSA kicks you out, and you have to start all over again. So it's a lot of incentive. How many people are here with federal government? So all of you commercial people have it so much easier, because when you get into FedRAMP and the fun things like that, 180 days would be unheard of in FedRAMP to go through. So collapsing that timeline down for us, especially on the software side, is really important. We took our iOS version of our product through that process, and we're going to be taking our Android version through that process as well. We don't have to do it. We just like to do it because it's a good part of our story. So I'll just read through my slides or bullet points anyway. So what was our life like pre-GitLab? We were using a lot of what I consider hodgepodge tools together, so I'm not trying to slam on their competitors, but we were using Jenkins. Runners for Jenkins are, I can't think of the right word. I know Master Slave is the wrong terminology anymore, but agents, yes. It's of GitLab to run, compile. It was tedious, I think, is the right word to use. It felt like we were trying to keep the plate spinning 24-7. Getting runners up and running on hardware was pretty difficult. For to build iOS applications, you need a physical iOS or macOS server. So you have to install the Jenkins software on there, set it up, and then sort of manage it. It just became tedious in many ways. So we even deployed this in AWS and we ran into some issues of just trying to keep instances running, databases, security. It was just unmanageable for us, being a small company, trying to be lean, trying to automate everything. So we started using GitLab earlier last year, and that really became our path of how do we help automate everything for our customers? Getting away from the traditional process of build it, submit it somewhere. I don't have to sell the whole CICD story to everybody in this room. I would hope not. How do we go from a very tedious manual process to something that's completely automated? And most important of all, we wanted to build out a process that our customers could leverage. The end goal was we want to eat our own dog food that we're going to sell to customers, and that was really important to us of a planning goal of our migration to GitLab was how do we ensure that what we're doing is something our customers can use? And that was where sort of base lining with FedRAMP was our table stakes of we have to do this in order to move forward. So as I said, our table stakes were, it has to be a process that our customers can leverage, from deployment to disaster recovery to, yeah, there we go, finally. Thank you all. For deployment, disaster recovery to setting up runners in an automated fashion. Within AWS, we use a series of cloud formation scripts that we built so we can just say here, launch this, it's up and running where we want it to go. Reality, it did take us a little bit longer than we wanted and that wasn't because of GitLab, that was more of constraints on our side. We thought we'd be done in about three months or about five months to get everything over and get a lot of the automated process done.  So there are a few things that documentation, scripts, there's just no need to automate some of this stuff. So one of my takeaways for everybody is look at what you're trying to automate and what are your end goals. Is it a project specific set of goals that you have out of it or is it a group of projects specific goals and really define what needs to be automated, why are you automating it, what tools are you using to automate it and sort of wrap your head around where are you trying to get. For us, the process is much, much easier. We are doing things that I wouldn't been able to do about a year ago from some of the automated testing we're doing. We've actually built some of our own CICD tools for command line. So if we want to do dynamic application testing, there's a company called Now Secure which we partnered with where they can actually test your mobile application on a physical device that's been rooted so they can inspect web traffic, what secrets have been stored in key stores, all those good things. And with other CICD tools, it was very painful to integrate with them. In a few hours, we wrote a command line tool to be able to upload the binary. It takes about 15 minutes for it to scan, so it'll just sit there and wait for the results to come back. And if the results fail, it kills the merge. So it allows us to put those controls in when I'm going from feature branches to dev master to master branches. We can really control that. And the same goes for some of our static testing. We're using some of the built in Now Secure static analysis, but we're also using third party tools like check marks to continue building upon that. So as I look at regulated industry government, it's not just what one tool am I going to be using to do static testing or dynamic testing. It's what suite of tools am I going to grab so we can get a better picture. Because I don't believe any scanning tool that's going to give you dynamic or static scanning is going to give you all the results you want. But if you layer those tools on top of each other, you're going to be testing for a lot of different things. And in reality, one of the big things we did as a company was, so part of our platform is a server hub that gets deployed into Amazon or Azure. GitLab really enabled us. We decided late last year to get rid of as much technical debt as we possibly could as we start to scale out in 2019 and going into 2020. We were deploying everything with Docker. It worked, but that really wasn't where we wanted to be. So we've made a big push to serverless computing. So for anybody that doesn't know, serverless is I just throw code somewhere. Amazon manages it, deploys it, sets up servers. You don't have to really manage anything. In my opinion, it's the one cloud technology. Nobody's really leveraging yet. Everybody's going Docker containers. But serverless is something completely different. So if you're thinking about serverless, I entirely recommend it. So as I said previously, we've integrated third party static testing, dynamic testing. And those really, so our build process is developer checks and code review. It begins the code quality analysis after code review, static testing, dynamic testing and then deployment. So that static and dynamic testing, after you get through code quality checks, that's really a determination for deployment. What we've really tried to show our government customers is, this stuff really isn't hard. There's a lot of fear, uncertainty and doubt out there of, it takes a long time to build and deploy something and it just, it's simply not, I think probably everybody in this room knows that deploying anything really isn't. You know, unless you really want to make it difficult, it actually isn't difficult. So our overall benefits, our real goal is we want to eat our own dog food. So what we're building out from how we configure and deploy build servers for iOS applications, we're automating that. We're even going down the path of, Apple has this program called device enrollment where I can, when you order a device you get the serial number for that device. You can put it into an MDM and then you can automatically configure it. So we're trying to go down the path of, can I just register that Mac OS build server with Apple when I turn it on, it downloads Xcode, downloads all the build tools, downloads the GitLab runner interface. So it's just automatically deployed. That's a lot easier said than done. There's no real easy way to do that. But it also goes to, we learned a lot of lessons on building GitLab runners. So how many people are using runners to build things Docker with Docker? So for those that might not know, GitLab runners are where code can be compiled or you can run tasks within GitLab. So we have a series of runners, we have one for .NET. So it's a custom Docker image that has some extra tools built into it. It's actually been hardened a good bit beyond what you get from the Ubuntu images. We have a custom Android runner, which is horribly bloated. It's about 10 gigabytes, which is a lot, but that's just the tooling for Android. So once we check in code, the GitLab runners pull that Docker image down, compile everything in there. The beauty of that is, now you have an environment where I could debug locally and figure out, okay, why is this not compiling? Maybe it's an issue with the environment. But then you're getting that repeatable result when you have it in the cloud. We were exclusively using within AWS GovCloud, Amazon's container registry to register those images. It just made it a lot easier for us. I know GitLab has some of the tooling to be able to be its own registry, but that was just easier for us. Yeah, so one of the other things, we can go from app code, check in to live on a device in 15 minutes. So I'm going to beat up on the government on this one. There's a government agency we're working with, well, indirectly working with. For a mobile application update, it takes between one to two months to get it from submission to live on devices. I know it's like everyone's like, what is that? But it's just the reality. They have a very manual process. They have integrators on site, inspecting the applications, looking for vulnerabilities. They have nothing automated. We did a demo with our partner NasaCure using GitLab about two months ago where just went and changed the color on the application, checked it in. It ran through NasaCure in about 10 minutes, published it to MDM. And within 15 minutes from code check into deployment, we had the application updated. So I really like to push back on people that say a lot of this stuff is hard that it really isn't. It's just a, what is your determination of risk? I think with a lot of this automated deployment stuff, it's going to be education for executives on how do you determine risk for this system? Some things you might want to take a month to dig through, but probably 99% of the solutions you're going to be pumping out, it can be pushed out automatically. So I think the deployment process for GitLab is going to be, what is my risk? What's the risk to the organization and how do we mitigate those things? There's a lot of interest in the government right now, software factories, and if you can't determine what your risk is for your project, you're not going to be able to automate anything, in my opinion. And my favorite right now is with serverless, we can deploy in a minute and seven seconds production ready from code check-in. Now, if you tie in more testing, that obviously takes longer, but I love serverless from that aspect of, I can just, our website, all our documentation, our blog, are all serverless and we can just update like that. I can sit here on my phone and make a change. So with tools like that, you really are starting to get, in a CICD process, you're really starting to see where we can actually go when it's not a process. We're not worried about process anymore, we've solved all that. What problems can we solve? So I know I have another five minutes to talk. I figured if anybody had questions or comments, criticism, sorry, it took a while to get everything sorted, but yes, sir. So when you mentioned the entire process of developing the application, in terms of the risk management piece, you mentioned you're doing SAST and DAST. How much of that are you sharing with your government customers in terms of, you know, compliance and governance? Yeah, so everything, I mean, we give them all the reports, they have access to all the reports, when we originally deployed the application, we actually had one of the NSA labs dig through and try to find vulnerabilities as well. DISA actually also had people dig through it. So it sort of validated our, well, here's all the automated tools that are giving us this output. So, you know, why do we have to add these other controls on top? And then, you know, the risk came down to, you know, what's this, what backend systems are we integrating with? So our Air Force project, Bryce, this was, you know, nobody laughed. It was the air, we deployed it in December of last year. It was the DOD's first mobile application that used cellular slash Wi-Fi that connected to a legacy mainframe going through the cloud. It's phenomenal that that was the first, but it was. So, you know, there are, at least our government customers are still trying to come to grasps of, you know, even though it is a managed device, even though it is an application that they've run through testing, what's the risk of having some of that airplane data on the device if they get, one of them gets lost? They already, there's about a pilot of 200 Air Force maintainers using that. They've already lost, you know, one of the devices was stolen out of their car already. So, you know, it's all, you know, what is the risk of that data getting out there? Okay, well, we're encrypting it on the device with the key the user enters when they enter the application. So ideally that mitigates most of the risk, but, you know, it's really dependent on the project. So, you know, how are you building that risk mitigation into your pipeline? It's probably a good question. It's probably independent, you know, maybe that's a good feature for GitLab to add of, here's your risk score of this project and, you know, so feature requests. Yeah, so, and I will say, so our Air Force project started off before we were migrating into GitLab and now that we're in the process of migrating it to it outside of contract, simply because it makes everything so much easier to use, obviously under contract, but it wasn't a deliverable, but now that we have these tools available, it's really how do we automate, how do we make things faster? So our customers can get to that point when they finally get some of their processes figured out where we can deploy this stuff in a day versus two months because that two month life cycle or that two month cycle of deploying is a killer of agile development. I mean, you can't develop agile anything with a two month deployment cycle, so. Could you talk to the governance aspect? So part, what we've run into some time, okay, technically that's feasible, but I have authority to operate or I'm a financial, could you maybe talk about any of the lessons learned you had about incorporating the governance process so that it could take advantage of this technology that you've done? Yeah, so some of the governance came down to of, you know, who it, you know, from the level I look at, who has access to those repositories. So, you know, it's control of, you know, there are some organizations where if you're part of the organization, you get access to all the code. I'm not a big proponent of that. You know, I'm a very much a proponent of need to know. So if I don't need to have access to that mobile application or server stack, I should not have access to it. How are you doing your code check?  What are you doing for static and dynamic analysis? You know, our customers have to accept that those reports are valid, you know, that's up to them. That's a determination we can't make. But it's trying to show the government, here's how we're trying to limit the risk that the solution, you know, these integration points are presenting. So there's no silver bullet from it. I mean, we're still arguing with our, you know, some people or some of these things. So, you know, it's so a little bit surely.  So it's just trying to get them to come to grips with, you know, commercial industries and doing CICD for years now. There's no, there's nothing really scary about it.


Minnesota we're on our way down to Shiller Park Illinois which in my mind is the same thing as Chicago Illinois we've got to deliver this lumber there first thing tomorrow morning it's been a great day so far we just woke up but I just know it's going to be a good day you gotta tell yourself that every day it's going to be a good day more often than not it'll turn into a good day it's what you're making so we got this lumber behind us still four lifts on the front three in the center here and two right at the back and that pretty much equals our weight perfectly it's almost right to the back here so on my rear trailer axles here i'm sitting at about 31 000 pounds on these two axles and on my drive axles behind my truck there i'm sitting at about 33 000 pounds which is good because you want to carry the weight you don't want to pull the weight so you want if you can arrange it in a way that you have a little more weight on your drives than on your trailer it'll give you a much smoother ride because if you have the heavier weight on these axles over every bridge connection and every bump you're going to get a donkey kick your trailer is going to hit it and push your truck forward and it's going to be very uncomfortable but if you carry the weight on your truck it's a much smoother ride do you like my new stickers i told you i was going to put the canada flag on the truck i also got it up here and the flag of my province in canada manitoba over there and i got the us flag on my mudflaps so i think i'm representing my my region that i that i haul in okay so that is my province flag i've told you this many times before it's got the union jack in the top left corner there and it's got the cross of st george with a buffalo beneath it that is the flag of manitoba the flag of ontario is exactly the same except instead of a buffalo in there it has three golden maple leaves i think the buffalo looks better really personally it really does bother me that manitoba's flag is practically identical to ontario's flag we're two very different provinces of manitoba's western canada ontario is eastern canada but for some reason our flags are almost identical and they're very close to the original flag of canada as well which was the the royal end sign which was exactly like the manitoba flag red background union jack on the top left except the canadian crest was where that buffalo crest is that was the flag of canada up until what 40 years ago or so is a little more than that 40 50 years ago and then they changed it to the maple leaf which some people like it some people don't but i wish manitoba had its own flag bothers me that they that they don't it looks very much like ontario's but i don't trust the government right now to create a new flag because you know with the way culture is right now they would totally totally mess it up with all their wokeness they would totally mess up the flag and then that the new flag wouldn't represent me whatsoever and then i wouldn't like it and i'd be sad so well we're just gonna stick with it we're just gonna stick with the flag the way it is and uh move forward it's not that big a deal i just i like flags they usually represent the people the the flag represents the people it doesn't represent the land like i like the u.s flag for for instance to me it doesn't represent the land here that it that they occupy the united states flag to me represents the united states people their constitution their way of life their their belief system you know flags are important to me you know you see a hammer and sickle flag you you know where they stand on a lot of issues you see an american flag you know where they stand on a lot of issues you see a canada flag i don't know that could be anything all right let's get out of here get to rachel illinois before all the parking lot is full i think that they look so ugly on vehicles i always wonder why would you put a bumper sticker on your car and like to face your car and bring down the value even faster then it's already going down a bunch of bumper stickers on you know what i mean bumper stickers that's cool it's your thing bumper stickers on your car at least put them on straight bumper stickers say no these guys got none see that's classy mind if i see a bunch of bumper stickers on the back of a vehicle that doesn't look classy to me it looks trashy no offense makes the car look kind of red naked trashy you know what i mean is it just me not a bumper sticker fan but what bothers me the most because it doesn't really have anything to do with me but i have one that's sitting behind you staring at your crooked bumper stickers at least put them on symmetrically sticker in your car permanently put it on straight does anyone else get bothered by that when people put like bumper stickers in there just all over the place doesn't really matter they're not even really straight they're totally crooked you can tell they were literally just like smacked on as they were walking path too excessive and i try to make sure there's symmetrical an actual bumper sticker a permanent one on my tailgate you know i got magnet stickers i always get the there's exactly like a bumper sticker but they're just a big magnet right now just stick them onto my tailgate i want to let the world know my message then at least i can take it off when i'm tired of it or if i ever want to sell the truck or any of you those people you know which people i'm talking about or any of you one of those people has like 50 bumper stickers on the back of your car just let me know let me know and what do they say what's your message let the world know you obviously got a lot to say if you got 50 bumper stickers i want to hear it a small town in wisconsin out for a walk i forgot my gopro in the truck so making do with the phone camera with the terrible microphone i do got a huawei phone or whatever you say huawei but i can guarantee you our next phone is not gonna be a huawei i think i'm gonna go uh might get a google phone next not too sure i'm kind of disappointed in the capabilities of this phone but i mean it does everything it's supposed to i guess getting a little chilly it's not as cold here as at home as you can see there's no snow out here yet you can tell it's gonna come soon the sun goes down so early now already now daylight saving time i you know i don't like daylight savings time what a dumb idea and why can't we just stick to the same time i always have to confuse everybody twice here changing the clocks i don't like it i think it's dumb i like places like the sketch one that never change their clocks never they're always just on the on the same time must be extra confusing for them if they ever move out of the sketch one like the manitoba or alberta and then having to learn to change the clocks back and spring them forward and spring and back and fall i don't know it'd be much easier if we didn't do that so in fall time the sketch one's the same time as us in manitoba central time and in summertime they spring away from us hang out with their buddy alberta for the summer and they're in mountain time much easier excuse me we're just doing laps around this industrial zone we just came from out that way it's like this big square block i like walking in the evenings around the weekends through these kind of zones because there's zero traffic so i don't have to worry about cars all the time i'm just focused on getting my walks in trying to get back in shape so bellies and getting a little big again i thought i was maintaining my weight and i weighed myself before i left and i'm back up to 217 and a half pounds it's a little lighter than i was when i started my working out campaign or before the wedding i was at 225 then and i went all the way down to 195 i'd like to get all the way down to 180 that's my goal so we'll see i'm starting a little late in the year i didn't do my walking this summer like i wanted to procrastinate procrastinate procrastinate and now it's getting cold already i want to get myself down to 180 so that's 27 pounds 25 pounds let's say that's our goal i want to lose that it's also good for our heart to get out of the truck get the blood pumping a little bit as a truck driver you have to make sure you stay active you have to force yourself to be active because our job we're professional sitters we sit all day really unhealthy and it invites early heart attacks it's also really good for this guy he's getting older eight years old now gotta keep him in tip top shape as well i keep his his heart healthy i always i always say that you know having a healthy heart is sort of like having a healthy engine a diesel engine if you idle your truck non-stop that's all you do you just idle it all that gunk builds up in what i would say is the arteries of the truck or the heart of the truck right it used to be before the age of def all that gunk would burn out as soon as you left in the morning right and that blue smoke would come out the stack as it burns off all that crud from idling it's healthy for a diesel engine to be working hard same thing for a heart it's healthy to get your heart pumping you don't want it idling your whole life so this town that we're walking around in here is called Baldwin Wisconsin or any of you from Baldwin i'm walking around your town well around the industrial zone right now on the south end of town parked at the quick trip by the interstate i'm walked up here and just been doing laps probably doing a good three laps around this neighborhood and then walk back i'm counting my calories again i'm using that my fitness app i'm keeping track of everything i eat and drink trying to keep it under 1500 calories per day until i reach my desired weight then i'll bump it up to 2000 a day max but when i go for a walk like this i'm expecting to burn about 400 calories that adds on to my 1500 so then today i'll be able to have 1900 calories and still lose weight it's a little tedious but worth it in the end i think what do you think diesel yep just going on a weasel walk man keeping the weasel heart healthy yes sir well that felt pretty good just over five kilometers or around three miles got a nice uh grilled chicken southwest salad from mcdonald's here i think i made good choices today let's get back on the highway still got about five hours to go before we stop there's a little town here though 200 meters turn left on 55th avenue and then turn left in 140 meters all right caron choices gotta get more healthy let myself go for way longer than i wanted to couldn't believe it when i stepped on the scale of i'd gained 10 pounds since the last time i weighed myself i didn't even notice it but yes i was wondering why i was so out of breath you know when i would do the simple tasks and simple chores i'd get out of breath a lot faster right i'm starting to worry it won't now make sense getting fat or anyway 100 meters turn left on 10th street us 63 i can't let myself get any fatter than this i never wanted to be heavier than 210 i wanted i would like to stick between you know like 180 to 200 200 max but not absolutely no heavier than 210 now that i'm 217 that's uh that's the final straw that's that's the line right there across the line in one kilometer turn right on to your pathway oh there's room to park here oh no problem oh that's an exit only over there oh no that's that's an entrance or exit i don't know i'm going in this way let's see if i can get into one of these spots here in the hole this is really close together oh boy yeah i'm gonna try to get in there Karen i know you're confused i got into a parking spot and everything is a real tight spot i got in there i walked around the truck i said nope i don't trust the other guys not to hit me when they leave in the morning it was such a tight lot i didn't feel comfortable there i don't want my my hood ripped off in the morning i don't want to get backed in too late at night so karen's all confused now because we went down the road to the next flying jay it's a much bigger parking lot with uh much more space and room i'll easily be able to park here and not have to worry about getting hit in the morning let's see what they got here seems like there's quite a bit of space if this jb hunt would have not taken up the entire space here i could have fit in there i might still be able to fit in there no that bob tail is taking up too much space shoot well i could probably sneak in there i will see i like to park off on the side where i won't be bothered i think i'm gonna park over here right in front of this old scale diesel we got the best spot here those of you who know south below it the flying jay here they have this abandoned scale that we just drove past right i'm not abandoned but they don't use it anymore anyway this is where we parked i almost never get this spot because this spot always goes so early you know off here all by my lonesome nobody to park beside me nobody to bother me that's what i'm talking about uh-huh and i left my tractor on the level ground there so that i'm not like rolling out of my bed so my at least my truck is level you know the trailer goes up angles up here a little bit onto the old scale hub where they used to have it but that's okay i got all my brakes set the truck is level and my steer tires are facing the curb so if the worst were to happen and somehow my truck were to become charged with air while i sleep magically i would roll that way but that would take quite the miracle so you bet we are going to have a fantastically quiet night here double check all the brakes again you guys are my witnesses they're pulled it's gonna be a good night so we got 10 hours from now till when i can start doing my pre-trip i gotta take 15 minutes in the morning make sure the truck's all still together not falling apart making sure no tires are going to fly off and kill someone making sure there's oil in the engine making sure all the lights are you know all the basics you know the basics make sure i'm not going to hurt anybody and then we'll be on our way into chicago this is as close as i parked to chicago i was going to go down to rachel but we're running a little later than i thought we would because we stopped for that walk so it was an expensive walk because now because of that i'm going to take the toll road down uh what is that interstate not 39 interstate is that 90 or 94 90 that goes from the wisconsin border straight into chicago right whatever it's gonna pay a few tolls but it'll save us about an hour or so and we'll get there a little earlier tomorrow i still don't have a reload but i'm guessing i'll have one sent to me tomorrow morning sometime i just want to get unloaded as early as possible so that if there is a reload that i can get there and get it done tomorrow afternoon hopefully or at least make it a possibility make myself available to do that because uh i would like to head back home that way i'd be back home Tuesday night but if i only reload Tuesday morning i'll only be home Wednesday we'll see trucking am i right trucking it's always an adventure thanks for tagging along on the adventure today with me great to have you here there's a lot of fun got our exercise in ate good food today we made good choices i encourage you to do the same the best choice you can make right now though is to hit that subscribe button on my youtube channel trucker josh vlogs hit that little bell beside it because apparently if you're just subscribed to me you may not be notified that i release a new video every day hit the little bell that way you get a notification and hit the like button share it with your friends if you want to show all your friends how awesome the videos are if you didn't like it give it a thumbs down and share it with all your friends to show them all how terrible they are now you all got your homework i'll see you tomorrow


Hello, world. Okay, so what is Toybox? Toybox is a fresh implementation of the Linux slash Android command line. It's BSD licensed. It draws from POSIX, the Linux standard base. It's good enough to build Linux from scratch. It needs to be able to replace Android's toolbox. It picks some stuff up from the Bashman page, and so on. That's not the interesting question. The interesting question is why is Toybox? The smartphone is replacing the PC. Mainframes were replaced by mini computers, which were replaced by micro computers, which are being replaced by smartphones. It's a standard disruptive technology cycle. The 8 to 16 bits to 32 bits to 64 bits things are sustaining technology changes within each cycle. But each time, the PC wasn't good enough that the mainframe and mini computer people initially paid all that much attention to it, and they did a standard upward retreat as described in the Innovators to Limit by Clayton Christensen. It becomes more general purpose as it matures. The PC started out booting into ROM basic. It didn't run native code. It didn't even have a real operating system. It grew out of ROM basic. The smartphone needs to grow out of Dalvik. Dalvik is this generation's ROM basic. Note that successful tablets are big phones, not small PCs. So attempting to move the previous generation's technology down into the new space, if you know anything about disruptive technologies, that tends not to work well. Last time around, the MicroVax was an example of mini computer makers who made a PC form factor mini computer that didn't help. In terms of ergonomics, the main objection to, you know, I can't use this, the keyboard's tiny and scrunchy, and I can't use it to replace a PC. It's got a USB hub on the end of it. Sorry, it's got a USB connection on the end of it. You plug it into a USB hub to charge it. Add a USB keyboard, a USB mouse, and a USB to HDMI converter, and you've got the hardware of a workstation. It's got a gigahertz processor, a gigabyte of RAM, and several gigs of storage in it already, and you can trivially add network mounts or USB drives or whatever else you want. Up here somewhere, I pre-opened several tabs that I would use and then lost track of which ones they were. Here we go. Oh, I have them in order the other way. This is an example of a USB display that's 1024x768 plugs in USB, vanilla kernel has support for it now. There will be better ones coming along. But that just gets you the hardware side. And yes, the hardware will improve. I'm sure that wireless charging is coming and the ability to associate with things via Bluetooth or something will happen eventually, so you don't have to actually plug it in, although that raises fun security issues. But right now you can do it through USB. But that doesn't give you the software side. The phone is not independent of the PC until it becomes self-hosting. The PC itself was initially cross-compiled, the software on it was cross-compiled from mini computers, and then it grew out of ROM basic to GW basic and QuickBasic and all those, and that gave us Turbo C and QuickC until the OS itself could be built on the device and it was self-hosting, and that's the point at which it no longer needed the mini computer. I note that this disruptive technology cycle that we've seen several times before, it's not that the old platform goes away, it's that it's not what you have in front of you. People initially used to go stand in line to submit their punch cards to the mainframe operators and wait around for their printout to come back, and when you could sign up for a time slot at the mini computer terminal down the hall, you didn't need to do that anymore. You submitted your jobs to the mainframe through the mini computer, then you didn't need the terminal down the hall when you had a machine on your desk, and now you don't need the machine on your desk when you have a machine in your pocket. But the software that Android needs to become self-hosting, by the way it's, I'm jumping ahead, the software it needs to become self-hosting is four things. It needs, the smallest self-hosting system is a kernel, a set of command line tools to run configure and install and make as a bunch of shell scripts it calls out to. It needs a C library and it needs a toolchain. These are the four things. If you saw the LLVM talk a couple of sessions ago, EGCS2 is LLVM. That's the new name of EGCS. That's probably the toolchain we're going to. For the C library there's a project called the Musil Lib C that's about to have its 1.0 release. It's a BSD license C library that already builds the Linux from scratch project. And for command line, I'm writing Toybox, which we'll get into. So these are not yet solved problems, but they are solvable problems. Why not just extend Android's toolbox and Android's Bionic C library? And the problem is there's nothing there. They're pretty much stubs. It's an intentionally locked down system because the smartphone is a billion unadministered fully powered Linux systems with broadband access. From a security standpoint, they wanted to reduce their attack surface down as small as possible and shoehorn everybody into a Java VM sandbox. Which is nice, but we have to outgrow that. And as we outgrow that there are going to be issues that I'll get to. The compiler is still a bit of a problem, but after seeing the LLVM talk from earlier and if you didn't see it, go watch the video, I think that's probably what's going to win for now. I'll just skip that bit. Do we really care if Android or iPhone wins? Imagine if Microsoft was competent. That pretty much answers that thing. Apple sues bloggers who leak details about their upcoming things. Steve Jobs' first act when he came back was to put power computing out of business. They had licensed clones and that stopped. Apple does not see Linux as an existential threat, but the Apple versus Franklin decision is what created proprietary software in the first place in 1983 by extending copyright to cover binaries, which were previously considered just a number. That's not copyrightable. That was open source because source could be copyrighted and binaries couldn't. The whole founding of the Free Software Foundation in 1983 was actually a conservative reactionary movement to changes in the industry. Yes, it was a good thing to oppose, but that doesn't necessarily make them a visionary. What's happening right now is that there's something in business called an S-curve where if you chart the market share of something, or the number of units, it looks like a big S. Even if you plot it on log paper, it looks like a gradual thing, and if you don't plot it on log paper, it just shoots up off the top of the thing. This is pretty much what happens when you get a period of exponential growth. Periods of exponential growth are always finite because you will run out of atoms in the planet. We will run out of people who could benefit from a smartphone who don't already have one in a finite number of doublings because there's only so many people on the planet. It does turn out that there are more pockets than desks though. We're definitely going to have more phones than PCs could potentially ever have grown to. When the S-curve flattens out again, this is standard business stuff, when the S-curve flattens out again, whichever platform has the largest market share at that point is probably going to continue to grow to become the de facto standard because there's a positive feedback loop to being the biggest one in any platform that has substantial network effects. The telephone is the standard example of network effects. One phone is useless, two phones can only call each other, but when you have three phones, each phone can call two other phones. Every phone you add to a connected network makes every other phone slightly more valuable. There is an exponential growth in value to the size of the network. It's not squared, it's slightly larger than one, but it's still really cool. This positive feedback creates de facto standards that are natural monopolies and you can be as sucky as Windows 3.1 and still be nailed to 90% market share just because everybody wants what everybody has. People write software for whatever has the most seats, people buy whatever has the most support. There are, you can argue that putting everything in the browser that Java's write one everywhere will save us. People have been trying to get away from that for a long time, but I'm not counting on that. So question, Android is not vanilla Linux and we've all been doing vanilla Linux. Do we want to oppose that or do we want to accept it? There are several reasons vanilla Linux didn't succeed on the phone and isn't going to. One of them is that it's probably too late for a new entrant because we do have established leaders with a significant lead and it's most likely to be a winner-take-all thing when the music stops. This is the third generation of Mac vs. PC. The first generation was the Apple II vs. the S100 CPM systems. Then we had Mac vs. PC, now we have iPhone vs. Android. We've had purists before who said that DOS isn't CPM 16 or Linux isn't a real Unix and that hasn't really been a winning argument. I mentioned that the MicroVac shows that disruption goes up market, not down. Unity and Windows 8 suck both at being desktops and at being phones and that's a real problem. OpenMoco was out, was our Windows CE. It was out before iPhone and Android and Linux in the phone didn't really take off there. There's a significant problem with pre-installs which is that you need channel partners and they're all basically claimed and getting your thing through a channel partner has some serious latency of multiple years. Steve Jobs was dealing with AT&T to do the iPhone back around 1995 and it's been a decade and almost two I think. Other thing, there's a major problem. The open source development model cannot do user interfaces. I actually have a longish write up about this part that I don't have time to go into. But essentially anytime shut up and show me the code is not the correct response to the problem at hand the open source development model melts down into one of three distinct failure modes. We either have endless discussion that never resolves. We have everybody goes off and implements their own idea and then we can't unify them after the fact either. Or, and this is my favorite one, delegating the problem to nobody where you separate the engine from the interface and concentrate on the engine and hope that some glorious day someone writes an interface that's nice or you make it so configurable that the fact that you still don't know everything it can do after a week of study and still has no sane defaults is now somehow your fault. Open source doing user interfaces is like Wikipedia trying to write a novel. It doesn't work that way. We have solved portions of Brooks law but too many cooks still make the soup taste bad. We've solved the nutrition aspect but the aesthetic thing, our model is built around defeating Brooks law with distributed disconnected development nodes that feed together and then have empirical tests where everyone can agree this is the best way to go. When you're dealing with aesthetic issues and there aren't empirical tests saying this is the one true superior approach out of all of these when it just matters that you pick something and be consistent and pull it off well. Chinese food isn't better than Mexican food but if you can't pick which one you're cooking the end result may not be fun. I could spend a lot of time on this but I don't have it. Let's just say that Linux on the desk, we've had the year of the Linux desktop 20 times now and the fact that we still haven't broken one or 2% market share is a systemic problem. Android doesn't have that problem because Android does have one novelist dictating the plot. Android does have somebody in charge. We've had several projects that had somebody in charge in open source development. I remember Mozilla wasn't considered particularly useful. Galleon forked off of that. Mozilla rebased on it and went okay the committee is in charge of the decisions again. Firefox forked off of that and then Mozilla went okay, we like what you're doing but the committee is going to be in charge again and well committees produce beige. If you're lucky committees produce beige. If you're unlucky they produce the DMV. Okay so enough of that. So trying to replace Android with vanilla Linux given what we have now and given that precluding the iPhone from becoming the new de facto standard helps us avoid a world of lockdown hardware and software we probably want to get behind Android and push and do what we can to clean up later because Android is at least salvageable. Android is not open source development. It's regularly updated abandonware but we can fork at any time if we need to and we may be able to get stuff through Google's not invented here naval gazing if we shout loud enough maybe. Okay so Android is not copy left. Is this something we're going to oppose or something we're going to accept? Well there's a problem. The GPL was a category killer. It was synonymous with copy left the way GCC became the de facto standard compiler the way Exchange became the de facto standard spreadsheet and so on. There's no the GPL anymore. GPL v2 was a terminal node in a directed graph of license convertibility. You essentially all you had to know as an engineer is is this license GPL compatible or not? If it's not, ignore it. If it is, treat it as GPL. And we're good, we don't have to be a lawyer. Well there's no the GPL anymore. The Linux kernel and SAMBA can't share code even though they implement two ends of the same protocol.   There's no universal receiver license anymore. People say well just do GPL v2 or later. Then you can't take code from either one. That's not an improvement. So what a lot of people have done is they have jumped in the absence of a universal receiver they've jumped to the other end universal donor. That's BSD or similar licensing staying as close to public domain as you can. There are a lot of people who are actually going the most common license on GitHub is not specifying any license at all because they're taking the Napster approach and going copyrights to dumb to live. It's like the patent law. The only thing you can do is civil disobedience and hope it goes away. I'm not convinced that's a good idea. I mean there's other people who are saying that maybe this will be a replacement for GPL 3. Additional fragmentation that's going to help.  What's essentially happening is copy left is dying. And androids no GPL in user space that's not necessarily their original reason for doing it but at the same time attempting to to solve the problem of copy left now being badly fragmented into incompatible camps. I don't think we can. I think going with okay we need a BSD licensed user space is pretty much our option given the tight time deadline of we really want to steer this transition we want to capture this transition so we don't get locked out of future generations. So in the absence of universal receiver people are going with universal donor. Okay so why not extend Toolbox and Bionics instead of replace it. I mentioned that a little bit. The security issue I talked about as as the phone outgrows Dalvik the way the PC outgrew ROM basic and runs native code that it can build itself that opens the can of worms of security issues now that we have broadband internet access. The solution that looks like the best thing is Linux containers because that's a generic solution to making the system nest attempting to break up root into a bunch of capability bits while it's nice a bunch of people have pointed out that about half those capability bits are equivalent to having root because from there you can crack root as it is now. It's kind of like saying we had one fireplace that we were paying very close attention to make sure that it didn't burn the place down but we decided that was bad so we gave everybody their own handheld canned heat thing so everybody has a little fire and that makes everything much more fire proof now. I'm not convinced about that. My problem with SE Linux is that you don't get watertight by plugging the holes in a colander. I don't like the direction of the approach. It increases the complexity of the system and we're talking unadministered systems so if you need 20,000 SE Linux rules in a stock Red Hat Enterprise install or whatever the number is these days are you sure you've guessed everything and are you sure that this won't be your own security system performing a denial of service attack on new software that you attempt to install that you do want to work? These are unadministered systems making them more complicated. I'm not convinced is the best approach but this is an area that the problem with Linux containers is that I can't really do an analysis of is this sufficient or is this not because it's not done yet. It's still cooking. Linux container shows an awful lot of promise and it's something that the kernel guys are pushing really hard and it's something that Android can get by re-syncing with upstream. The thing about the Android kernel is it's the vanilla kernel plus stuff. They didn't remove anything they just added stuff. So if vanilla solves some of these problems Android has a history of taking that if they didn't already implement their own solution that they feel like doing. But anyway, this is why in the one-pointer release of Toybox I'm not really paying attention to SE Linux. I am paying attention to containers. If it turns out necessary to add SE Linux I can be talked into it but that's a huge amount of work that I'm hoping to be able to avoid and I'll get into the reasons why in a bit. As I said, that one's a judgment call. So, what we need out of all that earlier here's the problem set we're trying to solve. Musil is being developed by a guy named Rich Felker. He's Dalius on FreeNode. He's doing a very good job at making a very competent C library that should be able to replace Bionic. The LLVM guys are going full bore at making a GCC replacement that could actually be pre-installed. The problem with GPL licensed software, GPLv2 or GPLv3 is you'll never get pre-installed through the vendors unless they violate the Android policy of no GPL in user space which most of them don't want to do. So, if you get BSD licensed ones it can actually be a vendor specific install on top of the base Android thing or it has the potential of being integrated into base Android either by come up with something like Cyanogen Mod that is a rebuild with extra work, a layer on top of the Android open source project and the Android open source project is a Google internal consumer of the Android development whose job is to export it. And if vendors like Samsung or something wanted to rebase on essentially something like the Alan Cox kernel instead of the Linus kernel if they wanted to rebase on Cyanogen Mod instead of the raw Google thing I don't know, that's a whole political layer that can be dealt with later, how you get these things upstream but I do know what the constraints are that will prevent it from being upstream. So we need a BSD licensed command line implementation that has to be simple, readable, security audible and minimize the attack surface but provide more than Android toolbox does now by a couple orders of magnitude, well, order and a half. The simpler and more readable it is the easier it is to security audit and if you have a billion Android devices out there worms and viruses going through them if people start doing online banking through this thing you don't want anybody installing key loggers and packets and stuff like that it is an enormous issue and the way to deal with security is make it so everybody can understand exactly what the code is doing at first glance. Spot single point of truth means you only need to change it once a thing about code reuse it's good if it accomplishes single point of truth and making code simple and readable and not redundant and things like that it's bad if it makes you pull in code you don't need a lot of people go code reuse is good therefore I'm going to reuse code I never had a first use for so they suck in 12 different dependent libraries that it's like okay I'm only using 3k of this library and it's 70k library so there's a lot of code I'm pulling in that needs to be installed on the system that could potentially be called but I'm not actually using it minimizing your build dependencies minimizing your environmental dependencies is actually a good thing and these are lessons from raw busybox I maintained the busybox project for a couple of years I put out the 101 through 122 releases you probably already knew that so I'll get into when I get back to the toy box specific parts I'll talk about why I started toy box but a lot of this I learned on busybox busybox already does some of it but it's got the wrong license and it's lost a lot of the simplicity okay another thing ifdef considered harmful the linux kernel guys already know this there's a famous paper called ifdef considered harmful busybox is full of ifdefs now you don't want your code to be full of ifdefs because it makes it really hard to audit see what it's doing we need good support for linux containers although this is mostly transparent from within so it's possible that if we don't have time the upstream LXC project if they get that working on android the correct response may be just okay use that and then run toy box in the containers it doesn't have to be integrated it should be a drop in replacement for android toolbox just on general principles it should be sufficient for self hosting a development environment remember a significant part of the point of the exercise is so that the smart phone can be independent of the PC so that it can replace the PC so that we can actually use smart phones as workstations if it can't rebuild the OS that's on the phone itself your development environment is not real it should be standards compliant it should have no external dependencies I mentioned not even endcurses and zlib to avoid the code reuse that isn't actually reuse because there's no re there's just use it should probably be a multi-call binary that can be statically linked and dropped on a system in part this basically just allows you to add it more easily to a system that doesn't have it it's generally a nice thing to have you can multi-call binary versus non-multi-call binary is just a packaging step you can change that later I note that I did try making some of these commands shell script snippets that gets into a little detail we're not going and it should be portable between Linux and Linux by which I mean Android Linux versus vanilla Linux versus different distros if there's ever a 4.0 release it should still build cleanly I'm not particularly worried about portability to all the strange unixes that the GNU tools have this huge configure step for where they're probing for the existence of the same header three times because is the header does the header exist is the header usable and then the third one just says probing for the header in a way that what are the first two doing the huge configure steps of the wide variety of environments that this builds in well you want to depend on your build environment being compliant with POSIX 2008 and if it isn't fix your build environment you want to your tool chain to be C99 if it isn't fix your tool chain we do want to try building with GCC and LLVM and PCC and stuff if possible but special casing a bunch of different platforms rather than relying on standards is not necessarily a good way to go okay so now we've gotten through the first main part of the why we get back to what is toy box what is the one quarter of this problem that I have bitten off and determined to solve for myself you know someone else is taking the C library someone else is taking the tool chain and the actually Tim Bird the founder of self has an android upstreaming project where he's attempting to bring the android kernel and the vanilla linux kernel closer together both by adding stuff to the android kernel that it doesn't do but most vanilla systems do and the android user space and pushing patches upstream into vanilla that have been languishing in android for a long time other people are doing that part I'm doing toy box so toy box started in 2006 when I left busybox I decided that I could do a better job than busybox by starting over I had other reasons for leaving busybox Bruce Perens but the reason I started toy box is I believe that I could do a cleaner simpler version than what busybox had become busybox had explored its problem space experimentally and by the time the project was 10 years old busybox had a pretty good idea of what it should do and a lot of scar tissue left over from finding its way so a lot of what I did on busybox was actually clean up work and there was still so much more clean up work to do and as a large user base was pulling it in many different directions it was developing scar tissue faster than I could clean it up from conflicting users Alan Cox said that a maintainer's job is to say no I like to use the analogy of I submit my short stories to a magazine and the editor picks a small subset of them and mostly bounces them back with a letter saying you know I'm rejecting this but if you make these changes I'll look at it again and a personalized rejection letter is a good thing open source development works that way a lot a maintainer has to do an awful lot of saying no to clearly define what is part of this project and what isn't and how do I want the design to look and how do I want the implementation to look and it's really hard and your users are always pushing in different directions than you necessarily want to go it's hard I mothballed the original toy box project starting around 2008 it tailed off for a long time because I proved that I could do a better job than busybox but busybox was there it had a 10 year head start it was good enough it had years of my own work in it it had essentially a dozen full time developers a very large established user base you couldn't displace it by being incrementally better and I really didn't want to sabotage my handpicked successor who's a great guy with pretty reasonable technical judgment he just doesn't keep the code as clean as I like but pretty much I had many other things to do with my time and the toy box worked tailed off and I actually tried to push a significant amount of it upstream into busybox busybox is using the toybox patch command for example the changes to busybox so that all the definition of one command was in one C file and you could just drop one C file into the busybox source code and the build would automatically pick it up and offer you the menu config option and it would generate the help text for you from that thing and you know the command would show up in the multiplex just from one file completely separate that was toybox stuff that I explained to Dennis Flesenko himself in 2010 we finally got to get together and go okay here's what I was going for and he added it to a busybox in a way that I consider less clean than toybox but a lot of the infrastructure went upstream toybox was relaunched in November 2010 when Tim Bird looking you know okay we need to extend vanilla kernel to better support android we need to extend the android user space to better be a you know linux system came to me talking about his proposed bento box project which was going to extend android's toolbox to be to do a lot of what busybox did and I pointed out to him that I spent years working on toybox I have a significant head start here and I've done the research for everything else I need to do I just haven't implemented it yet I've done the copyrights to all this code I only had like five other contributors so I could contact four of them I couldn't contact the fifth so I had to remove his code which I feel bad about but I could triage it I could relicense it to something compatible with the android user space licensing guidelines and I could take it from there and the reason I got involved in busybox development in the first place was due to a project that's currently called aboriginal linux aboriginal from the beginning where basically I was creating the smallest self-hosting development environment I built linux from scratch and then I went well can I replace all these GNU tools with busybox and uclibc and stuff the answer at the time was no so I fixed it and I spent years fixing it and I can do it again a lot of those commands I wrote all of the code of with no external contribution and others you know I wrote the busybox mount implementation it wasn't all my code but I know exactly what's involved when I get the time to do that one and he was actually thinking maybe I can rustle up some corporate interests in helping out here and some of the FSF guys who were totally unwilling to accept that gplv3's main effect was to undermine gplv2 freaked because one of the things I had done as busybox maintainer was to start a round of license enforcement lawsuits because Eric Anderson the previous maintainer had left me the hall of shame which was a list of these people are shipping busybox and never gave a source code and it was years old and he was trying to publicly shame them which yeah that'll work really well with the for profit corporation and I went okay I can't maintain the hall of shame so I asked Pamela Jones of groc law can I get some legal representation pro bono and she pointed me at this new thing the software freedom law center where ebb and moglin the co-author of the original gplv2 had started distancing himself from the FSF he used to run the FSF legal arm he now spun it off into an independent entity and I went okay fine contact these people and see if you can take source out of them and over the next year we got source releases from a dozen or more different companies and not one line of code went into busybox as a result of this because the code that they had was useless I mean okay yeah they took a random SVN snapshot ported some more stuff back from a future SVN thing commented out a bunch of line we were using subversion at the time for source control we got out a bunch of stuff hardwired in some constants because they didn't know how to use the config system and made some comments that made no sense none of it we wanted in our tree we just wanted to see what they'd done so I actually since then posted some mails to the list that went into the busybox web page about okay the policy of busybox with regard to the gpl we're not going to sue you like the FSF sued the MEPIS distribution considering with Debian and not mirroring the Debian source tar bowls that they hadn't modified the FSF actually took legal action against MEPIS for not mirroring unchanged code and I went okay we're not going to do that all we want to know is what are you shipping what did you do with it if it's vanilla unmodified just tell us and we're fine Bradley has since removed that from the busybox fact his only actual patches to the get repository that it's in were clarifications that took out the safe harbor provisions I'd added because well they got lots of money every time they sued one of these guys so no code but a self financing legal machine that continues to sue people to this day as far as I know and wouldn't stop when I asked because there were other people with copyrights who signed on yeah part of what I was doing with toy box was undermining the ongoing busybox lawsuits that I had started and couldn't stop and that freaked out a lot of the FSF guys and that basically scared away open corporate contributions you know I get contributions on the mailing list from individual Japanese developers who may work at companies in their day job and I'm not asking so but yeah I can't you know like do this is my day job or anything it's all hobby programming but I still want to change the world so that gets us through what is toy box why is toy box now we're going to get into the meat of what does toy box actually implement what is the task of coming up with a command line that actually you know meets this need of making Android self hosting it needs to support POSIX 2008 but not all of POSIX 2008 POSIX 2008 has a lot of obsolete crap in it it still it still specifies the SCCS control system which predates CVS and makes it look good it still specifies it still has a dozen batch processing commands like Qdell and stuff so I triaged POSIX 2008 and there is a road map is one of these tabs I have open well so there's a road map that explains goals and use cases of POSIX 2008 the Linux standard base the standard isn't scare quotes for a reason what it takes to be good at development environment what's actually in android toolbox and then various other packages that do similar things like Caleb see stand alone shell S base S6 red hats old Nash project which apparently died in 2008 having looked at it they had good reason to kill it and Beastie box which was some BSD guys vented some busy box envy for a while into Github in 2008 and then stopped and haven't touched it since but all of these have a selection of commands that they thought were important to include so I triaged all of these and put together a status page of okay POSIX commands LSV commands things that are needed by development environment that aboriginal Linux needed to rebuild itself under itself and build Linux from scratch under the result commands that are in Android commands Caleb see sash S base Beastie box things that were requested by you know various people emailed me and said I would like to use this but I really need blah and the crossed out ones are the ones that already implemented so there's you know all commands I break it up into the things that are still to do and the things that are done you know so these are implemented so let's go back to here so on the web page you can actually get a lot of the stuff that I'm going over now so POSIX is a very good standard it's failure mode is a mission or having things in it that should have been deprecated it hangs on to stuff for a while once it's standardized and it doesn't mention the existence of mount or init so if you have a system with nothing but POSIX in it it will boot LSB 4.1 the Linux standard base supplements it to give you a system that will mostly actually boot although it still doesn't specify a init but it is a deeply crappy standard half of it is deprecating is reversing deprecations in POSIX things that POSIX did manage to get rid of after hanging on to them for too long LSB puts back the Linux standard base documents what's there without a whole lot of judgment about what should be there it has pointy hair disease in certain cases but it's still a good source of information if you're implementing amount command you might as well make it conform to LSB 4.1's command line things Android Toolbox lives in the Android Core Git repository so breaking it out of Android you know Android has a fairly significant not invented here syndrome and this is one of their sort of background jewels so the easy thing to do is just put toy box first in the path and leave toolbox there for now I triaged it I mentioned making sure we have good container support for security what's involved in a development environment I gave a talk here in 2010 that's still online and the slides are the slides are online as well all 260 of them basically I have a new wrapper that appends the command line it's called with to a log file and then calls the next thing in the path with the same name it was called under so you make a directory with this wrapper in it sim link every binary name in the path to this wrapper and stick it at the start of your path and it logs everything that's called out of the path after that and then I have some scripts that will walk against this to give you a list of these are all the commands that were actually called and what stage called them so I've been looking for years at what's involved in a minimal self hosting environment I got that one down and I also have enough for it to build Linux from scratch natively on target I don't separately have to look at busybox because the reason that I became busybox maintainer was so that Aboriginal Linux could rebuild itself under itself and build the whole of Linux from scratch with busybox providing all of its command line utilities that weren't actually the compiler or the linker and I did that and busybox def config has about twice as much stuff as I actually need and I've already triaged that down I looked at the other packages klibc and so on and if you go to the roadmap there's actually specific triaging of each of the packages if you're interested in this first list is everything that it provides the second list is what's still on the to do list that before I can say to the users of sash toybox does everything that sash did if you wanted to switch because as always when you attempt to replace things in a heavily fragmented environment there is the danger of just fragmenting it further if you can't convince anybody to move off of what they're already doing so things it should have it should have good container support and unfortunately I can't tell you today what good container support means because it's still moving target it should have network administration stuff because you need that that's not in POSIX and that's not really an LSB it should have file system support because android tool box has make fat FS and I already did make swap and once that can of worms is opened maybe it should have some of the others I could be talked out of including it but they're actually not very hard because they're essentially just more archavers and I want to implement them as archavers so that you can do a makey 2 FS on a directory pipe the output to GZIP and SSH it to another machine you can't do that with the Jenny 2 FS right now because it's a big M map that does random seeks M dev I designed it in the first place toy box should have it but it should be based on dev temp FS because some of that stuff went upstream and it is one big unsolved problem there's sys 5 in it there's androids in it there's upstart system D needs to die I'm not opening that can of worms because again I couldn't tell you what the edges of it are the catamari de macy theme plays in my head whenever I read about it toy box has something called want it there's also run it in busy box I have to do more study here to figure out how I want to handle in it I'm probably going to lean towards whatever androids whatever androids doing I need to implement that because the main use case is replacing that it needs a shell that's a reasonable bash replacement I could go into why ubuntu replacing bash with dash was the worst technical decision they have ever made and I can back that up but we don't have time some things are more complicated than they seem and should not be in toy box a lot of maintaining a project well is say is what can I say no to what what are the edges of my project if I can't say what shouldn't be involved I don't know where the edges of my project are and it's going to turn into a giant unmaintainable mess various blue sky would be nice things like a hex editor a nine piece file system server io top linus's copy of micro emacs if I can clone that maybe I can get him to start using it that would be nice I doubt it but you know I don't know netcats UDP mode microterm rsync who is kex screen ntp slash rd8 htpd or dnsd maybe memory technology device stuff this is all maybe after 1.0 things or if I you know get bored and then there's a bunch of things that are in like posix for example make is in posix lex is in posix posix specifies a c99 command that belongs in the toolchain that does not belong in toybox if I was going to add strace I'd add it to a toolchain package if I was going to re-implement expect which is a nice thing because killing off tickle would be nice but that doesn't belong here the record commands raptor so that's basically my indexy thing and I probably don't have any time left but at this point questions yes yes in fact I have I've been tracking that and keeping the size down busybox does some tricks to keep its size down that are like weird linker flags to remove elf sections and stuff and I'm focusing on simple first and speed second and size and all that I actually have if you go to landly.net slash toybox there's a what is toybox thing that includes a bunch of goals and things and the standards and stuff and the design docs actually explain that it needs to be fast it needs to be simple it needs to be small and stuff like that but simple is the simplest implementation that provides the necessary feature set and then a little bit of extra complexity to reduce size or increase speed but complexity is a cost and we want to spend as little of it as possible because complexity essentially reduces auditability and we really need security okay we need this code to be as transparent as possible so that lurking bugs that you know cause the smartphone equivalent of the Morris worm aren't aren't our fault did that answer your question okay other questions none? okay well thanks for listening