Believers, hey We we're going to Karazhan now Karazhan for a lot of people is one of the best one of the best Raids in all of wow melee spell okay So just just a quick little explanation a rundown of what I what I'm doing right now because I've been a little bit Quiet lately trying to figure this all out I just went from being retribution DPS Paladin to now a tanking Paladin So now my character is like way basically way beefier to where I could take a whole lot more damage Which is good. I'm trying to put together everything I can as best as possible To get this thing rolling. So what I'm doing right now is I'm tweaking my armor to put together a maximum Defense set my maximum defense puts me right at defense cat. That is big time. That is big time I'm gonna give everyone Salve and then we can just kind of see how it goes like if we end up not needing salve then great We got to listen to Karazhan music chat. We got to listen to Karazhan music I'm gonna crank and I'm gonna crank the Karazhan music for so many people chat This is like just an iconic dungeon of an iconic raid reason being It's a 10 man. It's a 10 man raid and it's the first raid of burning crusades.  This is like a lot of people's first raiding experience back in the day This place is creepy. So a little bit of backstory about what Karazhan is Karazhan is the this tower is like Medivh's tower Medivh is like this legendary Warlock that opened up the dark portal which actually led to the events of what burning crusade is about even happening This is basically his castle. He's a mage. Whatever.  Yeah, this place is like all about organs This place is spooky. Did I miss tables? Okay chat.  Ottoman? Ottoman the Huntsman. It's a two-man. It's auto man Ready check three two one. Yeah, you guys have plenty of room to pump damage into midnight Is this is there an aggro reset? I think there's an aggro reset when they combine. Yeah, so just give it I can't remember exactly This boss is so easy chat you got a stack Nice good job bracers of the white stag and Gloves of dexterous manipulation dude. I'm so tanky With that 490 d-vans. I'm so tanky right now. I think I should probably I should probably take these a we packs and Hold on Guys on this next boss coming up this boss is morose morose drops a few things That are pretty cool. One of which is the well-known Morose lucky pocket watch increases dodge by 38 I remember some rogues would use this with evasion trying to evasion tank stuff. It's like you guys are still Okay, mr. Morose Spin do triangle my gifts you start To one hero them early is everything all good. I'm gous. I'm gous. I'm gous You gotta have to have to be second threat. I have to be saying Okay, kill our triangle My watches, okay, I think we're gonna be okay No, man. I got the girl if I have to okay, I'm Bob sir Okay, I got him. I got him. I'll answer Nice good job Okay, good pick up yay snap time Just like my streams after 30 hours I had my blessing of my blessing of salvation on myself on accident and I was still tanking just fine basically this fight is made into virtue and What we need to do or what she does is she drops like a consecrate constantly throughout the whole thing Yeah, so she does a chain holy lightning just like in for horsemen with Zell those or whatever the z-name guy So what you want to do is you want to make sure that you're spread out evenly enough to where to where you're not gonna get hit by That chain lightning and as far as a we goes she does a long repentance at some point and We need to counteract the repentance in order to be able to keep healing because if you're in melee You get by the consecrate how we're gonna counteract that we can run into the consecrate and it will break it Does Romulus drink and seals and if so is it good? Thank you I Don't know TBD think you need to spread out to Yeah, let's get let in melee. Let's get like a little triangle here. Repentance is going out in about five seconds You want to walk in probably now? Okay with her penance? Okay, and then run out right out I think I'm out of culture a little bit early. That's basically the fight. We're asking for a chain lightning. Did she even do it? Nice good job easy easy Bracers of justice those are really good at palette and healing so the opera event what the opera event is it's a It's a bunch of different Potential boss fights and every week it's random So just you kind of mix it up every week and they're all based off of something. There's the Wizard of Oz There's Big Bad Wolf and there's Romeo and Juliet. I don't really remember how all of them go So yeah, it'll be it'll be fun. We'll figure it out. Okay, drink up eat up I don't remember all the fights all the all the different opera event fights, but Let's get ready to go Nice nice was there boss. I don't remember what dude. I don't remember how was there boss works Oh Yeah, they open up one at a time Yeah fear cat straw man is next I'll pick them up No, I just fight just fire. Oh, yeah, that's right fire damage. That's right.  Okay, so it's round two. It's not over yet The wicked witch of the Northwest or whatever shows up Okay, we have to avoid the tornadoes Nice good job. I don't know that these pull together so let's just I think they did so let's prepare to do that Yeah, so I'll take left you take right sure. Oh, yeah, they did So wait wait, so we stack these no guys Yeah, no whatever gets the debuff moves out of the group. Yeah Yeah, I think I should take curator because it's hard for me to run and stuff So what you want me on the sparks? Yeah, okay? Well, we one shot Curator, this will be the first boss that we didn't one shot if we don't see you go. Yeah, here we go real chat Gallery rules gallery rules will be strictly enforced Mike on I got a solid threat lead That's my threat right there chat things are looking good. They are looking bueno. Okay. This is the big damage Failure to comply Nice job easy dude. This was so hard on the beta That was so eat. That was a joke. That was easier than freakin ottoman. Oh, there's ads there. Oh, we got we got we got ads Drop bows on drop bows. All right, so as when you want to take the ads and let me take them off Yeah, I think that's a good idea chat. I'm using my flasks at times. It's only 400 out though.   She'll be stuck in everybody's heads forever Two one Call out when you want to see them. Oh interrupts to I can't remember what we need to interrupt. So for the blizzard What keeps this chain? It's on Morocco watch where it's moving. It is moving clockwise around the room Okay. Oh flame. Don't move. Don't move. Don't move. Don't move.  Oh Yeah, we got three bosses left. I was just gonna say the chess boss This is if you've ever played chess before it is very similar in Design like the setup is very similar to chess, but it's it doesn't actually play exactly like chess It's really important obviously to keep them footmen moved up Once we start this and the goal is really just to burn down black hand as fast as possible and to keep our king From dying it should be good. This is this is a pretty easy one, but we did wipe on this Once on the beta. I think we're just kind of funny Okay chat here we go chat to war Okay Chat we're going to war the footmen up and get what we can out of them So that way the more powerful pieces in the back and move forward do stuff It is one shot all boss. Did we wipe on a boss? I don't remember Yeah, basically the two primary targets are for I guess the bishops the warlock in the king But we win by killing the king Yes Okay, so this what happens sometimes he cheats and then he puts you in fire. So mudkips you are sitting in fire. I can already hit him I'm hitting him now. Yeah focus on black hand. It's going good. I remember They're just taking longer to kill him. Wow, okay Nice three minutes 18 seconds very good girdle of treachery and Forest Lord striders drop with three two hunter pieces. No, this is the literally Plus healing leather boots. This isn't a hunter piece.  I'll knock you down the one HP just getting in there infernal If you're melee and you get that debuff just run in this corner and just hold w and you won't die got me healers Okay, here we go chat I'm 494 defense and we are Tanking at Prince Mount Chasar is the last this is technically like the last boss of kerosene But we do have two more optional bosses actually technically three Really two we should be able to avoid infernals Then I'm gonna I'm gonna freaking first-class ticket to the show dude, this is awesome. I love tanking.  Yeah, we're gonna do optional bosses, you know this Basically, there's like a triangle of Three different types of beams. There's green beam red beam blue beam blue beam for tank green for healing and Red for DPS if I remember right red for tank. Oh red was tank me and Kalaila will will switch off on the red beam and Will we need to have somebody else stand in and take that beam as long as possible if somebody is not standing in the way of that beam and absorbing it then Then another spike gets the buff and he gets really strong blue beams in the back Yeah, let mug get it pyro pyro.  I have 26 stacks right now. I'm gonna step in Oh Someone get in front of me now. He's another bit. Oh get behind him get behind him Yeah, that's how it that's how it works. That's what I'm remembering. Okay. Okay. Yeah, you're supposed to get behind them No, you don't know you just just go behind them chat Was that the only one we didn't one shot? Oh, they rotated the rotated You you get the red you get the red one red when you guys keep don't don't walk in I don't know why oh, I have a cool down on mine. Somebody else has to get it you have to get it. I'm at 10. Yeah Here just just just wipe it and let's do this right I don't know I would rather just go behind him because because people are running through the beams and then it sits a cool down Let's get buffed. Let's get juiced. Let's get ready to go so we decided it to rotate around him instead of running the other side of the room because if if we run across and Somebody accidentally gets a thing then it'll probably screw it up for the next phase or whatever We could just easily just rotate around him and we can keep DPSing him in the banish phase that way chat It's game time three two one I've given all of you a house time Same over as last time Okay, I got the red This is equal element 24 run through get behind him you want to get in melee range remember You get behind So he's turning so he's He wasn't turning earlier. He just stayed static Well, what the hell? I was always turn the window. That's not I didn't do it like that on beta We did this on the beta on like the second attempt doing it that doing it the way where I said where they just run run behind it Okay, we're good. I'm gonna pull Green beam green beam oh Okay, I got it. Sorry Okay, so yeah, go to the window and then whenever you run back just make sure you don't Red is on the right side. All right, somebody take over Good perfect. Good job Okay, we're gonna run back over here. We battle res That's good. She's building threat healing. Someone's gotta take green room. I'm taking both beams This is way harder than it was on beta All right, our snake. I'm here in ticket. We'll be Taking her right now wisdom is on the boss if you guys need to auto-attack or something. Okay, run away from me Maybe whenever we did this in beta he was post nerf or something and they can I don't know if you need to go That's totally fine at this point. Yeah, I gotta head out. Yeah, that's same. Good job, boys See you tomorrow for round two. Yeah, Gigi's. Good job. Grab some of loot Week one Kara free loot week all that stuff so overall really really good overall really really good raid I kind of like that there there something was left to be seen really really good night overall


Hi and welcome to the session. I am Shashi. Let us do one question. Question is if a is equal to matrix cos alpha minus sin alpha sin alpha cos alpha then a plus a transpose is equal to i where i is the identity matrix. If the value of alpha is a pi upon 6 b pi upon 3 c pi d 3 pi upon 2. Here we have to choose the correct answer. Let us now start with the solution. We know a is equal to matrix cos alpha minus sin alpha sin alpha cos alpha. Now we can find a transpose by interchanging the rows and columns of a. So a transpose is equal to cos alpha sin alpha minus sin alpha cos alpha. Now we have to find a plus a transpose.  Now we will add the corresponding elements of the two matrices.  So a plus a transpose is equal to matrix 2 cos alpha 0 0 2 cos alpha. Now according to the question a plus a transpose is equal to i. So the matrix 2 cos alpha 0 0 2 cos alpha must be equal to matrix 1 0 0 1. So this can only be possible if 2 cos alpha is equal to 1 or cos alpha is equal to 1 upon 2. Now this further implies cos alpha is equal to cos pi upon 3. We know cos pi upon 3 is equal to 1 upon 2. So we substitute cos pi upon 3 in place of 1 upon 2. So this implies alpha is equal to pi upon 3. So value of alpha is equal to pi upon 3. So our required answer is b. Hence correct answer is b. This is the required answer. Hope you enjoyed the session. Take care and goodbye.


And we've been using them for over 400 years to expand our cosmic horizons. And if you have the right one in your backyard, it can expand yours as well. This is your space pod for April 24th, 2015. In order to get a clear picture as to what telescope you should get yourself, you first have to understand some fundamentals about telescopes. Now, we won't be covering what telescope you should buy yourself. That'll be coming in a later space pod. First off, there are three distinct types of telescopes. Refractors, Reflectors, and Cata-Dioptric Telescopes. Refractors use lenses. Reflectors use mirrors. Cata-Dioptric telescopes use a combination of lenses and mirrors. For the sake of simplicity, we'll start off by looking at refractors and reflectors. Whenever you ask someone to draw a telescope, the design they'll most likely whip up is a refracting telescope. These telescopes use convex lenses to magnify the image. With a refractor, the light travels from the opening of the telescope straight down and into your eyes. This allows them to produce exceptionally sharp images. One of the downsides is that there's a limit to the size of a lens in a refractor. Glass is extremely heavy, and the larger the lens, the heavier the telescope will be. From 1610 to the middle of the 1700s, the refractor telescope was the standard for astronomical study. Now, if you'd like something a little bit more modern, the reflecting telescope is probably going to be your choice. The principal difference is that in a reflector, a mirror is used to gather light. The design for reflectors was originally drafted up in the 11th century, but no serious attempts were made to build one until Isaac Newton did so in 1668. But due to poor manufacturing techniques, it wasn't until the 18th century when reflectors rose to prominence. Because a mirror does not need to be set to a certain thickness like a lens does, you can actually make massive mirrors that are extremely lightweight. And the bigger your mirror, the more light you can collect. And the more light you can collect, the thinner an object you can see. That's why today almost all of the major research telescopes on earth, from the Keck Observatory in Hawaii, to the very large telescope in the Atacama Desert in Chile, and even the Hubble Space Telescope, orbiting 550 kilometers above us, is a reflecting telescope. With hundreds of years of heritage, tinkering, and perfection, refractor and reflecting telescopes are exceptional works of scientific endeavor that let you see a bit further than you would on your own. Thanks for watching this Spacepod. I'm Jared Head. Don't forget to comment on social media, subscribe to us, and we do have a Patreon campaign. You can actually find it for just the Spacepods at www.patreon.com. So an immense thank you to all of you who have already started contributing to this great addition to tomorrow. So until the next Spacepod, keep exploring.


What's good YouTube this is what you were back at y'all again with another art video man If you're new to this channel go ahead and hit that like button and comment subscribe Make sure you click post notifications, so you'll be notified anytime your boy drop some heat in today's video What we finna do we finna do another remake of one of my old pictures But this time I'm gonna go to one of my old videos This one saved from two years ago You feel me and this one of my videos where I got a lot of views You know I think this is one of the ones that helped the channel You know I'm saying get to that next level so We finna redo it see how much I improved as an artist Here go to final product I wish it was a way I can say this picture So I can Do it side by side Yeah So we can do a side by side once I done finished remastering This picture you feel me Another thing too if you try and check out some of my music the link will be in the description below So make sure you go check that out You know I'm saying cuz your boy about take over the rap game this year create a game going all the way up All right, okay, I got a nice little strange shot and send this to myself So we can do a nice little side by side This is the it's gonna be the before picture Now let's work on after picture And if y'all want to see the photo I'm using Unfortunately the picture I'm using don't got too much of a good quality They're gonna slow nothing down trying to work our marriage So if you want to know What size I like to draw? Let's go to create new I like to draw 18 by 18 inches Set my pressure.  Let's go ahead and do a side-by-side Improving in a major way the more you practice the better you'll get practice make perfect So the more time you put into your craft the better your craft will be May she hit that like button leaving a comment section of what videos you would like to see me touch on with Tutorials make sure you click that link in the bio. Go check out some music and make sure you stay to him Oh, he coming soon, and I'm idea


Welcome to the Voice of America's Newswords. Finding toilet paper during a pandemic can be a struggle. Panic In March, areas of the United States were told to self-quarantine to slow the spread of the disease COVID-19. It caused people to panic and buy lots of items like toilet paper. Producers say they have increased toilet paper production to meet the demand. Panic is a sudden condition or feeling of extreme fear that makes someone unable to think or act as usual. People often reason poorly when they are panicked and take hurried actions.


and this is a Jenkins developers online meetup on dependabot for Jenkins plug-in development with Oleg Nanashiv. Oleg? Yeah. Hi everyone. Thanks for coming. So just for those who do not know what our developer meetups are about, actually there are many people because we are just starting, it's our second meetup. So the idea is to have regular meetups for people who contribute to Jenkins who want to know more about development for Jenkins, mostly for plug-in development, and we want to talk about developer tools, any kind of best practices. So it's not just about Jenkins. We will be covering common tools, which other software engineers may also use. The idea is to have informal discussions, mostly to focus on show and tell and demos. So we have some slide decks, but we can deviate from them a lot and we invite everybody to participate in the discussion. So we all, yeah, messed up the slides of course. And if you're interested to speak at the developer meetup, if you want to present your tool or whatever, just join advocacy and outreach Gitter channel and we will be able to discuss topics there. So yeah, my name is Oleg Nanashiv. I'm one of Jenkins Core maintainers. I've been with the project since 2012 and I work a lot on different development tools, including plug-in POM, plug-in compatibility tester and the dependable which we discussed today. I actually started doing it in June this year to help other plug-in maintainers to spend less time on routine tasks and to focus more on real development. You also have Mark way on the call. Mark, would you like to introduce yourself? Yeah, so I maintain the get plug-in. I'm the happy beneficiary of many of the initiatives to provide improved tooling to people who do plug-in development. So I'm the very grateful beneficiary of Oleg's efforts and others. Thanks very much. Thank you. Okay, today we focus on dependable. So dependable is one of the tools which allows to automate dependency management for GitHub repositories. If you use Bitbucket or other source code systems that are equivalent bots, but today we focus only on GitHub and only on a single bot. There are other solutions available. If you're interested to get these slides, the Bitly link is shared in the Zoom chat and it's also on the slide deck. So you can just open them in real time unless your permissions are fine. And we will focus on dependable. I will provide a quick introduction and then I'll show how we use it in Jenkins and provide some hints how to properly use it in Jenkins. That's the idea. If you have any questions, again, Zoom chat. Mark will interrupt me if needed. And the results are offline for each channel, platform seek. So historically it was platform special interest group which started using dependency management tools. And if you want to ask any questions, just go there and ask. So the question to you, what's going on between Maven and PM or PM and actually almost any other system? Who does know the answer? You have seen these slides before? Okay. So yeah, actually it's dependency help because whatever dependency management system you use, eventually you end up in a situation when you have hundreds of dependencies coming from different locations, you have transitive dependencies. At some point it's just difficult to understand what you use and you may get various kinds of conflicts. And eventually your Linux system may stop working or your Jenkins plugin may end up with binary conflicts and fail to start up using the Jenkins instance sometimes. So obviously we want to prevent that. In Jenkins, we actually have many kinds of dependencies. If we talk about a plugin ecosystem and Jenkins core, so it's a common excuse for development. Jenkins core may include a number of libraries which are exposed to consumers as API. So Jenkins right now doesn't have fast isolation in between plugins and between libraries. Plugins depend on Jenkins core. Plugins may also depend on each other and plugins may depend on libraries. In so much cases, we have multiple plugins depending on a single library. For example, it may be Jackson, it may be Snakey Amal or the commonly used dependencies which are quite popular and plugins may require them. And we also have some cases where plugins and Jenkins core depend on a single library and sometimes plugins require a higher version than Jenkins core. It's technically possible, though you won't be touching these parts because it's definitely not recommended. Why did we start working on the dependency management in Jenkins? You may have heard about Java 11 support project in Jenkins. And one of the things we had to do there is to update many dependencies because we needed all libraries to be compatible with Java when we needed to update development tools. And as you may imagine when you do bulk updates, things start falling apart. Sometimes it's difficult to record what happens. And for me, the main takeaway from that project was that actually we should have been doing dependency management not in bulk when we need something but actually gradually during the project lifetime. So we would be picking recent dependencies, assuming that we have good CI, we would be able to discover issues, but we would be able to provide recent versions to API consumers and to our users because libraries also include bug fixes, sometimes they include security fixes and generally we want to stay on top of it. In Jenkins, the most popular tool chain is Java and Maven. There are some plugins which use Java and Reddle, but Maven is the most common tool. And in Maven, there are plugins which allow to actually display available updates and update them. So for example, there is a common Maven command, but if you just run it, you would be running it manually. And since we are talking about automation server project, it's definitely not something we want to do. We want to automate the dependencies and to automate the dependencies, there are many tools. The most popular ones are Dependabot, which we are discussing today. There is also Renovate, which is more focused on front-end projects and GreenKeeper. All of them are available as GitHub applications and they integrate with Jenkins GitHub stack well. But again, today our focus is Dependabot. Dependabot may be the most compelling tool for GitHub, because GitHub has acquired the Dependabot last spring. So now Dependabot is the fact that part of GitHub is available for free, for private source, repository, obviously for open source as well. And it gets a lot of adoption. You can use Dependabot in two ways. One is CLI2. So you can just run it externally. But what you can actually use with GitHub is GitHub application. So it's a tool which runs in source and integrates with your depositories and with common GitHub tools.  And this is what we use. So the idea of Dependabot is to just submit pull requests with dependencies. Probably I could just show it live. Do we have any questions so far? I don't see any in the chat. And I haven't seen any come in through platform sync. I think we're okay. Okay. So yeah, how it looks like in practice, Dependabot submits separate requests for which dependencies. So here you can see that there is a lot of pull requests being submitted by Dependabot. For example, a recent update for JUnit. There are some updates for Maven plugins like JMaven plus frontend Maven plugin. We also receive updates for test libraries. This is plugin POM. It's a base POM for plugin development. So the most of that are about development tools. And here if you go to each of these pull requests, we can see that there some additional information provided. So for example here. So what do we have here? There is a pull request. Again, it's submitted automatically. And here you can see that there is some change log. Well, this time it wasn't parsed correctly, but at least we have a link. Which points to the frontend where you can see the changes available there. Also you can get a list of commits, which you want to enter this release. And Dependabot tries to do some big data. There is a base here. And it shows compatibility stats across multiple open source projects. Because when many projects use repositories, you can collect some additional statistics. So Oleg, on that compatibility stats, I've seen somewhere the compatibility score was 80% roughly. Is that a concern for me? Should I be worried if the compatibility isn't 100% it's something to keep in mind. So let's try to find something. Okay, Gmaven plus, yep, 80% you were mentioning. And here by the way, change logs are visualized properly in the web interface, which helps maintainers. So let's take a look at this 80%. And here, basically, you can get a reference to the pull request, which fails. So here's just one pull request. So we can assume that there were five builds recently, which you know, of these updates. And here we can see why it fails. So it fails on Travis. So we can just go and investigate. I have no idea what is this report about. But yeah, theoretically, as a maintainer, you can do some analysis and evaluate the risks for your own. Okay, so so I've a less than 100% is not an immediate guarantee. Don't use it. But it is an in a chance to make an informed investigation. Shall I shall I go ahead? Thanks. Exactly. So this is what dependable basically does. You enable it for your repositories and it starts sending you pull requests. And one good thing about a dependable that it actually supports many technologies. So it's not just about Java million. It also supports Gradle. It also supports other languages like JavaScript Ruby.net. Or if you use GitHub actions, go, you can also find package manager for them. You can see that some, some tools and the beta state. So it means that there are some changes happening there. For example, for Maven, at some point, there was a issue with multimodal repositories now fixed. They keep evolving in order to support advanced maybe features because you can pass versions through properties, through bill of materials, et cetera, et cetera. So what we use in Jenkins now, we use dependable for Maven, for JavaScript Ruby and for Docker. We will briefly talk about this packaging. And if you have any questions again, just ask. I have a few slides about enabling dependable. But again, let's just take a look at that in real before I have chosen one of my repositories, which is called job restrictions plugin. So it's just a plugin for prevention of job execution when user has no permissions based on ownership or other conditions and also for protecting master. So here right now, I don't have dependable enabled. And if you go to the plugin form, you can see that there are some dependencies defined. So we use a plugin form, the repository I was showing this version is 3.18. So it's almost 30 versions behind. We also have dependency on Jenkins core. And we have two plugin dependencies for test purposes. One is matrix project, another one is matrix authorization plugin. So what we will do here, I just have dependable interface somewhere, yes, here. So I need to enable dependable. I will be using SAS because I don't want to spend time. So if you use dependable in your organization, firstly you will need to add it to your organization. I will skip this step because we already have it in Jenkins. What we need to do next, we need to add our repository to dependency checks. So here I just click a button at the repository. You can see a number of repositories offered because at some point dependable access was granted for them. But there is no job restrictions plugin because I need to grant access. Why we need that is because of permissions. Dependable needs right access to code, to issues and pull requests because it needs to edit labels. It needs to submit pull requests. It also provides chart ops operations. And here we are going to just add job restrictions plugin. So if you are plugin maintainers, you will see only plugins to which you have administrative access. And if you don't have administrative access to your plugin, you just need to submit an issue and we will fix it on the Jenkins project site. So I save permissions. I granted access to this repository and then I will just refresh this page. Okay. And here we have job restrictions plugin. I edit it. By default it will be building for Java Maven for me. And that's what we need to do. So here you can see that there is job restrictions and there is a flag checking now. So we will need to wait for a while. And while we wait, I'll just press it with the presentation because I haven't tried it for this repository. I cannot say what exactly we will end up with. But let's see. Just a second. There are some questions or not in the chat. I didn't see it. Yeah, I don't see any questions there. Although I was noting that you were at the apps.dependabot.com website in order to manage those, to manage the permissions and the controls. Did I see that correctly? Yes, I use dependabot.com. But it's GitHub application. So it's connected to GitHub. All right. Great. Thank you. Okay. So let's wait. So I just opened this repository and you can see that there is already a first pull request landing. So if you enable it for the big project, you may actually receive dozens of pull requests on the first run. But in this case, there are not so many dependencies. So we can just let it run. And meanwhile, I'll talk about more advanced features of dependabot, which we actually use in the project. So release note references have already presented them. And actually, it changes well with the change log automation story, which we will discuss in the previous developer meetup. Because if you use GitHub releases, if you use tools like release drafter, you can get fancy looking change log, which is automatically generated. And you can pass it through downstream dependencies. So you get additional benefits for using GitHub releases for such change logs. Another thing which is useful for dependabot is comment ops.  Okay. So here, dependabot, it has some front end, but you can also talk to it through commands. And there is a number of commands you can use. So for example, if you have some merge conflicts, etc., you can ask to release the change, you can also say that you please ignore this version. If you want to skip it due to whatever reason, you can set some additional configuration, for example, set the review versus assignments. But I didn't use these commands because there is a better way to do it. But these commands are available. So usually what, yes. Sorry, disrupting. I really have found useful to ignore this major and ignore this minor. But in my case, I think I had the wrong configuration, the things I was ignoring. I should have ignored in a config file at all. But Oh, whatever works. Okay. So we will talk about configurations a little bit later. But yeah, it's your choice as a plugin maintainer. In my case, I use rebase a lot. You can also use dependabot merge. And this is intelligent merge. So it will do a merge when CI passes, which is useful. And it combines with CI Jenkins IO, which builds Jenkins components. And yeah, there are some other requests available. Okay. So we also get a few extra pull requests coming in. So for example, this is our plugin form and for plugin form, what I wanted to show, yeah, this change logs. Again, these are fully automatically generated by other tools. So you can use them. And there are two plugin updates. So we can see that plugin form it passed CI. So I could just merge it. And we have test failing. So here matrix project, we tried to update plugin and it failed. So why did it fail? Let's see. Okay. It failed due to require upper bounds. Not surprising. And we will talk about it later in the presentation. So yeah, let's just move on then. So one another feature which Marcus has already hinted is configuration as code. Because indeed, you can configure everything for dependabot from web UI. But in such case, it's hard to trace dependencies. It's hard for other contributors to understand what's there. But you can configure everything using settings. And here you have an example. Let's take a look at another plugin, a strategy plugin. So here you can see that there is dot dependabot folder, and it includes config yaml. And config yaml includes some options. For example, here I say that I do dependency management for Maven in the root. So everything under the root, including submodels, will be checked. Check is a bit clear. There are some default reviewers assigned. This issue was introduced before code owners voted to GitHub. So I would say that right now it's rather obsolete, but it's available. So could you give some more words on code owners and how that applies here so I could skip default reviewers if I were using code owners? Yes, you can. Because code owners is a new GitHub feature which allows to set up reviewers on the global level or based on particular patterns. So for example here we have a GitHub team or all strategy plugin developers, and this team reviews all incoming code requests. So when new pull request comes in, it doesn't matter whether it's dependabot or not dependabot one, the team is requested. So yeah, this feature is rather obsolete. It's not something I would recommend to use right now. And there is a lot of other features available through configuration as code. Dependabot has really good documentation. And here for example, it's not also documentation, they also offer validation tool, which we can use to verify configurations. But for validation, let's see what we have. So you can set up scale, you can set up target branches, if you use multi branchy repositories, reviewers, assigns, labels, milestones, depending on your tools. You can either blacklist updates, so it's ignore updates or allow particular updates. If you want to laser focus the updates, you can set up auto merge. So if you are totally confident in your continuous integration, you can say that if CI passes just merge, no manual action required. Yes, so I've been using milestones in one of my projects, that's a GitHub capability. This will allow me to set a default milestone that should be assigned for, that's great. Okay, thank you. You've shown me auto merge updates, which I need on one of my plugins and default milestone, which I need on another one. Thanks. Okay. Yeah, you're welcome. So what else do we have? There are some languages and some languages also have additional features. So for example, for JavaScript, you can set up live updates because they talk to NPM, receive web hooks from there. So they get dynamic updates, no need to stop daily or whatever, same for Nougat, if you use .NET. But yeah, for Java, we have on there is at the moment, all these, but still is something useful. And if needed, you can always go to the web interface and trigger update manually because here there is a magic bump now, a button, which actually will trigger the updated needed. Okay, so what else do we have in this presentation? Yeah, one thing I want to mention that there is no or quite configuration support. For release drafter, for example, what we do, release drafter is based on the pro board. It's a common framework for GitHub applications and actions. And here we have global configuration, which covers the most of the use cases and this configuration is shared between plugins. It's not what can you can use an independent bot at the moment, but hopefully this feature is coming soon so that we want to need to duplicate the configs and we will be able to define common templates, for example, for Jenkins plugins, because yeah, I'll talk about it later. There are use cases we need to cover, but right now it's available on the manual. Isn't there already hiding in that release drafter that there are labels defined for release drafter, which I should actually use or encourage dependabot to use to flag a proposed dependency update? Yeah, right. So dependabot has default labels. For example, it sets dependencies label on every pull request, which it sends. And when you update the things, what we do in our tooling, we have category dependency updates, which also includes dependabot. So for example, here you can see that between releases 2.13 and 2.14, we had dependabots submitting full requests with configurations called plugin updates. And here is our change look. And there are other updates here and there. If you take a look at another tool like plugin poem, you can see that there are even more of these coming from dependabot, because there is just a lot more dependencies included there. So for example, here dependabot, here dependabot. So yeah, it definitely gets a lot of contributions across the Jenkins organization. Okay, another feature which I won't be presenting, but which worth knowing about is security, because dependabot also integrates with GitHub security. It's tooling which allows silent tracking vulnerabilities, et cetera. Again, it was introduced last spring by GitHub. And what dependabot does now it submits pull requests using security API. So you do not see it in public, but you see these changes as maintainers and you can properly handle them. For example, prepare CVs, prepare security advisors like we do in Jenkins. So updates which with known security vulnerabilities won't be displayed in common pull requests and you can rely on it quite safely. It was one of the main concerns when we started dependabot adoption, but it was at the rest quite quickly. So, Oleg, we had a request to ask a question from Sliden. Sliden, did you want to go ahead and ask your question now? Yeah, sure. Can you hear me? Yes. Yeah. So my question was that I think dependabot also updates Docker images. So does Jenkins use it to update Docker images currently? I'm not sure. That was my question. Yes, we do. So my plan is to finish with my event part because it's the most popular one. And then I have a few examples for the JavaScript and for Docker. Okay, cool. Thank you so much. Okay. I think you do. Okay. So let's speak about Jenkins specifics. So as I said, we started to believe in the dependabot in June. Right now, it's enabled in more than 60 repositories. A lot of development tools use dependabots and plugins use dependabot. And by the time of, well, in December, it created almost 2000 pull requests. So now maybe we are looking at something like 2500. I should have updated this slide. And I would say that dependabot really saves time because if you created this pull request manually, you just have to spend a lot of time if you want to prepare proper pull requests to reference change logs to reference address issues, but dependabot does it for you. So I found it really useful though. Yeah, first burst of pull requests sometimes makes you cry because yeah, in one repository, I've got something like 30 or 40 pull requests, sometimes major bumps with two or three, skipping two or three major versions of obviously say failed. But yeah, that's not the point. The point is that in common, when you figure out all these updates, it becomes quite reliable. And you integrate things credibly. So you don't need to spend too much time. Though there are some pitfalls to know about if you want to use dependabot for the plugin. One thing is that you should definitely use dependabot to update parent form and to update developer tools. So for example, if you use maybe plugins and other components, you should be using it because you just stay on recent versions that bug fixes in the case of plugin form. There is a lot of embedded tools like static analysis, injected test, and again, we update them automatically. So when you keep your parent form up to date, you get the recent updates. Also, what you shouldn't do is to actually update plugin dependencies to the latest versions, because plugin dependencies in Jenkins means a completely different thing than in common, for example, in Maven projects. So if we take a look, okay, let's go back to job restrictions. Let's take something else, configuration as code. So here, if you go to configuration as code plugin, you can see that there is a lot of dependencies that are deployed here. Not a lot. I definitely went to wrong repository. Okay, let's go back to plugin. Yeah, that one certainly declares several dependencies. Okay. Yeah, so what we have here, we define a few dependencies on plugins. You can see here, dependencies do not include versions because I suspect Mark uses a deal of materials now. On this experiment? Yes, that's correct. Okay, so again, wrong. Oh, oh, sorry. So that's, yeah, right. Okay. Let's take safe example. So role strategy plugin. So here you have some dependencies declared. You can see that there is plugin dependency. And here's another plugin dependency. And this plugin dependencies may be in different scopes. So for example, here we have a common scope dependency. It means that our plugin requires matrix authorization plugin version two to two. And if you let the panda boat to update this version, then the panda boat will push it no problem. But what it means that the plugin will actually require newer version of this plugin, and it will force all the users of these plugins to update, which might make sense. But you should be careful with that because your plugin users just lose freedom to manage other plugins. And sometimes if there are regressions in those three months, it's better not talk. Yeah. Oleg, for me, the distinction Hamcrest, for instance, here is altering generated code, not the later runtime environment. Whereas if I depend on a newer version of a Jenkins plugin, I'm demanding something from the Jenkins runtime environment. Exactly. So Hamcrest, he is a test dependency. And for example, folders plugin is also a test dependency. It means only that these plugins are used for testing. It still includes some requirements for transitive dependencies, but these dependencies can be relatively safely updated if you know what you want to achieve. But for these mandatory dependencies, you should be careful. Same for the Jenkins core. So here we have dependency which use Jenkins dot version. So what it means that it's minimally required Jenkins core version doesn't sometimes people do a mistake and follow a very recent weekly, just because it's more convenient. But again, it cuts off, for example, Jenkins LTS users and users of previous LTS versions. So our recommendation is to be careful with updates of Jenkins version and definitely not to pick a recent version. For example, what the practice I use in my plugins is to just stay behind two LTSs for my plugins. If you want to have more insights, how versions impact your plugin, there is a site called starts Jenkins IO. And here we can see plugin versions by Jenkins version. Let's take, for example, Git plugin. Oh, wait, wait patiently. That's a big page. Okay. There, yeah, it's, and this page is, I cannot sing the praises enough of that page in terms of what it helps you see about the distribution of installations of your plugin versions. Yeah, right. So here, for example, I have taken a role strategy. And you can see that the majority of my users are still on the previous LTS baseline. But, but, but they are on the previous LTS, you could, you can confidently say 2.190 is a safe version. If you're going back, you're, you're abandoning 25, well, okay, there are a bunch of users, one, one major LTS back. Yeah. So we had a Christmas break. So you can see that many people still didn't update to the recent LTS. We had a new security released announced for the next week. So yeah, I guess, you know, one week of this situation will change drastically. But according to plugin starts on January 1, this is the distribution we had. So the next month statistics will be more aligned. Okay. Anyway, let's go back to slide deck because yeah, we have some things to cover. So one other thing to be really careful of is library updates. Because library updates, well, they are like plugins, but they may conflict with Jenkins Core, they may conflict with each other. And for what it was, we also have transitive dependencies. Again, you should be really careful about them. Fortunately, maybe now offers tools which you can use. And these tools are included in our standard plugin POM. So if you use Jenkins plugin POM or if you use Jenkins POM for libraries, you get these checks automatically. There is maybe an enforced plugin which applies require upper bound through. It helps to prevent transitive dependencies. So you've seen an error I had in CI before for job restrictions. It's specifically this rule. There are also some additional rules, for example, the extra enforced rules which enforce some bad code compatibility checks so that you don't get updated to versions which don't support Java 8 anymore, for example. And make sure that you keep this rule enabled as well. So the default configuration is quite straightforward. If you don't use Jenkins, you can stop a plugin called maybe an enforcer. And in the configuration, you put a rule like require upper bounds. And after that, this rule gets applied with some tools. And you get the thing running. It helps us a lot with dependencies because again, when you bump one dependency, you may get issues with transitive dependencies. And maybe an enforcer plugin will show you a plug if something is not aligned so that you actually rely on all the version that you're supposed to use due to dependency requirements. So yeah, that's what we use. In addition to that, we have some tools which simplify dependency management because dependency management may be overhelming. If you take a look at Mark's plugin, how many plugin dependencies do you have, Mark? An embarrassing number and every one of them required, every one of them necessary. Okay. So yeah, if you want to see it in an offensive way, we just go to the plugin side. Yes, which is another way to view the embarrassing number of dependencies. Yeah. Some of them are optional, but still optional doesn't doesn't change that. Yeah, absolutely. Yeah. So it's a common situation for all the plugins. It's even worse because there are more in implied dependencies. But yeah, we have a number of dependencies. And you can see that Mark actually doesn't define so many dependencies here. Why? It's because he uses another tool called build of materials. So maybe you can declare dependencies in external repositories. And here you use, where do you declare bomb? Yeah, here. So here Mark declares plugin bomb. It's a repository created by Jesse Greek, which includes some plugin dependencies open it. Okay, so it's here. What it includes, it includes a set of plugins. Actually, quite a number of plugins. I just need to find. Yeah, for example, we can take one 50 baseline. And here you can, okay, I tried. Good to find the list. Okay. Thank you. One thing. So yeah, you can see that there is a bunch of plugins here. And the JC users tools like plugin compatibility tester in order to verify these dependencies. So you can consume this bill of materials and you can be more less confident that these plugins at least don't explode with each other. Because we use tools offered by Jenkins project, which verify these dependencies. And notably, this repository also uses dependabot. So you can see a number of incoming pull requests, which try to update versions. Currently everything is in red, because we have change in configurations, code, APIs, and I guess there are also some infrastructure instabilities. But generally dependabot is used in order to bump the dependencies. And here we can also see some fancy releases. Basically, again, we can see that plugin dependencies updated by dependabot. So if you want to simplify your life, for example, for test dependencies, especially if you use pipeline plugin, then going with Jenkins CI bomb is the recommendation. The Jenkins bomb that Jesse had created made my life dealing with workflow with pipeline plugin dependencies much, much better. I reduced significantly the time required to decode which combinations of plugin versions were allowed to work. Thank you, Jesse. Thank you. Thank you. Yeah. Another side of this, I think, is Jenkins core bomb. It's a new feature which has been added by Mike Cirooli and James Nord in recent Jenkins versions. So it's available starting from LCS 2.204, one which was released in December. But James has also created the backports for previous versions. So basically it's a file which includes information about libraries included in the Jenkins core versions. Because unfortunately, we had cases when the libraries were declared as conflicting dependencies. So sometimes it was leading to various kinds of binary conflicts. And these file aligns dependencies which are used inside the Jenkins core. And if you use recent plugin home versions, you actually have to enable a bomb manually. But we are working on a plugin, a bomb 4.0, which includes it out of the box. And here there is a reference to bomb. Basically, if you use 4.0 better, you automatically get these dependencies as a part of your tool chain when you use the plugin bomb. And you can get rid of explicit version definitions inside your plugin and rely on a plugin bomb to provide it. So you can be confident that each time you build, you build the dependencies required for this particular Jenkins core version. Yeah. So the recommendation for Maven, definitely use enforcers, definitely use a build of materials. If you use complex projects together with good CI and with dependable, you can get a pretty stable flow of updates coming for your project. I want to spend a few minutes on other languages and tools unless there are questions. Anyone? That's great. Keep going forward. I think we've only got about 15 minutes. So I think other languages is perfect. Let's please go ahead. Okay. So what else do we use in Jenkins now? We use Docker and JavaScript. Again, there are other technologies and tools you can use. For Docker, the use case is obvious because if you have Docker, you also have some dependencies. For example, let's open Docker file here. It's for Jenkins file runner. And here you can see that there are a few dependencies declared here. So this is multi-stage Docker build. And here I use a version of Maven. I also use a version of Open JDK below. And here I use a specific version of Maven. It's a right approach. So every time Maven updates, I will get a pull request from dependable. But here I use a tag. This is actually a better approach because, for example, if a new release of Java is delivered and if there is a security fix, then if I use such an approach, I won't get a pull request from dependable and might lag behind. It's not a problem for Jenkins file runner because it's in beta, but for other repositories, it's something you can see. And here's an example of Maven update because the dependable was able to discover Maven. It wasn't able to change the log because Docker Hub doesn't distribute information for official images. So for Docker, you can just get the version and then you have to figure out what's between these versions. But yeah, that's what we have. And for labels, I didn't set up filters. And here what I see is the Java version in this repository. No, it's in another repository in PluginCompat tester. Basically, I used the same approach for the development tool here. Hyperlink. So here you can see that there is update of Maven. And you can see one artifact which is, I would rather consider it as a bug in Docker. But basically, Docker tries to interpolate some versions. They use a lot of manual checks for common patterns. But here you can see that it parsed the version. It determined that a number on the end is actually a part of the version. So here's update from Java 8 to Java 13. As you may guess, it fails. Well, yeah, that's okay. But that's a terrifying proposal because this is saying change the Java, that probably means the Java version, right? And the Java version used to be 8 and they're proposing to go to something that is not a long-term support Java release and is certainly not Java 8. Yeah, good news that you can actually set up filters. When I was talking about what to update and what to not update, I forgot to mention it. But since we are here, let's return a bit. So if you want to set up some rules, what to update, you can use a configuration file. So here I have configuration for ignored updates. And here you can see that I ignore all Jenkins core dependencies. So basically, I don't update Jenkins core. I also do not update plugins located in standard packages. So for Jenkins CI plugins, I use Jenkins plugins. It's not a silver bullet because Jenkins plugins may be released with different group IDs, but at least it covers a majority of plugins.  It's not limited to just these types. If I go to the dependable settings, you can see that they use GitHub API as an example. Much appreciated. But what you can see here, you can also set additional types. For example, version requirements. There are also other filters which are not mentioned here. You can ignore dependency types. So you can update on the test dependencies, on the common scope dependencies. So dependable got a lot of features for maybe already and counting. So yeah, you can set up your own filtering if you want to avoid the cases like that. But yeah, just keep in mind that obviously you shouldn't accept any update. Okay. So for me, the main idea, the main reason to have Docker auto updates is to actually have Jenkins agents auto updates, which is a nightmare at the moment for maintainer. And yeah, we will eventually get there. But right now, docket is also under evaluation for Jenkins project. Same for JavaScript, we have several plugins and components which use JavaScript. Nothing changes specifically. So dependable can determine NPM and can determine yarn and other standard packaging. And for example, I just opened the plugin site. And here you can see that there is a lot of updates coming for JavaScript. And well, it's the same as for everything else. For JavaScript, actually they have much better diagnostics just because there is a lot more JavaScript projects. And yeah, I'm not sure what statistic here. It just takes a while to load this information. But yeah, eventually it will also show information about failing pull requests, also change logs and other things. So you get the same for JavaScript. Basically for other tools, there are some specific Flux available. But it remains the same for almost any technology. So they know how there is how to parse files, how to submit patches, and dependable does it pretty well. The dependency check engine is more or less the same. Okay, just a few items as a summary. And then we will have some time for Q&A. So yeah, if you develop software, consider automating dependency management for your projects. It helps really well. It saves a lot of time in longer term. We already had a few cases when Dependable helped us to prevent security issues because Dependable picked the releases long before the advisory was published and finally we had it post factum. And yeah, if you automate the dependencies, there are tools for that. And today we presented Dependable. But again, it's just one example of a tool. You can also write your own tool if you want for your components. And Dependable is plugable, so you can write plugins for your language. And specifically for Maven, be careful about the transitive dependencies because the most of the problems come from there. If you don't use Maven Enforcer, just don't use Dependable to spend some time in order to add additional static analysis checks. And of course, make sure that you have a good continuous integration setup. So we work on Jenkins. So we are supposed to have a good CA and we actually have a lot of useful plugins. And if you measure your test code coverage, then it's great because you can also discover potential gaps where dependency updates are not covered. So yeah. For us, what's next is to document how we use Dependable. It would be also great to have global configurations. So for example, for plugins, we could have a common template, which defines a white list for dependency updates, which just gives plugin updates by default so that we don't have issues with that, which also disables some library updates because we have API plugins, which would be recommended way. And it would be great to configure that and then to facilitate adoption in more repositories. Because we are still at something like 60 repositories and adoption of Dependable is lower than for other tools because of the complexity. So if you could document that, if we could provide configuration, it would be much more convenient for end users of Jenkins. That's the plan. If you want to know more, there is a lot of information. So there is Dependable website, which includes documentation about configuration as code, about using Dependable, about some pitfalls. This documentation is quite good. We can also discuss everything in the community. Please use platform special interest group for Q and A if you want to follow up after this meetup. There is a developer mailing list where we discuss Dependable evaluation. It was not detective for a while. There were other threads. But yeah, if you want, you can use this one. You can use this one. There is also a bunch of examples, some of them I presented today. So you can just Google for them and check out how we configure and use Dependable to know our repositories. Okay, that's it from me. And thanks to everybody who was on the call. I guess now we have some time to answer questions. And Slavin had another question. So he notes in the chat that part of his proposal for Docker polling project as part of Google summer of code was to send pull requests to repositories when a base image update or security patch had occurred. Could this be done with Dependable or is it rather better to be done with a separate plugin? What's the preference? So one of the problems. So Dependable relies on databases for updates. And there is Dependable doesn't use specific databases, which identify about security updates earlier. So if you are comfortable with eventual updates and eventual security, then Dependable is probably fine. But for example, if you're a customer of organizations, which notify you about security vulnerabilities, which provide proactive scans and other tools, then you might want to implement something on your own. Whether it's a common use case, we had that, but I'm not sure how common it is across the industry. And this part still makes sense. Also, if we talk about JSOC project running security scans for Docker, it has to happen somewhere. For example, in Jenkins, you can use onshore and other tools, and you can provide triple dependencies based on that information. Again, Dependable doesn't provide you much insights or why this update is needed right now. It provides some metadata references to CVs, but you would still need to analyze the impact of this update. Thank you. Any other questions, comments? So you mentioned that there are sometimes security notices. So I received a security notice for a particular Jenkins plugin, a total of 25 installations, a tiny number of installations. Was that coming from Dependable? I thought that was coming from GitHub. What can you teach me about that? So what I can teach you about that? Well, basically, I couldn't teach much without the disclosing potential vulnerabilities, I guess. So the one that I had was UI themes plugin, UI themes-plugin, and it was just an out-of-date dependency. And it said, this dependency is catastrophically out-of-date. It needs to move forward this large number of steps to be fixed. Yeah. So one thing about it is that Dependable is deeply integrated with GitHub now, and at some point, it doesn't really matter. So for security, I believe they use Dependable on their own whatever you configure. It is Dependable course to suggest the dependencies. But if I recall correctly, the full requests are still referenced as Dependable. Okay. Thanks. I can double-check, but... No need. I was trying to comprehend what... I was really pleased to get the notice. It was great to be told, hey, there's a problem. And then think about what does this problem mean? Yeah. If you're interested to know more how Dependable is organized, actually, there are repositories. Dependable itself is open source, so you can just check it out. You can find out the logic, and we had to do it a few times to understand why it doesn't behave as we expected. So Dependable is mostly written in Ruby, but the code is quite good. One thing to keep in mind is about license, because it's not MIT license. Basically, you can use it for non-commissioned purpose, as you wish. So, for example, we can take it and run Dependable as CLI tool on Jenkins infrastructure, actually, if you want. But if you want to make this a commercial feature, then do not. Okay. So it is not a BSD or MIT-style license. Got it. But for us, as Jenkins community, it's perfectly fine. But yeah, we use Dependable as a GitHub application, because Dependable, when it operates, it pulls change logs, it pulls GitHub, so it would consume REST API limit and other things. So for us, it's more convenient to use GitHub. Well, Oleg, we have just very nearly reached our time. Anything you want to say in conclusion? Nothing from me. Just tame your dependencies and be careful with them. Thanks a lot for your time and for watching this video. Thanks, everybody. We'll end the meeting now. The recording will be posted to the Jenkins YouTube channel. Thanks very, very much. Thank you.


Good afternoon, everyone. My name is Martin Donikey. I'm a massive student working with Dr Nick Rattenby at the University of Auckland, Department of Physics. I'm working in the area of gravitational microlensing. The particular project I'm working on at the moment is a data mining project using open source software. I'm working with the MOLA catalogue, so you've probably heard a bit about MOLA today. Just to remind everyone, MOLA is the Micro-Lensing Observations in Astrophysics, which is a joint New Zealand-Japan collaboration, originally set up to investigate the nature of that matter. Just a brief bit about gravitational lensing. As Nick was talking about earlier, space-time is curved in the presence of a gravitational field. The effect of that, as the light rays passing close to the massive object are bent, means that background objects are distorted, producing multiple images. I've got a couple of little diagrams here, so you can see here. We've got the background object here, the lens here, which in this case is a galaxy cluster. Observing from the earth here, you can see the effect of the mass of the galaxy cluster there on the background object. The light-these-right-lays are deflected, and you see these as two separate images here on either side. Here's just an image from the Hubble Space Telescope, just showing us the same real example of this effect. Here we have the foreground red galaxy here, which is the lensing object, and we have this blue galaxy in the background. The alignment in this case is such that it's almost the complete eye and sign ring there. The alignment is almost swollen, so the image is almost a complete full circle around. As for microlensing, in the case of microlensing, the object is typically a star. As we're saying earlier, the separation of the image is related to the mass of the lensing object. In the case of a star, the image separation is quite small on the order of milliart seconds, which means that we can't actually resolve the two images separately. However, if the lens, so in this case a star, is moving across a line of sight, so here's a line of sight from the earth to the source. If we have a star moving across this line of sight here, then that amplifies the signal. Here is just a little to show the geometry. These deflected rays from the source object coming to the observer deflected by the lens, and we see these two separate images, which, as we're saying, in the case of microlensing, the mass of the lens is not strong enough to resolve the two of them. However, if we monitor this over time, so here we have our telescope on the ground, this diagram, the lensing object, is a black hole but it's irrelevant because the only thing that matters is the mass of the object, and again that comes back to what Nick was saying about one of the nice things about microlensing, is that the lensing object doesn't need to be emitting any light, you can still infer information about it. So if we're monitoring this star from our position on the earth, before the lens passes across the front, we see it as its normal background star, the lens comes across the front amplifies the signal so we see it as a brightness. So just to show you a light curve, I think Nick had this one earlier as well, so this is some real data, and we have the different telescopes here showing the data points, so you can see the data sparse and regularly sampled. So yeah, so this is the typical swt you would see for a single lensing object. However, this type of variation, this type of brightening, with time is not something that's unique to microlensing. You see it with a lot of other different types of astrophysical phenomena, so you have a lot of different types of variable stars, cephid variables, RLRAs, et cetera. You've clicked some binaries that Alex was talking about earlier as well. All these different things have been cataloged by Moa as well as a section for the microlensing, because as Nick was saying, the Moa telescope uses a different imaging analysis, so it basically just has a reference image, and it looks for any change whether that's a brightening, any change in brightness. So the result of all that is that Moa has also cataloged thousands of other astrophysical events as well. So at the moment, this data is all just sitting from the mid-90s, it's all sitting just in one of the servers over at Massey, because there's just too much data for anyone to manually go through and look at any large subset of this data. So the aim of my project is to look at ways to classify these data into distinct types of astrophysical event. So just for a sense of scale, so we're talking, in the case of Moa, Moa observes 50 million stars towards the galactic bulging LMC. Gaia here, so that's a space-based telescope, which was started operating just at the end of last year. That's going to be, that's observing the position of about a billion stars across the galaxy. It's going to measure their position with the highest position yet. And LSST, so that's the largest in optic survey telescope. That's going to be coming online within the next decade, and that's going to be collecting about 20 terabytes of data every night. And also as Nicholas was just talking about with Square Kilometre Aray, again you're talking about terabytes a second. So it's an enormous amount of data now, and it really is a year of big astronomy. So if we can't manually process all that, how do we do it? The solution is to use machine learning algorithms. So the idea being that we use automated classifiers to separate the instances of each of these objects in multi-dimensional attribute space. In order to do that, we've decided to use Weka, which is the Waikato environment for knowledge analysis. And that's an open source Java-based toolbox of machine learning algorithms which was developed by the University of Waikato in Hamilton. So some of the typical problem types that the Weka can handle. So classification, obviously that's what we're concerned with here. But it can also be used for regression or clustering problems. One of the things that you attract to us about Weka is the compatibility. So Octave, look at the R Weka, which is a Weka implementation of R. There's also a Python wrapper, which allows you to incorporate Weka as well. So as well as compatibility aspect of it. It was the fact that, as I say, I'm doing a masses this year, so time's restricted so we really wanted something that was ready to go straight away, that we knew would be reliable, and Weka is well supported. The guys down there had been really helpful and they'd offered to provide us with support. Obviously they could be geographically close as well, which is another big advantage. So that was our decision to go with the Weka guys. There are alternatives. The most notable one is probably Astro ML, which is a Python module built on NumPy, SciPy and Matplotlib, which is another good alternative. But as I say, it was really the aspect of the fact that Weka was well supported by the guys down there and we knew we could rely on them if we needed help getting this classifier running. So, as for the classifier itself, we've chosen to go with the random forest classifier. So that's supervised, so basically it just means that you're using a training set, you're not just running it blind. The main features that I tried to build it was the accuracy of it. It's fast computationally, and it's really robust outliers and irrelevant features. So I've talked a little bit more about that in a second. So how does it work itself? So basically it's a tree-based classifier and each node of the tree, the classifier takes a random subset of the feature, so you might have 10, 20, 30 different features or attributes that characterize your data. The classifier takes a random subset of them and chooses the best attribute to split that node of the tree from that random subset. You go down the next node of the tree and it continues again until you get to that node size of one. So once you've got one tree, you repeat the process again until you have multiple trees and so you may make hundreds or thousands of trees, effectively a forest, hence the name. And how you estimate the probabilities is basically once you have your forest built, you take the data that you want to classify and you just run it down all these thousands of trees and effectively these trees vote for the most likely class. So this is just a little illustration. So here we are, so this would be one tree, that's another tree all the way up here. So you can see in this case, so each node in this tree there's a different attribute that's been chosen to split the data. You take your data point here or your instance of the class, you run it down here, you can see in this case this tree votes for this class, this tree votes for another class, this tree votes for another class and then you average the results over all the trees and that is what gives you the most likely classification for that instance of the data. So again this is just another, just to illustrate, so you have different trees and each one of these trees will be slightly different and again so you can see the probabilities from this one and averages, so that's basically just the probability of a class given your input data, averages results out and that will give you the most likely classification for that particular instance. So how do we apply this in this? So first of all we need to build the training set so in the case of Moa we're actually using synthetic light curves and in the ideal world we would have had this data would all have been previously labelled through third-party methods, people going through it manually so we'd have a stack of all the different types of events and then we could have taken them and used that to trade our class for however as Nick was saying, just manpower issues really, that's not been done with the Moa database but it has been done with Ogil which is another micro-linked collaboration which is joined between the Polish astronomers and the US. It's all their data, it's all free and open data, it's online, the whole catalogue's up there so basically we've just taken we're using their light curves, reconstructing their light curves that they've previously classified into all these different types of events then from that we're then adding noise from our database so again the synthetic data so we want to try and make it we need to add our own noise because every telescope of the instrumentation the noise is going to be different depending on your setup so we're going to add noise to these template light curves and then after that we'll train the classifier so to train the classifier basically that just means you're extracting all the different features from what you're trying to characterise your light curve so you'll be looking for the period analysis I'm using what Alex was talking about earlier the conditional entropy so we're using for that so we want to take each of those light curves pre-processing so we can extract all these features from them so we want lights of the period we want to fit harmonics to them as well things like skewness and kurtosis all these different, there's a huge array of different features that you can use to best classify the light curve and that's part of basically what the a big part of the project is going to be once we're training this classifier is going to be what's the best selection of features to characterise the data how we're going to balance that with computation time et cetera because the main thing with the random forest method is building the actual classifier once you've got your forest built it's relatively comparably trivial just to take your data and then run it down all the seas of trees so that's the big thing is training the classifier so again so that's all all the pre-processing stuff we're using python for that numpy, scipy, that's all done in that yep, and as I say using the conditional entropy method that Alex was talking about earlier yeah, and then once we've got that once we've got our classifier all trained then it's a case of running our data through and seeing what pops out and then that's going to lead to the select of Alex's looking at eclips and binaries so future if this is if you were looking if you we would hope to put all this online and similar to what always done so that all this would be free and old open access to all this this whole catalogue so if you're in a particular area you're interested in eclips and binaries you just look up the catalogue and you've got it right there instead of at the moment Alex is interested in eclips and binaries he's unfortunately got to just suffer and struggle through the data himself so just with a view sorry, just a couple of other considerations so also to improve some of the there's a couple of groups in ES that have been looking at this sort of stuff with a view to future LSSD and GAIA and the like and one of the couple of ways to improve the performance of the classifier one of which is active learning so instead of instead of sorry, instead of getting to the point where the classifier is not there's a some of the instances of the classifier that's not going to be very accurate instead of putting instead of putting them into different categories you can basically hold them back for a human somebody to manually go through and look at the sort of and identify ease by eye and then classify them which can basically this combination of some of the groups have found that this sort of combination of using the automated aspects but then with some of the stuff that's noisy and uncertain things like that by having a human to manually analyse that can improve the performance considerably and also there's other options of noiseification or denoiseification so in that instance you basically try to take the noise out of your data and match it to the ideal like curve which is kind of what we are initially started with with the old stuff so that's a couple of other considerations that can you know as I say that can possibly improve things but that's for future and just to briefly say sort of the long term goal of this this type of work I mean what I'm doing at the moment is kind of laying the foundation but in future the ultimate aim would be to get a real time classifier running on down in the motel scope so I said John was talking about Supernovae earlier so basically you want to have your classifier running in real time so that as these events are happening so the typical microlines and events timescale will be a couple weeks so you basically want to have your classifier running so that as you get more data points you're continually narrowing down what this event is because if it's something interesting, something rare like a Supernovae then you want to get other telescopes on it and alert the community so again that's just for future that we have to take any questions Thanks Martin that was great do we have any questions for Martin oh we have lots of questions excellent excellent thank you first congratulations for your next presentation how much power would your algorithm consume for machine learning well it's really just the training the classifier aspect so that's a good question we're going to be working we've got the Nessie cluster and the university to use for that so again that's really something that's to be determined by as I say all the what features we use how many we use what sort of how many bins we want to use do we want to just categorise it into four by different types of event or we want to subdivide it further into 10 or 20 that's really that will really be determined by that that's your happy with Nessie yes we've got that that's happy to use that option yet one of the things that I've seen as a problem in rule-based or sort of machine learning systems is it doesn't really give you the machine learning rules aren't really equatable to real world axioms that we might use to explain the data ourselves is there a way of do you see a way of getting using the machine learning system to actually tell us some general rules about the data sets you're working with do you mean a bit different types of event I mean do you mean to be general general observations that can help us predict not just how that particular system works but that may actually give us insights into other systems other properties of stars that we're not current that this particular system doesn't look at that would be kind of the point of the the sort of like as I say what Nick was saying earlier we've seen this type this is available stars this is Michael Ensign this is different we've never seen this before and I guess that would be the way they can use science to come in if this is an event that's not been seen before how can we use what we know at the moment to try and how can we use our current theories to actually best understand what this has shown us for that do we have some more questions if you have questions leave your hands up and we'll get to you we do have a little bit of time so we're happy to take some more thanks Martin very much


We were the first blacks in the Navy, other than mess attendants and stewards. We set a standard and a stage that said blacks can do more than just menial work. It was an awakening for our country to see us in this role in the United States Navy. That time of the year again, time to get your taxes done. W-2s are available online. So after watching this video, grab your paperwork and go get them done.