Hi guys, so I have been at the time I run a software development bootcamp in Delhi. We teach people mobile development, web development, data development. So, I sometimes these days there are some small projects to build and needs to off-platform. So, I have explored a couple of different things. I've used native script, React, native flutter also. Basically, this talk is about I have taken a project, exact same apps, built using three platforms. So, React Native is not here because there are a lot of people who already talk about React Native. So, my point was to discuss about things, not React Native, all the other things and give a comparison between them. So, this is a very famous project built by Insta. Insta is an online software learning platform. So, what they do is they have this project you can go to realworld.io and visit. So, it's really nice what they have done is they have created a subset of mediums feature. There are articles, users, people can make comments on articles and they have created a standard API for that. And anybody can build a backend which produces that API and anybody can build a front-end that consumes that API. So, it's a standard API and if you want to learn any stack, you want to learn any backend stack like Django, Node.js, you can make this your capstone project, build this API. Similarly, if you're learning front-end, you can make this your capstone project and finally build this thing. So, this is how it looks like, the web exemplary version. So, this is a list of articles you can favorite those articles, you can sort articles by certain tags, you can sign in and sign up. So, at the core of it functionality is like medium, but like it's not very polished and finished because it's the purpose of it is just to demo that we can build something like this. This is the web version and similarly, you can of course do something very similar to this on mobile. There are like users, you can follow users, then you can see feed, like global feed is everybody's latest post. Your feed means I feed from people who are followed. So, creating articles, all that stuff. So, for a mobile, it would like, I guess, look somewhat like this. You'll see articles and login and register and all that stuff. Basically, everything that's available on the web version, try to create the same thing for mobile. Haven't really worked to create an exceptionally beautiful looking UI. The point was just to be able to build in three platforms and see and then come the results between them. So, before you go to the rest of the presentation, just for context because of course, you will be seeing some numbers like memory users, CPUs, all of that. That's that based on this context that I am pretty experienced with native. And native script, I have only like explored it very recently, but I have like native script you can build using Angular or using Vue. And with Vue.js, I have a lot of experience. So, I have a few libraries I have published which are very popular. So, I know like the best patterns that are used inside Vue.js. So, that way Vue as it is, I know native script, I've been delving a little bit recently. Flutter is something I had read about quite a few times before, but this is actually the first time I am building an app on Flutter. So, like the level of experience is very different on few platforms for me. So, just all the rest of the things based on that might be wrong about a few things on Flutter or native script as well, because not something I know as much as native I know. So, the first thing let's talk about is developer experience. I feel that, you know, I really like this support by David Henry Hansen from the founder of Ruby on Rails and I will trade a few CPU cycles for developer cycles any day that a lot of times when you have a fast-moving product, people being able to build things quickly is more important than 5-10% of performance. That's very important to ship products. That's something I consider myself also important. First of all, ideas that are available to work on these platforms, you can use Android Studio first for Android development native or you can use IntelliJ IDEA with the Android plugin. For native script, native script is not a very IDE dependent platform, right? Most of the, you know, read me and all if you go through in native script, they would suggest everything doing it by the TNS CLI command. So, you can literally use any IDE that is good for web development. You can use WebStrom, you can use VS Code, Atom, Backads. It does not really matter like there is no very deep level integration. There is a Vue.js plugin for an Angular plugin for WebStrom and VS Code both, which work really well, make entire analytics and all very better. Flutter also can work with a lot of IDs. It can work with most of the JetBrains based IDs because there's a Flutter plugin that comes that you can install in WebStrom or IntelliJ IDEA or Android Studio and you can work with VS Code as well. The best experience though is pairing it with Android Studio because then you can do breakpoint debugging and all of that stuff is available only via Android Studio, otherwise it's not available. And the Hot Reload also, if you are using it with some other ID, mostly you have to press the R button to do Hot Reload. Using the Android Studio, every time you save the file, Hot Reload automatically happens. So, best experience is with Android. So, first of all my experience getting started. So, this is something I have done it on a fresh laptop with fresh installation. So, Android, just download the Studio, the SDK and straight away I did not find any problem getting started which even for a, although I am experienced but somebody who is a novice should also not find a problem because if you follow the steps, I did that and I was able to build the Hello World app and there was no hiccups in that and I did not need to go down into the command line to do anything for this because pretty much double click to install and then this GUI based stuff as well. Next, my experience with Flutter was it does have one or two command line steps to install the Flutter SDK. You have to, like on Mac, you have to usually put it in the off slash Flutter folder and like that. After Flutter was installed, then most of the things were pretty automated and smooth in Android Studio GUI based apps are there to create your first project and run it immediately. So, first project worked out of the box. There was no hiccups in that. Native Script, this is something also with React Native also I have faced these days based frameworks. There is a whole set of node modules to download and some version compatibility and all. So, just I was following the step by step instruction as it is available on the website. Even doing that, I faced some problems. The first project that was generated did not build. I had to change my Cocoa Port version. I had to also change the Swift version in my config file. A couple of things need to be changed, even for the first time, even without writing any bit of code. So, that was my experience to get started with these things. One thing is very interesting is these days all these cross platform languages. So, my Native Script one I built using TypeScript. So, if I take TypeScript, Dart, Kotlin and Swift. So, cross platform languages which are very popular people are using these days. Although like the patterns that exist, the architecture patterns that exist, the way people develop on them might be different. But if you look at the core syntactical level, things are much more similar than you might wonder. In fact, just to make this slide I realized that some things are pretty similar like starting off with how you do your lower printing to declaring variables and constants, creating arrays, samples, all of that is pretty easy. You can create hash map kind of things, the object that directly has map. Same thing is available in all of these other languages. Your streaming operations, map reduce filter, they are available in all four languages. Similar syntax for them with classes of course are available everywhere. Again, very similar syntax. Interfaces, there is something specifically called interface in TypeScript and Dart is just create abstract classes. There is no specific way of doing an interface. Make an abstract class, everything is abstract inside that, that works like an interface. One thing I leave couple returns. So, couple returns is something that Dart does not support or I do not know, I have just been using Dart for one time. TypeScript Swift and Kotlin you can do couple returns like multiple value returns kind of thing. Downcasting, something that is like if you check if a variable is of a particular type like this, then inside that you can directly, before this if condition, the language does not know whether this object is of type movie or not. But when inside the if block, current.name kind of things work, this is something that people who use a bit old school language like Java and Objective C complain that they do not have this kind of thing. You have to do a manual cast. All these four languages have proper downcasting support. Next up, what are the common design patterns that exist in these languages because having a good design pattern that a lot of people have tried it out and built on apps of big scale, it helps a lot because you do not have to think a lot where your state will go, where your component will go how the reactivity would be working. So, first of all, talking about native, how many people are native developers? Kotlin, Android were done. So, lot of different design patterns exist. Way too many blog articles comparing these. Mbp, Mbc, Mbpm all are there. If you want to do reactive, then RxJava, RxAndroid that is also available. The most officially recommended one these days is I think the Mbpm one with live data that Google promotes. But everything else is also available. With native script, it depends a lot whether you choose to go with Angular or with Vue because your design pattern would depend on what web framework you are using with native. If native script does not provide its own any design pattern it is up to you to use any framework that you want. For using Angular, people with Angular I think usually prefer to use RSJS and with VueJS there is a Vue model like system and you use Vuex which is the state management pattern that exists inside VueJS. So, it largely depends on which you want to use. Vuex is very flux based kind of thing. So, as I started off with Flutter I felt like this is something that was lacking because I saw some of the people who are most well renowned in the Flutter community and their articles they are all a lot about how to do animations, how to create views very little about what solid design pattern exists for state management and reactivity and all of that stuff. I mean you can go over the internet search you will find there are 3-4 articles all of them have very radically different ways of managing data. Google officially is promoting something called block which is business logic component fighter so that is what I tried using in my project as well. Next comparison of some common tools how they are available across these platforms. So, I think first of all Dragon Drop GUI builder something Microsoft made famous with Windows from. So, of course Android you have got a full page at GUI editor a lot of people start off like they have like 1 or 2 years experience of Android they have been building with the GUI editor only have not gone on manually edited XML file. It is that good. With native script there is no GUI builder available you have to write your templates down in code in HTML XML basically and in Flutter so there is no official support but there is a website called Flutter Studio.app on which you can do some Dragon Drop editing Flutter skeleton you get a Dart file you can export from there and you can paste it into your project and start from there. So, it is not something you can do live with your project but every page you can start off with a basic skeleton you can build on Flutter Studio and import it and continue here. So, there is some third party kind of support. Breakpoint debugging how many of you prefer to just print lines instead of breakpoint debugging how many of you have used breakpoint debugging a lot use breakpoint debugging. How do you do breakpoint debugging where you have race conditions writing and all how do you just use println lines is important feature to have do you think ok. So, with Android of course JVM based breakpoint debugging properly works as you know right. Native script has a breakpoint debugging system that works over web sockets. So, like during debugging the socket connection can break so it is not something I felt very reliable. It is there like as far as it is just checking a box it is there but does not really work very much well. So, with native script apps all the debugging I have done with console.logline only is not something that was helpful to work with in a long duration ok. Flutter has something that works now I do not know somebody who has worked with Flutter a lot would be able to say but my experience was that it works well when connected with Android phones does not work so much well when debugging Android phones. Again it is of course much more reliable than the native script one but not as rock solid as native development works not something like that. Also there are like sometimes you are doing a breakpoint debugging and at the breakpoint there is some field which is basically a getter. So, the getter has to be executed to find out the value those kind of things do not properly work is what I experienced. Ok, auto reload good feature to have good feature to have so of course Android has a very fraud auto reload thing it restarts your activity. The life cycle goes away so you do not actually have auto reload ok. So, the instant thing plus I think if you go if you have a big code base then the instant run stops working. Most of the time if you use like third party libraries bunch of the third party libraries will break your instant run. So, it is not something that works at scale with big projects it does not work. Native script has both the things available it has activity restarting kind of hot reload all available which is a bundle reloaded and very recently just two three months back they have launched proper a hot module replacement which uses the webpack hmr thing which react native has been having for a long time. Native script has that and originally it could only replace JavaScript changes now if you make changes to your XML or your CSS that also gets reflected immediately. So, flutters hmr is something that is I think not comparable to these two things very different in its way of operation and it does not break at any kind of scale and it works really nice data changes styling changes everything works perfectly fine and this is something that works in below one second latency kind of hot reload that is something that the others do not have. Later technical detail though it actually works because when you are running it in a debug mode then the entire flutter vm is copied into your app and your code is directly interpreted in a production app your flutter code is compiled into native and that is put into your app. So, the way they do debug mode that is why it is possible to do hot reload to be nice. So, testing frameworks android native people who have done they would know you can do certain tests on your laptop jvm itself the unit tests if there are things that depends on android or anything classes then that has to be done on the device right that is instrumentation you also have a device connected with that. Flutter also has well supported unit testing patterns the default project that is created has sample tests inside it and with Flutter you can run all your tests without a device without a simulator or device you can run all your tests ui ones and the normal ones as well. Nativescript does not have any inbuilt testing framework or the sample project that is generated also does not contain any sample tests but your usual tools that you use for unit testing in view or angular you can use like mocha or you can use just and all of that stuff so that you can just continue to use those things that will work there are like your testing set up should be pure js it should not have any native dependency most of the testing frameworks are pure js only so that works that is what I do. Now here is something where differences start showing up so data desalization at current time so this is really converting your json or xml to data classes so for android and all you probably be using something like json or faster xml, jackson these kind of things here is something where the javascript based systems like react native and native script is that json does not need to be converted to not concern at all if you are using typescript then you might need to create your class definition files so that you get autocomplete for your json this is something that I felt was a big disadvantage with flutter flutter does not support reflection reflection everybody know right so run time reflection is not available in flutter since reflection is not available that means that you cannot build libraries like json in flutter because json kind of libraries they work with reflection they would be basically at the run time looking at your class object and changing the fields and everything so I will just show the code how it works in flutter in flutter you have to generate the desalization code as part of your source code ok so like native if you have done without json get json object get string get boolean get and kind of so that entire code has to be pre generated inside your source code now if you are working with an api that has say you know 60-70 types of models so you will have 60-70 files for data desalization in your flutter code base that is something that I felt it increases your code base a bit certain fields like date time fields and all you will have to write data and some converters also inside it so there are plugins available these days which does generate automatically these kind of fields but most of these plugins what they do is like you take a json object you copy paste it into the plugin it will generate the automatically desalized code but it will treat the date as a string because it is basically a string it will not realize that it is a date formatted string so those changes you will have to do two way data binding so this is something people who move from web development to mobile development feel like why is it not available here with live data it has just been possible in android having proper two way data binding native script has two way data binding as long as angular or u supports it so flutter there is no you know conventional two way data binding so you know what play the standard two way data binding should support is like you have an input field you have a text field you type into the input field immediately the text field changes without any writing any on text change kind of things ok so that as it is does not exist in flutter there is widget bindings available but not something as simple as two way data binding like connect the input field and output field to the same string object and changes automatically that is not available so varms think just discussed about varms a little while like so flutter will probably never have a varm as long as they do not support run time reflector ok so if they support that then only on varm also it is a similar thing as converting JSON objects again right so being able to generate the queries will need reflection to see the class fields that is not available so no varms available and not as close as lot of varms available any Java varms works and native script so there is a varm called type varm it is a type script in a varm which works so I in fact myself have added the support for native script into type varm sometime back so with flutter you cannot avoid writing any sql at all that is not possible you have to write a bit of sql even if you use sqflight sqflight is the most used library as you see this is something integrating native widgets so integrating native widgets means that you want to put a web view inside your app or you want to put a google maps container in your app so that is something I mean with android of course it is possible with native script also it is possible because in native script the rendering of the views happens via native widgets only so your business logic is j's but the rendering of the views is happening via your proper native widgets so anything that is seen in your screen like let me talk to you in context of android basically everything you are seeing in your screen is basically that extends from the view class right so in native script and even with react native the same thing happens flutter generates its own pixels it is like a game engine kind of a thing it takes the full screen canvas and it uses skia and generates its own pixels which means like if you want a small portion of your app to have a native widget inside it so that is straight forward it was not possible there is a native widget that has recently launched but it works only on android and it is a bit buggy does not really work well that is what I saw so let me do this the walkthrough of codebase just note down this links first I will do it at the end so that amount of time available about this I will go to the benchmark numbers first so if anybody wants to see this app codebase for the Kotlin one it is cv.lk slash rwapp kt the native script one is rwapp ns and the flutter one is rwapp fl cv.lk slash real world app flutter kotlin and native script so it is published on github you can check that out let me quickly go to the numbers I think which is something that would interest everybody most then we will actually I will just show that on my laptop the codebase as well so yeah starting with the debug app size so you see in what the app does there is a list of articles you can comment on the articles login that is all that is available not a very complex app very simple app in fact ok the debug app size as you can see native script one of course is going to be big because it has js runtime inside it flutter one is also big because it has a flutter vm inside it android one is 3.6 mb flutter the numbers change drastically when you go to production mode because now it does not have the flutter vm inside it it is compiled down to native so the app size reduces ios app size is flutter is 62 mb that is because it contains the 32 bit and the 64 bit both things available inside it I do not have a lot of experience with ios I do not know if we can create separate bundles for 32 bit or 64 bit on android you can do that so with native script if you put every architecture into the same app bundle it would be 25 mb or something in size you can make it 10 mb apps for each architecture armb7 you can make separate bundles for that and on play store you can upload it as separate bundles if you want to the native script ios is also pretty big this is the production app size peak cp usage take the numbers in context of the android ones are running on a 4 thread device in ios 12 thread device so peak cp usage usually happens like when the first time the entire list of articles is generated those kind of places so this is the highest spike I have taken I think native script has the highest peak cp usage as far as the ios team this is the consistent cp usage like the average cp usage when you use the app for a long part of the time of course native is going to be lowest is what i saw native script flutter a little bit more now in ios there is a more start difference between native script and flutter flutter does take a lot of cp usage in a 12 thread device 4% is pretty much on the higher side native apps don't take that much cp usage on ios usually this peak memory usage and android apps i don't know why but it will be taking a little bit more memory in my benchmark test that I have done and flutter takes the maximum amount of peak memory usage memory wise flutter does take a lot of memory peak memory, average memory again on average memory also flutter apps take almost double the amount of memory as android could attribute it to me being an experience so I don't probably know all the ways to optimize for memory usage just use flutter for the first time to make an app something about this how many people have used flutter before anybody here used a bit you know about stateless stateful widget there is a nice article I saw in a medium recently about somebody who created a stopwatch using flutter and basically the digits are changing continuously so like the cp usage for creating the stopwatch he created originally it was pretty high when it was he created each digit as a separate widget then it means that the millisecond one changes 100 times every second but the second one changes only once a second then the minute one changes only once every 50 seconds so that brought down the cp usage by I think it made it like I think 10% of the original cp usage and memory usage also dropped so there are things that you can optimize for those kind of things are there okay lines of code has taken to build this app android one is 1100 lines of code but for android of that is XML automatically files are pretty big match parent wrap content all that stuff you have to write a lot of that the native script line so I have given this breakdown because in the native script one there is 230 lines of code is huge which is my components 150 lines of ts code which is for my api calls and all and dts files there is 100 which is basically only the definitions of the json so I can actually still build this app without those part of the source code flutter app code that I have written is around 470 lines 270 of it is this data de-civilization code which also becomes part of my source code anyway this is the lines of code and build tanks this is clean build time with empty build directory android one takes around 52 seconds native script 30 seconds flutter 50 seconds in iOS it takes 30 and 40 seconds respectively this is the warm build so this is not the hot module replacement build this is like you are just made some changes in your file and just built it again without cleaning the build directory that was those kind of build so that is again comparable sizes 8 seconds 7 seconds like that one of the apps none of the 3 platforms I had used too many third party libraries so those factors are not here it is a very simple app these are the times and finally time taken to develop these projects for me this is I think pretty good for the flutter time because it took me less time than it took me to build native something that I have 6-7 years of experience and this is something I have one month of experience so it still took me less time to build using flutter the same thing native script also took me around the same amount of time so that is the amount of time that is taken to build this is done via that called walker time you can install the plugins and it sees the amount of time so just for context this is time of actually writing code so it does not measure the time when your id is open and you are doing something else that time is not factored into it so this net time would have been like something more than this of course thinking about the architecture and all that stuff so I guess that is it in the slides let me just give you a walkthrough to codebase how it looks like thus these slides would be available on speakerdeck.com so native codebase is somewhat like simple app that you build with a view model kind of thing there are the adapters for there is a main activity there are fragments for the home screen the login screen I built it using a single activity only and there is a data class and stuff it is all retrofit based so lot less code for the api gathering and stuff completely made in the so the quarter one has built it using concept of pages which is basically every route you go there is a home page there is a login page and a register page and stuff like that so the model that I was saying is if you take say a json response so there is an article object inside which there is image following bio user name like that so you have to generate this kind of code for every json object that you want to call this is simple because there are only strings if there is something a date time so you have to you can't just do directly equal to you have to convert it into a date object and that so there is usually plugins like android studio has this plugin which can do like Dart beam class form json you paste your json into this RoboPojo generator exists for android data class creation also you paste your json here give the class name and it will generate this thing for you if you need specific converters for any particular field you have to add those things but yeah like most of my code like contains a lot of these data saliation entities basically and the api calls are pretty simple to create kind of things that exist in js you do get articles fetch articles and all that stuff and finally the native script one I think not a lot of people would be familiar but the thing is the app structure looks pretty much like how you create a vjs for intent app again this has like routers so this is something that people who do native development is something that really they don't start off with understanding the concept of router but people who come from a web world they have this url and page kind of notion so you create routers and every route you go to then page opens up here also like api requests are pretty similar you create I think await functions to fetch data here also like models exist but these are simply interfaces for the models the data conversion logic of course stays on in javascript so you don't need that and we can just like it exist in we have seen with flutter there are components which work like widgets so they are single file components there is a template part of it where you write your UI the script part of it where you write the business logic and there is a style part where you can write the CSS really nice thing I felt is like CSS directly works like you can write CSS simply like this or you can attach a font family to your entire app directly from CSS and our people would really love this because using calligraphy and all that stuff here just font family and it works across the entire project you can use things like font or some more material design font based icons those can be directly so yeah I guess that's it anybody has any questions time is up


Okay, so we come to know how do we use all of these things in web services? So a very, very, very huge subject that has grown exponentially in the last five or six years. So around 2001, some of these standards started getting introduced. Different entities that introduced them worldwide web consortium W3C, IETF, and an organization called OASIS which stands for I don't recall what. Anybody knows of this? OASIS, organization for the advancement of structured information standards. That is to say basically XML. When you say structured information, I mean XML. So what are the problems between, why can't we use the same old techniques that were used for web applications? Okay, web services introduced some new features. Introduces some new features. Example, interaction with partners with no previously established relationship. So we're talking about, for example, a supply chain. You've got multiple suppliers who will supply you a certain product, for example. Because of the web, you can find suppliers across the world. There is no loyalty that I will always buy. I will always source, for example, I'm buying this thing and I'm selling it in my retail store. Nobody tells me I should always buy it from this guy. If somebody's offering me a better discount, for example, better terms, terms of shipment and so on and so forth, I might just shift loyalties and buy it from somebody else, okay? So a large, the last item, large number of service providers and users in the first place. So my loyalties keep shifting all the time. I don't have a standard buyer like in the old days. I was always buying from this guy for the last 10 years. No. So interaction with partners. Suddenly somebody in Taiwan is willing to sell me this for half the price. Well, I'll just rush there and get it from him so that I can make a greater profit. So interaction with partners with no previously established relationship. I don't know this guy at all in Taiwan. Am I sure I should transact with him? What if he doesn't pay me? What if his goods are not up to the mark, et cetera, et cetera? Program-to-program interaction as opposed to human-to-program interaction. When you were doing an application such as internet banking, it was you on one side and the bank a program on the other side. It was not a human being there. It was a program over there.  Think of workflow applications, for example. So it could be just programs-to-programs that are talking as opposed to just human-to-program interaction.  So some of these interactions can be very dynamic. For example, let us see where that picture is. Something over here. You have, you're interacting. There's a person over there interacting with his TA's travel agent and trying to book tickets to Rio. He's never been to this place before. So it's entirely possible that besides flight tickets, you also need hotel accommodation and you need transportation, ground transportation in the form of a car rental or something. So I would really like if all this was done very, very quickly on the web. Professor Mesh Belor always does this on the web, by the way. I don't know how many of you do it. He always books his tickets and everything. I've got to still learn it from him. He books everything on the web. So that's wonderful in terms of convenience. You don't trouble anybody else. And only that you might be able to also get besides the flight to your tickets hotel accommodation and car rentals, everything in one transaction, one composite transaction. So how do we do this and what's the problem? The problem is I only interact with this travel agent that I know very well. Again, it might be a program over there. It's not a human being. It's a program. But I am a loyal customer to this guy. I've been, you know, this transaction, this travel agent is just in Pabai. So I know him very, very well. I've been interacting with him before, manual interactions. And now he's got a nice website. So I go to the website and I click and I say, I want to go to Rio. So and so date, so and so time of the day, et cetera, et cetera. He buys me the tickets, but then he also offers me these complimentary features out there. I can also book, for example, a hotel because I've never been to the city before. So I don't know what I'm into. But since he knows me and he's got a business relationship with all these chains of hotels, like the Hyatt and the Sheraton and whatnot, he can also give me very good prices on those because if I go and start searching, I'm going to spend half my day trying to find out which is a good hotel and so on. So he sort of, because I'm this platinum customer, he's willing to offer me certain discounts because he knows the hotel chain is his business partner. So he tells me, which of these hotel chains do you want? They're close to this conference that you're going to be attending, et cetera, et cetera. And then also, he can take me to the site for car rentals. Now the thing, the problem over here, so this is a composite kind of web service. I go to the travel agent, but in the process, I've also booked a car rental and hotel, booked my flight ticket plus the car rental plus the hotel. Now the fact of the matter is that this is a momentary kind of transaction, that hotel chain in Rio doesn't know a thing about me, that car rental in Rio doesn't know anything about me. So who am I to them? What am I trusting is the recommendation letter kind of thing from this travel agent. So he's got a business relationship with the airlines, with the hotel, with the car and so on, car rental agency. And he tells them, look, this is my good customer. Please give him decent prices. So there is some kind of a record letter sort of thing that is sent. That thing is done through a standard called SAML. How many of you have heard of SAML? So this is one of the, yes, you've heard of SAML? Okay, great. So this is one of the standards for web services security. SAML stands for security assertion markup language. So basically we've got to figure out some artifact so that when I log into the travel agent, I get my tickets but also there is some information that is sent as part of that transaction. You have to figure out how this is done, through what HTTP kind of artifacts, for example, is it through some hidden field in a form, et cetera, et cetera, through some way, and there are many ways of doing this if you look at the SAML standard, through some way that travel agent is able to send some information to the hotel and that information has to be, of course, integrity protected and so on and so forth, signed by him, saying that don't worry, this guy Bernard, who's trying to reserve tickets and hotels and so on, is a good guy. I know him very well. More importantly, I have already authenticated him using this particular authentication method at this time and this authentication should hold at least for the next 10 minutes, for example. So trust him at least for 10 minutes. After that, I don't know what may happen after 10 days. He may not be a very good customer, et cetera, but at least for the next 10 minutes, please trust him because he's now buying his flight tickets. Please give him good fares for this. Now if he comes to your hotel, he messes around over there, then you can blacklist him the next time. But at least for this particular transaction, give him good fares or good hotel, a good deal on the hotel reservation. So this is one application of web services where you need security. Of course, there are so many examples. In fact, almost anything you think about needs security. Now you might wonder why not use a regular SSL. So we've got wonderful protocols that we've designed so long for so many years. SSL secure socket layer and TLS, its equivalent version. And then IPsec, which is security at the network layer. SSL is at the transport layer. Why not use some of these things? So here are some of the reasons why you can't just do with SSL. SSL is operating at the transport layer. It provides point-to-point security. Now as you have seen over there, there are many intermediaries. There are many points in between yourself and the people you're talking to. So what would happen if you use SSL is that every single message might have to be encrypted, decrypted at each point, and this gives you only point-to-point security. You want end-to-end security. So give me a solution for end-to-end security. More importantly, in a particular document or in a particular message, there may be only parts of the document that need to be encrypted or signed. And as they pass from intermediary to intermediary, different participants might have to sign different pieces of the document. Think of workflow and things like that. So somebody has to sign only this particular piece of the body of the soap message. Somebody else has to sign another XML element over there. Somebody has to sign this and somebody else has to sign the same thing. How can all of this complicated stuff be enabled by SSL? So there are many requirements over here that simply cannot be handled by the very well-known SSL protocol that is used for web applications. So we need something completely different. And SSL doesn't deal really with messages. It doesn't understand what is a message. It operates at the transport layer. So what is the solution to all this? There is a whole suite of standards over here, starting with the XML digital signature. You know now what's a digital signature. XML encryption. There is a standard called WS security. Let us see what this thing does. And the same thing that I just mentioned, security or secure assertion markup language. There is a complementary standard for access control called XACML. And all of these can actually fit together. All of this is pretty new. Like for example, the SAML version 2 has just come out, I think, a year or so ago. And the first version came out in, I think, 2002. So many of these things are still in the process of being developed and so on. Lots of industry input into all of this. Microsoft and IBM bitter rivals have actually teamed up to come up with some of these standards in particular WS sec. So we will take some very quick examples of these. In addition, the suite continues. There is WS policy, actually WS security policy. There's also WS policy which Professor Balloon must have talked about. There's something called WS security policy in addition. Then to handle these keys, some sort of a glorified PKI, which is made possible through some of these things that we see below. XKMS, key management, WS trust, and WS federation. So federation is where you've got multiple business partners and each person is known by a different name within that particular organization. So there are different identities. Each one is full of very rich identities. You might be called something at home and something else in your office, for example, to take a very simple example. So what is your identity? Is it your name? But your name is only understood within your organization. You might have an email address that's understood by somebody else. You might have a pan number or social security number that is understood by some government agency and so on and so forth. So how do we somehow unify all of these identities? So that's where federation comes into the picture. So your federation is a nation and you've got different federal units inside over there which are sort of, in a sense, autonomous but still under some sort of federal or central authority. So that's the idea of WS federation. Okay, we start with the XML digital signature. What this thing provides, as usual, is authentication, integrity and non-repudiation. So you can repudiate your signature. As I said, your signature may only be on a small part of the entire SOAP message. So that's the beauty of all of these standards. You don't have to sign the entire thing. It is very flexible. It can sign one or more items, read elements. So you can sign an entire element. You can sign only the content of an element or a sub-element within the element and so on. So it's very rich in what it supports. So it can sign one or more items within an XML document. It can support multiple signers. So your business partners or your intermediaries along the way can sign. You might need a double signature, sort of you sign and somebody else also signs. You might need two signatures. So two people can sign an element or he can sign another part of the document, et cetera, et cetera. So lots of different combinations over here. You can not only sign part of the document, you can sign a remote object also through a URI. So and sign XML content as well as non-XML content and very rich support for different kinds of digest algorithms, different kinds of signing algorithms and different kinds of canonicalization algorithms. So to start with a signing algorithm could be for example your, how many different signatures you are aware of? How many different signature algorithms exist? SHA is a digest algorithm. So the digest algorithms are your cryptographic hash which could be MD5, SHA1, et cetera, et cetera. Now in terms of signature algorithm somebody asks you how many different signatures, how many different ways do people sign different algorithms for signing? The one that we just talked about is typically, yes. Yeah but what is that signature called? That's called what signature? No, true. So use the private key, et cetera, et cetera. That is a generic statement but that particular signature is called an RSA signature because it uses RSA encryption. Likewise you can have L-Gamma signatures, you can have DSA signatures, Schnorr signatures and a variety of them. So you can specify any of those signing algorithms. SHA signatures, I mean sorry, RSA signatures or for example DSA signatures. DSA stands for digital signature algorithm. It's another standard that has been adopted in some places including the US government. Digest algorithms are already mentioned, SHA1, SHA256, MD5, et cetera. And canonicalization is basically taking the, as I said, it's a fingerprint of the message. Now as you very well know, XML is very liberal. You can put extra spaces and the XML parser is not going to complain. Everybody agrees? So this element tag and so on, if I put an extra space between that tag and the next thing, nothing is going to happen. It's not going to complain and fail. The parser is still going to validate your message. But if I sign that document with an extra space, I'm going to get a completely different digital signature. So I want to convert the document to some sort of a canonical form. So there are algorithms to do that as well and you can specify which one of them you choose. Besides signatures you can do XML encryption as usual for data privacy or confidentiality. So you have, so this standard specifies the different XML elements for example. The different XML elements for encrypted data. So there's a nice XML tree. You can look at the standard. I didn't bring it all up over here because we don't have time. What are the different elements and sub elements in this thing? There's like, for example, cipher data, et cetera, et cetera. You must of course specify the key. So there is provision to actually specify the key. There is a certain element called encrypted key element just like you have encrypted data. How is the data encrypted using some key? So I specify what is that key inside the document itself. So an encrypted key, so encrypted data is one element and encrypted key is another element. There I specify the key. Now what are the different things I can specify? I can say that we've been communicating for the last two years. Let's use this key called X1 which stands for this particular secret that we share. We know what that secret is. I call it X1. You call it X1. X1 is the name of that secret. It's a big key. Another thing is I can encrypt the key using my, using his public key. Correct? So we come up with a so-called session key which is encrypted with that guy's public key. So he and only he can decrypt it. So I can specify whether I want to use this method or that method and so on and so forth in this encrypted key element. There are many, many sub elements and so on, many, many optional elements, optional sub elements, et cetera. And once again, you can encrypt the entire document or just a part of the document. It's a very interesting standard. Please go through it and see. My textbook actually has a full section on XML encryption, has another section on XML signatures. Now what is this WSSEC? So that's the third thing on that list. I'm not going to cover all of them, just three or four. So WSSEC, it defines XML elements that are used to communicate security tokens. So what is this security token? And where do they get placed? How do they get placed? What are the elements for them? Quite confusing, quite complicated. This basically, there is something called a security element in the SOAP header. Okay, so if you want to do things like encryption and sign signing, you have to include certain elements inside this secure. So first you have to introduce the security header and under this header, things like encrypted key and so on will appear. Likewise, the signature element, you specify all of those things. I want to use this method for signing and not that method, say RSA method. I want to use MD5 and not SHA1. All of those things have to be specified, which canonicalization algorithm to be used. All of those are specified inside the security header under different elements and sub elements. A security claim is a statement made about a subject's identity, signing key, etc. And one or more claims are represented by a security token. So basically the standard WSSEC specifies what are the different tokens that can be included in the SOAP header and what is the format for these tokens and so on. And an example of these tokens, one of them is the X509 certificate. So you can include the entire certificate inside. You can include a pointer or a URI saying my certificate is in that particular location. Go and check that. You can include a Kerberos ticket. How many of you are familiar with Kerberos? So it's another protocol for distributed security in a distributed environment. So a Kerberos ticket or a SAML assertion. I told you what is a SAML assertion before, that travel agent of mine tells the other guy, I know this fellow very well. He's a good guy. I authenticated him using a password mechanism. I authenticated him at 5.15 today. And please consider this thing valid for the next 15 minutes. So all of those things can be included inside the security element within the SOAP header. That thing, how to include it, what to include, what are the options, et cetera, are all part of the WSSEC standard. Here is a very, very simple example. User token, user name token. I'm trying to authenticate myself to this other guy. So inside my SOAP message, I include that security header. And one of the sub elements inside security is this user name token. I'm giving an example of a token element. So I'm saying that my name is Shivani and that my password type is password digest. That means it's the digest hash of the password. And the value of that password is all that funny stuff there. And then it's been created at so and so time. I forgot to put a backslash or the slash for the created. So one slash created and the other created. And then this nonce. What is this nonce business? Any guesses? Yeah, I used only once, but why do I want this? Tell me the purpose of it. Convince me that I need this thing. Related to session sort of yes. So every time I choose a different random number, why? Convince me that I should do this. Why I don't dump that nonce away? Very good. To guard against a replay attack. If I'm just sending the hash of my password, what prevents somebody from intercepting that SOAP message and replaying it back two days later? So what do I do? Something clever that nobody else can do. I take my password, concatenate it with this random number, which is a fresh number, and then take the hash of it, just like a Mac. And I send this across. Now nobody can. Well, people can replay it. Okay, but at least there's an element of randomness in it. Very simple.  Correct. I put the name over there. He knows my password corresponding to that. He just plugs out the password, concatenates it with the random number, and performs a hash on it. Because I'm sending my random number. Don't forget the nonce is sent. Now ideally speaking, this should have been done slightly differently. And this is what is done in most authentication protocols. What should have been done? Tell me. Because he asked me the question, why did I put the nonce that he said to prevent a replay attack? Then I just thought about it and I said the replay attack is not prevented. Somebody else can take the same nonce and put it over there. So in a real protocol, you might do something slightly different. I'm trying to avoid sending too many messages. That's why I'm doing it this way. In the real protocol, you have a challenge response. That guy will send me a nonce and challenge me to compute the hash of my password concatenated with his nonce. I don't choose a nonce now because an attacker could choose the same nonce that I chose and just send this thing. But at least this is better than doing just the hash of the password. You confuse the attacker at least a little bit, but not completely confusing because he can still replay unfortunately. So this is one example of a security token that is defined in WSSEC. Another security token is to include your certificate. These are called binary security tokens because all of that stuff is actually binary stuff, right? Especially the signature and all that. It makes no sense. It's not really text. So to convert from binary stuff to text you something called base 64. So the encoding type over here is base 64 and all that stuff that you can see is LP9 and so on is actually the content of my certificate. So this is a special kind of token called a binary security token because much of it is actually binary and nontext. But to be able to print it, I converted to using the base 64 coding scheme. So I'll give you two examples of security tokens. One is the simple password, the username token, and now this one is the binary security token which encapsulates your digital certificate. That X509 version 3 is the name of this token, which is the X509 certificate. Yes, yes, yes. Why should I send my digital certificate? Exactly the same reason I told you before. Why should I send my digital certificate to that guy? Is it proof of my identity? Anybody can snatch it and send it and say, what is my digital certificate? How is my digital certificate going to help in any way by sending it? I have signed this certificate. So that's the point. The point is in this SOAP message, I took a part of it. It's very nice how they do it actually. You can take an element inside the body. You can take an element inside the header. You can take a whole bunch of different elements all over the place. Take the digest. It all computes. There are Java APIs. Some of my students are doing this. There are APIs to do this. And it will sign all these different, it will actually take the digest of all of these things, concatenate the whole thing together and sign that entire signature element. So I've signed parts of this document and that guy needs to verify my signature. How does he know it's coming from me? He needs to verify. He needs to know that I've actually signed it. I am a party to this thing, this transaction. And he should verify it. He needs my public key to verify. Where does he get the public key from, the certificate? So that is why I'm also enclosing my certificate inside this message. So that's where I use that binary security token. Okay, so let's conclude with this standard, which is SAML. So a lot of work has been done on this and it's already in its second version. I don't know. The third version might also be out soon. Very, very interesting to see how this whole thing works. So I've been looking at this in some detail. So a basic summary is the following. There are three types of assertions. So it's a basic grammar for writing these assertions. Again, using all XML elements. And it could be inside the SOAP body. Usually they are in the SOAP body, but you can also include them as tokens. So I mentioned in one of the previous slides that these tokens, security tokens include certificates. They include this username, password kind of thing. Kerberos tickets and they also include SAML assertions. And this assertion can be one of three types. It can be authentication information. So an authentication statement or an attribute statement. So let's see some examples and then it could also include authorization statements. So let's look at one simple example of an authentication assertion, authentication statement. So what does it say? It says that this is an assertion which happens to be an authentication statement, not an attribute statement, not an authorization statement. There are three types of statements. It says that I have authenticated this guy. So you need to have the identity of two different parties. The asserting party, the guy who is actually asserting this on your behalf and the so-called subject or principal. I have not included all of those things here. So the asserting party says that it has authenticated the principal using a password mechanism at so and so time, 2008 this month, this time, etc. And some information about the subject in particular, the subject's name is Rajesh and the security domain is IATB, etc., etc. So these are some of the basic elements and sub-elements inside the assertion. So this assertion is inserted into the SOAP body. And there are many, many more elements over here. I'm not showing all of them. So how this whole thing fits together, you can think of WSSEC as being sort of the basis and as we had said before in the previous slide, you want authentication. So let's get that through SAML. You want it integrity. So let's use XML signatures. You want to privacy confidentiality. Let's use XML encryption and you also want authorization and so on. Let's use the SAML profile for that. So one of the things that SAML is most concerned with is something called single sign-on. As I showed you in that example, you authenticate yourself only once to your travel agent who knows you very well and can verify your identity. Thereafter, you don't need to sign-on because the other people anyway don't even know you. So that's an example of single sign-on. And the most compelling example for SAML is single sign-on. Then there are some other things that are used in conjunction with this, like XACML and XKMS. So I won't be touching upon these standards, but XKMS is basically for key management. So that, as you know, is a serious problem. We use PKI for it, but you want something that is more general than PKI. So XKMS is one of those standards. They all fit in very nicely over here. The base is WS Security, which of course is normally supported on SOAP. It can be supported on just HTTP without SOAP also. There are some options for that. And this is the final slide, which shows you how you can use a couple of these together. So this guy has a purchase order, which he signs and he encrypts part of it. He signs another part of it and so on. So you're using XML encryption and XML digital signatures. And this thing all sits inside the both, the SOAP header, which includes the security thing. You use WS Security to figure out what are the different elements to be used, what are the different options and so on, and you send it across. So there are these elements both inside the body and inside the header. You can include the ciphertext and so on inside the body. And all the meta information, the security meta information is in the header. And then you send it across and then this guy looks at XKMS probably to verify your public key and so on. So that's another standard. XKMS, that is key management, XML key management or extended key management service or standard to get your public key and verify your public key. And then he also uses XACML, he uses SAML to look at the assertion and having found out your identity through the SAML assertion, he goes and sees using XACML, what are the different access control, this is the policy basically. So given that your name is so and so thing and you're an MTEK student at IITB, etc., which printers can use for example. So all that is encapsulated in these XACML documents, AC stands for access control. So here's an example where you can use about four or five of these things. And we have students over here who have actually done this and we have a nice example with several intermediaries and so on and so forth. You can actually look at the SOAP headers and see what has been going on along the way. Okay, so with that I conclude my presentation and any questions. Okay, in multiple ways, number one is you can use a SAML assertion as one of the tokens. So you can use it, yeah, you can use it on there. So both need the other. So inside the header, you might have a SAML assertion. In addition, as this SOAP message is going from intermediary, you might want one of those guys to assert, I know this guy and so on and so forth. So please treat him, you know, don't think he's a complete stranger. So you might have a SAML assertion inside the body. You might have a SAML header, you might have a SAML token inside the header. Okay, then the SAML assertion is typically signed by the guy who's asserting. How do you know it's valid in the first place? So you can see how they interact with each other. In the assertion itself, there might be a signature. Correct? I mean, I can assert that your name is so and so, so and so. But who's going to trust me unless I sign it and they know who I am. Correct? So I must enclose the signature as well. Sir, suppose my son and daughter, sir, have a digital signature. Yes. We then wait to build a family tree of digital signatures. These are in SOAP or Genetic Algebra. What do you mean by a family tree of signatures? I have a digital signature. Yeah. My son and daughter also have a digital signature. So similarly, a family tree can be built based on the relation. Either way, we can build a family tree similar to a digital signature. Yeah. When you say tree, you mean something is related to something else. Now, your private key has nothing to do with anybody else's private key, including your family members and so on. This whole thing could be jeopardized. Okay? So when you sign a document, nobody else can sign it on your behalf. Your private key has nothing to do with your spouse's private key or child's private key or anything like that. They're completely different things. Can I use my own algorithm with my own question? Can I use my own algorithm? What algorithm for what? Other than using a digital signature. Okay. Now, one of these algorithms, it turns out that these standards specify a suite of algorithms that can be used for everything, for canonicalization, for signing, for digest, et cetera, et cetera. There's a bunch of different algorithms and you can only choose those at this time. But there is scope for expansion. So they have schema where you can extend, but they don't actually support it. And all of these algorithms are specified by URIs. Show some light on security in IP11, IP4 and IP6. Okay. IPsec is basically intended to work also with IP4. IP6 is the successor to IP4, and there have been a lot of people who are hoping that the world moves to IP6, but so far it hasn't happened. So you can have IPsec just working with IP4, but you can also have it working with IP6. So at this time, there is no imminent change. It doesn't appear at least. I used to think five years ago, even told my students that we are moving very soon to IP version 6 because there was a lot of hype, and then I found that we could just relax for some more time. So as far as IPsec is concerned, this is another protocol which is a highly complicated protocol. It operates at the network layer as opposed to SSL, which operates at the transport layer. It's made up of many sub-protocols. It's a highly complicated protocol to talk about. Basically, you establish some kind of a security association. So there's a protocol to establish a security association analogous to a session in SSL. This session or the security association defines the algorithms that both sides have negotiated to use. For example, I've decided to use triple desks. I've decided to use 128-bit triple desks. I've decided to use, you know, Diffie-Hellman for key exchange, et cetera, et cetera. All of these were negotiated beforehand. So in SSL, this is an SSL handshake protocol. It comes under that. In the case of IPsec, it's called ISA-CAMP and IKE and so on and so forth. It stands for Internet Key Exchange. So it's a highly complicated protocol. SSL is much simpler to understand. And then once you've negotiated these parameters, this entire cryptographic suite, you go ahead and actually encrypt, compute the max and so on at the sender side, verify them at the receiver side. So you could use this also, but as I said before, SSL and IPsec even more so, these things, the abstraction is packets. Their abstraction is transport layer entities, segments and so on and so forth. They don't think in terms of messages. When you give them a message, they don't make any sense of what those things mean. You need something that understands what those elements are. That is the reason you go to these WS6 standards. These things can be more fine-grained. They can understand and say, the user wants only this part of your message to be encrypted using this algorithm. He wants this part plus that part to be signed. He wants the intermediary to sign this part and so on. How do you convey that using SSL and IPsec? There's just no way you can do it.


Well, this morning what we want to do is to announce the program, Mr. Meena, the version program for young adults. As probably many of you know, back in October of 2013, the City Council asked the Durham Human Relations Commission to begin to look at some charges and allegations that were made against the Police Department, racial profiling, etc., etc. And they took about six months, and I thought they did a very thorough and credible and commendable report. And they presented that report back to the City Council in April of 2014. And since that time, the City Council and the Roundtable for Reduction of Violence has been looking at many of those programs that they suggested. And some of them we have implemented, some were in the process of implementing, and others we are still considering to look at. But one of the ones that was raised was a question about low-level marijuana arrests, particularly as it impacted young people, young adults. And we know all the issues that accumulate when a young person gets involved in the criminal justice system. And it was recommended that we might want to look at a program that was already in existence for diversion for young people. The one that Chief District Court Judge Marshall Murray has implemented, and in my opinion has been very, very successful. The persons that are here this morning, and I'm going to ask each one of them to introduce themselves and the organization that they represent, have been involved in the ad hoc committee looking specifically at a misdemeanor diversion program. And that's what we want to speak about this morning. And I'm going to be very brief in my comments beyond what I've said, but needs to say we're trying to do everything that we can to try to hopefully prevent young people from getting into the criminal justice system, particularly first offenders in particular. And you guys come on here. And if you don't mind, why don't you stand up here since all of you are part of this ad hoc committee that you're going to introduce yourselves to as we come in. But we're doing all the weekend, at least in the city of Durham, to try to prevent young adults from getting into the criminal justice system. And Marshall Morris, Judge Morris program really addressed it young people 16 years below. What you see this morning is that we're talking about young adults and ages 18 through 21. So before I begin any more, why don't we introduce ourselves from right to left and just say who you represent? Tom Bonfield, Durham City Manager. Lawrence Campbell, Public Defender. Marshmore, Chief District Court Judge. Jose Lopez, Chief Police City of Durham. Donald Ladd, Chief Deputy Representing Mike Andrew, Sheriff of Durham County. Wendell Davis, Durham County Manager. Lowell Siler, Durham County Attorney. Mike Page, Durham County Commissioner, Chair. And I know one person that's missing from attorneys, our city attorney, Patrick Baker, who's also been involved in this committee. So that's right. Supreme Court Judge Orlando Hudson has also been a Superior Court Judge has been involved also. So I'm going to stop there and actually turn it over to Judge Maure and I'm sure Brutum will follow her and then we'll have opportunity for any questions and answers you might have. Judge Maure. Thank you, Mayor. Appreciate it. Welcome, everyone. Glad you're here today. This is a big deal. Yeah. About a year and a half ago, we started the program in Durham, which we called the misdemeanor diversion program for 1617 year olds. And one reason we started this is because North Carolina has the youngest age in which a person is considered to be an adult. 16th birthday, you're an adult for any type of criminal charge. That could be littering. It could be marijuana. It could go up to felonies. So to try to look at that, how do we prevent these young people from having that first criminal charge, which can be debilitating for a public record, if they try to get employment, if they're trying to get financial aid to go to college, even their housing can be in jeopardy if they get that first criminal charge. So after a year, we've had 116 1617 year olds in this misdemeanor diversion program. All but one has been successful. We have had a 98% success rate. Only seven have had any new criminal charges since that time. But the most important thing is we hold them accountable. The law enforcement officers have discretion to send them to this program or to go ahead and make a criminal charge. The kids that have come into this have to come to a court session. They have to go to a community service agency. And within three months, we report back to law enforcement. Thank you for the referral. They have been successful. The officer will not do any formal charges. It's helping save their futures with that and with the success we've had with the cooperation of everyone. I mean, this is a joint effort of the city, the county. It's marvelous to see everyone so involved and understanding. We want to save these kids Durham's youth now to expand it up to 21 year old for the same criteria. It has to be a misdemeanor. Officers will have discretion. There will be exceptions. No traffic matters can be referred. No offenses involving firearms and no offenses with sexual allegations. Basically, we're talking about misdemeanor marijuana. We may be talking about shoplifting disorderly conduct underage drinking minor offenses that have major consequences in these kids lives. So I'm proud to be a part of this. I really we couldn't do it without everyone coming to the table and realizing how important it is for the youth of our city. Other districts across the state are looking to expand this into their jurisdictions and we will offer any support because we think it's important for the future of our youth. So thank you very much. Thank you. I'm going to ask gluten problem or she might come up and speak a little bit about her involvement and how it fits into this program. Mayor Bell asked me to tell you a little bit about the nuts and bolts of this new program. And the criminal justice resource center has been providing services to the adult population that is involved in the criminal justice system for many years. And one of the programs that we have recently been involved in is the misdemeanor diversion program for 16 and 17 year olds. So this new program is designed and tailored like around the 16 17 year old program but it is not an expansion. It is a separate program. Law enforcement will make contact during an incident and then determine whether this person will meet criteria for this new program. This means no prior adult criminal record no arrest no convictions. If the victim agrees the law enforcement officer will refer the refer the person to the criminal justice resource center. The law enforcement officer will complete an incident report and turn that in at their agency. And the person is instructed to report to the criminal justice resource center within 48 hours. The criminal justice resource center staff will conduct an interview verify the eligibility. We will do another record check make sure that there is no adult criminal record and then assign this person to a diversion program. They will also be assigned to a court session. And once a month we will have a court session specifically for this program where the participants will observe a court hearing and then have a conversation with the presiding judge and court officials around the unintended consequences of an adult criminal record. The persons will have about 90 days to complete a program. We will have workshops that are tailored around the charges that brought the participants to the program. So alcohol and drug education classes employment workforce initiatives mediation and conflict resolution communication skills a variety of workshops will be offered upon completion. We will report back to the referring law enforcement officer to say that the person has been compliant and that they have completed. If a person refuses to participate or does not complete we will also refer back to law enforcement. And then the officer will have the option of proceeding with charges. Thank you. Thank you. And if you notice that a good reference to law enforcement quite a bit in program and they're very very key because they generally the first point of contact for the young people who are talking about. So I think at this time it might be appropriate to at least have the police chief and a sheriff to indicate what they've done in terms of training their offices to be a part of this program. And I don't know if you want to who wants to speak first. Well during police department it's been a week that we've already started doing online classes for the officers we put together a program through our Internet and that that pretty much explains not only the philosophy that we have based on this program but also the the method that they have to use in order to write their reports and refer individuals. And explains the entire program to them. The training is starting and we should have 100 percent completion by the beginning of October the 1st of October. And we're going to move on explain to our officers what it is that the police department feels in reference to the the diversion. It's been our philosophy that whatever we can do to minimize arrest especially for individuals who make the mistake that I think everyone in this room possibly have made in their lives that could have caused them to have a negative interaction with law enforcement that in fact an opportunity is given so that these individuals can redirect their lives and hopefully not have any other issues occur and they can move on with life. So that's basically where we're at. It's going to be very simple. Everything he said we've got going on with our agency as well. And I want to reiterate that point of a mistake and a path or a process now to solve that mistake. Thank you. I don't know if anyone else wants to step up and make any comments. If you do feel free. If not then we're open to any Q and A question.


Chairman of NESG, Ollani Yiyusu, welcomed the economic reforms announced by the Tunibu administration, specifically with respect to fuel subsidy removal, foreign exchange rate harmonization, food security, and palliatives to sub-national governments. The NESG chairman placed that the NESG would work with the newly inaugurated cabinet to achieve the eight-point agenda of the administration. Looking backwards is retrogressive for any reformer. Looking forward can give you on the lips that will propel you in the right direction. We need to take tanks on agriculture. I don't see why the idea of being so blessed will bring rain and food soil and not have a commodity exchange. I don't see why we have not been able to interrogate our existing sector and people. I don't see how we have not used government credits to build an opportunism power of our people and the capacity for the manufacturing sector. I don't see why extremely in need of fakers and do-actors. And what you have to come about is teaching. Nigerian economic sub-national groups will not be, if you don't believe, in being one team that can bring Nigeria to the lab of promise. I've been said that there are quite a number of other action steps, other reforms, that we are all eager and waiting. And we are glad the game can affect the sector. Cabinet has not been enourmated. We will be working with quite a number of colleagues in the ministries to push some of your reforms agenda along the eight-point agenda, which in our view speaks to the political issues affecting us as a nation, from insecurity to economy to job creation, and of course to an enabling environment for the private sector. The key metric that is required for private sector investment is macroeconomic stability. Of course, we include security in macroeconomic stability. And you have already, as was recognized by the chairman, you have already set this country on the path towards that stability by what you have done in correcting the distortions on the fiscal side. You've reduced the huge leakage that was preventing government revenue to be anywhere near what is required. Hello. Hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


What's going on everyone Sam here with late in sports cards we're up in one box of 22 bowman chrome baseball hobby for Carla W So good luck Carla. See we got in in here for you More Taco Bell.  There's gonna be hungry every two hours You're gonna eat eight like what? 12 Taco Bell meals a day Have a good one Derek Aloha, baby Heather's watching right now. Oh, no I know we gotta be on our best behavior now face No recap me any zappies There could be there could be she's in here and you're gonna do that Shimmery, eddy cappy Carla Carla. Yeah, not my best pen work there. No never is Hernandez Jose Rodriguez Yeah, that's Lou rod Curtis me Colton Couser. Oh an orange of Vladimir Guerrero Jr. Nice one there 18 out of 25 congrats Carla. Nice low-numbered. Vlad. Can you see it? Yeah, Stephen Adams is a scary dude Oscar Colas you were Donnie Delos Santos Should have our auto in here We've got a redemption the wander rookie of Alexis Hernandez for the Cubs very nice on The base auto congrats on that one Carla.  Stephen has a real life I don't think he would ever like purposely go out and fight anybody But he is like he's not somebody you'd want to mess with the over-paguerra refractor and once he contrarious the 499 Jose Ramos. Oh Yeah, I remember that that was awesome. It came to league Francisco Alvarez face Sequel Tovar got refractor James Triantos on the first the 499 nice one there Virgola and one been show Last pack should have our auto. Good luck Carla. We've got base auto CJ Rodriguez on the first for the A's there you go congrats Carla Nelson Velazquez and Matt McLean I'll do it for your break right there Carla congrats on all the hits. We'll get them right out to you. Thanks as always for this work