What are the top five free and open source web browsers as of 2022? Well, in my opinion, I'm going to give you what I consider the five best free and open source web browsers. And I really think these five web browsers really stand above the rest of the crowd because literally we've got dozens of free and open source web browsers out there. But I think the group I'm going to discuss today, they really differentiate themselves from the crowd. So coming in at number five on my list is Mozilla Firefox. You really can't talk about free and open source web browsers without talking about Mozilla Firefox. Mozilla Firefox has been around for something like two decades now. It's really the most popular free and open source web browser on the planet. It's one of the most popular web browsers, period, on the planet. The problem is Google Chrome has more than 80% market share as far as the browser market share. So that one browser pretty much has like 80 to 90% market share. And then all the other browsers are really just fighting for that, you know, 10 to 15% scraps, right? Well, the good thing is Mozilla Firefox has the bulk of those scraps. And I think that's important because Firefox has its own web engine that's not chromium based. And a lot of people worry about the Google monopoly. And Firefox is kind of that hope, right? That's our one hope fighting back against the Google web monopoly. Firefox has a ton of features. It's very feature rich as feature rich as Chrome or any of the Chrome based browsers can be. Of course, you have extensions if you go into settings and go into extensions and themes, you can search for something maybe like a new block origin for those of you that need a good ad block and you could click on it. And then I didn't already have it installed. I'd have an install button here instead of a remove button, but you can go to the add ons.mozilla.org site and you could search for all kinds of extensions and themes literally just countless thousands of extensions for this browser. And that's definitely one of the selling points with Firefox is it is extremely customizable, maybe more customizable than Google Chrome even. And one of the things I really like about Firefox, if you go into the settings and go into Firefox settings and privacy and security, there are a ton of different options here in privacy and security. And by default, I would say Firefox is a little lax in privacy and security settings. They don't have everything ticked on obviously. But if you wanted to, you can really lock Firefox down to where it's a really secure web browser. One of the biggest selling points for Firefox for me is that Firefox is cross-platform meaning it's available on all three major desktop operating systems. So we're talking Windows, Mac, and Linux, right? And those of you that use all three operating systems, if you want a consistent experience between all three platforms, Firefox really is your answer. And on top of that, Firefox is also on both major mobile platforms with Android and iOS. And I've actually used Firefox on mobile as my browser. And it's all right. It's not fantastic or anything. But again, if you want a consistent browsing experience across multiple devices, multiple operating systems, Firefox is what you're looking for. Really, the only downside to Firefox is the fact that it is not chromium based. And because Google kind of dominates the web, Firefox maybe doesn't perform quite as well as Google Chrome. It uses a little more RAM, at least that is what some people complain that it's a little bit more RAM intensive. And some people do complain that it's a little slower rendering web pages than Google Chrome, especially certain sites which are rather optimized for Chrome. Sometimes Firefox does struggle with those sites. So let's talk about a chromium based web browser. So what if I want to use something that is Chrome based, but I don't want to use a proprietary web browser like Google Chrome that has a bunch of built-in spying and telemetry built into it. I don't want Google to know every move I make in my web browser. Is there an alternative for me? Yes, there's actually several. And at number four, one of the best of these privacy oriented Chrome based web browsers is un-Google chromium. So un-Google chromium is essentially your standard Google Chrome. Actually, it's really a fork of a free and open source version of Chrome called chromium. Except even the free and open source version chromium has some built-in Google telemetry built into the free and open source code. And a lot of people really want to just break all ties with Google altogether. And how you get around that is with un-Google chromium. Now, one thing about un-Google chromium, it's still kind of a niche kind of product. It may not be, for example, in your Linux distributions repositories, how I typically install it, it is available as a flat pack. Those of you that are using either the Nix package manager or the Geeks package manager, it's available in those repositories as well. But other than having those ties to Google being completely severed, un-Google chromium is essentially just chromium. If you go into the menu, everything is here. You go into settings, everything looks just like it would in chromium. If I go to extensions, there's no extensions installed out of the box, but we could go to the extension store. If I go to Google.com here, you see I'm not signed in into Google in any way here. And now I'm going to search for the Chrome store. Let's go to the Chrome web store. So this is one important feature here. Let me search for a plugin. I often install the tabless plugin in my browsers, whether it's Firefox based or chromium based, really cool extension as far as like a stark screen extension. If I click on this, there is no button here saying install this plugin. Because of course, by default, with the chromium web store, you need to be signed in. You actually have to sign in to your Google account. And of course, the point of using something like un-Google chromium or some of these other web browsers, I'm going to talk about today is to not actually have to sign in with a Google account. You don't want to be tied to Google. So is there a way around this? And yes, there actually is a way for you to manually load chromium extensions without having to sign in to your Google account. And what I'm going to show you is not just for un-Google chromium. This will work on any chromium based browser, which will include some of the browsers I'm going to talk about here in a minute as well. But especially for un-Google chromium, you're going to want this GitHub repository here called the chromium-web-store. It's basically a way to side load these packages from the web store. It's going to be an extension that will enable the install button without you actually being logged in. So just read the instructions here depending on the browser you're using. But essentially, what you're going to do is you're going to go to the releases page here. So if I go to releases and scroll down here, you're going to want this file here, this .crx file. Now that you've downloaded that CRX file, go back to the extensions tab here. Make sure you're in developer mode. Now that you've got developer mode turned on, I'm going to open up a new tab and I'm going to change the settings for extension-mime-request-handling. So this is in your chrome colon slash slash flags settings. Find the handling of extension-mime type requests and make sure this is set to always prompt for install. By default, it's going to be set to default. Make sure that is set to always prompt for install. Then I'm going to close that and I'm going to go back to this extensions page here and what I'm going to do is I'm actually just going to open my file browser here, my file manager. I'm going to go into downloads because in downloads, I have that crx file that I downloaded from that github page and I'm just going to drop it right there. Add extension. It's going to tell me that the extension has been added and if this worked correctly, I should now be able to go into the chrome store and install extensions without being signed in. So let me go to the chrome web store here. Let's see if it remembers the chrome web store. Yes. As a matter of fact, it remembers the tabless page in the chrome web store that I was searching for earlier. And now look at this button here. Add to chromium. So I don't have to be signed in. Now I just click add extension. Tabless has now been added to chromium. And if I open a new tab, let's see. That is the tabless default page. And of course, you can add quick launchers, you know, links to favorite pages. You often see me use tabless and other web browsers, such as the brave web browser here. But I'm not quite ready to talk about brave just yet because I want to talk about my number three free and open source web browser. So it definitely makes the top three for me is cute browser. Now cute browser is really interesting because it's free and open source. It's based on chromium. So it uses the chromium engine, but it is mainly keyboard driven and it uses VIM like key bindings. And that's really nice for those of you that love key bindings, especially VIM key bindings to run things. For example, in VIM, typically to open a file, you would do colon O to open and then a path to some file. Well, here in cute browser, you don't need to worry about the colon. Just hit O for open. And then it remembers a lot of your history. Of course, you can set bookmarks or quick marks here inside cute browser. You can see I've got these quick marks with just one or two letters, letting me know that that's an abbreviation. For example, if I wanted to go to YouTube, I believe I have a quick mark for YT for YouTube. And that should just take me directly to my YouTube page. And the YouTube page is taking a little time to load there. And that's probably due to me being at the office. The network is not great here. Now being mainly keyboard driven, obviously HJKL the motion keys. So I could J for down or K for up or I wanted to, I could do shift H to go back, right? So H to go back, shift L would go back forward. And if you need to click on a link, of course, you could do it the traditional way with the mouse, but being keyboard driven, just hit F and you will get hints for various links all around this page. For example, the link to the subscribe button you can see is GG. So if I hit GG, it's going to ask me, do I want to subscribe to this channel? But of course, you have to be signed in to do that. But that was just an example of using F to get these quick links. Basically your key bindings essentially to follow a link. For example, maybe I want to go to the videos tab here. I can see that that is FH. And I just clicked on the videos tab, right? And I never had to touch the mouse. And really the reason Q browser makes the number three spot on my top five list of free and open source browsers is all because of the keyboard driven nature of it. Now Q browser does have some issues that I know will prevent some people from using it. For one, Q browser doesn't have good ad block. There is some ad blocking capabilities for Q browser, but it's not great compared to every other browser I'm talking about today. Q browser is the worst as far as ad block. That is a real issue for some people. For me, I don't mind occasionally having an ad shown to me. I understand some people on the internet, they get paid with those ads. I don't mind if it's a website, a news site or whatever it happens to be and a place I go and find useful information. I don't mind supporting them by watching an ad. But I understand some people really get annoyed with ads. And if that's the case, Q browser probably isn't the browser for you. Another negative or positive depending on what kind of person you are, Q browser can be configured with its own custom configuration file written in Python for me. I love that for many just regular desktop computer users that might not be great for you. Most people of course prefer just something in the browser itself, something web based where you can toggle on certain buttons. And Q browser does have that as well. But to really get the most out of customizing Q browser, you kind of need to play with that config file. And I know not everybody is going to love that. Now let's move on to number two on my list of top five free and open source web browsers. And now let's discuss Brave. I absolutely love Brave. Brave is typically the web browser I use anytime I'm recording videos. So this is typically the web browser you guys see me in. And the reason that is is because out of the box Brave has excellent ad block and ad block is so important for me as a video content creator is because even though I said personally, I don't mind watching ads. I understand people get supported by those ads. I also can't risk getting in legal trouble by sometimes recording my desktop and then maybe a multimedia ad plays. Maybe it plays with some music copyrighted music. I can't risk that kind of stuff. So I have to have all advertisements blocked anytime I'm recording my desktop just for safety reasons. And of course, many people just block ads all together. And if you're one of those people, you're going to love Brave. I love Brave because it's minimal. It's not trying to do everything. It's just trying to be a really good web browser, right? Look at the UI. There's not much to it. You've got your tab bar. You got the URL bar. This here will bookmark a page if you want to bookmark it.   Now me personally, I really don't do anything with bat. I don't even know that that crypto stuff is there because I have the ads turned off. I don't want to watch the ads that if I was willing to sit there and view ads inside Brave, I could potentially make a little bat. I don't care. The other thing is if you happen to have some bat, you can send it to your favorite content creators. So if you visit a particular site or like DT's YouTube page here, if you wanted to send me some bat through Brave, you can actually do that. And that is a really neat feature. Again, it's a feature I don't do much with. That's something that you actually want to explore. Fine. If you're one of those people that just absolutely hate crypto, because I know crypto right now has a lot of negativity around it because so many people have lost money. They just think it's a scam. It's not a scam. Things go up and down, right? Markets go up and down. You guys that got burned. Oh, well, that's life.  But no matter what you think about crypto, you don't even have to worry about the whole crypto thing using Brave. You'll never even know it's there unless you actually want to explore that stuff. For me, I think Brave is easily, easily the best chromium based browser out there. And one of the great things about Brave is it is cross-platform as well. Truly cross-platform, just like Mozilla Firefox, which I talked about earlier, and that it works on Windows, Mac, Linux, and it works on the big mobile platforms iOS and Android. I actually have since switched to using Brave on my mobile phone on my Android phone as my browser. I've used Brave on my phone for the last two years or so. And the reason is because I also use Brave on my workstation here at the office. And again, just for consistency sake, you know, I like it. And of course, it blocks all of the ads and the tracking. And that's great. It does that on the desktop. It also does that on the mobile phone as well. And that's probably even more important on mobile devices to block some of that malicious stuff. And of course, that leads us to the number one free and open source web browser here in 2022. According to DT, let me switch back over to my desktop. And I think that I have to give the top spot, if I can spell, to LibreWolf. LibreWolf is a fork of Mozilla Firefox. And you will notice that LibreWolf when I open it up looks very similar to Brave because I have the Tabless extension. I love this extension. So the start page extension called Tabless, I have it installed in both LibreWolf, Brave, and you guys saw me install it on un-Google Chromium using the Chrome Web Store extension so I could manually load it without having to be logged in. But what LibreWolf is, it gives you all of the best parts of Firefox and then gives you some extra security, some extra privacy on top of that. And being a fork of Mozilla Firefox, LibreWolf is in no way tied to the company that is Mozilla, which these days is kind of a positive because honestly, the corporation Mozilla these days, they're not in the best standing with the free and open source community because they have made some questionable decisions in the past few years. And I think that's part of the reason why Firefox is kind of waning and popularity. But I do have high hopes for LibreWolf as a fork. And I mentioned they're really focused on privacy and security. So if I go into settings, the settings look like your Firefox settings, right? So if I go into privacy and security, they've got a lot more stuff enabled out of the box turned on. And of course, there's some stuff going on behind this scene, some advanced stuff that they've got turned on. And one of the things with being so privacy and security focused, they've got things like some DRM stuff turned off out of the box, which could be a problem for those of you that want to say, watch Netflix in your browser, you can get Netflix working and LibreWolf just fine. But just note that out of the box, all of that stuff is turned off. Much like the Brave browser we discussed earlier, LibreWolf is very, very similar other than being Firefox based rather than Chromium based like Brave was, you get the ad blocking out of the box. Really nice. You get a lot of extra privacy and security features turned on out of the box. And really kind of like Brave, you know, LibreWolf is really focused on just being a good browser, right? We're not trying to be an entire desktop operating system with all this extra functionality that really isn't tied to being a web browser like mainline Firefox is. Mozilla Firefox, it's got so much going on more so than just being a web browser. They're adding all kinds of stuff with the VPN service and the pocket service. They're always adding new features and we're going to tie in all of this torrent stuff and email clients and you see what all of these web browsers are doing. They're adding all of this unnecessary stuff because no longer are they just being a good, fast, efficient web browser. They're trying to add all this extra cruft to it and it slows them down. And that's why I really love Brave and that's why I really love LibreWolf as well. So that is my top five. So again, number five, Mozilla Firefox, number four on Google Chromium, number three was Kube browser, number two was the Brave browser, number one, LibreWolf. I know that's going to be a controversial list. I know a lot of people are going to disagree with some of what I put in that top five. I know a couple of them are especially controversial. But guys, if you disagree with me, fine. Tell me in the comments down below what you think your top five free and open source web browsers are. Don't give me Vivaldi or Edge or Google Chrome. I don't want to hear about that garbage opera. They're all proprietary, right? Top five free and open source browsers. Comments down below. Now, before I go, I need to thank a few special people. I need to thank the producers of this episode. And of course, I'm talking about Dustin Gabe James, Matt Maxim, Michael Mitchell, Paul West, Wyatt Bald, Homie, Alan Armoredragon, Chuck Commander, Ingrid, Iokai, Dylan, Greg Marsdrummer, Yon Alexander, Peace, Arch, and Vador, Polytech, Realiteats4less, Red Prophet, Steven Tools, Devler, and Willy, these guys. They're my highest tiered patrons over on Patreon without these guys. This top five list of free and open source web browsers, it wouldn't have been possible. The show is also brought to you by each and every one of these fine ladies and gentlemen. All these names you're seeing on the screen right now. These are all my supporters over on Patreon because I don't have any corporate sponsors. I'm sponsored by you guys, the community. If you like my work, I want to see more videos about Linux and free and open source software like free and open source web browsers, subscribe to DistroTube over on Patreon. Peace.


Friday across Victoria is still a day of significance for fire, and in particular the northeastern part of the state in Gippsland. We'll see temperatures into the high 30s. We'll see winds of the north-west gusting up to 70 kilometres and a south-westerly change, which sees if fires are burning they move and move very fast in a different direction. A major fire in Gippsland, 20,000 hectares already has impacted on fire properties confirmed and has the potential to do more damage in Gippsland. South-westerly change will move it into the Lakola Valley, which means we've got fire back into the wilderness and into another part of Gippsland, which will be of significance. This fire looks like burning over the weekend or will burn over the weekend and take some time to control, and I think people just need to take that as a message that fires will move around in the state and to make sure that you're able to make good decisions about your safety, know where to get information from, make sure you've got a plan and it's a dynamic plan that you can make it happen for you, but it's also not just about you, it's about you and your family and the friends around you. So we still stay in a warm position, fire will still be in the environment, one of the challenges in Victoria, so over the weekend we still need to be very focused about what fire means to us and hopefully next week's a milder week that we were in lax a little bit, but we're in a summer period of significance.


Chuck's tickets drew his characters masterfully which made his works enduring classics. Here is one of his famous characters, Mr. Macalber from David Copperfield. And how does he describe him? Let's see at the character description.  His clothes were shabby but he had a imposing short collar on. He carried a jaunty sort of a stick and the quizzing glass hung outside his coat for ornament. Fun fact, this character is drawn heavily from Dickens' father. I hope you liked this video. Stay tuned for more such character sketches. Let me know in the comments section who is your favorite Dickens character.


Most people know what to do in the case of a medical emergency. Call 911. Call 911. But don't know that stroke is a medical emergency. Stroke? What you need to do is get to a hospital as quickly as possible. Every minute counts. When her husband, Robert, had a stroke, Alma Shanley knew just what to do. And he sat down in the chair and he kept staring at me and I thought he was fooling around with me at first. And I said to him, this is not funny, Robert. I could not speak. All I knew, she was my wife. And I reached over and took a hand. And I couldn't remember the names of my grandchildren or my daughters. It was a complete blank. And I said to him, you're having a stroke. Stay here. I'm calling the ambulance.  That can happen if a blood vessel breaks or gets blocked by a clot. When someone has a stroke, brain cells in the immediate area begin to die because they stop getting the oxygen and nutrients they need. Somehow we have to get the hopeful message out that there is something you can do. It's not hopeless. And I think four or five years ago, that was pretty much true. But now it's changed vastly. And the change is that now you can do something. In the past, people often struggle to live with serious disabilities after a stroke. But they don't have to accept those limitations now. Today, people have a much better chance for a complete recovery. Effective treatment is available for strokes caused by a blood clot. And that's about 80% of all strokes. He made it to the hospital, I would say, in probably 25 minutes from when he left here. And six days later, he walked out of the hospital. And I think that's a miracle. I really do. We've been able to develop a drug, TPA, which you can inject in a vein, goes through the body. But it knows where the clot is. It goes and locks onto that clot and dissolves it. And the blood starts flowing again. New treatments can limit the disability caused by a stroke. But you need to know the signs and act in time. Here are the signs to look for in yourself or those around you. Sudden numbness or weakness in the face, arm, or leg, especially on one side of the body. Sudden confusion or trouble speaking or understanding. Sudden trouble seeing in one or both eyes. Sudden trouble walking, dizziness, loss of balance, or coordination. Sudden severe headache with no known cause. If you experience any of these symptoms, you need to get to a hospital right away. Even if they go away quickly, it may still be a stroke. Stroke is really a block or a break in a blood vessel in the brain. If it is on a specific side of the brain, usually that's the left side of the brain, then people will have a great deal of trouble either saying things or understanding things, and sometimes both. When someone has a sudden loss of function, they should, without delay, call 911 and get to the hospital. It's that type of a medical emergency where you don't have time to call your doctor's office, you don't have time to discuss it with the friend, the patient, or more properly, the person with the patient. Call 911, get to the hospital. Hi, Grandma. Because stroke injures the brain, the person having one might not realize it. In this demonstration, other people recognize the signs of a stroke and call 911. Mom, I don't know, she just suddenly stopped. An alert family member or bystander can be a real hero. I don't really want to know. Mom, I can't talk, I think she's having a stroke. It's really worth the effort it takes to dial 911. It's hard to decide to do that. You're not always sure exactly what's going on, but it is really worth it. It's going to pay back in terms of going home and living your life. They have to get there early to get the best treatment. They need to be examined by doctors.  They need brain scans, like CAT scans, to know what the best therapy is.  It also helps to know if you or those you care about are at risk for stroke. Take Sylvia Saxton, for example. Despite high blood pressure, diabetes, and a family history, her stroke came as a surprise. When my foot went to sleep, I hadn't thought it could be a stroke. I thought it was just when you're sitting down or laying down like you're doing, your foot got to sleep. I did not really connect it to the science of a stroke. If you have high blood pressure, you're four to six times more likely to have a stroke. Heart disease and a heart condition known as atrial fibrillation can double your risk of stroke. Your risk also increases if you smoke, have diabetes, sickle cell disease, high cholesterol, or a family history of stroke. Strokes are preventable. They can be prevented. They can also be treated. Years ago, we couldn't do that. Now we can. We want people to be aware of their body, know those numbers, their blood pressure, their glucose, their cholesterol. All of that's important. It's so important to just watch my health in every vein. Try to watch my weight. Try to keep the pressure down. It's just so important to try to stay healthy so you won't have another stroke. Stroke touches so many American families. It's the third leading cause of death and a leading cause of serious long-term disability. But today, there is effective treatment that can prevent or reduce those disabilities. The key is know the signs, act in time. If you think someone is having a stroke, if they suddenly lose the ability to speak or the ability to move their arm or leg on one side, or if they have weakness on one side, don't wait. Call 911 immediately. You can have your life back after a stroke if you know the signs and act in time.   We can enjoy our children, our grandchildren. It means that Grandpa is going to be around, that Mom's going to be there to enjoy Christmas with you. All of those things that make life worthwhile simply because we all understood and acted on the signs of a stroke. Okay, over here.


Top athletes from the nation's secondary schools will showcase their talent Friday as the Ministry of Youth Development and Sports in collaboration with the Ministry of Education, Sustainable Development, Innovation, Science, Technology and Vocational Training stages Island Champs at the Sufran Ministerium. Director of Sports, Jim Zavi, was part of a delegation that visited the Sufran Ministerium Tuesday for a walk-through to ensure everything will be in place to host the event. This year we are endeavouring to make it bigger and better. Actually the prizes have gone up. The winning team, boys' champs would be 20,000, girls' champs 20,000 and there's combined champs 10,000. So there's a lot to look for this year. The excitement is building up, Sufran is getting ready and we want to ensure the public that everything will be in place for a successful event on Friday. Facilities manager at the Sufran Ministerium, Nihomaya Saint-Jean, is confident the facility will be in good shape to accommodate patrons and athletes attending Island Champs. We have tried our best to get the facility as prepared as possible for Friday. We've added some sitting areas, put some added toilets and generally just get the trucks ready to give the athletes the best possible area that they could show what they can do on the track. I know people have a lot of concerns but the ministry is doing all they can to ease some of those concerns. We have tried to do all we can. The aim of the ministry is to ensure that the athletes have the best possible facility to perform on. I mean it's Island Champs and we want the athletes to be on the best possible tracks and we want the world to see them performing on the best possible track. Meanwhile, Anthony Laffey, a police officer attached to the traffic department at the Sufran Police Station is assuring the public that traffic flow issues and general safety will be given strong attention from his department. The traffic will be able to flow as smoothly as possible by means of traffic signs being placed on the Palmis Road, the New Vivellman Road leading into the activity area at the mini stadium. Other officers will be at the grounds as well to ensure the safety of the athletes and patrons. I'm trying my best to make sure that the activity is a successful one, safe and without incident. I hope that our officers attend at full force to make sure that the event goes on without any problems so to speak. A total of 20 schools are expected to fill athletes at Island Champs, including students at the San Rucha Sports Academy. The public can follow the meet live on the National Television Network and on the Ministry of Youth Development and Sports Facebook page. From the Ministry of Youth Development and Sports, I'm Ryan O'Brien.


The Ministry of Health, Wellness and Early Affairs continues to manage the four-for-even country. From July 25, 2021 to September 26, 2021, we noted a total of 5,703 cases at an average of 91 cases per day. During that period, we noted 94 COVID-19 deaths with a case fatality rate of 1.6%. Females account for 53% of the deaths. The average age of the deaths is 66 years. In relation to this new wave, from July 25, 2021, 5,703 persons were positive. 51% in the age group 25 to 49 years, 57% of the cases are female. The majority of the cases are from castries, grozilates, viewfort and barbina. Today, Monday, September 27, 2021, the Ministry of Health, Wellness and Early Affairs received a notification from the Caribbean Public Health Agency of 9 new cases of the Delta variant. All of the cases are nationals. The majority are from castries and grozily. Five of them are female, for a male, and the ages range from 18 to 60 years. Based on contact tracing data, the majority of the cases that we are seeing right now are acquired from non-adherents to the recommended protocols. We note excessive social activity, especially on weekends, even during the curfew hours. The contact tracing team has informed of the positive cases providing false contact information with holding their place of employment and contacts. This prevents us from tracing and testing in a timely manner. The respiratory hospital also reports that many persons remain at home with respiratory signs and symptoms for extended periods and only access care at the critical stage which leads to poor outcomes. We advise the public to access care at their respiratory clinics or their respiratory hospital, if unwell. Signs and symptoms of concern include shortness of breath, difficulty breathing, tightness or pain to the chest, feeling weak, pale or blue-colored skin, lips or nail beds. If you have chronic conditions, please get reviewed by a healthcare practitioner if you suspect that you may have COVID-19. The positive cases in home care are reminded that they are not to leave their place of isolation. They contact the home monitoring team or a healthcare provider via telephone with any concerns that they may have. Family members and friends advise to deliver groceries and needs to those persons who are positive in a safe manner. By supporting each other, we'll get out of this. We continue to ask the public to work with us and exhibit responsible behavior to manage this fourth wave. Let us all take personal responsibility to keep ourselves and family safe. At present, we have both the Pfizer and the AstraZeneca vaccine free of charge in country and the various wellness centers. These vaccines have been proven to be safe and effective in preventing persons from developing COVID-19 in severe forms, complications, hospitalizations and death. With the high level of community spread noted in country at this point, we continue to advise the public to remain vigilant and adhere to the protocols that are put in place to keep us safe. These include regular hand washing, the use of face masks in public places, avoiding crowds and persons with respiratory symptoms and keeping frequently touched surfaces clean. The Ministry of Health and Wellness will continue providing updates to the public as new information becomes available.


Tell me the product you're most proud of. The reason the design these questions is that the interviewer want to see in your answers whether you have product management experience before, whether after they hire you can hit the ground and running, and whether they can assign really important and big-scale tasks to you or not. So therefore, I recommend all of you guys, when you're getting ready for any product management interview, especially in such a competitive space like Google, you need to learn product management skills very solid ahead of time. Build a product portfolio and start to exercise and learn how would you use your own hands, own experience to build a product.


Hi, welcome to election security part two, the infrastructure strikes back. My name is Amelie Karan. I will be your panel moderator for this session here. Little did we suspect that this set of panelists would be back together six months later to discuss where we are versus where we were when it came to election security and the upcoming November general election. Since then, to say it lightly, things have gone off the rails given that you now see us by video in our pandemic fast. We've had a highly contentious democratic primary season, some technical glitches supporting such primaries, court cases and regarding in-person voting and enough various disinformation campaigns to last another election. One thing that hasn't changed is the lineup of our esteemed panel from Shmucon. And tonight we have Kimber Doussa, Casey John Ellis, Jack Cable and Todd Beardsley. I will then let them introduce themselves with a short intro. Hi, I'm Kimber. I am the director of security engineering at TRUS, that's trust.works, a software infrastructure company based out of San Francisco that works with both the public and private sectors. Hi, my name is Casey Ellis. I'm the founder, chairman and CTO of Bug Crowd. We run Crowdsoul Security as a service programs, including Voln Disclosure, Bug Bounties, Crowdsouls, Pentests and so on. And yeah, great to be unusual to be talking about this with all the additional content, but very good to be talking about it again. Everyone, my name is Jack Cable. I am an election security technical advisor for the US Cybersecurity and Infrastructure Security Agency, which is essentially the nation's risk advisors. We advise states and localities on the risks associated with different technologies, provide cybersecurity assessment services so that they can make the best decisions to have a safe and secure election. Besides my work at SZA, I am a student at Stanford and a security researcher. Cool, and hi, I'm Todd Beardsley. I'm a director of research at Rapid7, US based cybersecurity company. I personally care a lot about elections. I am usually an election judge in Texas and I have a deep background in hacking, offensive security, research, vulnerability analysis, stuff like that. And congrats to Jack for the level up since our last meeting.  That's awesome. So we're gonna break this down into two sections. I believe unlike last time, but mainly kind of a catch up, a first section here about what has happened since February. So we have a couple of questions regarding that. And then obviously a section B, we were coming up on about 90 days until the general election. And what we can do between now and then since the timeline is definitely shorter, but also what kind of activities are gonna be carried forward from them to the next elections, next primaries, or just in general lessons kind of learned. So with that, we have ourselves a first question here. So we find ourselves here again after six months and there's been a lot going on that we didn't cover back in February. However, regarding one of the last takeaways from closing that panel, we noted it was important to engage your local board of elections. And with that, where do we stand? Wow. Well, let me start this off. I engage with my local board of elections by being an election judge. I ran a polling place not too long ago about we're recording this on ended July. So for me in this time stream, this was about three weeks ago, there was a special election and a runoff election combined here in Texas. It was pretty fun. There's, I never knew that like wiping down voting, polling places would be so rewarding. I got to feel like I was battling COVID like every five minutes, helping people out, helping people vote. And so like, and for that, at least for me, like I felt like I was really, I was doing something. I did notice through training then on election day, you know, the demographics have switched over quite a bit on who is working in the polls. Like it is very common normally to see a lot of retirees and just, you know, older people who are there to help out and help out their communities in this way. I was not the youngest person at this polling place which was first for me. So if you have the opportunity and the inclination, and don't mind doing a whole lot of cleaning all day long, you know, maybe volunteer to work in a polling place come November. Anybody else?  But I think, you know, Todd's example of just doing what's needed, especially with the pandemic and, you know, the changes in operational considerations around actually running an election. Still true, it's even more true now, I think than it was. As the token non-citizen on the talk, I mean, this is even more foreign interference now than it was when we came to talk about this because I'm actually in Sydney at the moment. But, you know, part of what I've been working on and a bunch of other people have been working on is standardization of, like, how do we make adoption of vulnerability disclosure programs and the implementation of policies specifically for 2020 with all of the unique considerations this year has? How do we make those easy as possible for the states and counties? So we updated a version of the language on disclose.io, which is an open source initiative to basically make it easy and make it as standardized as possible. That came out after the talk and it's been good. I think, you know, at the very least, that's actually served to get a lot more people thinking about doing that that maybe weren't before because that kind of blocking function of how do I even engage with the hacker community in the first place was, I think, pretty difficult for a lot of people to even consider. Certainly to echo Casey's point there, I think, yeah, something I've been involved with and pushing for is states and vendors to establish these vulnerability disclosure policies. On the CISA side, we are releasing guidance to election officials in order to establish vulnerability disclosure policies, essentially saying, if you want to do this, this is the best practices that you can follow. A lot of that is drawn from CISA's directive, binding operational directive 20.01, which is a draft directive that will require all federal agencies to start vulnerability disclosure policy. Yeah, that was a good deal, by the way, so. Yeah, I think, yeah, really looking forward to see that come out and see the positive security effects that can have all across the federal government. But of course, CISA doesn't have that same authority over states. So we're essentially putting out guidance, giving them the best practices and the resources they need to start this themselves if they want that. And then of course, yeah, besides that, just the homework I've been doing, yeah, clearly not at the local level, but the federal level. I think that there's really a lot of ability there to kind of have an impact at scale of working with all 50 states, working with a significant portion of the localities of the counties that are out there. So I think that's a really great opportunity to be at CISA and have this kind of wide-ranging effort, wide-ranging effects that I'm not sure you can have anywhere else with election security. And Kimber? Yeah, I'll jump in, it works out well since Jack touched on Casey's point, I'm gonna touch on Todd's point, but the prompt was, you know, what's happened since February and the answer's a pandemic. So the reality of a lot of the election security, the election security, things that we would normally talk about and that we will touch on today, still rely on people being able to actually get to the polls to vote in states that aren't gonna allow mail-in ballots. So I think it'll be a nice segue into a lot of the misinformation we're hearing about mail-in ballots, but to Todd's point, we can scream to the skies that mail-in ballots are perfectly safe and reasonable and actually help disenfranchised voters have a voice, but there are gonna be some places that folks go to the polls and somebody's gotta be there to man the polls or we're gonna end up in a different type of disenfranchisement, right? Where people are lined up for 20 hours because there's three poll workers, you know, for thousands of people who wanna vote. So it's important to know what's going on in your voting district and if your voting district allows mail-in voting, great, cool. But if they don't, like that's a perfect opportunity to get involved. And I understand that it's asking you to put yourself at risk too. And that sucks, right? It is, yeah. That's where we're at. I am shocked. I had a COVID test about four days after election day and I am shocked I did not come up positive. But hey, turns out masks and hand cleaning and surface cleaning works though. Yeah, kind of the follow-up on this too is I mean, obviously the curveball the earth realm was the pandemic. And as Todd mentioned that primarily a lot of the election workers that were counted on by various precincts and states in general were retirees and those who, I hate to say it but have more time in their hands. This is obviously gonna be proving a challenge for staffing and it runs headlong into the issues obviously some of the disinformation that's been spread about mail-in voting. Are there any particular ways that we can kind of mitigate or address any of these issues that are novel? Obviously we're running headlong against people pushing back on the mail-ins but then we have the reality of folks potentially exposing them to a deadly virus. I hate to run the gambit of talking about like e-voting but obviously there are other ways to look at potentially extending voting times, alternating places where people can vote to reduce exposure. Are there any other methods that potentially the EAC and others can address in this case? In before block train. Yeah, I wasn't sure you have to drink now, so. I mean, e-voting is a non-starter, right? Like we're recording this and it is today 97 days. By the time this airs, it'll be about 90 days before the election and you know, West Virginia is doing their thing and good for them but no one else is. I don't see anybody having any plans for that right now. You know, maybe someday in the future, you know, e-voting will be a thing but I don't, I think the easiest way to get people to the polls in states that don't have mail-in ballots is extending, you know, early voting. I mean, that's a thing. Texas, I'm in Texas right now, so great Texas. We're bad at mail-in ballots but we're apparently really good at early voting. My first date of vote in November will be October 13th so that's a stupendous amount of time, way longer and so that will help at least give people an opportunity to get into a polling place when maybe it's not so crowded. Last day of early voting is super crowded and election day will be super crowded. So, you know, if you can vote in that early voting period, I strongly suggest you do. That, you know, it doesn't help any of the IT problems that we talk about and that nominally this panel is supposed to be about but it does help the like not getting COVID. So, which, you know, might be a little more important. Kimber? I want to plus one to the adding more polling places because we know social distancing is huge to prevent the spread of COVID. When we have communities like mine where there's one polling place downtown and then one local school, then we have basically the town split in half to go to these two polling places and it gets kind of crazy. Holding people to districts, we see some gerrymandering, right? They'll draw a line right through the middle of the university so that half the university students think that they're supposed to vote at one place and it's really the other. So, you know, if they're gonna say no mail in ballots then why not say, but all the schools in a single district can vote and if you're eligible to vote in one, you can vote in any of them so that folks can at least get to the closest, you know, place and we do our best to like disperse the population. But a lot of towns have a couple polling places. There are almost always schools which who knows if schools will even be open but if they are, you sure don't wanna have 100,000 people rolling through a school that children are gonna be at the next day, right? So there's physical considerations that certainly were not part of our equation in what February 1st when we jammed through all the things we think could go wrong. This was not on my bingo card. No. No, no. So the thing that's to me that's new is, and I've actually heard Todd say this in a panel on this before, you know, democracy does rely on the peaceful concession of whoever loses. So the increased likelihood of a hanging count because of mail-in voting and the changes in process and different things like that. I think there was a lot of conversation back in January and prior around the role of risk limiting audits to basically say, no, this is not like any accusation or fraud can be basically the confirmed or denied at that point, projects, you know, to give a shout out to is Arlo ARLO, which is essentially a framework for that that I believe is funded by CISA and is open source. And something that I've been trying to encourage people in the security research community to do is to go bang on that, actually go look at it from a security standpoint because ideally if there's any point in time over the next six months where Arlo itself gets called into question as a tool to rebuff, at least at that point we can say, no, we actually went through this and it seems legit. So that to me is new. Like that was always gonna be to some degree of risk as it always is. But I think that's actually a far, that's gonna play a far greater role actually post election on election day and post election day in 2020. Yeah, I think they covered a little bit of that on the HBO special with Hari, as well as, I think it was the second half of the documentary was regarding the risk limiting audits. I don't know if they necessarily had a really good explanation of how it all worked. That is a little extra math for most folks, but it's one of those good things that can be put in. I think in looking at, looking at, so calling myself out as this was a theme and last time we got together as well, the acronyming stuff. So risk limiting audit is what RLA stands for. I think it's verified voting who are running point on it and they've done some pretty, I think good work on explainer videos that take some fairly complicated math and kind of simplify the concept to the point where a non-technical potential voter can actually consume it and understand what's going on. It's essentially a cryptographically determined sample, random sample set that's then paired with verification of the outcome compared to what's recorded. And if there's any sort of deviation or margin of error within that sample set, then it goes again and goes again and goes again until it can work out the scope of that. Or if everything checks out, then everything checks out and things are okay at that point. It's the randomization and the process around it that I think is, to your point, difficult to explain on a technical level to most people, but I think the concept itself has actually felt easy to Grock. Yeah. Great, and just to kind of go back a little to our discussion on the different kinds of voting options that there are, it's clear that the election is going to be run a little differently this year. Just with the constraints we face, election officials have to provide an accessible and safe method of voting for their voters. And what this means is essentially from CISA's perspective, we want to limit the risk as much as possible with these options. So for instance, talking about online voting, also called electronic ballot return. CISA has assessed that that is high risk, even with controlled in place, the risk there still cannot be controlled. And it's not CISA's job to decide whether these are deployed, but as our belief that the risk on the needs is much higher than say compared to in-person voting or mail-in ballots. So on that, and CISA has put out a series of documents essentially describing from a procedural sense what kinds of options election officials have, both to ensure safe in-person voting and then also to make sure that mail-in validating process goes smoothly. And just to touch on some of the in-person voting options there, it is very true of course that like Todd was saying that truth is a lot of these poll workers are older and they face a high risk of being impacted by the virus. So there's going to be very high poll worker shortages. And a lot of cases that means consolidation of polling places because they can't staff that many. And that of course can lead to problems because then you have more people in fewer places with a pandemic that's of course not ideal. But we have to make it work. So one option there is vote centers for instance where larger physical polling places that make it easier to maintain physical distance. There's of course still a polling shortage. I guess here I'll say to everyone who is young and healthy the best thing you can do is serve as a poll worker and make sure that on a local level your elections run smoothly. But yes, it is going to be a challenge just because yeah, of course in-person voting carries some risks with it from a health perspective. So we encourage states to make the decisions that best fit them but both mail and voting and in-person voting we view as being low risk options given that there's a paper trail and you can run and say risk one of your audits on those. So I'm going to take kind of a little bit of a left turn. I know we just full transparency for folks for watching this like we have a list of questions that we've agreed on, but I'm going to kind of find this because of the way the flow is. One of the things that's amazing about like where we live, we're in the United States here and Casey accepted, but we'll adopt you on this one. Most of the time. It's the freedom of speech, it's part of our own constitution and whatnot. But as we mentioned in February one of the critical things about this election is how we talk about it, whether it be through discourse about outcomes, whether it be the primaries or the general election, the methodologies we use to do that. So we talk about the press about like how things have gone, the process of how we go about voting, but also it's another thing called disinformation or misinformation where what we talk about is willingly bad, essentially not right when fact checked or in some cases is disinformation provided by an extra entity. I know with the 2016 and earlier, the recent, the midterms, we had influence from outside sources and obviously, Washington Post just recently kind of covered that we're potentially seeing some influence from China and Iran and some of our other, classically qualify them as adversaries, but yet we still find some ways to deal with them. Where do we kind of find ourselves in this case right now? I obviously, six months later, we had a little bit of a kind of, I wouldn't say necessarily contentious democratic primary, but it was a lot more graceful when people just basically said, I'm out and let people carry forward, but also in recent news about how people are talking about the legitimacy of the methods that we're using, where do you kind of see ourselves now and what can we do in the future here, both as folks who are attendees to this video, but also as responsible citizens to kind of educate others, your parents, your friends, your peers, your neighbors and so forth to be on the lookout for this. I'll rush into the fire. I think an interesting thing that I've seen is that, yes, when we did our panel back in early February, which seems like so long ago now, I think that we could pretty clearly say like, Russia. We're seeing the Twitter bots, the farms, we're seeing like the disinformation campaigns Facebook, Twitter, IG, now it's much more complicated. So the interesting thing that we've seen now are, well, I feel like it's interesting because I'm a social media nerd, the QAnon accounts that have popped up seem to span the gamut of countries. And you see a lot of activity from these QAnon accounts just coming from the U.S. And they're not like some complex, combative nation state, right? They're from just like die-hard MAGA people who are like, I'm gonna do my duty and this is patriotic and they are figuring out how to spin up bots. And so that's pretty interesting. And then to see bots that'll respond to Trump accounts, or the interesting thing that I see a lot too are accounts that get a lot of followers because they'll post pornography, right? And then they get like loads of followers and then they get verified in some cases. And then as soon as they get the check mark, they switch to like QAnon accounts that have give themselves some name that you can recognize in the media. And all of a sudden you think you're engaging with someone that you're not in contact with.  But what that does is have this like celebrity or verified boost of this misinformation. So for me, as a person who has a blue check mark, I wanna say, I don't know anything.  And I'm gonna tell you flat out that like, you'd be hard pressed to find a blue check mark that is an expert on everything. So if someone gets their blue check mark for being an actress, like maybe don't just immediately trust that they're an expert on vaccination protocol, right? So I think that it's really fascinating how the floods are coming and the stuff that Cambridge Analytica did, it's all still happening under a different name, a different company, but it's all still out there on Facebook and Twitter. It's just like now more people from different countries including our own are able to participate in the disinformation process. So. Yeah, I'll tag in on that. Just confirm what you're saying, like the QAnon stuff and things of that nature that they're happening on the ground here in Australia. I think for ostensibly different reasons from a partisan political standpoint, but it's kind of coming from the same mindset. And I think in part, like we're all going a bit stir crazy right now. It's good not to ignore the fact that society just in general is dealing with mental stress that we've not seen collectively for as long as Twitter's been around definitely.  Yeah, there's that piece of it. I think, Kim, you touched on a really good point. I actually got invited to talk about disinformation on a friend who has a cooking channel. She's got like millions and millions of subscribers, but she saw basically like advertising focused, bot-generated content ripping off her stuff. And then noticed that there was subversion starting to creep into that and the ability for that type of channel to be used. That's so crazy. It's nuts, man. And I'm like, what am I doing on a cooking channel? This is crazy. No, they have an entire channel on this, like basically debunking some of these bots or the content farms. So it's a real thing. And I think the ability for that sort of thing to be deployed very rapidly, because these are businesses. It's businesses that exploit the things that are exploitable to build following on social media and some of the ways that Kim had just described, but then they sell that or rent that or if they're owned potentially by an actor that can go hostile, it's really deployed into that. And that's happening across all sorts of different channels. The one you asked Amelie about, things that we can do. I think something that we can all agree on. The great hack, for example, just as a way to get people that aren't necessarily technical in a context that's apolitical. So you're not sort of going one way or the other too much, you're just explaining to them, this general idea that like social media is a constructed reality that's been built just for you. And you actually need to be observing it like that. I think for the hackers that are kind of watching this, that's probably a thesis and something that's important that we could all agree on. And I found that to be fairly helpful. Great, and just to talk briefly on foreign disinformation, of course, that's a very large concern we've seen in 2016, what happened, and in 2020 it seems to be shaping up again. We know, yes, our nation's adversaries, Russia, China, Iran are all targeting, trying to interfere in our democratic processes. So from CIS's perspective, our number one priority is to ensure that Americans decide American elections. So that means ensuring that foreign adversaries are not able to interfere, whether that's by actually targeting election systems, whether that's disinformation campaigns, all that, it should be Americans who are deciding American elections. So that kind of leads us to the point then, what steps can Americans take to mitigate the impact, say of disinformation or just general confusion, say on election night? I think the most important thing here is just to understand that elections are going to be different this year. Election night November 3rd is not going to be the same as election night in the past because with many more mail-in ballots, they're going to take much longer to count just due to state laws and processes around that, as well as just technical constraints, since some states are rapidly scaling out mail-in ballots at a scale that is maybe 10-fold from what they previously had operated. So with that perspective, election night, it is entirely possible that it just isn't final what the election results are, and it may take a week, it may take several weeks to actually learn what the final results are. So the best thing that Americans do is to just internalize this, understand that election results are not going to come out immediately. Media has a large role in this, that it can't just be election night, the final results to clear who won because we have to acknowledge that might not be the case. So I think that if we all are on the same page expecting this to be a slower process and keeping in mind that a slower process means that there's more time to actually verify that results are correct and to ensure that the final count is ultimately the right one. So I think just understanding that patience is needed here and that election night, not going to know who won, it may take some time, but we'll get there and we can be confident then in the outcome of the election, that's the important thing. Yeah, and just to follow up on what Jack said, election night is not the end of this, right? Like for starters, like any kind of disinformation campaign that we've been talking about, that's going to happen way before election day. Like I mentioned, I get to vote on October 13th, so look for something exciting happening around, I don't know, first to second week of October, almost like that's the time when your fear ganglia should flare up around what's going to be happening around disinformation. And just one other super quick point, Jack is also totally correct that I would be shocked if we had results election night. Now it doesn't mean it's the end of democracy. Like there will not be rioting in the streets over this. We've done this before, like the 2000, some people on this call are old enough to remember the 2000 election. And we remember that like that was weeks and weeks of will they, will they, which ended up in the Supreme Court decision. So like that did not destroy America and not having election results at 1 a.m. on November 4th is not going to kill everybody. Like we'll be fine, we'll be fine. Yeah, that does bring up a good point or subsequent question here. It's kind of talking some of the logistical errors, just to put on election is not as easy as everybody kind of thinks. Like you just go in there and pull the handle if you're in manual or you... It is way more complicated. It is way more complicated. I mean, just watching Matt Lays' Twitter feed sometimes and just how simplistic some of the suggestions are. And then of course, Matt being Matt kind of fires back and Matt's way and whatnot. And that's not a knock on him.  As much as I railed on my trip to the DMV recently, I sat in the car and kind of pondered everything required to kind of make my trip better. And I'm just like, oh my God, that's a lot to move. That's Sisyphean in a way. But obviously one of our bigger challenges is obviously the thing that made the biggest press right after our February conclave here was the Iowa caucus. And I wrote a long paper on this about the whole DevOps process in regards to how it was developed.  But the other issues underscore the potential about how trust is eroded through procedural process error by no fault or intent of the creator of that error. It was more or less like we're forging new areas of election things we can do and mistakes will be made. You know, there was no necessarily evidence when looked at that interference necessarily occurred.  You know, what are the different ways that we can as professionals in the security and election security arena kind of captured the discussion and say, you know, this shouldn't erode trust. This is us trying something new, mistakes will be made. Morale will be, you know, lowered. But, you know, what are some things at the technical level to kind of, as I mentioned, you know, you have a lot of technical people that will swoop in and say, oh, we can fix this with this. Blockchain, for instance, is so lightly joked about. But, you know, what are some things, some practical techniques we can have to kind of educate some people on like, no, no, this is a big ship to steer, you know, this is what you can expect. And, you know, don't lose trust in this. Great, so first just to really underscore the point that running elections is incredibly hard. There's so much more than just kind of from a voter's perspective showing up to say a polling place, casting a ballot. There's so much more that goes into this process. So many months of preparation. That's a difficult task. And every single election official I've talked to is incredibly motivated and wants to make sure that elections run smoothly and that their people can, you know, free and fair manner decide who will win the election. So just thinking about like going back to February, say it was already shaping up to be perhaps one of the hardest elections that election official has had to run just because we are in an incredibly polarized environment. We know that there is foreign interference that occurred in 2016 and we can expect again in 2020. So even from that perspective, this was a hard task. And then you add the pandemic and everything becomes so much more complicated because suddenly we can't vote entirely in the same way as we're used to voting and all of these processes have to change. In a lot of cases, that election officials now have to scale out mail-in ballots at 10 times the capacity. And when your machines process those, we're only intended to do say a small percentage of voters in your jurisdiction. From a technical perspective, that can be very difficult and things can break because we're rapidly scaling out these technologies and things can and likely will go wrong. So from that perspective, what should voters expect? So I said before, be patient, election results may not come in immediately and that's fine. I think the second point there was really to expect things to go wrong but don't immediately believe that that is say a result of interference of any kind because most likely explanation is that's for some routine error that occurred and that will be worth for there's process in place in order to handle these types of failures we have for the most part paper trails that allow verifying elections. So from that perspective, we have controls in place. And yes, technology can be brittle and stuff can break down but a lot of times just look for the most likely explanation that of course interference is still possible and we should be very concerned if that does happen but just looking from kind of what is most likely to happen it's more likely that, I mean, we can almost assume that some technical failure and some capacity will occur but that doesn't mean that's malicious and the people just have to view it as that way and understand that there are still controls in place. Yeah, Alchemist's razor is good. I can't remember if it's Hanlon's razor or Alchemist's razor but it's one of the razors. It's Hanlon's. Yeah, anyway. Yeah, we'll simple ends, Malice, anyway, whatever because we can probably look that one up after the fact that I'm outing myself and not knowing which razor's which right now. I'd add to that, no new stuff in 2020 like time out. Like there's a whole bunch of innovation happening in the election space, which I think is fantastic and I think it's important. It's going to be critical after this is done but the addition of variables, the idea that there's software files which is the second point I'm gonna make but the failure rate of software is directly proportional to how quickly it's been brought to market and oftentimes how mature it is. So this idea of like, cool, let's just blast 2020 with a whole bunch of brand new stuff that we haven't really tested. Ultimately, when you go back to Iowa and do a bit of a root cause analysis, that's sort of most of what happened there. It was less than six weeks when I did the analysis, yeah. Yeah, it was, and it's logically what would happen again if we deal with other stuff. So no new stuff, but then this other idea of like software in terms of again coming back to how we can help like humans make mistakes, period. Like this is why we've got an industry is because while we come up with all these incredible ways to do stuff including democracy itself, we do make the occasional spare spelling error and then there's bad people that wanna manipulate that to get what they want. So this idea of like to her as human it's more about how you respond. Again, it's part of what I like so much about you know, vulnerability disclosure as a process but also as this like leading indicator of maturity when it comes to security of an organization that can translate to trust. I think that's a concept that isn't very well understood. And I think a lot of the time people you know, on the operations side would prefer to just do ostrich risk management and pretend it didn't exist. But I think it's gonna become pretty important in context of all of the stuff that can and probably will go a bit funky this year. Casey, you have some of the best vulnerability disclosure jargon around. I love it. I've been practicing. Yeah, a little.  There will probably be mistakes.  It's very hard for me to say like don't disclose vulnerabilities. But you know, maybe not on election day and maybe not make a bunch of hay about like hackable voting machines. Like that is kind of the least of our worries. If all we had to worry about was a hackable voting machine like that physical device. Boy that would imply that we've fixed so many other problems in infrastructure and disinformation in everything up and down the line. So I would hope that the folks that work in the space who pay attention to things in voting village maybe not completely lose your cool over a voting machine that can be hacked in person. So I'll do a quick response and I'm sure Emily wants to move on but this goes back to something that I said in February and it's a recurring theme because I feel like I say it a lot.  And we do that by constantly preaching that the system's broken, the voting machines are hackable, the infrastructure's flawed, the voter registration system is something that can be tampered with. It's not to say these things aren't true but also like you have to qualify those ramblings and announcements with how often that actually happens and what the likelihood of that happening actually is and the idea that hacking 20 voting machines is gonna sway an election without even like acknowledging what it would take to actually hack the voting machine or to tamper with the voter registration system without acknowledging that states do have some IDF systems in place. Sure, could it happen? Yeah, we can like what if all day long but if we're putting information out there that even makes one person think, well, my vote can just be changed anyway. So why would I bother voting?  So we're now in the section B. So we've now pivoted from where we were six months ago to where we find ourselves in the last 90 days here. 90 days scares me because, you know, coming from the federal government it takes longer than that mainly to fill out the paperwork for something. So 90 days for us in the real world if the commercial sector will be totally interesting. But obviously I'm gonna highlight the fact that, you know, as Jack leveled up here, CISA has taken more of an active policy and assistance role for states. The election assistance commission committee has hired some really great new staff. In fact, some folks, I believe Kimber and I were on the panel many years ago with. And, you know, the feeling that while it's awesome they hired these people. I don't know, I've tweeted out about it. It's a little too late in certain cases, but, you know, they hire great people. What is the feeling right now that these folks can actually make a difference between now and the election? Or obviously if we can't do it by then, what are the, what is the change that can be made for further elections provided that the world isn't gonna melt down? Yeah. So yeah, I think, yeah, I can take this to start. Yeah, so it's true. Yeah, CISA has brought on some more people to help out with election security. I'm part of a group of me and four other Stanford students who all came to CISA to work specifically on election security. And we've been having a lot of fun being able to work essentially on both the infrastructure component building tools to allow organizations to better secure their systems and allow CISA to say aid and assessments to state and local election officials, as well as working on some of that, say foreign disinformation component. So in terms of what both say CISA and EAC can do by November, I think there's a lot that can still be done. Of course, yes, we have, I believe I calculated this, I think it's 89 days from the time the talk this is airing until the election. That's very little time, almost nothing, but we still can do a lot. We can help say states identify vulnerabilities in their systems. We continue to offer services that assess these systems and give guidance. I mentioned before we have documents that we published along with the election assistance commission. And we're working to support states in the capacity that we can. So I think that there's a lot that still, of course, needs to be improved, but we're getting there. And from my perspective, yes, the government plays a large role in this, the federal government. And I really do think that states, this is I'd say one of the major improvements since 2016, 2016, the federal government's involvement with the states was not at all near where it was today. So much has improved since then that we are now working with each of the 50 states. We're working with a significant portion of the local election offices. And we're in much better place, both to the protecting systems and then monitoring in case stuff does go wrong. So, you know, you speak obviously kind of the involvement with CISA and kind of the states taking a more active role in their own survival in a way. Have any of the vendors, either of the e-poll books or the election systems been more willing to kind of come forward and work proactively with the government or say any of the companies represented on here to kind of solve the problems? I know, I've recently been involved with some workshopping with OECD on regards to vulnerability disclosure policies and digital product security. And one of those cases is finding a good mediator sometimes to kind of do that. Has anybody kind of moved that way or are we still kind of like, you know, kind of finger pointing and moving forward there? So in terms of CISA's involvement with this, of course, CISA's preference is for vulnerabilities to be disclosed either directly to the state or to vendors when that is possible. And it is our view that of course, vulnerability disclosure policies can be very helpful in this process. I'm not aware of any vendors that at the time of recording or states for that matter that have come up with vulnerability disclosure policies that could very well change between the two weeks when this airs. But what we do offer is resources for those that want to implement vulnerability disclosure policies to do so. So like I mentioned, we have our guide on vulnerability disclosure that will be live by the time this panel airs. As well as the fact that we do serve as a last resort for people who are unable to disclose vulnerabilities for any reason. They can report it to US search, which is under CISA. And we will work to get that disclosed to the vendor in order to mitigate that vulnerability. So CISA does play an important role here. And yeah, it is our hope that of course, yes that any vulnerabilities that either people come to vendors with or come to us with that they will be addressed. So, I mean, and just to follow up on that, I mean, we're getting under the wire at the wire, right? For the November 2020 election, if I were the king of vulnerability disclosure, I think I would direct people to disclose to you personally, Jack, and by extension, this is before vendors and states. Like, I mean, I think that's kind of the way, like, let's say I'm sitting on a vulnerability or I find a vulnerability in some election system or whatever, like, and I'm a hacker guy who wears bed of split jeans. Like, I have it.  I think it's probably not great to like drop that on Twitter and just full disclose and do that. I mean, that's not helpful. I don't think in the slightest, but I do think, like, you tell me, like my instinct is, you know, tell SZA and hope for the best and keep my mouth shut until November, I don't know, 10th, 15th or something. You know, so at least this is where they can do, I'm describing your job at you. Yeah. You can do instrumentation, right? Like, so even if there's no fixes, there's still ways to track the vulnerability. Yeah, and you're exactly right there that yes, the priority is for the vulnerability to get fixed as quickly as possible. And we want to support whatever will make that happen as efficiently and smoothly. So of course it's ideal if it is possible to disclose directly to vendors, but that is hard one. There are no disclosure policies. Today, though. So in that case, yes, exactly. Working on it, working on it. So given that, yeah, the current landscape, yes, SZA does serve as a coordinating role there for people who, yeah, can't really find the contact to disclose, they can come to SZA and SZA will work to make sure that the vendor or the state is made aware and that the vulnerability can be fixed.  You know, the thing that I wanted to double click on is actually around basically non-disclosure of findings ahead of November at this point. And this is very much opposed to how I normally talk about bond disclosure. It's very hard to say. Yeah, it's really, it's a really difficult thing to say. We actually talked about this in terms of the boilerplate election policy that we put up on disclose. And we've got it in there. It's like, you know, basically the agreement is not to disclose until after the election is finished. Ordinarily that timeline would serve as back pressure on the vendors to fix. And I think that's a really good and an important thing for accountability and transparency. But the risk of frightening a non-technical voter into just giving up and not showing up to the poll booth as a product of trying to do something good, I think is extremely high on this particular topic at this particular point in time. So yeah, it's a hard pill to swallow. I think for security researchers in general, it was definitely, you know, from what we do and where I sit, it's a hard thing to say, but I actually do think it's the right thing for this year. Yeah, I know that's one of those things we've kind of, you know, as I mentioned with some of the policymaking, you know, obviously federal, international, but not, you know, we've said that, I wouldn't say necessarily artificial 90 day deadline, but obviously for inside the 90 days, it does kind of create an unworkable framework with both in the timing, I think the regulatory environment for whatever folks need to do for certifications, plus loading all the election information and the logistics of that. So, you know, it just creates this whirlwind of not a good situation for us to be in. So yeah. So yeah, we talked about this, you know, earlier in regards to kind of the effect that COVID-19 has had on how we staff the election, how we are attending the election and participating it, obviously with retirees and whatnot. There is so much dumpster fires being poured into the alley right now. It's not even funny. And obviously with the disinformation and just all the stuff we talked about, if you were all betting people, and if we were in Las Vegas this year, instead of doing this virtual, what would you bet to be the first thing to crumble out of all of this?   Like, I think that, sure, I think we'll see people tweeting, oh, I got a mail in ballot for my uncle who died last year and then it gets 10,000 retweets and then somebody else tweets something similar.  I think like polling places being disbanded for like civil unrest and not from the folks who are there just to vote peacefully. So this is starting to form like a John Carpenter movie in the worst way possible then? Well, I am a horror fan. So of course that's where I go. My hope is that people respect democracy regardless of which side of the line you fall on and just let people have their constitutional right to participate in electoral process. However, I am currently disenchanted by the state of the country right now. So. I don't know. I think that your first sign of everything going to hell is gonna be on like in the neighborhood of October 13th, October 14th. That's gonna be where you have your last big push of whatever disinformation campaign is going on. I'm not a disinfo expert by any means, but if I were gonna own stuff, I would definitely want to tell people but like one of the tactics we've seen over and over again of people who are attacking election systems is that it's no good unless you tell people about it unless you get noticed. And so you got to get noticed like early enough to sway elections, but not so early that there's enough from, that Jack can fix it for us. So like October 15th, I think is the sweet spot for what is that? That's like Wednesday I think or Thursday. Non-Friday, non-Monday, early October, I would expect to see, I would expect to see big news to try to have that last push of, hey guys, don't bother voting. And you think that because that's when the mail-in voting window opens. That's when most states, in many states, absentee ballots are starting to get filled out then, early voting starts at then, and it's still early enough that you can make hay about it for the following two weeks. Like a losing side can call cyberfowl pointing at that thing and just eat up news for the rest of October. Just this is, it's a bit personal, but it goes to one of the reasons that I'm not in the U.S. right now. I think we had the option to be near family and write out the pandemic. Part of the concern that was in the back of my mind was how the potential for civil unrest and those sorts of things are amplified by the backdrop of the pandemic and economic depression and a lot of other stuff. So I think the number of things that are available for an actor to tweak on and the amount of leverage that's present, as we do version two of this panel is radically different to what it was last time we got together in Sparock. So from a mitigation standpoint, it really does come back for the typical audience of this panel in DEF CON is making sure that you're not adding to the problem. The whole idea of like polarization of just general distrust, like nihilism or that sort of stuff. And I do believe like we are talking Armageddon-ish type stuff at the moment, but I do believe fundamentally in like working back from the worst case scenario and optimizing the critical path from there. So it's an important conversation to have. Yeah, that's a good segue into the last question we're gonna do today. So obviously we talked about mail-in voting as the next best mitigation for forcing people to kind of show up in person and definitely a better alternative than I'd say any potential half-baked e-voting solution at the last minute that would come in and swoop. But obviously with the rhetoric that's been spoken by various folks in the press from various levels of government and elsewhere about the validity and trustability of the Postal Service as well as their own financial woes imposed upon them by Congress and pre-funding and so forth and so on. It was just announced today that they had worked out a deal with a massive infusion slash loan from the US Treasury. I think it was like $15 billion, which is a huge chunk of change. It does keep people from necessarily having to rush out and running for stamps, but obviously I have reports from some of the locals here in the DC area specifically Baltimore about potential fallout from the recent Postmaster General coming in and saying, please delay first-class mail. Obviously that puts a downward pressure on delivery of mail and voting as well as returning that and making sure that everyone hits with the deadlines with the postmarks. So where we sit here is our last best effort to run a secure election as a Postal Service. It is in dire straits. It has potential leadership that is working anathetically against the essentially constitutionally or state that the Postal Service exists in. What are the last bits here that we can ensure that that is functioning for us to go forward? Are there ways that maybe we move up early voting even sooner so that we kind of play into the logistics of extended timelines? Is it write your senators and make sure that mail is delivered in a timely fashion? Or some other aspect of it, with that and especially as you mentioned earlier too, I think it was Todd talking about the expected timelines being a lot longer for us to hear the outcomes. If we have this extended timeline, what's our expectations to actually hear what the outcomes are gonna be given this? I mean, it'd be great if states would extend their deadlines. Like I was shocked to see that Texas, for all the hand-wringing Texas has been doing about mail-in ballots and like trying to make that hard. The fact that Texas then turned around and extended early voting was a sweet surprise. I don't know, we do things randomly here in Texas. Some things are great, some things are not so much. But I guess that's just here local in Texas. I don't know, I feel like everyone should mentally hug a postal worker today. They do a lot of really hard work. A lot of people depend on them for a lot of things. They are in fact constitutionally enshrined. It's an Article I power of Congress to establish the post office. And the fact that it became a target for disenfranchisement is just mind-boggling to me. But I think that we can all agree that the post office is kind of a wonderful Americanism, really, like it was a largely this notion of a single stamp that carries something across the country. Like that is pretty sure, it might be an English thing. It might be a British thing. But one or the other, it's pretty great. So yeah, I mean, if you have the opportunity to vote absentee, absolutely do it. Absentee voting, you can get all nerdy about it and say like, well, technically you're violating like the secrecy of the ballot by doing that because someone can watch you vote and direct you vote and see that you vote correctly and see that you put the thing in and mail it away. But that is so low on my list of problems when it comes to democracy is vote selling. If it turns out that's a big deal, great. Like let's go tackle that. But that has not been a problem since the 19th century. Yeah, I wanna say too, we've seen the current administration, we've seen the current administration actively attack the postal service on social media. And so I would ask folks to understand that I don't think there was a long game there, but I don't think that it's gonna be unreasonable to see more attacks on the postal service from the current administration. The unreliability, the conspiracies about deals with Amazon and then how Jeff Bezos ties into Amazon and then with the Clintons, like there's a lot of stuff to unpack there. But I would say, at the end of the day, like these are feds, these folks are feds, they took the same oath to the constitution that other feds take, they're there to just do their jobs every day. And the idea that postal workers themselves would be tampering with mail-in ballots is just kind of ridiculous and- Oh, it's completely insane.  And if there were one, it's a blip on the radar if the numbers are out there of folks voting, right? So let's just keep it all in perspective. And to understand the importance of the postal service, when I was younger, the DMV test had a question that said, if you get to a four-way stop and there's a fire truck, an ambulance, a police car, and a mail truck who has the right away. And everyone assumed like the ambulance or the fire truck, but it was in fact the mail truck because they are protected under the guys of the federal government. Certainly the mail truck wouldn't go first, but they could. And also, if you hit a mail truck, you get into a lot of trouble too because you've damaged federal property. So you probably don't wanna go out and take your angst out on vandalizing mail trucks or bothering postal workers, so I just- That is a hot tip. I feel like- Robbing post offices used to be a hanging crime. Yeah, well, they've also got that crime a daybook that just came out from the Twitter feed. I would hope that there's a chapter in there about weird stuff like that. So, all right, then last thoughts on what we see as our future here. What you'll be doing, what you hope others will be doing, and then where do you hope we will be? I can go and take this first. So yeah, nothing I'm gonna say here really is anything new I would say that I haven't said. But yes, in terms of what I'm doing, what CIS is doing, we are going to be working through and after the election to support election offices at the state and local level to ensure that they have what they need from a security perspective and we're committed to doing that. In terms of, I think, what's maybe more valuable is what people watching this, what steps they can take and what steps they can recommend others to take. And this goes back to the two points that you have to be patient and you have to expect that things may go wrong, but that doesn't necessarily mean there has been interference and that doesn't mean that the election is invalid. So be patient, do not assume that results will come out on election day, may take some time, but have faith that election officials are doing their best to have an accurate result, that we have process in place that if interference does occur, we can identify it and just ultimately the main thing is that the people of America need to have faith in their own elections and that can go away without any actual tampering or current without any interference. Just if the people do not believe that their result was valid, then the result is not valid. So I think to everyone watching this just to understand that what you believe happened matters and just to understand their process in place, there are committee election officials, the federal government is here to support that process. And yeah, let's hope that we have smooth a free and fair election in November. Sure, so I mean, I guess like to just kind of reiterate what everyone else has said, it's like the best defense against any election shenanigans is voting and voting in numbers that are too hard to push one way or the other. If people go and they vote, especially people who have historically been disenfranchised or haven't felt the need to go vote, it is here at every election, but this election is literally the most important election of your life so far. And so go vote and hopefully if enough people do that, any kind of shenanigans will be drowned out by the overwhelming signal that we have. Me personally, not only am I going to vote early, I'm very excited to do that, but I'll be working the polls. It's gonna be crazy, it'll be November and there will be no vaccine. And so I will be doing a lot of cleaning and hoping that not too many polls close that day. There were poll closures. In our last election here in Texas, there weren't any poll closures on the day of. People did show up. They got enough recruits to come and do the thing. I did have a couple of poll workers not come to my polling place, but we had enough people to pull it off. So hopefully that will remain the case. But that's gonna be November. So who knows what the pandemic will bring us? If it becomes impossible to vote in person in any kind of crowded way, then we'll just have to deal with that as it comes. But if you have the bandwidth and the health to throw in for a, what is a super fun, sounds boring, but it's actually pretty fun, like 14 hour day, go with the polling place. I'll go next. I will say that I'm very much looking forward to returning to the U.S. And this is honestly a part of that. So again, speaking to the subject matter, but speaking to it from a very personal standpoint, it's like my adopted country is trying to figure all of this stuff out. And I'm looking forward to being past it is something that, it's heavy, it's the heavy thing. So aside from that practically, if for the hackers find out where people are asking for help, go help them. Like look for the stuff that people have already volunteered, you know, the volunteering stuff that we talked about at the start, just to reiterate that some of that help might be IT. Go looking for it. See if you can find opportunities to provide your skills into those different areas. Help out on the open source projects and some of the other things that are going on that have been volunteered. So Arlo, we mentioned before, verified voting it's up on GitHub. Go bang on the source code and if it's legit, say so. If there's a problem, submit a PR, help make it better. If these audits are a part of how we have a peaceful kind of acknowledgement of the count after the fact, then you'll have played a pretty big role in that I think. And then finally, you know, don't scare your grandma between now and November. If you're doing security research and you find something, you know, talk to Jack and the crew at CSIR and try to talk to the vendor. Just be very mindful of the fact that dropping any kind of anything that looks like a vulnerability on the internet right now is highly, highly exploitable from actors from a disinformation standpoint and you don't want to be a part of the problem. Technically, you have a last couple of days because July sucked when it came to volums. So, or at least people had to clean up after volums. So let's make August better. Yeah, well, we can, it's DEF CON months. So the internet's on fire this month anyway, but maybe after that, I don't know. October, let's let October be quiet then. That's cool. Kimber, any last? I, it's unprecedented. So it's anyone's guess what actually happens on election day and the months following. Vote, just vote. Tell your friends, tell your family, vote. Vote safely, vote mail-in if you can. If you pay attention, your state may have deadlines for your district on when you have to let them know that you're gonna be voting by mail-in ballot. Some folks here didn't understand there was a two-part process to mail-in ballot. You had to request one to receive one. It didn't automatically get sent to you. So just being aware of how your local districts work when it comes to mail-in ballots so that you can participate. And if you have to go to the polls, you know, wear a mask, social distance if you can and you don't have high-risk folks at home, volunteer at your local polling places and do what you can to make it safe for our most vulnerable populations to be able to get out and have their voices heard. Well, yeah, that's a great thing to end on. You know, obviously I have a spouse who's immunocompromised. So, you know, I preemptively requested a mail-in ballot. I know some states require a extenuating excuse in order to get a absentee ballot. So please check with your local officials on what you can do to do that. Obviously, you know, a safe and secure voting is important but safe and secure also means individuals as well. With that, I'll close out our panel. I do appreciate Kimber, Jack, Casey and Todd for joining us this evening for the recording. Again, this is the election security part two, the infrastructure strikes back while I can't necessarily drop in some John Williams here. Use your mind's eye as well as the Starfield background to kind of get it through. And hopefully come November, we'll see what kind of shakes out and geez, maybe next February, we'll have a cleanup on this, maybe a part three. Hopefully it doesn't end up with a bunch of Ewoks running around, seeing UGNUG, but anyhow, once again, thank you very much and thank you for your time. Take care.


From Soldiers Radio and Television, this is the Army Now. More than 300 top government and industry leaders gathered at the Detroit Arsenal during the grand opening of the Ground Systems Power and Energy Lab. Three, two, one, let's open G-Spell. The 30,000 square foot research facility offers a range of testing and validation capabilities in eight state of the art labs within one facility. This lab is coming together of the best minds, the best equipment, the best testing facilities all in one place. The Air Filtration Lab tests vehicles against desert dust. If we can take vehicles off the road that have to transport fuel, we're putting fewer troops in harm's way. We're moving the focus of the mission and giving the troops the tools certainly that they need. From Soldiers Radio and Television, that's the Army Now.