Hello everybody and welcome to my Linux Security Summit talk about patch attestation. My name is Konstantin Rabitsev. I am in charge of kernel.org infrastructure at the Linux Foundation. I've never done anything like this before. I'm not a professional recorder, so I hope it works out. There probably will be some awkward moments when I'm rapidly trying to fix or switch between windows. So hopefully there'll be a few of them and not too many. All right. So let's get to the topic of our presentation, which is patch attestation with patat. Patat is the tool I wrote. And before we talk about the actual tool, let's go and look at what the state of patch attestation is without it. So RFC 282 attestation for mailed-in patches. What options do we have these days? There's two mechanisms of doing it. There's an end-to-end, which means it's developer to developer, developer to maintainer. You sign the patches on your workstations. The developer who reviews them verifies them on their workstation. Or there's the main level, meaning you don't do anything on your workstation. You submit it to your SMTP server. The SMTP server signs it using the DKIM standard, which we'll talk about in a moment. And then the developer basically does nothing to verify it because all the verification is done by your receiving SMTP server. And if the DKIM signature doesn't match, chances are the mail ended up in spam anyway and you didn't see it. So for end-to-end attestation, there's two mechanisms. There's OpenPGP and then there's SMIME. OpenPGP is about as old as each other. OpenPGP was introduced, I believe, late 80s or early 90s. I don't remember which one it is, but in the ensuing 30 years of life, it didn't really solve the problem of key distribution because key distribution and bootstrapping trust is really a hard problem. And there is no easy sidestapping of that problem. Like, we can create a certification authority, but then you have to trust certification authorities. Obviously, if you don't want to trust anybody, then you have to worry about key distribution and management on your own. And that is the crux of the problem. Another problem with OpenPGP is that the mail client support is still subpar. There are still many mail clients that do not support OpenPGP or there are those that do support it, but don't do it on a sort of the mobile application or anything like that. Anyway, if you've ever tried to use OpenPGP with signing messages and verifying messages, you know that it's hard to get it configured right and it's hard to get the tooling to do the right thing when sending and receiving mail. Now, SMIME is another standard for doing the same thing as OpenPGP signatures, but it really is relegated these days to the corporate world. There used to be public certification authorities that would provide you an SMIME certificate for signing a mail, but there used to be two of them two years ago. Now it's just only one that does this and they do it in a really strange fashion. If you try to get a certificate from them for signing a mail, they will send you the certificate, the public key, and the private key, which is totally at how it's supposed to work. So I don't recommend you use them because that's kind of really sketchy. Anyway, there are vendor-specific end-to-end mechanisms for signing and receiving and verifying mail, proton mail to the NADA, but they're all within the vendor itself. They don't scale outside, so we are not going to talk about them at all. So the main level verification is DKIM. Let's take a look at that in a moment. So patches on OpenPGP, can we use current OpenPGP standards for signing and verifying patches? Well, yes, but nobody does it because there are important problems with it. One, it breaks code review. If you use the inline attestation, I think you've seen some of that there is going to be dash dash dash begin, PGP sign message dash dash dash, then the body of the patch, then there is dash dash dash begin signature, and then there is the base 64 encoded signature at the very end of the message. And the problem that it introduces, and not just those headers and footers, but also the fact that if there are any double dashes in the message body itself, it will add a dash space before that so it doesn't get confused where the actual signed content starts and ends. And that, of course, becomes a problem because Git itself uses triple dash as a mechanism for logical separation of commit content. So there can be anything that's above the triple dash goes into commit, anything that's below the triple dash is just auxiliary information for the developer to review the patch. For example, it can contain history of the patch, it can contain the short log, any sort of information that the maintainer may find useful, but not preserve in the actual commit. So that if it's in the inline sign message that will get turned into dash space dash dash dash and tooling probably just choking that believe me. So mind based data station is a way to solve this problem ish. By default, it does not sign subject. It is not in the signatures do not include the header metadata like subject and from and date. And that does go into the git commit. So this is the information that we really kind of want to be included in the signature. So we are there are ways of doing it with git you can you can copy the the subject and copy the date and copy the from into the body of the message and get will look at that but almost no tools do this and it continues to be a problem.  I've seen this happen all the time that I recognize that the bgp signature is a trusted and valid content they may quarantine it or do anything like that. So the SMTP relays may may cause problems verifying this. Also does not attempt to solve key distribution, not going to talk about it too much. There is a Web key directories that sort of stepped up to try to solve this problem, but it continues to persist. Decay matter station is created to combat spammers really. So when gmail.com sends an email to you, it wants the to to verify to your receiving client to verify that the mail actually came from gmail.com just so the spammers don't pretend to be anybody from a large company like Microsoft or Google or or Facebook and so forth. So Google and Microsoft and Facebook will add a signature the the decim signature header that will contain information about the message including the body hash and it will sign it with a private key and to get the public key after query DNS to retrieve it at a specific specific domain record. It covers the it's actually pretty good. It covers the header metadata. It says the there's an h equals which includes which headers are included in the signature. It includes the body hash which is actually the entire body canonicalized and then that's this that's the hash of the body. And then the the actual signature includes all the data that precedes the B equals characters in the header. So they will include the body hash because the headers and then the actual header content will be part of the signature. So it really is pretty cool. It's an open standard. It is widely used. It's easy to implement. So it is I think we should rely on this to a certain degree. So it's decim good enough to attest patches. It is but with a few caveats. You know nothing about the infrastructure doing the signing right. If it's a small developer mom and pop shop you probably don't the key is probably not on an HSM anywhere. It's probably somewhere in there on the main server that is doing mail processing accessible to the postfix so whatever mail transfer agent that is doing all the signatures. So if that server is compromised then all of the email you know is suspicious after that because you don't know if the key was stolen or anything like that. The DNS zones when you're looking up the public key you're doing a DNS query. Of course DNS zones are still not signed. The vast majority of them isn't even if they are signed. The DNS sec is turned off verification for most of the very most of the systems that are trying to perform the verification. So kind of you hope that nobody's done anything nasty for your DNS lookup but you can also never be sure about that. Now the problem is that the relaxed body canonicalization. So if you look at the c equals relax, relax that tells you that the body was canonicalized using the relaxed standard and relaxed standard one of the things that it does it will kind of collapse all the multiple white space into a single space. Not a problem for patches for languages like c or or pearl anything like that but for languages syntactic white space like python obviously this is going to be a problem because a return true with a different indent could return you from a verification function and that will be a nasty vulnerability. So we can't really rely on DKM at least when it's not using the relaxed standard for canonicalization to really attest patches because it doesn't quite do it for us. It's better than nothing. If you look at the tools that I provide before for example it will use DKM verification all the time regardless if it's simple or relaxed canonicalization because simply it's better than nothing at all. So we can I suggest that we adopt DKM for our purposes. We're going to use the standard almost in its exact form. We're going to twist it slightly. We're going to instead of canonicalizing the body using the relaxed or simple canonicalization we're first going to pass it through git mail info and git mail info one of the things that it does it will look for things like a from or a subject in the body of the message to substitute its own from and subject. It will look at the same for date. It will parse the metadata of the message and the commit message and the patch and prevent present them separately so we can actually see how git sees them. So we're going to take this information that git mail info provides us then we go into canonicalize using it simple and then we're going to not use the DNS for key distribution but we are going to use our own key rings and I will talk slightly about that in the future and we're going to use open pgp instead of rsa or ed259 directly because it just makes sense for us for as a kernel development community because we already are using open pgp quite extensively for a lot of other things. So this is the example with open pgp shot of 56. We use open pgp for actual signatures. We use shot 56 for creating the hashes of the body and each of the headers. You'll notice that it looks exactly almost like the decim signature. There are minor differences there that for example we include the length of the message. I won't mention why there's reasons for that. You can read the code to figure it out. There is we would say we only we only include the from and the subject hitters not we don't care about any other headers because they don't become part of the git commit so we can ignore them and we the b content is the output of open g of gnu pg specifically that we include in a direct form and that includes the date of the signature. We can't actually use the date header from from from the email itself because interestingly git send email will change the date to the latest so if we sign it and then pass it through git send email the date header will stop validating I have no idea why it works this way it's really maddening but there are probably reasons why it's this way but so we're not going to sign the date header but we do include the date of the signature in in the open pgp standard itself so we do check those to make sure nothing untoward is happening. Okay so skipping to we obviously not going to do it by hand I propose that we do it with a tool I wrote called patat silly name serious business it means potatoes and a lot of languages and I fully appreciate that and apparently in Norwegian it means false which is really strange to me but it just happens to be that way doesn't really matter you can clone it from git curler org there's the url right there it can clone it from github because that's your thing you can be from there you can just install it from pip with pi pi using pip install patat it's there it's really only a few hundred lines of code and of course we don't do our own crypto we just rely on new pg and on pi knuckle if we support the ed259 key directly won't mention those in this presentation because we're trying to keep it short it is for python 3.6 it's the earliest the latest the oldest python version still supported it is intended to be used via sort of you set it up once and then you forget that it's there it's invoked via send email validate so if you do use git send email the idea is that they will enable you configure patat once and enable it via the hook and after that you all the patches are just going to be automatically signed before you uh you don't even have to think about it twice before doing it and I think everybody should sign their patches because why not it's just an extra header all should sign I'm going to have a demo session uh this is sort of the overlook of how it's going to work you can install it on your own and test it out or you can just follow me right here I'm going to switch to the terminal there we go and I already have patat pre-installed that's the latest version as of today maybe later when you're playing with it and I already cloned the Linux repository here and I created a commit that you can um I can look there and it pretends that we just released uh kernel 600 that's it's not don't don't yeah don't think too much about this so let's do git format patch patch one out take a look at this commit uh this is the what uh the patch looks like it's really very short I just changed the uh version and patch level to six zero now how do we make this uh signed with patat well first of all I already have a pgp key generated just to for the purposes of this example it's right there and it's got the signature sub key d25519 we can use that directly so let's say git format patch one we just pipe it straight wait before we do this I'm just going to show you my git config just we have the signing key right there just what you would use for assigning pgp uh signing a git commits um directly so this is the same it's user dot signing key specified if that's specified then patat already knows how to find the key that you want to use for your development work so we're going to do format patch one student standard out and I'm going to pass it directly to patat sign and if we look at the output here you will see that we gained two developer signature developer key headers developer signature contains the information about the uh the actual attestation it's got the signature it's very short because we use a edt59 key uh the developer key is really for the purposes of just information we don't use the information directly from this header to verify the key uh verify the signature because that'll be silly obviously because we don't carry we can we don't trust the contents directly from the same message we're trying to verify but if you are interested in how to import this key into your key ring or do any other work about it this is information that you will need to obtain it right so it's got the denities patata example.org it's an open pgp key the fingerprint is right there so you theoretically should know how to retrieve that from a key server or how to ask the this person for the public key not what go into it right here so we can pass this straight to patat validate right because it's our own key where you have the public key for it it says the pass if there's anything about the body or the headers that were signed that was different we would have gotten a bad sake so obviously we don't want to pass all the format patch to to to patat sign so let's just enable the hook and there's a convenient command to do this uh install hook you'll say that it installed the send email validate hook if we look at the contents of that you will see that it's just uh literally just one command patat sign dash dash hook and then just whatever is the um hook gets on the um as an argument and after this so let's say get format patch one let's say o to send so you created that patch we will now do uh get send email and I say dry run because we don't want to annoy anybody and then we say to send star right and you already here see that patat was already invoked it was signed and if we control see now if we look at the message as it exists on disk you will see that there is a signature header present there so let's say uh test the local host because it doesn't really matter for dry run where do you want there we go um and if we look now if this wasn't a dry run it would have just gone out but if we look at um uh to send oh one you'll see that the headers were added even though they weren't there before this was done by the hook so any patch that we now generate with format patch and then we send with get send email will automatically get those signatures and we wouldn't have to really worry about patat invoking it manually or doing anything like that pretty cool huh all right so you signed you sent the patches how is the maintainer supposed to verify this patch that it's uh hasn't been tampered well tools like before will do it automatically for you so let's get uh case cook is a good person who is doing uh using patat before all is signing so we're going to just demonstrate it right here so we're going to retrieve his uh message that he sent a few days ago and is uh if you can see that but before we'll do two attestation verifications one you will verify the dkms signatures are correct and we can see that they are correct here the dkms signatures passes but it will tell me that there is no key to verify case cook at chrome or so i don't have it in my key ring now i could ask case to send me the key and import it into my key ring right gpg import or there is a way to deal with this other ways there is a repository that i provide on kernel.org that i track i call it the kernel.org key ring and you will have to trust me unfortunately there's no way around it like i said bootstrapping trust is hard so if you want to trust me you can just clone that repository and use it with before let me look at git config and say for key ring look at this repository that we just cloned and this is uh the url will be in the presentation you can see that there is a dot key ring right if we're doing a key ring open pgp chromium.org key case cook and there is a default key that points to the one that we have in file for case cook so now that we have this key ring src there right we're going to rerun the same command before am and you will notice that now before says oh well we already have the key in the key ring not the open pgp key ring not the new pg key ring on disk but we used the the key ring that is in the repository and there that key matches and the signature passes and we can just say this got signed by case cook at chromium.org and this tells us that after the message was sent by case via all this mtp servers via you're gonna have to get stored on lorker.org anything else that's been done to it we can still verify that it has not been modified between when case sent it off and when um we retrieved it all right switching back to slides let me go back here this is what we did uh the key ring management is still kind of nascent i'm not going to go into it too much i'm just going to mention how it works briefly uh there will be a command for before that will allow you to simplify management of the key ring currently the only thing it does it can show you the keys that were used for signing a particular message thread so test that out by yourself if you want so before we'll use a global new pg key ring so if you already have a bunch of keys in your key ring you don't really need to worry about re-importing them for before use we will always look in the key ring new pg key ring if we don't find the key elsewhere but what i suggest is that we stick pub keys into the git repositories themselves right it's not as crazy as it sounds right the there is it is a bit of a circular how do you use the git repository to verify the git repository itself but the distributed trust is hard and this kind of allows us to set sidestep the problem uh git repositories are distributed they're also auditable you can uh for kernel.org we have uh the audit trail for all the git commits so if there's something bad happens you can we can look at the uh the audit trail and figure out who added which key where at which point uh we can uh the git commits themselves can be signed and verified so for example if if there's a maintainer maintaining with a bunch of sub maintainers or a bunch of contributors that that they work with they can verify um they can verify their own signature on the git commits it'll be one person that's kind of acts like as an introducer to all of the other people who are working with that sub maintainer this is a hard problem key ring management and key management and it's it's complicated so i don't want to bog everybody down too much so i just wanted to point out that if you do have um the key in your new pg key ring that you don't really have to do anything else it will be automatically used it'll be automatically verified um if if before finds the patches signed with that key now sub maintainers can keep their own key rings in a separate ref in a repository for example if you have uh if you're a sub maintainer of a specific driver and you work with 10 contributors who send you patches for the drivers all the time you can just create your own ref and there's information for patat or before you can look into it how it's done and you can create your own rest like ref refs meta key ring and you can just keep their keys there for before to use this is a way to sort of centralize your key ring management so if you have copies of the repository in other places it's easy for you to not have to re-import the keys in a bunch of other places you can use the curl at org's key ring like i've just demonstrated with my uh with my example or you can use the fault through a combination of all of the above you know before we'll look into any key ring src that you specified before it looks in your in your new pg key ring so you can play around with it i i recommend that you do this this is this is kind of uh i think a cool idea that allows us to simplify key public key management for contributors and for our sub maintainers so whose keys should be added to the project key ring uh it doesn't really make sense for one of contributors obviously so if somebody sent you a patch that you've never worked with this person before uh you can just always you should always assume this the code is malicious and you should be reviewing with extra zeal right but uh maintainers don't really scale so if there's somebody that you work with on a on an ongoing basis day in day out right you want to uh be able to sort of have a quick way to verify that the patches that they sent actually did come from them from this particular person that they haven't been tampered with uh and root anywhere so uh this the key ring as per management as proposed by patatin before allows you to to add this as an extra sort of protection around your workflow um doesn't say you should stop being vigilant constant vigilance as always but uh yeah just keep keep this as an option especially if you work with a whole bunch of different contributors and you want to make sure that the patches you receive are coming straight from them thank you questions or comments send them to tools at linuxcrown.org um patches are welcome if you if you use patatin you find that it doesn't do something that you need or before or anything like that if you do sign the patches that will get warm and fuzzies uh so i will feel very good about that so be so free to do that and that really is all there is to say about it so thank you very much for being part of this talk i believe there is questions and answers you can ask me in the chat i actually have no idea how it works i hope that somebody introduced this um topic and uh please ask away or you can find me and uh on the mailing list or um hanging around thank you very much have a good day


I want to explain to you the nuts and bolts of building an Instagram food business. So then that way you have everything in mind. So you're not leaving out key components that would be crucial for the success of your Instagram shop business. Next up, this overview allows you to see things in the whole picture. So then that way you can actually dissect and absorb the information properly. And for you to make the decision, whether you want to go with the freeway or the paid way. Now let's dive right in freeway and the paid way. So what do I mean by that? As you can see, there are two different shops available. There's the free shop right here and the paid shop right here. The main difference that we're seeing is right here that has a shop feature. Now, if you're just looking at these two different shops, it might look entirely the same. However, there's a big distinguishment between the two. You might be thinking just, Hey, it's a button, but actually it's more than a button. OK, and as you can see here, once you click into the button, it brings you to this site and then the site would allow you to actually click in each of the products for you to learn more about the product that you're selling. Whereas with this one, there's no feature that is similar to this. Now, let's dive into the requirements. If you want to use a paid account, OK, then you would need a Facebook page and an e-commerce website as well. Whereas if it's a free, then you don't need to worry about any of those items. The three key benefits of a paid Instagram shop, and this is something that I highly, highly recommend you guys to invest in. First up, because it is much more convenient for your customers to browse your items instead of directing them to a website of yours, which would be clunky, which might be difficult for the pages to display. Your customers would potentially be able to just click into your shop. And this shows up right away. This is much more easier and convenient for your customers to just browse through your items. It also increases the likelihood for them to purchase because there's less friction when they're looking at this. This is much cleaner on the eyes and much easier for them to make a decision because it's just so convenient to clicks and you're here. Whereas in the website, people need to scroll, scroll, scroll, find your product, so on and so forth.  So instead of you telling people to visit your Instagram bio, click on the website and then browse your items. You can actually have people and actually have links right here that populate. And once you click into the link, automatically it brings them to your website, which they can place an order right away. And this once again increases your likelihood for people to purchase. OK, so you can actually have multiple call to actions within the image itself. And this once again increases the likelihood and it seamlessly promotes your product page. And that's the reason why I love this shopping feature. And lastly, it also gives you much more exposure for your customers who are searching for your cuisine. So for example, if I just type in pizza, this pops up right away. The shop pops up right away. It's in the Explorer tab and it has much more exposure than if you were not on the shop feature. Your product is now exposed to people who has the intent to buy. Because when you're in the shopping tab right here on your Instagram, most likely you're thinking about buying something.  I want to probably buy some pizza dough or let's see if there's anything pizza related that I can buy.  Shushi and pizza. Let's give it a try. And that's how you're going to be able to market to people who have the intent to buy rather than just mindlessly promoting to people scrolling. So this increases your chance of your shop being exposed to much more people. And that's the reason why I would highly recommend you to look into using a paid Instagram shop. But nonetheless, regardless of whether you choose a free or paid Instagram shop, you would still need the following four components for your shop. So make sure that you guys pay attention in the next four lessons as we cover the business operations, we cover the ordering process, we cover collecting payment and fulfilling orders and we're going to dive deep into each one of these processes so then that way you can start building up your Instagram shop either free or paid and we're going to cover the pros and cons within each of these lessons.


So let's shift gears a little bit. It's like about Trump. You know Trump was not too far up the road here Yeah, an hour to whatever not even he was recent president of the United States.  They just arrested what Rudy for no reason They're rated as rated as apartment No, they will do anything they can even after they win in their power to find anyone who ever tried to question their power and destroy them and Trump didn't do it Trump was too nice. He thought oh, I've won now. I know these people are crazy, but he just thought I Guess he was I wouldn't say Trump made a mistake But certainly he looked at the tiger and thought all the tigers behind that wall. That's fine He should have shot it in the head.  We don't know the powers behind the world who allowed it all came and sat down with him and said Listen, mr. Trump, you can lose this election and go back to Mar-a-Lago Or you can lose this election kick up a fuss and end up in jail for one way or another We are worse. We're gonna find something. We're gonna raid every single property.  When that's your intention That's what they're gonna do.   I think and for now And hopefully and hopefully hopefully is the intention of coming back etc. etc But the the democratic systems are so powerful and they're powerful because the left are so petulant They'll stick together no matter what they'll defend their own no matter what you can be high on fentanyl I'm point a gun at pregnant woman.  Yeah, we don't do that if we're not going to do that We're not gonna win because we're not united. So that's what it is So if what Trump should have done in his presidency, I'd like to think of you would go back in time He would have done what the Democrats are now doing and just went for it cracking skulls Just cracking skulls. That's what you should have done. How do you feel about Trump 2024 running again? I I would love for Trump to win in 2024 But I have I no longer have any faith in any electoral system on the planet if they'll Which they did I'm not gonna even say maybe they did we all know The election for the number one most democratic most powerful nation in the world You think that all the elections in the world You know, it's funny. My and Mar recently had a military coup We don't know if you know guys know this my and Mar about two months ago The military took over the country and when the military took over the country they were citing the reason was electoral fraud and They were saying that the elections are fraudulent and we are taking back the country blah blah I looked into it. It was like 51 percent 49 percent for years throughout the 70s and 80s and 90s then Clinton Bill Clinton went over there became friends with one party and ever since it's been 80 percent 20 percent They use Dominion voting machines or Dominion can whatever Now I know that's rigged. It's a coincidence. It's a rig. That's not coincidence The military said no we're tired of this America's controlling our country and they're rigging the election So the military took it back now. I don't believe in any election. I don't believe in any of them anymore So if Trump went runs, it's nothing to do with how many votes he gets Unfortunately, that's the case. I think Stalin said it during communism It doesn't matter how who casts the votes it matters who counts the votes. That's one big chess game Yeah, so how can Trump run and win when they'll just like the what can he do?   Yeah, this is how the reality works This is unfortunate. So Trump can win and Trump can get a ton of votes, but the other I don't think he stands a chance. There's no way they worked that hard to get rid of him to let him win again I really believe that they thought he was smoked with Hillary he won They couldn't believe it and they thought okay. He cannot win again when when Joe Biden won the the Nomination Tristan goes our Trump's gonna win again And I said I have just lost all hope in Trump winning and he goes why I said they just invented the Russia collusion They've had a full-on panic attack these years cuz Trump was in president You think they're gonna put some senile old man up there to get landslided and do nothing You think I'm not give him some kind of sugar, but sleepy Joe up there to get whooped no way as soon as they said sleepy Joe I was like no I Think I tweeted out or Tristan put a tweet on Twitter about it He said I wanted to put money on Trump and Andrew wouldn't let me he said it I didn't believe and Andrew called it. I knew I just knew soon as they said Joe Biden I was like this is this is over. Here's the question. How much longer do you think Biden will be president a few months? You're what Kamala is that is that exact?   Am I allowed to say that word because okay, so but she is no She's the least likeable individual. She's so unlikable as an individual and yeah soon She's gonna be worse Kamala Hillary.  Free some bro. Let me just get it over with right we get over with let's go hard.   Yeah, I've been made.  I agree


The Mekong River Basin is a key regional resource in Southeast Asia for sectors that include agriculture, fisheries and electricity production. Climate change could have significant implications for the region's water resources, which are vital for sustaining these sectors. To investigate the potential impacts of climate change on freshwater resources within the river basin, researchers ran pattern, scaled global climate models, GCMs, through a semi-distributed hydrological model, Slurp. They found that the temperature-related signal in discharge was strong enough to overwhelm the precipitation, related uncertainty in the direction of change in discharge, with scenarios from all GCMs leading to increased river flow from April to June and decreased flow from July-August.


My only problem with the thesis boot camp was the fact that I didn't do it earlier in my candidature because I think I could probably have taken about six months off my time for completion. My name is almost Dr. Kelly Strepec and I participated in the thesis boot camp early 2014. And I can honestly say that it was probably the best workshop that I participated in during my four years as a PhD student. Actually, I'll go as far to say that it was the best opportunity that I had as a PhD student here at the ANU. I heard about the thesis boot camp through an email that was sent around to all the students. And so I had a little look and I saw what had happened at other universities. And to be honest, I didn't actually believe what the testimonials were saying because for me the thought of writing more than 500 words a day was just the realm of impossibility. All of a sudden I found myself in this environment where our sole purpose was to write. I didn't actually have to think about anything. I didn't have to feed myself. Every time we got up for a break there would be some sustenance, some nutrition, loads of coffee, loads of people to talk to, to talk about your progress, to talk about your fears, your anxieties. And then we'd be back to writing again. So there was this energy there. During the write-up of your thesis, you're at that point where you're not only writing your thesis but you're also writing job applications. And for me the whole process was made so much faster. And the tools that they gave me, they've actually allowed me to be a lot more creative with my writing as well. Now that I don't sit on things and I don't stew on things, I find that those moments of brilliance that come along, well not quite brilliance, but those moments of inspiration that come along, they now flow out onto the paper. And for me this is something that has never happened before. Over that weekend I produced just over 10,000 words. I finished an entire chapter. A chapter that I'd been sitting on for months and didn't think that I was ever going to be able to complete. And I wrote the whole thing. It was the first draft, it wasn't the final draft, but the stress levels for me, it just made finishing up so much more easy. I also, straight after that, I wrote three job applications, wrote the selection criteria that people told me would take weeks, took me days, and I actually got offered all three jobs as well. I can wholeheartedly recommend the thesis bootcamp to everyone, everyone who is trying to complete a thesis, anyone who actually needs to do any form of writing in their work life. For me as a scientist, it's actually something that you're not really taught, it's just expected that you'll be able to not only do your science, but be able to communicate your results. And for me I realised that writing and writing quickly is a real art form, and it's something that you can take into all different walks of life. So if there is one program that you get to be involved in while you're at the ANU, then I would highly recommend it be the thesis bootcamp.


ompany called BigHeart. After the post-Taipei, they got 2,200 million dollars in 3D open-source. They are home from China. But their branch is Singapore already, New York already, Japan already. And I have seen the presentation of the China open-source conference. He said, beginning of the era of Taipei, calling the time on BigHeart is only Chinese break time. But now, almost 20 hours, 365 days, continuous treatment from all over the world. That's the reason why Taipei is a global software and Taipei is more a mandatory software for the society. That's the reason why they did the company. BigHeart company is providing software as a service platform for the users and still supporting the community. BigHeart model is Huroku, Docker, and Electric Stars. China completely copied that BigHeart model in there. And this is a chart from the Chinese venture capital. Fundraising OSS company and some companies called Unicode already. And Chinese fund focused on open-source. Because we, Kai Wencha, and other Kai's members, are working for the business. If the company is software from China, how to make the market do well? Very, very, very hard. Extremely hard. But the open source, open standard from China are easy to bring to the ground. Many Chinese companies, not only from IP, bringing the more developed standard, bringing the more developed building together. That's the reason why China government and Chinese company focus on more and more open source. This is most important slide we might share. From the Chinese venture capital, they told of current open source 3.0 era for the business. The beginning of open source, open source 0.0, is a typical softwareizer, ggna and relax.  I really like just for fun. And also just to change the society. This is the most primary important on the path. And second one, gna, relax, relax, high SQL, PHP era. Building the software, building the solution, building the service by only open source software and doing the same thing as the software development. This era is almost the same. As a normal company, use for free, support for the pay, is a version of 0.0. And version 2.0, software as a service era, clandera, component of Kafka, these are mixed community beta, mixed software as a service beta, and mixed for good service by the community. This is a very good way from Apache software foundation, they saw the community over thought. Mixed good community, they contribute and renew the software a lot. That's the reason why we pay for free for the software as a service. Then, now, newest one, open source software 3.0, like MongoDB, Databricks, also BigHeart and iDB, which is not just a cloud native, always an open source software, just a platform as a service model. Scarable, disk-reviewed, cloud service, almost all solution is open source. Very hard to find a proprietary, but we still pay for the software. Currently, community is most important. How developing the software is most important. Primary or open source is most important. If you're making a global community, if you're making a big developing power, if you can hire a million engineers, you can do the proprietary, that's very hard. Good is also sometimes doing the open source, because good people are also very clever. Good is brilliant engineers there, but they know although good is much, much better. That's the reason why they choose the open source. And also the community style, our community is still growing. Also in the foundation is the global community. Trash can remember is far away, Tencent cloud, Antedrupe, Anipada. We are working together with Sony, Erikson, Facebook, Winniar, Red Heart, Microsoft. In the open source style, western people and eastern people working together to make a platform. Currently, open infrastructure is making very good cloud software, expect awesome. Many projects from China, Incubation by Mirage Foundation, Apostos Air Foundation, CloudNate Foundation, Mirage Foundation makes 50 projects already. Just 15 projects is all coming from China. Foundation was there. This is a simple, China government supported the open source foundation. They are ocean foundation. They can make a regulation. They can make a goal for the open source in China. They build the license, integrate open source software from China, and push open source infrastructure from the government, and build the university and the company, and make a role support in open source. This is one of the examples from the Open Atom Foundation. They make the new license, Moorang Software, Famicom Software right as part of too. Moorang PSL. This is almost the same as the past license. But Moorang is China friendly. Because in China, some systems are different from the United States. This license is a good for the Chinese society. And also, the English and Chinese are compatible. This license's purpose means to make contracts from Chinese company to overseas company using the same license for the open source. This license is a open source infrastructure already in the open source infrastructure. And we Chinese making new one for the GDL style license for China. And also open source hardware style. There are a lot of Chinese style copies here from Shanzai. Shanzai company makes a lot of copies. But this Shanzai style is transforming now to the Gronka. Later, we are coming to each other his way. These two are ideas from my part. New Shanzai engineers and entrepreneurs are helping the Chinese technology such as Xiaomi, OPPO, and the Haki layer robot. I try to explain to them where the Shanzai comes from and where the Shanzai has to go out. Shanzai means Chinese style open source hardware. But design change is based on license. That is why open source. We share the design. We share the hardware and we share the IP. This is a function of serial open source but not based on license. Current Chinese company is a transfer to share IP, share product, share knowledge but based on open source license. Currently, more than 550% of risk-fired premium vendors are from China. Currently, China is the most popular risk-fired company in the world. You can see some clients company was there. Rick Kestova is the best of Alibaba. They sold a more 2.5 billion of chips by risk-fired vendors. If you have a true buyers here and there, the price under there keep from China, Shanzai, Jelly or Plutons. These two companies are very huge advocate for the risk-fired. Currently, risk-fired is a cover already. If you bought the Bluetooth chips under 10,000 dollars, probably risk-fired chip from China. Alibaba is the chip design company he had 6 out of 2.5 billion of risk-fired chips. They are open source. No any Shanzai was there. And the rest of 10,000 Bluetooth chips and Bluetooth and Bluetooth speakers are sometimes tired about the Bluetooth IP, but chips and IPs are purely risk-fired. Our company sweet science is an open source hardware marketer. We sold a lot of Raspberry Pi, Arduino, and M5 Star, and also PSLab. Many open source hardware with 5 chips, StarOS and Sensor from China. I spent the biggest from China from 2014. 2014 hardware is ok, comfortable even cheaper than other. But last time hardware from Star from China I never saw yet new type of technology from China, like AI, A6 model and also one chip SOC installed a lot of functions Shanzai transforming to the public now, there again. In this IoT development of hardware for M5 Star ESP32 desktop in screen and battery there are some markets that are currently bigger than Arduino in Japan. Thanks for the attention. Currently this activity in post Asia is very good for that and memorable for the Kaiwen Sha. Three Chinese open source community want more and more to contribute to the world of open source community. We start from Rami, we use a lot of open source and currently we want to contribute to the world of open source community. We think more and more to make and also more and more in Singapore as a society. Marseille, Singapore, Marseille open source society. Thank you, Wakami. Thank you very much. Can we talk? I'm going to ask questions. In Japan Japanese Japanese Excuse me. Can you hear me? Yeah, you talk about something like an Arduino so what is the difference between in which you talk about the difference between the books and the change of the world in Singapore? You have a question about the different society open source in western Thailand? Of course almost severe I know in my knowledge almost all open source license is based on United States even if we find a contract we have to bring that into the U.S. court like in Singapore I keep an eye on the license but you are out of the license they have to submit that contract even if it's a shorted contract we have to go to the U.S. court but in China is the border in China Chinese government is open source Chinese government is open source open source for the Chinese I was just wondering you mentioned a lot of development how is the Chinese government approaching other governments around the world I think that China is a more European service by the government in the Chinese society open source the Chinese government has to proceed most of the big things in the world secret from China very hard to sell most companies in the Chinese market are only in demand Japanese companies even my solution is appropriate very hard to sell from China okay thank you that company pick up American company square Japanese company also using the okay American company square Japanese company also using the Chinese open source in exchange the question is more about what you think a Japan open source communicator from what pirates are doing in China I heard from Japan a lot of techies are doing so and hard to understand the Japanese open source Japanese open source society are the students doing the contribution that most of the world problem in Japanese society the business guy and government is very very far from the deep end you can't understand the open source most important to learn the open source in here China is a better thing because many business guys many government guys more open source and good open source and well thinking and design very very far this is the largest problem in Japan I also want to show you that program the open source is all over the world thank you very much thank you Takasu and we are looking forward to the other section here the event thank you so much for meeting me with us thank you thank you thank you thank you please enjoy together for the possibility after three days


My name is Lita Grabovitz and I'm a sophomore year nursing student and I'm Shelly Ferri and I'm also a sophomore year nursing student and we both just came from our ethics test in our first pre-nursing class and now we're on our way to stats and later probably studying for anatomy. Yep, so that's next one day.