So, hi everyone, so my name is Michael and this is a session about Secure Software Supply Chain and I will cover the kind of basic concepts of how Secure Software Supply Chain works, some of the history and what we do there on the operating system level and with me I also have Stacy and she will talk more about the management part of what we do on the Secure Software Supply Chain and what tools do we have there and if you have any questions feel free to ask during the session or at the end we will have some space and those who will have like good questions and every question is good they can get a nice t-shirt so write books down, prepare the questions and you will have a chance to get your answers as well hopefully. All right, so supply chain what exactly it is and why we are talking about it so the supply chain attacks have been recorded fairly recently only so there is an European agency which is called Anisa which has been doing monitoring of supply chain attacks since 2021 and you can see on the picture that the amount of these attacks has been on a rise so in 2020 actually 2020 was the start when it started to monitor these attacks so it got like four of them in 2020 or four to eight and then it raised to four times the amount in 2021 and this has been on the rise since then and since this I mean this is not a new problem but only recently it was it's something what people started to pay attention to and supply chain attacks have also been something that's became easier as the resources to run these attacks are getting more and more available it used to require like state nations to to run these attacks but lately it's so easier it's very easier so that even like small groups or even individuals can can pull off these these attacks so be aware of those and prepare for for them because it's something that's given what's not going to go away one of the first actually the most famous attack which started all this was the Swarovans hack so it's a company which has been working on the which has a software for infrastructure monitoring and network monitoring and the that software has been in use by many customers including government agencies worldwide and the software is called Orion and sometime in early 2020 a group of hackers injected a malicious code into into that software so they broke in to the company tools and premises and injected malicious code to the source code of their Orion software and the Swarovans didn't know about that hack back then so being unaware they actually spread that hack to their customers and at the end exposed their customers environments to the to these hackers so it was pretty serious it affected a lot of companies and this was one of the first attacks which popularized the supply chain supply chain security needs and attacks and made like most population aware of their their existence so what's supply chain what's the secure supply chain so we talk about supply chain security and the definition is about securing documenting and tracing so you know that's not about security itself it's also about the option the possibilities to document and trace the all the details regarding sources binaries dependencies updates and all of that regarding the specific workload and for each workload you are running you should be able to document and trace all these details and not only upon its initial deployment but also throughout its its lifecycle because the application is deployed and when it's running it's being updated and throughout this this lifecycle at each of these times it can get get attacked and exposed to to something malicious and why do we care it's easier as I have said the number of attacks has been increasing but also there are other aspects you should keep in mind because software nowadays it's not only data centers right so you get software in cars you get software in appliances you can software in whatever you can think of and each of these software components is a possible target for this supply chain attacks and you probably don't want to sit in a car which suddenly gets a malicious code injected because somebody forgot to verify one of the dependencies because these cases can become pretty harmful at the end and the other reason why we should think about supply chain attacks is are actually human errors because social engineering is a thing nowadays it's actually easy to get hold of like contacts within a specific company and convince those contacts to like somehow get some parts of a code replaced by something malicious or put a USB stick somewhere and get the environment infected so these are the reasons why supply chain security is is important supply chain as you know is a chain meaning it's as weak as its weakest link so we need to take care that all of the links in that chain are actually secure so from the start to the end you need to take care of all the components of that chain so there are different threats which apply to different parts of the chain you probably can't read it but this picture illustrates the lifecycle of a piece of software so it starts with development which creates some source code the source code gets built packaged and distributed to the consumer and in the build process and in the development process it's consuming some dependencies from the outside and there are multiple threats which can target different parts of this process meaning source code threats you can get like malicious code in the source code you can get compromised source code versioning system you can get build threats meaning some source code gets injected in the build process which was not controlled by the source code control system you can get like compromised packages used during the build process you can get like bad packages so you expect some packages being used but at the end those packages might be compromised already and you can have dependency threats and that's something what many people do not realize today and actually they are fine if you are developing application they are fine getting very dependencies from a public repository so if you are developing in python you can get pipi packages same applies to Node.js, Go, Rust all these programming languages have their ecosystems publicly available and obviously not all of these dependencies are strictly monitored for malicious code so this is one of the frequent reasons when and how malicious code can get to the application and that applies also to not only source code attacks but also nowadays with containers which became very popular people or developers are very used to just grab their dependencies from repositories like docker hub and like half of the docker hub is not maintained for like people just injected their containers there and left them running and others are happily consuming these containers despite having a security hole so that's another point of view you need to keep an eye on what you are consuming from the outside and while it's very easier for developers to just grab stuff from third-party repositories be there that you better take care of what's being consumed so you had a question perfect so great question and I will actually cover some of these parts in my next slide for the presentation but the simple answer is you need to make sure that the source they are getting your software from is secure and that can mean multiple things so ideally you have a trusted vendor who is providing these these packages to you and they are doing the audits or you can have your own team which is doing the audits on the packages you are consuming so you can do it yourself you can have a vendor but you need to have kind of a process in place to make sure that there is no third party like interfering with the code you are actually consuming so let me carry on with the presentation I think it will answer some of these questions if not just raise those again and I will I will carry on I've answered thank you so that's actually what I want to talk about right now how what are the ways how to how to prevent secure so how to prevent supply chain attacks using some of these methods so security is about like multiple targets and I'm going into detail here so the primary targets are confidentiality meaning that information is exposed only to those who are or who should be able to access that information the other target is integrity so that information is not changed or altered on the way to the to the target consumer and obviously availability meaning that when the target consumer needs that information it's readily available and ideally not at other times for security purposes and there are multiple ways how to make sure that security that these targets are applied to the software's supply chain processes and tools and one of the recent methodologies is called salza it's a google's specification and also kind of a certification of supply chain security and it specifies how to address some of these some of these threats how to avoid them actually and how to make sure that your supply chain is secure and it mandates some some measures so if you want to have your supply chain deliver delivery certified you know what are the measures you need to apply so for instance for a source code it mandates like two person review so upon any code commit there needs to be like two people there that review those specific commits and the other source code related is a version control system so there are measures like about the the machine security when the verbal control system is running there are measures how the control system should be set up and that applies to the other parts of the other threats as well so build threats for instance salza mandates control build environment so the built environment needs to be kind of self contained so we can imagine a VM which gets spawned the the stuff gets built within that VM without any like outside influence so the build process cannot just fetch random stuff from github the build process cannot fetch random python modules all these modules need to be predefined available within the VM so that the result is is defined and ideally the build is reproducible that obviously can conflict with what developers some of the developers do today because a lot of these processes build processes are dynamic they rely on on github repositories during the build process they fetch the stuff from the internet well it's convenient but it can be risky so it's always like a trade-off between convenience and assurance and security and the other related topic is its provenance of pretty much all the data which are related to the build processes so meaning it should be locked what's being used for the build process how the build process is running there are the like what what arguments have been used and all that is available not only during the build process but also after the build process so that whoever is consuming the outcome of a build can independently verify later on how the build process went what was used and if there's nothing which is which is wrong or or insecure and obviously security measures for the build machine and the build VM are important as well yes please do you do um so that's a good question you can do security checks at any time appropriate or what fits you it's important to make sure that there are checks in place so for the build process itself the important aspect is that it's reproducible and it works with a well-known source code and data and packages and input right and if you check this beforehand when you are fine as well because when during the build process is if the environment is confined and limited then nothing can be introduced during the build process because you work with a known input and the output is deterministic right but you can obviously run build checks and security checks so the important thing to keep in mind is that this is kind of a repeated process so at the time of the build you what i've been describing right now is that you are making sure that the security aspects are met at the time of the build but the next day or next hour even there can be a security issue found in one of the libraries used in like third-party libraries in your own code and you need to react somehow and you just repeat the build and you either fix the bug yourself or you get a fixed third-party dependency or you remove a dependency and repeat the build and get a secure outcome again but this is really over and over and over repeated process absolutely absolutely yeah yes exactly that's how it's how it probably has to work nowadays i know it's like so that's related today we need to be able to react fast unfortunately the threats are coming on a like hourly daily basis and we need to be able to to react and respond you can limit what you can limit the exposure so you can be application contained in a like a VM in a container you can have a controlled environment so you can be relaxed a little bit but then obviously eventually you need to update the application or its dependencies somehow and there are measures how to update the application in place so like we do have stuff which is called live patching so you can update applications while running so that the performance and function is not affected but sometimes it can be used sometimes it can't so it really depends and thank you for your question regarding dependencies that's actually what i've already mentioned but a lot of these things which apply to source code and build threads apply to the dependency threads so you need to keep the provenance of the data there in case you get a like third party library you want to know what version it was what it contained what files it has and then how it was used for the build and be able to check and check that later when you are building the stuff or when you are verifying that the application was secure secure beforehand and obviously you want to check your dependencies i will probably be repeating that because it's what this by being annoying part of the process needs to be happening right so this is a picture of what we actually do as part of a building our operating systems less so we work with the community code and then take the code through this process up to the customer systems so we work with the community and we make sure that the community development process is sane so like generally communities are trustworthy so we upstream at least most lively ones they have like a regular review they have multiple maintainers and they are part of a maintainers group as well so we make sure that the upstream code is is safe but then we also need to make sure that throughout the process speak before it gets to the customer it's all verified and and secure so there is a code review before it gets injected into our build build service then there is a package selection meaning like how which components are selected for that specific package build then there is a build process and we are using the open build service tool for that which does exactly this confinement so each each build has its own VM it has its all its sources source packages and dependencies in it so it's reproducible it runs without any for part interaction without any external exposure so we know that whatever was in there is also getting into the into the output and there is nothing like what what can interfere with the outcome that gets tested and this testing can be also security testing but generally it's like functionality testing and then all this is signed and delivered and then customers can consume it so the packages are signed the repositories are signed and this way the customers the customer who is installing that specific package can be sure that during this build chain this build process nothing has interfered with that code and he's kind of safe to run it but as you said next day there can be a security issue somewhere so well we need to rebuild the package and we actually do it so some packages are rebuilt pretty often and each build is going through that process from the left to right and updated package can be available like in an hour and then obviously all the application developers need to grab that updated package and install it again all right yes please so let me answer a second question first so the signature is valid for for everything what we release so we actually we have a like signing key which we use to sign all the packages we have a signing key which we used to sign repositories and you can verify if you download the package from from suzer repository that you can easily verify that it's actually coming from us it's like usual usual signing mechanisms which are used so you just verify it the ways the same way you are used to verify stuff so that's actually pretty straightforward when it comes to the build processes within the company I mean it's it's tricky obviously because it's a trade-off between effort and security and like how much time you spend on on securing your environment and it really depends how much sensitive information you are processing how security there or who are risky environments you are running or you have inside your company so some companies are more security conscious or aware because they are running like processes customer data in some of the departments and in some some pieces some parties can be easier like if you have like POCs open source developers most probably do not need to be that that aware on the other hand you need to make sure that the overall infrastructure is not exposed to to attacks so it's fine to have open source developers grab stuff from github and developer applications as long as if this development process is not injected injecting the like malicious code into your production environment so this kind of separation can help the other aspect can be that you actually have a like team which takes care of the basic building blocks so we do have some customers like in in telcos which have dedicated team to the operating system and its components and they prepare repositories for the development teams and in some of these industries you are actually mandated even by law that you can't just grab random stuff and develop with it and so this team takes care of all these dependencies so they have like a operating system they have python python interpreter they have a set of I don't know 300 1000 python modules ready available to the development teams and these teams need to use only these modules to develop their application if they need another module they go to the team and the team goes to the vendor they talk to us and to be kind of provide these because this is really like contained environment and they cut efforts they are not even allowed to use like random unsigned or insecure things we need to have guarantees and support for for many years for these components so that's a good question somebody asked me the other day about s-bom as well I don't have full details what I can tell you is that we are exposing the complete source code with all the build flags to actually publicly we are we are only doing open source as part of our products we are exposing everything what we use to build stuff so if you install a package like from the latest version I pick like slash 15 sp4 if you install bash package you can go to sources.sus.com and look for for this specific package and specific build and you will see the source code for upstream you will see the spec file you will see the patches which are applied and the spec file will obviously contain all the details about the flags which have been used and the patches which have been applied so that's how you can you can actually build it yourself at the end using the source code and verify that what we are distributing is like the same depending the signature because you won't be able to sign it using the suzer internal key and one more question yes please so jeff do you happen to know what level is that all right so yeah so salsa is fairly new thing so google used their own specification to come up with salsa levels and we have been actually certifying against salsa just just recently so that's what we do and speaking of certifications there are more of them so salsa is a recent one and the one which can be used right away for software supply chain security there are more of those and I'm not going through the details because there are like different bodies different certifications and different different purposes and I like actually uh this table more because it illustrates what kind of certification are there and this is by no means exhaustive list there are many of those available but these are the main ones which we are facing when we are talking to our customers so common criteria is actually my favorite one because it's pretty complex it covers the complete environment so it's not about it's not only about the software itself not not only about the software components but also about the processes which are used to build the software it's about the processes which are within the company used to decide about new features about communication within the company it's about the it environment how the service are set up it's about the physical environment how the offices are used so that they check for the stuff that you can't enter the premises without being authorized and they're actually these offices are going to those offices checking the environment that you are really secure so that's pretty complex and there are multiple versions of common criteria certifications the other one which is mostly used in the US is FIPS it's about crypto algorithms and random generators it defines which crypto algorithms are secure enough and which can be used and STIC is about documenting how to make a system secure so these are sets of security guidelines which you should apply when you are setting up a system and configuring the workload there are a bunch of other certifications PCIDs for financial data so you need to figure out which ones apply some are mandated by law if you are processing financial information or customer data PCIDs this might be already something what you need to adhere to others are voluntary but you should keep looking for vendors who are certified against these certifications because it also improvements the overall supply chain security processes and environment common criteria as I as I explained is the most complete when it comes to the topic there are multiple levels against from one to I don't know seven the most the biggest level reachable for the regular operating system general operating system is level four because up to level four it's about the software and processes how it's built what components are used if you go to level five and above it requires requires formal specification of algorithms used in the software and that can't be really done for Linux nowadays so there are specific specialized operating systems which carries these higher levels of common criteria certifications we do have EL evaluation assurance level four and we actually have four plus plus means that there is a formal specification of the processes related to to remediation of a security flaws so if there is a security issue then it's defined and prescribed what the process is like who reacts how how they react what do they do so it's something what you actually ask for so this process is well defined in the in the security the certification criteria we have to have the documentation we have to have follow these processes to make sure whenever there is a security issue that this timeline is fault in every case and updated package updated component is released to the customers in a timely manner so that's I like this certification because it actually is something useful unlike some of the others it shows that the environment of a vendor is actually really secure according to the certification body and common criteria is used worldwide so there are some some countries which have authorities issuing the certification our countries do accept the certificates so it's pretty pretty useful certification and as I explained for some industries different certifications might be relevant like FIPS is relevant for the government agencies obviously specifically in the US they are mandated to to use FIPS certified processes and other industries can use these certifications as they see fit so really look for the vendors based on what your company actually does and this is a picture I showed before it's just to reiterate the fact that the certification should apply to the complete process so if I would be just certifying the delivery chain delivery part of a chain that's really not very useful because the rest needs to be secure as well so our certification is applicable or applies to the complete chain how we deliver software to our customers from the community code through all the development building testing signing steps and you can obviously do something similar with your software when you are developing you can also look into these certifications how we are how we are done and yeah that's it any over to Stacy to talk about what this any more questions right now can give you mine and you hear me all right so now that you have this great software implemented and secure and it's in your system how do you keep it secure well you need to patch it so I have a question for you how many of you have a defined patching schedule that you use on a regular basis and you know your systems are secure she gets a t-shirt you already have one all right so unpatched systems cause more than 60 percent of software secure cyber attacks and sometimes your cio's and your cso's are actually going against you because they don't want their systems going down and 56 percent of 56 percent of attacks are coming from vulnerabilities that are more than four years old that means that these systems have not been patched that's a problem so patch management is important because it fixes the vulnerabilities and it decreases cyber attacks it also is a proven a way that you can prove that you're compliant so for PCI for example you need to show that you're patching your systems on a regular basis and of course patching goes beyond software fixes and make sure that your systems are the best for your users so how are you managing your infrastructure some more numbers 33 per six million dollars is the annual cost of downtime due to cyber attacks that's a lot of money and you don't want to be responsible for it cyber attacks globally the price is going up 4.4 million dollars per cyber attack and the average annual hourly cost for cyber attacks $400,000 these are coming from a gardener report so susa offers a product called susa manager susa manager is the only it infrastructure management tool that manages and secures non-susa infrastructure so if you're running sluzz our product you're running red hat you're running ubuntu debion you can secure it from a single console with susa manager we scale with our hub architecture from 10 clients to up to a million clients and you can prove through reporting and dashboarding that you're keeping your entire mixed linux environment secure healthy and current and we allow scheduling and automation through salt and those ansible playbooks that you guys sitting around you can import those into susa manager and with our last release of susa manager these are the distributions that we support so everything from r sluzz 12 and 15 the r slay micro product and even the new alman rocky litics that is the said to us clones that are out there you can support it and we have customers that are using susa manager that are not using anything else susa we don't particularly like that but we do so just to go back a little bit susa manager pulls in the scap protocols the scap checklist and can validate your systems using the openscap technology through susa manager we pull in the cv checklist for common vulnerable vulnerabilities and we can check against your systems and provide those patches and then prometheus is a real-time monitoring solution that allows you to use that data real-time data to create grafana dashboards that are graphical that you can share with your cio's your directors your ciso's etc and i just want to go through a quick case study office depot is one of our customers they are a leading provider of business services they have merged with other companies i think the most recent merger was with office max and they were going through a lot of challenges because of all the mergers and acquisitions and the different infrastructures coming in they were seeing an increase in cyberattacks they also needed to minimize the cost of management and security they wanted their people to do more interesting things more business oriented things and they were just really wanting to get to a cloud first strategy so they brought susan they were they were able to save more than 40% in their it management costs with the combination of susa linux and susan manager they were able to automate their processes for patch management get themselves on a regular patch schedule and just basically really simplify their data management and their their engineers are now doing things that are innovative for the business and with that i want to thank you and ask for any questions so thank you guys we are out of time but we will be here around until friday we are in the sponsor showcase if you have any further questions happy to talk just reach out


Tommy from one system we're going to talk about the most secure app for end-to-end encrypted Privacy-oriented communication and that signal it has added a lot of features since I last reviewed it So I figured one it needs an update to a lot of people are looking for a good privacy app with all the confusion out there about some Of the other companies whether or not they are actually doing encryption How they're actually handling your data or sometimes mishandling that data So we're gonna dive into the signal app and why it's my favorite app for secure communications Before we dive into that. Let's first feel like to learn more about me and my company head over to Lawrence systems calm If you like to hire short project There's a hires button right at the top if you like to help keep this channel sponsor-free and thank you to everyone who Already has there is a join button here for YouTube and a patreon page your support is greatly appreciated If you're looking for deals or discounts on products and services we offer on this channel check out the affiliate links down below They're in the description of all of our videos Including a link to our shirts or we have a wide variety of shirts that we sell and new designs come out Well randomly so check back frequently and finally our forums forums Dot Lawrence systems comm is where you can have a more in-depth discussion about this video and other tech topics You've seen on this channel now back to our content a couple things I want to get right out of the way when it comes to signal one a lot of people have issued the fact that it uses The phone number for identity, but don't worry. There's an easy workaround find any voice service And I've reviewed VoIP MS which does support tech services where you can buy a phone number And you can use signal on a brand new phone number you buy from somewhere like VoIP MS for a few dollars a month So that way you can use signal on a device without having it tied to your personal phone number But I like it tied to my personal phone number for talking to all of my friends and you know Makes it an easy way to do it We've actually tied our business number to signal as well, but we're not actively using it did it for mostly Demonstration and testing purposes But that sometimes is a problem people have with signal is the fact that it does tie to a phone number Like I said, there's workarounds for that next I will address the other issues and one of those bigger ones is well There's other companies that are open source time There's other platforms in etc etc that are also open source that are also even some of them use because the signal Algorithm and all the technology behind it is open source and other companies do integrate it into their platforms Signal has a couple distinct differences from those other companies. One of them is it's not a company. It's an organization This is a very important distinction when you're looking for a Application because what's their business model? How are they going to leverage privacy or not? And that sometimes comes in the case of their business model is harvesting some type of data about you charging you for the app or Selling off the company because they have a business that's set up to run for free to build up users And once they run on a venture capital money, they're hoping to sell to someone else none of those issues affects signal and Because they set up as an organization not just a group of people working on an open source project, which of course is another distinction this means the organization can continue and Keep allowing a free application plus the bylaws of the organization Well, it doesn't have a methodology by which you can sell its users data. They also chose not to have users data signal has been really Vetted by some really familiar names and security such as Bruce Schneier Jack Dorsey's use signal Edward Snowden Moxie Marlin spikes the original author of the signal protocol and everything else very privacy oriented now Let's get over to features. This is where things get really cool share without insecurity state of the art and Encryption this is an important thing that they have this because a lot of companies claim and encryption But when you dig into it, they're the key holder like oh we use end encryption But we also hold a copy of the keys So this is where it becomes a buzzword versus a practical security measure They don't hold the keys the encryption starts on the device From where you are initiating the phone call the text message or multimedia message Whatever you're sending or video call like I did at the beginning of the video and it ends encrypted on wherever it lands The other place at no point in between the signal hold your keys So while their companies claim and encryption, they are also wanting to do the key management and key management means they have The potential for subpoena or anyone else to tap into that either an inside threat actor who may want to You know go in and tie into your privacy see something on the inside well signal avoids all those issues How do you know they avoid the issues? Well, they have several responses about how they've dealt with grand jury subpoenas Basically giving all they have and when you see all they have they really don't have much so there's a couple different Blog post they have about this and of course they link to exactly what they submitted a matter of fact they had to actually file and a petition removed gag order in order to allow to say what they did share with The government because people say you shared with the government like yeah, we did but we don't have anything So then they had to file a petition and they're very transparent about this whole process now being that they're an organization They do have that little donate button at the top you can donate to signal that's part of their business They're also well funded by some of the security researchers for mention that have dumped a lot of money into it and organizations that care about privacy So it's a business model indeed, but it's not like it's running on a shoestring budget here They're actually a well-funded organization with a lot of privacy in there. Let's get to features though say anything speak freely They get all the cool things that you want out of a messaging app Make privacy stick a new layer of expression your conversations encrypted stickers It's kind of fun like the standard things you may want out of a messaging app because it doesn't have to be just You know some type of basic boring text, but all well encrypted No, let's put some stickers and have some fun. But also why not encrypt all of that get together with groups This is another feature they've added. It's really great now One of my challenges I've always had is I didn't like when you have people on android platform or the apple platform And their messaging app and getting groups together. Yeah, there was always some challenges if I didn't see the message It doesn't show this attach signal because it's completely cross platform works on android works on apple works on linux Works on mac works on windows So my group conversation that I started on any one device I can move to another device and Carry over that group conversation with me and join in those conversations and it doesn't matter And like I said, I have a lot of friends using this That work in security and I've even got a lot of my family using this So this is my preferred methodology for communicating and it's actually been really convenient Like I said, it's free for everyone. So there's not a great feature Now the desktop support is very recent for the video phone calls But I've been really impressed with just how well it works and how solid of a process that is like it's really easy You get the signal app for whatever you're using mac windows or linux And you can now have a conversation with another person using signal and using the phone number as the identifier While some people may have a problem with it Like I said at the beginning it also makes it really easy to figure it out using signal And as soon as you load the app on your phone and allow it to start looking through your contacts They only exchange metadata. They have entire write up on how this process happens You can start identifying other users that have signal And this makes it a little bit easier to find people and of course if you're dealing with your personal inner circle Most of them have your phone number as well. This is really replaced any type of other messaging for me In terms of secure messaging with family and friends, of course I have to use all the other ones just to communicate with the world as a greater whole But overall, I'm really happy with signal. I'm really happy with the transparency They've offered over the years that I have been using them and I've really seen 2020 as a big turning point where some of these other applications And yes, I was a huge fan of keybase Which unfortunately got sold and the development kind of halted on that And I was really hoping for them to come up with something Because they were so full featured and offered it more than signal But then keybase got bought by zoom and that just didn't go well So I kind of quit using that application, which is unfortunate But with them updating the groups inside of signal, that's another thing that has been really good because well now I got my groups back I just don't have uh everyone that I had over on keybase. Sorry for those of you that are asking me about that still Back to signal. Last thing I'll mention is I love the fact that you can set ephemeral messaging on there Because most of the messages I have most of them are really mundane But that does not mean I need a complete long archive of them and signal makes it really easy to set Expiring messages you can say only hold messages in this group chat for 24 hours two hours, whatever that may be So if you do have to send something very private or secure Maybe some type of password or some piece of information Like, you know, I've recently bought a house and I had to exchange information my wife And I don't want to just send personal documents that I needed to do the home purchase I have no trouble at all one sending them through signal means I was able to quickly get her some piece of information Privately securely no worries about people seeing it and it had an expiration time on it I set it to an hour. She only needed it of that moment so within an hour It just disappears off the phone and now it's gone without a trace in case I ever You know forget the phone somewhere or someone unlocks it Having that long history signal makes it a lot easier to do So I'm giving a huge thumbs up the cross platform nature of it If you're looking for an app and you have friends on both platforms You can talk more of them into using it It's an easy sell because it can in some circumstances replace your sms app But it's so easy to use and because it already has a phone number You can slowly inch your family over there and have private conversations And now that they've added this video conferencing on there for people truly looking for an encryption on that It's solid. I've been using it quite a bit Matter of fact the voice quality if you just use it not as a video But is it just a voice call because hit that as a voice call works Really really well because it uses a nice hd voice quality And I've been really happy with that a matter of fact to make more and more phone calls That's frequently how I talk to my wife and many of my family and my security friends We just you know hit that call button on signal and they can answer from their desktop or their phone Whatever's within reach of them, but uh leave a link to signal at our there's no other Thing I have there's no offer because it's free and it's just something I really endorse And by the way if you're really curious to dive into the encryption deeper That's all documented as well with all their source code and they have the entire Methodologies by which to encrypt things so if you're really into that Trust me they've got it all documented and it's kind of a fun read if you're into cryptography And it has been vetted as I said by people like Bruce Schneier who also is really into cryptography and took the time to actually Audit and vet the code. All right. Thanks And thank you for making it to the end of the video If you like this video, please give it a thumbs up if you'd like to see more content from the channel Hit the subscribe button and hit the bell icon if you like youtube to notify you when new videos come out If you'd like to hire us head over to laurance systems.com fill out our contact page And let us know what we can help you with and what projects you'd like us to work together on If you want to carry on the discussion head over to forums.laurancesystems.com where we can carry on the discussion about this video Other videos or other tech topics in general even suggestions for new videos They're accepted right there on our forums, which are free Also, if you like to help the channel out in other ways head over to our affiliate page We have a lot of great tech offers for you. And once again, thanks for watching and see you next time


This study examined the gender differences in suicide attempts among adolescents visiting a University Hospital Emergency Department. It found that girls attempted suicide more frequently than boys, using mostly poisoning as their method of choice. They also spent more time in the emergency room, had a higher rate of discharge against medical advice, and were more likely to be admitted to the hospital. Boys, on the other hand, used sharper objects more often and were less likely to be admitted to the hospital or discharged against medical advice. This article was authored by Young Joon, Sohyun Piek, Okay Joon Kim and others.


Welcome everyone to this session of visual testing and visual regression tracker by Pavel Strunkin. We're glad to have you here today. So without further delay, over to you Pavel. Thanks and hello everyone. And today I'll be speaking about visual testing and how you can do that with the visual regression tracker. So my name is Pavel Strunkin. I love to call myself as the software developer engineer and test and mostly I utilize the Java and the JavaScript in my work. And I am the creator of the VRT tool. Those are my contacts. So feel free to reach out to me and take a note about the latest contact is the telegram chat dedicated to support for this tool. So see you there. And according to our agenda, we have some introduction, then I'm going to present to you how you can set up the service, how you can integrate your existing test with it, and how you will see the results of the visual testing in the admin panel. Of course, I'm going to share the future plans and how you, yes, yes, how you can contribute to that as it's an open source solution. And first, I would like you to imagine the situation that you are a QA, you work in the company, and your company has some mobile application or the web page in the mobile design that you are responsible for testing. And you are testing this in the variety of different screen resolution, and of course variety of different platforms, whether it's Android, iOS, etc. So you are quite busy because there are plenty of them. And maybe you even have some farm of the devices that you are running your test on it. And of course, multiply it by the number of the browser in case you have a mobile application that runs in the browser. So imagine you have lots of work to do, really. But if you think that you as the person can memorize how your application looks like, and from version to version, you can constantly review it and note any difference that is caused by the visual regressions. Not the case, actually, because our brain doesn't work like this. We memorize only general things. And unless you put the old version and the new version of your application side by side, you may really notice only then that there are differences, and you cannot control them. You may find lots of interesting examples of the visual regressions. For example, these images were found really within five minutes for the big application of the Twitter. Some of the regressions visual visual regressions may cause your user even stop using the tool because some of their features may not be accessible to the user. But this, in fact, you cannot control with the tools that are already provided to you. For example, Appium, it doesn't provide you any solution to this problem. And if you try and you already have the tests that are checking the functional side of your application, it's not the case with the visual representation of it. And you may blame the tool itself because some of the issues may still slap into production, but it's not the reason to blame them. You just need the different set of tools. And lucky we, there are specific tools dedicated for that, such called as the visual regression testing tool. And the basic concept of it is that you have the baseline, the image, how your application looks, and you already asserted and decided that this is the way how it should look like. And every time you do the change, you make another screenshot of the newest version, and the image comparison algorithm helps you to find the difference highlighting the pixels. So for you as an operator, you can decide whether this change is the new feature that is introduced in the new version or it's some unneeded regressions. Mainly you can use it for checking the design, how it looks like in different combination of screen resolutions for the tablet for the mobile for different mobile for desktop application. So such called as a responsive design, and you may be controlling that. Also, you may be interested to control how your application is rendered in different platforms like iOS or Android, etc. Also, with the browsers is the same. It may look different in different browsers. And maybe if your application is internalized, you can have some of the configuration file with translation. So after you made a change in there, you can run your test and spot the difference without need to check them manually. And first of all, you will be searching for the visual regression if the change is causing any difference any glitches, such called as the visual regressions, but what about really the functional things. Maybe some vendors of the paid solution for visual testing may say that the visual testing is something that's going to replace the existing test. I am more conservative here, actually, and I would say that you should mainly respect the testing pyramid. For sure you know what is that. And the visual test should be on the very top of that pyramid. But depending on your project, if the functionality is something that you can assert visually. Yes, you may use the visual testing. I saw even some examples of the people that are using visual testing for the API testing. But it's up to you to decide. But still, it's possible. To give you all the information that I had before I started my journey in the visual testing, feel free to open this web page. This is the created list of visual testing tools that you may find on the Internet. There are lots of information about the tools itself with the documentation, with video. So that's the good point to start. But when I started using that, and some of the tools were not working, were outdated, or dedicated to specific automation tool or a language. And as I work in different companies in different projects, I didn't want to tight my project to specific automation tool. So I decided to make the solution that I'm going to be using by myself. And that is not specifically dedicated to the automation tool. So that's how the visual regression tracker started. It was the beginning of the pandemic, of the COVID. So I had lots of free time and I made a good use of it. So feel free to go to that link. You will find the source code, the whole project. And feel free to hit the like button if you like this tool on the GitHub. To give you the quick overview of the application, it's basically the front end and back end application that is running inside of the Docker container. For you is provide the admin panel as the operator for the test they can integrate with the API, through the API, through the SDK, or through the agents. Basically, those are the libraries to store to send the images into the server that are stored inside the container and in the database. The quick setup is as easy as it looks here, you need the Docker installed everything is wrapped up into the Docker compose file. We have the installation script that gonna go through that gonna make all the things that are needed for it to run. And it will start the service locally for you just to try it. But if you want to see the example how I run the tool in the remote like cloud providers. So you can check out this video how I do it for digital ocean, for example, it's already there. So feel free to check this out. After you do all of this preparation, and the console will tell you that there is already created the default project for you and default user for you to already start integrating your tests. The integration of the test may be falling to separate into different cases. For example, you're using playwright Cypress, code suggest or web driver IO, we have dedicated libraries to that are providing more native integration way for them. So if it's not the case, don't worry, you can still utilize the row programming language SDK, like a JavaScript for Java for Python, even for the dotnet. If it's not the case for you, you, you, you work with the different languages, you can still use the service as it provides the rest API and you would need just to write developers over it to send the data to the service. You can use it with any languages. In fact, and for all of these libraries, we have the set of examples. So feel free. After you set up the server server locally, feel free to clone the repository with the example and just try it to make sure that it works for you for to feel how it really, how it really works. After you set up the service, after you made the, the installed the integration library, you can already start integrating your test. For this, you go to the page with all the configuration needed for you with the URL API key, and you can copy this to further use in your test. I'm going to show you some examples that are written in Java. This is the real example you may find it into in the GitHub for Java examples. You would need to create the config object providing the URL where the service is located in our case it's a local host but for sure for you it's going to be maybe a different URL API key to authorize yourself the project for service to know where to store the image. And of course the branch, depending to which the changes are going to be stored as we are just starting the main branch for us is the master so this is going to be our first branch just to make all the screenshots except the baseline, and then we're going to be changing this branch related to the branch we are currently using in our version control system enables of the sort option will provide us the capability of not failing the test and made all of our tests run through. Then we accept all the baseline and then we can switch off this option just to make our test fail in case there is any difference. Now you are making this conflict, then you can easily start the service by calling the VRT start method. So this is the same way how you do with the driver. So just put it up. Just put this code after you do with the driver and you are ready to utilize the method to send the screenshot and inside of your test. This is how it's going to look like. So you do some preparation you navigate it to the needed activity when where you want to make the assertion. You make the screenshot. There's the same way how you do usually and also you can send the screenshot, like is shown right now. So we are calling VRT track method, providing the name of the image that we want to store in our case we want to store the homepage how our homepage looks like. So we are passing this string there to name our image, we are passing the screenshot itself. The rest is the optional configuration that will help the service to store separate separate images for the combination of different things. For example, we are running our test for iOS device with the API version 14 and 14.5 for the iPhone for the browser in case we want the browser for the viewport. We can make these parameterized things for the service to know whether the image is should be stored as the separate baseline or compare to the existing one. So this is the help information to save the same copy of the homepage for different devices or different resolutions. The last part here is the ignore areas. This is something that is useful with the mobile testing when you want to ignore some parts of the image. For example, the header that where we have, for example, the timer when we have the clocks. So we can ignore the full region of the header and we can make it of course parameterized depending on the device of viewport. So this is just an example how you can do that. After the tests are executed, you can navigate to the admin, you will see all your bills or your test runs with all the tags that you are providing with the status of those tests. In case there is a difference, right now you can see how this difference will be showcased to you. So the pixels are highlighted and it's up to you whether this difference is expected. So you approve the image or it's the regression that you need to fix. So you fix the issue and run your test again. So here we have some more functionality that you can utilize. For example, you can manually draw the rectangle to ignore in case this is not needed. For example, we have the animation that we want to ignore. So we can easily draw this rectangle and also we can copy in case this rectangle wants to be reusable to other images. We can copy these two other images. So we have some kind of baseline history when you can track all the images that are taken for this set of the tags. And of course we can add some comments here. The service also provides the functionality of storing images related to the branches corresponding to your version control system. Just imagine that you are testing the new feature and your feature is made in the separate branch. When you run the test, you would need to pass the name of this branch to make to let the service know that this is a different branch is not the main one. So the service will store the separate baseline and when your code is merged finally to the master branch. The service will try to find the respective image across the feature branches, the such called functionality as auto proof feature. So it will try to make the test pass according to the previous history. So you can, you can already use it as the service will make it automatically for you, but you can still switch off this feature. It can be done in the configuration of your project and make the manual merge of your branches. But the service provides you the capability of working and having the baselines for different branches. I would like to also share some tips about how to make the visual testing really works for you. So first you may struggle with some dynamic parts, maybe some animation. These things would need, you would need to take control of that. For example, you can freeze the animation or you can ignore the parts of the, of the screen. Also, in case you have the data that comes from the server, you need to have a control over it. Either you make the preparation in your database or you are intercepting the request. The visual test would need for you to have the same data displayed on the screen. Otherwise, the images will be different. So you will have the flaky test and we don't need this really. So you would need to mock the data for sure. And just a good example or how you make the screenshots, you can make it with the retry mechanism. The service also supports sending the same image over and over again, unless the only the latest image is saved. You can find the example how you can you, how you can do that in the Java, but in fact is the same way how the expected conditions are working so you just do this over and over again. And also, I would like to share some future plans how I'll be working on it. So you may notice that I'm not the best designer or the front end developer so we will work of course on the UI UX improvements. So we are working on the performance issues. Of course, when I made the service, I didn't expect a service to have like 1000 of an images or one image more than 20 megabytes. So we will need to make some adjustment for it that we're going to be working for sure. The latest version introduced some permission mechanism that now you can set the roles to the user in order to allow or restrict them from deleting or managing the baseline. So this is already there, but for sure we need to work even more on this. So related to config to comparison algorithm. Currently you can use three different algorithms like pixel match looks the same or odd if those are the libraries to compare the images, but I really personally things that we can do better and we can think of some libraries that are part of the image of the pixel by pixel comparison, we can do some. We can find or maybe even develop some libraries that may notice not only the pixel difference but also the structure differences whether some part of an image shifted left right or etc. And also, I would like to work towards the CI integration. The CI providers like github allows you to make some plugins and make the visual test as the separate step. So I would like to work on it as well. And of course, it's your suggestion are welcome. This is an open source project so feel free to contribute to this. And then how you can contribute are really different. You can use it, you can share, spread the word about this. You can request feature through the github issues, suggest improvements, and of course feel the feedback form, we have some small feedback that you can feel to give us the information that you would like to see. I encourage you to became a contributor. The most of the integration libraries that are done are done by external contributors so feel free to write some code. And if you would like to donate, you can do this as well through that link. And the last one I would like to thanks to all the contributors that are worked already and made a contribution. So thanks to all of those guys and I really appreciate your work. And I would like to see more people here. So that was actually the all information for me. Many thanks for having me here. Join the telegram and subscribe in Twitter. Thanks. Wonderful. Right on time, Pavel. Thank you so much Pavel for sharing your experiences with today.


Nothing mysterious there. These are captions. Open captions are the on-screen display of a movie's dialogue, speaker's names and sounds. Theaters in New York City are now required to show some of their movies with open captions. To learn more, visit nyc.gov forward slash captions.