So, welcome to this last session of the Linux Security Summit in North America, our first time ever virtual and this is our panel session and we had one panel session already yesterday and today's panel has the same topic as yesterday, so if you have attended yesterday one might be already started to think about the questions you want to ask, so feel free to start asking them already now. And I have not had much time to think since yesterday about how to improve this and make it more interactive and we decided that one way to make it would be that as the questions come in the panel members would pick a question each of them like and they can make a small round table also for the panel members which just randomly picking questions of the interest. But with that let me introduce first our panel member. Let's give them like small virtual round table so each panel member can introduce himself or herself since there may be few words about them. So we will start as like people appearing here on the screen. So Andy you will be the first one. Hi everyone, I'm Andy Ludomirski. I've been working on the Linux kernel for a while now and mostly do XMT6 stuff and I do some security stuff and some code review and hopefully I solve more problems than I cause. Thank you Andy. Next will be Christian. I'm Christian. I work on the Linux kernel as well surprisingly for not as long as Andy has been. Thank you Christian. Admitri. Hello, my name is Nitya Vyukov. I work as top-to-engineer at Google. For the past five years our team is working on bug detection tools for the kernel in particular address sanitizer which finds use after freeze and out-of-bounds access. Also recently memory sanitizer which finds uses of initialized data and concurrency sanitizer which finds data races. Also we are working on kernel fuzzer and in particular on the notorious C-scolar fuzzer which is coverage guided structure where kernel fuzzer and on the CIS bot which is high-level automation for the fuzzer which does continuous fuzzing, automatic bug reporting and bug breaking. And it has found thousands of bugs in the Linux kernel and in some other operated system kernels. Thank you. Thank you Admitri. Emily? I'm hearing a lot of echo now so I think somebody needs to mute their phone. All right thank you. So I'm Emily Ratliff. My professional career in Linux security started about 19 and a half years ago when I was one of the first two people to join the core Linux security team in IBM's Linux technology center. I worked on the first common criteria evaluations, the first trusted computing enablement for Linux, and for the security architecture for IBM's first public cloud. I've worked on Secure Boot for AMD's Mullens chip. I've worked on the core infrastructure initiative and with the Ubuntu security team. Most recently I rejoined IBM working for IBM security to get a view of the world from security as an application perspective. Throughout my career I've worked at all levels of hardware and software with a focus on open source and open standards. And back to you. Thank you Emily. And last but not least, Naina? Hi everyone. I'm Naina Jain. I work as software engineer in the Linux security team of IBM cognitive systems. My regular work involves enabling Secure Interstate Boot on power systems. My most of the work in kernel has been mainly related to AIMA, TPM, and key management. Thank you. Thank you Naina. So I'm Naina. So I have not changed my workplace and I'm very interested since yesterday so I'm going to skip my intro and talk about time. So let's really get to the panel itself. So I want to first start by recapping for people who hasn't attended the panel yesterday and by the way you can already watch it or watch it anytime you want because everything is already available. But just a couple of points I wanted to recap which we basically spent most of the time talking in yesterday's panel and the first point which I think we spent most of the time was really about testing and testing in the terms of our Linux kernel testing and more like lack of testing in the Linux kernel. So which has been given the reason for many of the bugs we have which have been called out so that we have a lot of vulnerabilities, a lot of bugs reported patch release, including regression bugs and a lot of discussion went into how can we improve testing, how do we make sure that the test code which gets in kernel actually has the test page just go. So there was a lot of speculation around that was the first point. Another point was maybe I could kind of summarize it as some lack of focus on the user space. So the point which was brought that we focus nowadays a lot on the kernel security and we kind of completely or greatly forgotten the user space, the sling of the user space, how all of it integrates and quite often some security decisions are pushed into the user space thinking what all the users will figure it out. But then what users tend to choose is that they they don't figure it out. So they kind of the end result is not very good. And of course performance attached, no surprise. So performance security, long live friends. I really like Jan's point yesterday about this burning security issues into fixable performance problems. I really like that idea but I just don't know like how long if I try to propose something like this to my interests like I did when proposing something like this to you saying oh here is a great security patch for your self-system and just create this big performance problem but this is a good one. So we know what your maintainer you can fix it. So I don't know if I might not have too long time to leave on the mailing list. But I really like Jan's idea about this. And there was many other points also discussed but I think this was kind of one of the main ones. Also Mimi talked about this importance of understanding with trust how the trust applies for different things within the context of integrity subsystems. So how it's important to kind of differentiate and understand especially the packaging and power origin. And then we had also Brad's talk today where he gave his view on what he thinks Linux security should be doing in the I don't know next 10 or four years. So I guess we can also start discussing some of that. But now before we go into question and answers mode so I will give again they will make another small round table so that each panel member can bring the points which they consider important and which way they want to bring with regards to kind of the current problems in Linux security and what should we be doing about it. So we will start it in the same order as we started the introduction. So Andy if you could start it. Hi I definitely I think testing is particularly important and not just testing but making sure people actually run the tests especially this caller are excellent at but there's writing tests running tests making sure that they run recently. I'm currently chasing a security bug that's embargoed that embarrassingly we have a test for and the test has been failing for several months and nobody noticed. So we definitely have a lot of room for improvement in the kernel. I don't know quite what the user situation is that involves a lot of coordination with distros.  And can we Christian? Christian I think you're muted. So maybe we can go to Dmitry. Yes can you hear me? So I'm actually going to repeat all of the same roughly. So I'm going to talk about bugs testing and quality. There are lots of bugs in every kernel release literally tens of thousands and lots of them affect security in some ways like memory corruptions or information leaks and security is the weakest thing problem. So logical protections like security modules, containers, integrity and even users and permissions they can be compromised by memory corruption. Then all of those things like CVs are not working or not being filed or fixes not being back ported to stable or vendors are not updating their kernels. I think major reason for those is simply very large number of bugs and fixes. You can file CVs if you have say 10 or maybe 100 of bugs but if you have 20,000 of bugs you can't do CVs anymore. It's just too much work and vendors are not updating their kernels because they're not able to keep up and it's not their fault I think. So you can imagine doing few security fixes per month that's a reasonable rate but if you look at say 4.14 release that's almost 20 patches per day for the past two and a half years like every day without weekends or 550 patches each month and it's not even full number we know that patches have been dropped if if they don't apply clearly and Brett just told us that we missed more than a thousand of fixes. So I'm not surprised that nothing works well at this rate and this just doesn't look right for the most security critical infrastructure project in the world. I think we need to reduce number of bugs per release to orders of magnitude to make situation manageable and to make those security processes even possible. So what should we do about this? I think we need to make testing and quality integral part of the development process end of the project and not try to push it to some third parties so users and wait when they will do this so users and users are very bad testers they don't necessarily see bugs they don't use debugging tools they don't report bugs most of the time and they don't test any corner cases. So for the project it should include things like policies like developers need to test with new functionality at regression tests for bug fixes and drivers need to be testable because if they can only be tested with real hardware it means they are not tested on CIS, they are not tested by developers, they are not tested during stable process. Then static analysis need to be integrated into sending batches and we need green light for people deploying new static analyzers. We also need more SNN tooling and automation because at this scale something that can be automated and needs to be done manually it simply won't be done at all and that's what we see with testing. So this requires unified formats for tests and unifying all aspects of tests actually like prerequisites output formats how to run them in particular that means also that developers need to stop inventing their own test frameworks and systems on the side and also things like unified crash reporting because currently say you can you can run tests but you won't be able to understand if kernel crashed or not in an automated way and in particular this complete such complete automation unification is the reason why CIS bot is so effective. So it may appear that I'm asking to kind of do more work and increase costs but actually a good test in automation in the end that significantly reduces cost of development because we don't need to chase bugs, we don't need to fix regressions again and again and we don't need to do the small follow-up fixes for static analysis warnings and so on. So that's my view and thank you. Thank you Dmitry. Let's go to Emily next. I don't know if Christian will return to you at the end of the round. Are you actually here? I am here. Oh okay so maybe we can go to your back. I hope I'm not breaking off again, I'm sorry. This is Germany's internet, I tell you. So yeah I mean I was expecting that Dmitry would cover all of the technical details with CIS caller and so on. Christian I guess we lost you again. Okay so maybe Emily let's go to you. All right let's hope this is more stable. So as I mentioned in my introduction it's been quite some time since I worked on the Linux kernel so I wanted to take this opportunity to give my three wishes for the broader Linux security ecosystem beyond the kernel. I really enjoy coming to these things and hearing the latest of the innovative solutions coming out in the Linux kernel and it brings me great hope and optimism which lasts until October when we engage in cybersecurity awareness month and I find out that once again the latest state-of-the-art advice for end users is to not click on links right so it makes me wonder you know are we really making progress. So when I think about the future of Linux security I think about how the path of code to the user the paths are just proliferating so in the past we've had the Linux distros be a curation point where users expected them to to determine which are the most usable and most useful open source security projects. That may have been an iffy proposition. Some distros did more curation and some did less but they were still commonly considered a curation point and now with you know all of the different ways the Docker containers and there's many more ways through and so one of the big problems is how open source projects signal to each other that they are doing the that they're developing with the security in mind and so the Linux foundation did create the the badging app and it is still ongoing it's been ongoing for the for the past four years and this past month curl and the Linux curl and the Linux kernel became the fifth and sixth projects to become bold badge. The importance of the project is not necessarily in the badge per se but as a conduit for the discussion of what makes a secure open source project. So my wish is that you know the the badging app gain more visibility more projects and have more people contributing to that discussion. So my second point that I'd like to talk about today is about resources that are out there that are available to open source projects and so you all may be aware of Mozilla's MOS program and its associated secure open source program which funds audits for open source projects that Mozilla and Firefox use but I also like to make sure take this opportunity to make sure you're aware of the open tech fund which has as a mission secure communications and censorship circumvention and they also offer as part of their red team fund part of the core infrastructure fund security audits for software that support that mission and so my second wish for the future of Linux security is that more projects take advantage of these and then the the last thing that I'd like to talk about is that even as Linux has really taken over the world you know it's in safety critical systems and IoT devices running massive cloud infrastructures knowledge of Linux security is really not keeping up with the widespread proliferation and especially in the top level you know the highest level of applications or projects intended for IT security operations you tend to see these projects coming out with you know fully populated information about windows security and then with the TBD yes we know we need Linux security and that's coming soon and we really appreciate your contributions and so my my third wish for Linux security is that the you know knowledge of Linux security for end users proliferates much more widely and keeps up with the adoption of Linux itself so those are my three wishes back to you thank you and Liana yeah thanks Elena so we had some great discussions in the yesterday's panel and Mimi Sohar has brought this question on the need of file provenance and now in today's well our whole world is evolving around technology the technology has played a significant role especially in this time of pandemic whether it is cloud infrastructure for online shopping AT&T networks collaboration tools or user and devices now and we also heard but a lot of cyber attacks happening this time so in such a scenario could file verification would have played a very significant role in building our trust on the software or the applications or the firmware which are getting run on these devices or on the infrastructure on which these devices depend on but now the need of signature verification implicitly brings with it the need of asymmetric public keys and then the similar question of trust will apply on those keys which are used for verifying these signatures so in this global world where every device has the firmware stack or application stack operating system from different vendors by default the signers of these different binaries there are different owners of the keys so I think in today's discussion I would mainly like to emphasize on the issues related to key management in context of the kernel the key management is a full entrant cycle from creation provisioning retention to revocation and one of the problem I see is how kernel trust asymmetric public keys which are not owned or built within the kernel so I think I first realized this issue while enabling secure boot on open power systems and in this case the interesting thing was that our bootloader itself is kernel and the keys for verifying the actual hostwares is being owned by firmware but the kernel do not trust firmware keys because they do not match the trust requirements of existing kernel key links so the addition of a new platform key link resolved this issue by isolating kernel verifying keys from other key keys in other keys in the kernel and was used only for kernel verification but this was a small step that was used only for the purpose of using firmware key for the kernel verification and there's still an issue on how to how does the kernel trust the keys from various other layers if those are not signed with built-in keys so is there a possibility where kernel can trust something from outside and load the keys dynamically is there another route of trust which we can depend on like trusted hardware or other external key management servers how does the kernel trust any external source and then additionally how do we ensure that our keys are getting having the relevant checks which are needed as per the x509 specs or any of these specs and then is the revocation of keys happening as needed is it handled sufficiently or are we even doing it sufficiently so I think these are the main issues which I would like to get discussed into this call and and then I would like to say that most of these issues we are seeing in server domain and there are people here from various other domains like IoT embedded containers so it would be interesting to know what type of problems they are facing in the similar context and then we can see how can we come up with a flexible solution in the kernel for handling the key management issues so thanks Elena thank you Nina so Kristen are you able to talk now or okay so this has been a round table and actually like usually nothing goes as planned so by the time we round table in yesterday's panel I finished they had already in the queue like millions of questions now I can only see two of them so at least looks like I can encourage people to ask more questions you get actually a chance to be answered this time much less in general and we have this very bad background now I think it's got better okay so maybe since we have only two questions here so I can ask these questions to the panel and then we'll see how we go from there so the first question is actually on the security and crypto so the question is security and crypto subsystem seems quite a far apart because it's things like key management being artificially split in two for example there's no easy way to accommodate crypto acceleration of encrypted fees and the tpm doesn't count because it's slow and this means that most of the times the keys are lying around in the plain text so a question to panel members how do you see the situation improving does anyone want to comment on this I can take it sure okay so I think that there are basically two points here what I'm seeing is one is related to the crypto acceleration so if I'm understanding the question right there is one thing is like whether do you offload the computation to the crypto accelerators and the second thing is the keys are lying around in plain text so can we use the crypto accelerators or the probably hardware security modules for the for storing those keys so I think if you see the latest work which has been happening so there was cpm being used for encrypted keys that was for symmetric keys and there has been recently some patches in area of tested execution environment to use that for the encrypted keys so I think people are trying to use no more on the tested hardware site for encrypted keys but which is like symmetric keys and I think that is the same point now we how can we use them for us symmetric keys also so I'll say the situation is improving I think with more and more secure hardware type of things coming up now there are more people people will be trying to use them for the and their patches coming around probably as there are different varieties of hardware might come there might be a need of a generic layer which can be tough transparently and do the underlying thing and mobile you can see around in this in the thank you does anyone else want to comment please question next question isn't very different area so next question are did the next channel really meet the 80% statement test coverage required for the CI silver gold badge it seems unlikely other frameworks are for example piece and my man would place well enough scorn or at the end of the maturity lever journey I don't know what this piece I can take this question so one of one of the nice things about the the badge app is that the evidence is made public as as as the questions get answered and so if you go to the badge app and you look at the entry for the Linux kernel it that's actually one of the unmet criteria it's with the comment Linux tests kernel tests individual feature functionality not code branches and is generally only new features not older positives like functionality and so the lack of meeting that criteria did not prevent it from getting to the gold badge you don't have to match everything in order to get to the 300% level to get to the to the gold badge and it I mean it's entirely possible that other maturity models wouldn't agree to to that level that's the beauty of having different different maturity models and it's also the beauty of the Linux badge app or the the CI badge app program and you can go in there and have the debate about whether or not it should get that gold badge without that 80% coverage I also have have an answer so I am not working on CI systems but last September I asked all main CI's like kernel CI, CKI, LKFT about kernel coverage, code coverage and none of them had any infrastructure to even collect coverage so I suspect the answer is that nobody really knows what is the coverage and so I know some some number some coverage numbers for syscolar it's somewhat hard to assess because we we work on the compiler level not necessarily statement level and we don't cover say unit functions and say if you're testing on the x86 architecture how do you count other architectures doing it to take them in the total number of statements not but I get a number somewhere around 8% so sysbot covers about 8% of statements that were compiled into the kernel but one remark here is that as it was mentioned yesterday sysbot actually doesn't do any testing of the kernel in the traditional sense it only tests for basic safety violations for example if you create a socket and the kernel it said delete all of your files that perfectly fine with sysbot like it didn't crash so there's I mean there's also different degrees of coverage like what does it mean to be covered by what does anyone else want to comment on this one and I hope you're not leaving us moving no I'm still here just getting out of the sun okay so if no one wants to comment on this one let's move to the next question oh I if you can hear me yes I would want I would want to I have a question for Dimitri actually because we talked about this before do you do you feel are you happy with the impact you're having right now with sysbot syscolar and casey sun and so on that you have on am I happy with impact to some degree I would say so we definitely lots of box getting fixed because of our work and that's very nice and I'm happy with that on the other hand I would like tests to be added for the box fixed for example and that's usually not happening in most of the cases I would also like more box to be fixed because we still have I think now about 600 open box so I don't know I frankly it's hard to say if I'm happy or not well I guess mostly yes there's there's one bug in the console code that Dimitri that syscolar keeps hitting every couple days and they keep sending us reports and nobody's fixed it yet so someday we'll fix all 600 bucks so Christian while while you are able to speak so do you want to try to again present your point of view which you didn't I'm very happy I'm very happy too and I'm sorry for all the problems I'm causing but that's what I'm known for and joking um one of the things I tried to make a point before is that a lot of us have just developed a domain is how it was sold and what it's breaking again maybe you can type your point no you can try again so it's like starting and it's good and when it just has breaking am I back now maybe if you turn the video maybe it will help now we can just hear someone's typing and we completely lost Christian I think okay this is really the downside of us being virtual so I'm I'm truly hoping that next year we can actually make a nice panel with members being like Christian are you back or yeah I try to be but I hope am I breaking off no not okay so we think we always tend to think that or we used to think that there's inherent conflict between security and performance and performance has traditionally mattered a lot on Linux and it's good that it matters like that there's nothing inherently bad about this but I think this this false sort of conflict has sometimes held us back and and there is another aspect we need people that can tell us I think the difference between security theater as some people like to refer to it and stuff that actually improves the the state of the art of uh kernel security and I think that is actually a problem we don't have a lot of people that have that can provide the quality of review that is needed uh across the board for new kernel features and so on that can tell us first of all this is introduced a significant security pack just based purely on logic analysis it sounds like he is still trying but I mean that that's a discussion that I'd really like to have because I mean it's one thing to talk about uh security theater at the kernel level but then um you know what's important to users as well because I mean sometimes we spend so much time focused on securing the system that we lose track of we're still allowing things like ransomware for example to uh that that really impacts the user and so it's not necessarily you know all of the security controls functioned but the user still lost their data so I think you know while we're having that discussion about what's real security and what's what's security theater we need to focus on the goals as well yeah I think that's actually a very good point and Christian are you able to continue or okay so no but I also agree actually with Christian's point that we're getting more reviews and I think Brad has uh to some degree kind of talked about it today saying that we don't have enough expertise for example like people like Jan Horn who is reviewing patches but not necessarily like from point of view just reviewing with patches but staying with how efficient this special mitigation could be against certain exploits for example or against certain threat models and it's actually not a trivial task to do because it's it's very hard it's like very easy when we bring a security patch forward I mean we can measure its performance and it can be horrible or not horrible or something in the middle and but it's something very kind of easy to measure but how when it comes to security it's very hard to measure how efficient a certain mitigation on or I mean you can say that yes this this mitigation stop this particular let's explore it from working with particular technique but it might be even if you close the technique exploitation technique where it's very easy way for a person attacking this to just go and try something else and it's it's it's just like it might be even not worth the amount of effort which has been put into it so I think that's actually really a big problem so if you could get more reviews from people with exploitation knowledge on the hardening techniques which being proposed and stuff I think this would be very valuable I don't know if also this is the point that Christian was the one of his points that he was trying to bring but at least this is my part take on it so okay so does anyone wants to comment more on this one and maybe you're from the crown side on this I don't have anything I don't have any amazing fixes here getting people to do code review is hard it's it's a lot of fun to go and write new code and make things work and it's not quite as much fun to go sit and read code that you had no direct involvement in and that nobody's paying you to read and to say let's make this better or let's see if it's already great so it's a tough thing to recruit for so what do you think from the point of view um because you're kind of representing the kernel community maybe not so like security related kernel community so what would make you being more interested in reading let's say new patch series and some security hardening feature so what should that patch series how help us to kind of how should we frame this start from very strong case point to existing exploit or how to make it more appealing let's say to kernel maintainer I I think that's hard I don't have any magic fixes I think part of it is just recruiting people who find this to be fun there's there's certainly a community of people who have a lot of fun breaking things and I think the Google project zero people are an example of this and it would be great to try to recruit more people to see their own role as breaking things in the Linux kernel and maybe even breaking things that haven't been merged yet but what about back to kind of to maintainer position I mean maintainers are usually very loaded so there are like a lot of features being developed things like bug fixes and stuff everything when we start schedule and when there is this people coming with some hardening patches or something like that which might be like you know out of your normal cycle and things like people looking so this is what I was trying to ask but how to make how to make how how we can kind of frame this patches in a way that's making it easier for maintainers to look at them like finding time to look at the security patches because in in many cases it's ultimately up to maintainers to take certain changes in I mean they might be security changes and patches might be proposed but the maintainers need to find time to look through these patches and the security patches might not be like you know with usual ones one thing one thing that's kind of specific to hardening patches when when someone sends a patch to enable new hardware or a patch to enable a new feature or a patch to fix the bug it's it's very clear what the patch is doing what the benefit is why we would want to merge it when someone sends a patch to harden a little corner of the kernel sometimes it's a little hard to see how that fits into the big picture and the a lot of the patches we see are hardening against certain exploit techniques and I think a lot of the maintainers and a lot of people in general don't have the clearest understanding of when an exploit technique matters so as an example right now in the x86 space we're seeing we just saw patches to harden access to the cr4 register on x86 and I as a maintainer don't necessarily have the clearest idea of what precisely we gain by doing this and it may be we gain a lot it may be we gain a little it may be that this plus a few other things in the radar down the road will give us a big advantage but sometimes it's hard to see what we're actually accomplishing and clearer descriptions in the patch maybe feedback from people who are in tune with how exploits are written would help with this if someone came up and said hey I exploited the following bug or would have exploited the following bug using this technique and this hardening patch would have made a difference that would be huge thank you Andy does anyone want to comment on this or continue yeah Kristen yeah I would like to try to if you can hear me yeah you can hear you wow I called in over the phone um so uh I think Andy is pressing a really good point we have it's like a lot of times when when I see hardening patches come on to the list it's like and they need to explain their threat model and it needs to be clear what is the the larger benefit for all of the kernel is there like really something that we're protecting against or is this just yeah as I said before security theater and I don't I honestly and even in in core kernel stuff I'm not always sure that maintainers or developers of features are the best people to actually uh to actually just judge this um a lot of time it depends on me cc'ing people that are that are have written exploits in in this area for example well in this case my example is obviously young who I always see when when such things come up so we don't really have a community of of uh of people who know their way around exploits know their way around uh security and security research and and that's kind of a and that's kind of a problem and and that's the point I tried to make before in my introductory introductory statement is in order to portion your security features I think relevant security features you obviously also need to have some let's say let's put it like this cloud within the community right people need to trust you people need to kind of recognize who you are or that person has taken on responsibility in the kernel I I know if stuff breaks that person is going to be around like I can rely on stuff being fixed um and so it's sort of when you have crossed that threshold I think then it's much easier for people to say okay this is something which we haven't done in the kernel before and I can kind of see the benefits but I can't really I can't really analyze it myself but I know that the guy who is pushing this like or the person who is pushing this sorry I can trust that person so I'm fine with with with pushing this feature upstream and that means in the end becoming a maintainer becoming a maintainer in Linux and that's that's not necessarily a job that a lot of people enjoy I think yeah I think it's actually a very good point especially about this I think the community for people who are experts in exploits I mean the community exists but the community is not connected to our community very much and that's a problem and maybe that's also I think what some finger spread has called out and in a sense that these people they exist but they they are they expected to be like his point was that they expected to be paid and and and they're there in some other communities and and they're not commenting much and when one I mean Jan is not scaling well for all the all the needs that um which I might I don't know if there's if I don't I don't personally know if it's fair to say that people and I guess that there wasn't a there wasn't a whole point of of this discussion but I don't know if it's it's fair to say that these people just are in it are in it for the money I think there are a lot of talented people out there who are really interested in writing exploits just because they enjoy breaking things or making things behave in a certain way that they don't expect them to behave and a lot for a lot of them I think it's it's more of sort of if there is money in it then that's probably fine but I think that's not necessarily I would think that's not necessarily the mindset that these people have the same way I don't have the mindset of developing new features uh um for money but I did it because it I did it because it's fun it's much more um it's I think this goes back to Andy's point it's just not fun to review other people's code per se right I mean you have to sit down and then like there is a patch series it doesn't matter if it's on on github or github or if it's the mailing list patch and you have to sit down you have to look at this code you have to stare at it you have to understand what's going on you maybe have to apply this patch to your tree to see the context of the patch and so on and then you have to think about all of the cases where this can break and it's just not that's way less fun than sitting down and staring into assembly and making a breaking hardware that's way more fun I think that's ultimately the problem convincing people that they need to do both yeah very good point does anyone else want to comment we also have um maybe we should also get back to our queue uh let's see oh does anyone wants to bring something out of queue from our panel members I have a question for me specifically um so it's about uh one second it's about future of sanitizers uh the roadmaps or any plans that we have and in particular about Hwasan and RMT so RMT is a hardware technique that effectively gives you address sanitizer capabilities in in CPU at very low cost it uh can protect from use of the free and out of bounds box and we have very uh large plans for it and I think it will change landscape of of this memory corruption exploitation very significantly because it can be simply enabled in production all the time and so for ARM it's it's already the specification is published and I hope we will see actual CPUs with MTE soon maybe within a year or so and we definitely hope that other vendors will also do something something similar in their CPUs following ARM then the next sanitizer that we have in plans is it's currently called Keyfence or previously it was called Gwip Asen I did presentation about it on the last plumber's and it's a tool that gives you also detection of use of the free and out of bounds at literally zero cost but with very low probability so let's say we sample one out of a million allocations and protect box only on that allocation and the idea is that you can deploy this to the whole fleet of I don't know data center or all of your devices or all of your I don't know IoT devices or phones and then this gives you the scale the probability back so in the whole fleet you can detect all of the bugs that happen again we also have future plans for trying to do something similar for other bug types for example probabilistic low rate detection for data races or for other types of identifying behavior that's it so I'm I'm very excited to control flow integrity become a widespread thing um in the x86 land we have Intel CET specification which may or may not show up in computers near us sometime soon and CET gives us strong integrity on return it gives us very weak control flow integrity on indirect calls and I would love to see some of the especially LLVM efforts to build stronger control flow integrity combined with features like CET give us something that is overall very strong unfortunately I don't think anyone has even tried to write patches to make this work in the kernel and doing so is going to be a mess because x86 is a mess but someday this will happen anyone wants to comment on this what's this what's the status I think I saw case briefly speaking about this but I didn't catch all of the the whole talk what's the status the status of CFI if it's going to be upstream soon thank you as talking yesterday the status is project code that lives on on on the androids that also didn't catch all the details on on the so as far as I know CFI is deployed in android for some time now and for now it's in the process of being upstreamed and integrated which is a long process and it takes lots of fixing and also doing link time full link time optimizations full kernel build as a prerequisite so it should happen reasonably soon it's in progress and I agree it's a very high marked technique as well I think we have one more question I don't know if we have answered this does having an LKDTM test a company a new hardening patch help in disregard reviewing acceptance I think just having a test with every feature is kind of really what we want it helps with it helps with any feature I get if I have a test that I can run notice I can verify a new feature that I see being upstream that's obviously pretty great and that's by the way I think to some extent also kind of a I guess it's the way how you have been socialized with writing with writing patches but I see especially from from from my generation or younger generations people pushing patches upstream and they usually have tests they know that case self-test exists that Linux kernel has some some test suites and so they usually send the patch test along and that's extremely helpful because it gives you the confidence that the person not just the compile test has to change that they did but also that they've actually written a test and verified that that change works so I think in general this just gives a lot more credibility to when you send the patch serious okay does anyone want to just tell a comment though let's see what do you have else thank you I wonder now that we have I have a question I wonder now that we have for example Casey son which is the newest feature that we related to I guess just call her um if if this is going if this is going to be hard like this is going to have a lot of impact um in the kernel because I hear that there's like a lot of bugs that are sitting in a cube yes there are lots of bugs and the story with Casey son is very difficult so it's fine data races and the problems that kernel has lots and lots of what's called benign data races and I take it in quotes because from the point of view of the c standard which is the language the kernel has written is any data race is undefined behavior so it's very bad buck like use of the free but in the kernel they are considered benign and so far there is no agreement on removing all of them so what happens with Casey son it just traps on all of those well kind of intentional data races that are not really considered as bugs by developers and we have lots of those currently in the queue and it's very hard to find actual harmful bugs there and it's unclear also how can we deploy this on sysbot because sysbot is it has automated reporting and if we will just start reporting all of those then like I think it will not be accepted well by majority of developers and there is no way to filter only the harmful ones and also fixing them from the kernel is lots of work especially um while there is no kind of green light for for eliminates and all of those because it currently really depends on the subsystems some subsystems are much more welcome fixes for races and want to fix all of them and some subsystem like you then have lengthy discussion with the maintainer about the data races and they don't agree to take any fixes but on the other hand we know from from address sanitizer that actually lots of the bugs lots of the use of the freeze and even out of bounds they caused by data races we see that because say free happened in one task and access happened in the other task or we see that it's not reproducible well or we see that it manifests differently uh so most likely it's a data race I would actually go as far as saying that data races are the major source of bugs in the kernel so in the end to like cases and would be super super useful but currently we can't take advantage of it so we would need to to figure out what to do with benign races and like if you're asking me I would say that we need to do well fix all of the benign races just because that will allow us to use the tool so regardless regardless of the standards and like if they can really be harmful or not we can just forgot that and fix those just for the tool itself so there is no what you're saying is there is currently no consensus on what is with benign data races yes I think we have mostly answered two questions there is one question about like what do we people think about scorn security bug bounty so paying researchers for proof of concept exploits so we have discussed that there is like there is lack of interest or maybe like not enough participation from exploit writers but I don't know how can we possibly answer this question because this so it's I guess it's a proposal to run a security bug bounty on Linux kernel itself but I think the financial aspect of this is something I don't know I don't even understand how this would be run so I don't know does anyone want to comment on this one I think it to gain conflicts somewhat with the number of bugs so usually those programs run for projects that are ready to you know they're best for testing for fuzzing and then there may be few security bugs and it's reasonable to pay for those and so it's harder to find but today say if somebody takes hundred of use of the freeze from sysbot dashboard and copy paste them into the bug bounty submission form like and what if hundred of people do the same I think here that the idea would be not just the bugs but you would actually write proof of concept exploit and you would probably maybe I mean it doesn't have to be stupidly like anything except that you can kind of have to show that the technique is new enough and then something like you can try to make it more clever but I still kind of don't know how far we can go with this so I know lots of bug bounty programs say for home they don't require proof of concept so you can get more money if you if you create full system exploit and actually prove but they usually pay for just use of the free because like it's it's too expensive to create full exploit and I don't know how we are doing in time because it shows one hour then to have just one hour and this is supposed to end so are we over time now already or I think I would just bring one point where we had been I think the Christian Christian brought this that that it's not easy to do review it's not fun to review others patches which I agree very much so I think one of the things probably everybody can help with is like it's not easy to review actually but it's probably easy to just take the patches and test them and ensure that even if somebody else has posted the patches for for a particular architecture they can test and then make sure that it doesn't break their architecture and share their tested by because that seems to be easier than actually doing the review but then it also ensures that there was somebody else had also tested on different architecture and one change did it impact something else or a new bugs are not actually got because of that so probably people can actually contribute by doing more of testing the patches before even they are upstreamed or accepted. Yeah thank you man I think this is actually a good point and I think case is also usually on case repeal is here looking always for volunteers to test in different architecture so that's really a second sweat point but I think we have a tough time now so I would like to thank all the panel members for an interesting discussion and being with us today and also for all people who have asked questions and I'm going to hand it over to James to close your mark. Thanks Alina can you hear me yes you're able to hear me okay getting some thumbs up okay thanks that was a really great discussion to close out there with and you know I'd really like to thank everyone all of the attendees who are online now we've had really good attendance we during Brad's discussion this morning we had over 300 and you know we've maintained well over 100 throughout the throughout the conference I'd like so you know people out there watching later as well thanks for for checking this out the speakers who put in proposals and went through all the processes for and the uncertainties thank you for that a special thank you to all the panelists who joined this is something we arranged the last minute and thought would be good to try and make this a more collaborative and more of a conference feel for something that is a virtual event and I thank great thank you to Alina who I think has done an excellent job shaping a really productive discussion and we have a lot of the really core people who really understand Linux security and who work in that every day participating we've had a diversity of input from from people slightly outside that group too which I think is really important and I think you know there was some discussion at one point whether we were going to have this conference at all this year due to COVID and I think that it's been important that people have been able to present the work that they've been working on and get that out to the community for people to be able to ask questions and to have these discussions so it's not optimal it's not as good as in person for many reasons but it also I think perhaps has allowed others to participate this year who may not have been able to in the past so this is something you know regardless of COVID status next year we'll look at possible online participation and you know think about if that continues to make sense and I think also you know we have to be able to adapt to the world changing that is us the you know the Linux community and the security communities and in fact you know now it's possibly even more important to be focused on security defenses given the amount of critical functioning that has been going online through through COVID certainly you know we're seeing reports of attackers targeting companies and organizations and people that are now moving to much more online work just to also mention that Linux Security Summit Europe will be happening the CFP is open until the end of July and I certainly encourage people to still submit talks to that Alina will be running that conference as she has for the past couple of years I'd like to thank Linux Foundation who were able to bring all of this together online especially Gillian Hall who really takes the lead for us on the Linux Security Summit and Angela Brown of course who heads up all of this and Trisha and all of the others at Linux Foundation and the engineers that we've had working on this today so with that I guess you'll be able to review these videos and slides online shortly after the event okay thanks to everyone and I hope to see you at the next conference


Hi everyone. Shout out to jaspyscasebreaks.com here doing 2020 Panini 1 football 10 box case break plus 2021 hit parade graded rookies case break. Random team number one. So this is a 32 spots where we get to random team at NFL and obviously all card ship. One 10 box case of 2021 football and one 2021 hit parade the rookies graded football series 16 hobby 10 box case. Here is the list of customers Paul Norden down to Bennett Page and the teams from the Cardinals down to the Washington football team. Diceholder randomized both lists and pair them up four and a four eight times. Good luck. Eighth and final time revitalized down to Ryan eight times on the randomizer now eight times on the teams eight the final time Texans down to Cowboys eight times so eight times on the teams eight times on the customers eight times on the dice remember obviously community one does have a checklist hit parade does not. So trade at your own will or at your own risk revital Texans and Seahawks Paul Norden Broncos Bennett Page Bengals Revital Lyons Ryan Hynes Jets Aaron Woodington Giants Jerick Corfage Colts Bennett Page Saints Tom Lee Titans Lee Cuba there's a Leo Cuba package Revital Ravens Nick Farquhar Steelers Revital Buckley and Sean Matic Chiefs Revital Bills Adrian Lopez Bears Revital Eagles Brandon Lattelipe Washington Revital Rams Daniel Katz Patriots Zach Winn Raiders Revital Cardinals Jaguars Brett Rogers Vikings Alfonso Falcons Sean Matic Dolphins Adam Levy Panthers Sean Matic Chargers Steve Bright 49ers Bennett Page Browns Ryan Hynes Cowboys trade window is open so here is the full list for you there you go I am going to show you guys the cases real quick I'm going to pop these open and start ripping so here is graded football edition series 16 case 7 this is going to be a 10 box case here and then you've got a 10 box inner case 10 boxes per inner football one 20 20 20 20 football so I'm going to pop these open and just prep the boxes and not going to actually pull stuff out but that way you guys can kind of go to there that way it gives you a longer time on the trade window as well so I'm going to keep an eye on the chat obviously quite a few teams are up for trade it looks like already Bears for Niners Adrian's asking Washington's up for trade Panthers are up for trade Bears are up for trade Raiders are up for trade Jonathan has the Cubs up for trade any but Cubs are trying to trade themselves right now I'm going to like I said start popping these open just prepping them open so it makes the break a little bit quicker if anybody comes to any deals on trades let me know hey speak because Patrick wisdom three-round homerun Zach is saying Raiders for skins Brandon Washington for for Vegas Brandon's in no on Raiders so I'm done with the hit parade box I'm going to start opening this one case like I said once I'm done with this trade window is closed so trying to give you guys plenty of opportunity to that's up to you guys so I know some of you guys are obviously looking for specific teams instead of looking for those teams if they're not available look at teams that are available in the chat so concentrate on that both the Bears were on the block oh Adrian you have the Bears you're the one that has the Bears especially with the rookie quarterback and a questionable offensive line he's gonna be there he's gonna be there like little stopgap you know there's gonna dump dump to him whenever he can and that's a big man they're on the training block okay so guys I've got five more boxes to open up once I'm done with this I'm gonna give it like a 10 count and that's it we're gonna knock it out you guys another 20 seconds or so okay guys nobody wants to trade nothing's getting finalized am I giving you guys too long of a trade window to consider stuff that you're just like nevermind okay nevermind no trade window yes or no trade let's do it I'm a print rip nobody agreed to any trade so trade window closed here is all this it's gonna go let's go let's go the rookies this is all like I said graded football this is series 16 each box hand numbered out of 100 here is our final list lots of trying to trade couldn't trade mojo you do not so first one box 81 copies are just the whip on the white sox right now we're starting with an eagle Jalen Hertz camel pink mosaic PSA 9 rookie Philadelphia Eagles revital goldblaster this one was box 46 this one's pretty nice PSA 10 Aaron Rodgers upper deck rookie premiere from 2005 Green Bay Packers Leo Cuba a rod PSA 10 rookie box 74 we got a rated rookie to a tag of Iowa press proof blue PSA 9 non numbered Miami Dolphins shawmatic number two you've got rated rookie die cut out of 75 4 out of 75 Jonathan Taylor for the Colts Jarrett court fires that is a PSA 10 guys don't take this lightly these die cuts are extremely hard to grade so a 10 the very nice grade on that you got Jarrett box 99 Russell Wilson 2012 tops magic mini rookie PSA 10 Seattle Seahawks revital goldblaster congrats a rod and Russell Wilson box 38 that is true then that is true oh this one's cool how about a Ray Lewis 1996 Bowman best rookie it's a bgs 9 case could use a little bit of love and Karen but this is old school Beckett grading so 8 5 corners 9 surface centering and 9 5 edges what's up Adam alright buddy 1996 Bowman best Ray Lewis Baltimore Raven to revital goldblaster box 26 we've got Saquon Barkley 2018 Don Russ elite red rookie to 199 PSA 10 Giants Aaron Whittington box 61 White Docs are just kicking themselves in their own asses and it's Chase Claypool rated rookie PSA 10 had a Don Russ for the Steelers and Nick Farquhar I agree with you box 19 I do too Adam and if he keeps looking good I honestly think that he might get some interest from teams that might be have questions at quarterback with injuries so we'll see Emmett Smith 1990 pro set rookie PSA 10 the Dallas Cowboys and Ryan Heights and last hit parade degraded box 54 it is 2020 mosaic Justin Jefferson PSA 10 for the Minnesota Vikings and Brett Rogers there you go so that is the graded half of this hit parade now we're on to the patches and autos all the other stuff from Nini one full 10 box case intertase we've got Dwight Stevenson NFL 100 auto for the Dolphins and Shawn Maddock to start us off two color patch three color patch 82 out of 199 cam acres for the Rams and revital goldblaster love the guy don't like the Rams but like him said that he hurt himself so badly gone for the season hopefully not gone for much after that and it's Henry rugs one out of 25 shadow box rookie signatures for the Raiders and Zach when spot he won one out of 25 very nice you can see the shadow box effect on there such a cool card and grass Zach and we've got a DeAndre swift that is 83 out of 149 four color patch on top solid color on the bottom Detroit Lions revital goldblaster Cubs have put up five runs have a runner on first and third and one out left still they've only given up two outs in the top of the first and it's juju Smith Schuster that is 19 out of 20 jersey number 19 two color patch on top and on bottom Steelers Nick Farquhar jersey number hit five boxes left this it's Phil Sims award winners auto Phil Sims for the New York Giants and Aaron what he said Aaron unfortunately it does look like somehow this card has shifted in the holder give it a light tap see if maybe I can get it to shift back down but it is not moving so you will probably be best to cut this open and obviously shift it back into the spot that we're supposed to be this is why we typically don't ship in one touches just because of the process of the potential for the card to shift but for the New York Giants that is Aaron Woodington Aaron if there's any issues obviously you've got it on video you can bring that up with Benini see if you might be able to help you out with that if hopefully there is nothing wrong with bottom end of that car and you've got Jacob Eason two color patch auto for the Colts Jarrett Corfage this is really nice you do not see this precision one very often that is 35 out of 35 looks so good kind of an optic hollow mix with the Penini one patch auto look nice one for the Colts Jarrett and we've got runner-up for rookie of the year Justin Jefferson 129 out of 149 Minnesota Vikings Brett Rogers you go Brett yeah Logan I like him and it's another Henry rugs lightning strikes twice for the Raiders that went 48 out of 99 you got the out of 25 now you've gotten out of 99 whoa Logan Archie was great by the way played for a terrible team and to finish it off 6 out of 10 Justin Herbert Sean Maddock and the Chargers shadow box signature what a great way to finish it congrats Sean that is there you go very nice break that was 2020 Penini one football 10 box case break plus 2021 hit parade graded rookies case break random team number one from jasperys case breaks.com I'm Sean jasperys case breaks.com thanks for hanging out I'll see you next time


Hello. I'd like to add my voice and that of South Cambridge District Councils to the NHS's new campaign this week, to the messages the NHS is still open for business, and the sooner you seek help for possibly serious medical conditions the better your outcome will be. We've seen a worrying reduction in the number of people attending A&E and also their GPs. They're all functioning in different ways. A&Es are keeping people separate who might have Covid from everybody else, and GPs are triaging people by phone or by video call and are still offering one-to-one appointments for people who need to be seen but all be it in a different way. So I needed an urgent appointment for a family member this week and I rang my GPs at half eight in the morning and we had an appointment for quarter past nine which was an excellent service and just as one would expect. So please don't do things differently, behave exactly as you would have done before the Covid-19 crisis and look after your health. So please stay safe and stay well and go to your doctor or go to A&E if you need to.


Hi, good morning and welcome to today's products and focus so it looks like we had a whole raft PMI date already this morning from Japan and Across in China and the final PMI number actually came into slightly Better than expected the forecast was forty nine point six the actual was forty nine point eight I'm following on from yesterday's exuberance for we saw most global markets managed to pull some gains for the end of the Quarter if we ever look at the US 30 you'll see we actually had a bullish engulfing pattern yesterday And we're still going great guns this morning with us above the 21 period SMA the other technicals are still relatively neutral But it looks to be a slight shot in the arm to to start our Thursday morning Then looking at the UK 100 a great candle yesterday another positive Better momentum this morning breaking through 60 73 and above that 21 period moving average With 60 73 now potentially acting as potential support We could be looking at a 62 96 or basically 6,300 as the next potential resistance for the UK 100 We actually have a whole host of other data due today. It's not just about Chinese PMI We do have a German Eurozone and UK and US PMI and we've got unemployment claims in America To finish out the day And of course tomorrow brings us to non-farm payrolls the most important macroeconomic data release of the month And this one's going to be quite keenly watched and yesterday's ADP private payrolls came in slightly better than expected If the 200,000 jobs are created and if you just look at the forecast for that ADP private payroll number They were expecting 194 so a marginal beat, but a beat none the less So then looking at Japan 225 Not such a not as strong as gains is what we've seen in the US and the UK 100 It could be a slight recovery of mining stocks that are helping to push that up a little bit higher But we're still in positive territory breaking above 17,500 so then moving on to the Japan Sorry dollar Japanese yen Very similar to the last few days not really that exciting if I'm completely honest Oscillating around the 21 period SMA but above 119 which is expected to act as potential support But we are now trading between two ranges So then finishing up with the West Texas crude scraping ever higher towards potential resistance at 45 85 Inventory data actually came in higher than expected But it seems to be that which normally would be negative for for crude oil, but what we have now seen is that Falling on from yesterday where people were kind of buying up the last little bit of equities to finish up their There at the quarter that West Texas crude has benefited from that last bit of window dressing Now looking at gold It looks to be with the ADP private payroll number coming in slightly better than expected now that people are thinking it non-farms Will be better than expected and that's given a dollar a little bit of an increase But it's also given gold a bit of cause for concern Because gold sensitive to US interest rates you can see there the acceleration to the downside That is traders now betting that perhaps on due to Friday's non-farm payroll numbers coming in strongly that US interest rates might in fact be increased this year Which has quite a big knock on effects on the yellow metal So trading below both moving averages the next potential support If we draw that on now is just at the tip of this candle and that's round about let's just say it's 1100 but we're a little bit away from there right now Almost a head and shoulders formation by the bottom of a downtrend. It doesn't really count So then looking at Euro dollar and GBP USD to finish things off You can see the dollar has wrestled control from the euro again with a bearish engulfing pattern yesterday and another Preaching towards the bottom end of our range this morning with one spot 11 being the next potential support And then finishing up the GBP USD is continued to grind lower below one spot 51 85 with one spot 48 13 being the next potential support So as ever guys keep your eye on the chart forum make insights part of your layer going forward and join me again Tomorrow to find out what happened next


Hey everybody Matt here for Layton Sports Cards ripping two boxes for Justin S We have one box of 2023 Panini Chronicles graphics football and one box of 2023 Panini USA Stars and Stripes baseball Here we go Justin. Good luck Grab up your boxes lots of room. I can go until 3 30 and even if the queue gets full to where I can't finish everything It'll be an hour and a half after I get done before Kyle starts over on the Layton 2 channel ripping personals all night Kevin McGonigal silver training camp auto to 100 Ryan Lascaux Jersey it's 250 Alexander McCurrius Kimball Smithwick Silver and Alonzo Treadwell auto to 100 says Ethan Holiday It is black to 50 Young Chuan Hwang under 18 national team Chinese Taipei Hunter Elliott auto Ross Dunn bronze Backstone Stars and Stripes white Langford and to 100. That is auto Ethan Holiday I think so. It's a 1500 national team Grady Everson red stars to 149 Kevin McGonigal auto to 100 Jersey auto to 72 Stein van der Schaaf Netherlands under 18 national team USA Baseball 1500 national team bronze Wilson I appreciate it Tim. Yeah, be sure to hit the like button. We do appreciate it And grab up your boxes if you want something ripped. There is not a very long wait. Go with Chronicles graph technical rookie Bryce Young Addison AJ Brown Auto to 49 you know, they say J Reese CD lamb lamb check Johnston That is origins Rookie Otto Israel Abana Kanda Zeke XR and CJ Stroud. This is the 49 Nene black Purple parallel Anthony Richardson college ticket and Jalen Hertz. So your Quebec Silver Jordan Addison Quentin Johnston clearly Don Russ purple to 49 Zach Charbonnet Hinden Hooker Anthony Richardson Chronicles rookie Abhijan Robinson pinnacle and Impeccable canvas creations Rookie Otto red jacorian Bennett Justin Herbert Josh Allen spectra Quentin Johnston rated rookie and Jalen Hyatt and your Richardson says encased jumbo jersey Christian Gonzalez Bijan Robinson Phoenix rookie Champ Bailly and Tanner McKee. This one's a rookie to 149 Sean Tucker and McCaffrey rookie Jackson Smith and Jigba pinnacle Geno Smith Clark Phillips rated rookie purple 49 rice young classic silver and on the back Joe Namath That'll do it for your boxes. Justin appreciate it. We'll get these right out to you


Hi everyone and welcome back to the vlog. My name is Claire Carmichael and I am a general practice nurse. So just wanted to do this vlog because with the announcement of the lockdown, the cases of Covid are going up, the death rate is going up, it's going to be tough right now so I wanted to do this vlog to make sure that you as student nurses mainly get the right support and help and advice and everything that you need whilst out there and protecting yourself and your families. So as a student nurse if you're going onto your placement and they are testing their staff regularly for Covid then you should be included in those numbers. You should be getting regular testing as well as long as the staff. This has been made very publicly clear, there is letters and all sorts online publicly for you to see and take into your placement if you are struggling with this. Next PPE make sure you have got the right PPE for your placement and your patients. If you're dealing with Covid positive patients you're going to need some top PPE. I'm going to put all the links below which PPE you should have, which patients and when and hopefully that'll just help you out. There's a lot of guidance out there about PPE, what type of patients you should be using, what for. So just make sure that you've got the right PPE before stepping foot on a placement, make sure you are protected, stay safe guys and protect your family as well. Because as nurses we don't often think about ourselves and protecting ourselves, we automatically think about other people. I do it as well, I still do it today. I will only speak up if a patient is going to be affected, if patient safety is infected, anything like that, patient abuse. I will stand up and stick up for my patient, I will also stick up for my friends and my colleagues that I work with and student nurses which is why I'm here. But when it comes to myself I'm just like yeah whatever but anybody else I will fight for and I think that's just a normal thing that we do as nurses it's something we do but it's really really important, Covid is out there, we can die from this so it's really important that you get the right level of protection to keep yourself safe, protect yourself from Covid and also protect your family that you might be going back home to. So just some little tips about keeping yourself safe and what is out on placement. So the first thing you want to do before you go on to your placement, ring them, make contact with them like I've said before and find out what PPE is there, what type of patients they've got just to give you a bit more awareness of what you're walking into on your first day and just make sure that that PPE and all of the safety measures are put in place before you step foot on that ward, that's the number one thing to do. Maintaining that two meter rule is another one, I know it's very very hard as healthcare professionals we can't physically keep two meters away from patients and things like that because we have to do observations and injections and all sorts of personal care and so this is more about where you can try and keep two meters so if you're in the staff room for example try and keep that space between you all, staggering breaks out throughout the day maybe so that people are going at different times so that not everyone's sort of communing in the staff room, make sure that you're staying safe in that staff room and around the nurse's station and things like that just keeping the space, wearing your full PPE unless you're going out to eat your lunch or anything like that just make sure you're just following that guidelines and that will hopefully help a little bit. Hand washing, hand washing, hand washing, everyone is sick to death of hearing what hand washing but I've got to add in this, make sure you're hand washing all of the time properly with hot soapy water, get it done using alcohol gel in between where you can't and then as soon as you see a sink wash your hands, don't just rely on build-up alcohol gel because eventually it's going to get really sticky, your hands are going to feel awful, you need to be washing that those hands as soon as you see some hot soap and water as much as possible even if you think that you don't need to do your hands because they're clean do it, it doesn't matter just do it because these type of viruses sit on the surface, there's not something you see with your eyes so you don't know it's there until you've got it in the body so it's really important you wash your hands constantly and if you've got a ward full of non-covid patients or you think they're non-covid because they haven't got any symptoms or anything but they still could be carrying the virus so it's really important to maintain that infection control between every single patient so make sure you're hand washing, changing aprons, changing clubs, doing everything you can to avoid cross-contamination between patients and yourself and your colleagues as well but to be honest I don't work on the wards at the minute so I have no idea what people are doing out there on the wards with COVID positive patients, with COVID negative patients, the routine and things like that so I can't really give much advice on that other than just if you think it's wrong then it's probably going to be wrong so just avoid it or ask for some support on something or ask for some guidance on something, have a google at some guidelines and things like that, look these things up, if you think feel that something's not right or something's wrong then you have to look into it a bit more and make it right. I have heard recently so many worrying stories from student nurses that haven't been given the right PPE, they're not getting tested with the rest of the staff because they're just a student, this is the words from these people and that's not okay to me, if you are a student and you'll be treated like this please speak up about it, take it further because this is not okay, you should be getting tested along with the staff, you should be treated the same as the staff, you should be getting full PPE but anyone that's COVID positive especially if they're coughing and spluttering you need that proper aerosol generated mask thing whatever it's called, NP36PO something but don't let them fob you off because you're a student, no sorry you're a human being just like the rest of their staff so please make sure you've got the proper PPE for what you're doing, you're being treated like a human being, getting tested along with the rest of the team but then if your uni's already doing testing and stuff then don't worry about that part but if you're not getting any testing at all and then you're going to a placement that are testing their staff regularly you should be included in those numbers as well because you're part 13 for the next however many weeks but obviously NMC code of conduct and all that jazz we must be professional about these things so don't go in organs blazing go rah rah rah that's not okay do it in a professional manner get your evidence get your backup present it done and lastly I just wanted to say thank you, thank you so much to all of you student nurses out there who are fighting in this pandemic right now this is going to be some of the toughest year months whatever of your lives during this whole nursing career and if you and if you can get through this you can get through absolutely anything think how resilient and strong you'll be at the end of all of this and I know it's a pretty crap time right now you're going to be feeling really deflated really tired exhausted even fatigued really demotivated you must be feeling really really down there right now but you have to keep the faith you have to keep going you have to keep smiling you have to stay motivated you have to remind yourself why we're doing this why we're in this and if you leave the course or anything who's going to nurse in the future if everybody leaves so just remind yourself why you came into nursing get that motivation back in your heart think about qualifying and getting your pin number and being a qualified nurse on the wards or the community or primary care wherever you want to go it's it's just you need to keep that motivation in there because it is tough and there are going to be many days many probably most days that you want to quit and give up but you know what you are amazing you can do this and at the end of it you'll be so so proud of everything that you've just come through and fought through to save our world save our planet basically I mean look at those numbers like I talked about at the start of the video those numbers are rising the more we can do and the more things that we can put into place to save other people the better and there's no other reward there's there's nothing more rewarding than saying that I saved lives during a pandemic it's amazing it's still the best career to me in my life but yes just please take some time out get the support you need if you really are struggling never suffer in silence because you don't need to everyone is probably feeling like this right now so just make sure you get the support get some help make sure you're okay take some time out if you need to you know the course is still going to be here at the end of the day there's no rush to finish by such and such a day you've got your whole lives ahead of you so look after yourself first before anything else guys just take care of each other take care of yourself and keep going you're doing amazing you're doing fantastic and a massive loves hugs to every single one of you for being amazing thank you and lastly my inbox is always open as always if you need anything if you need advice anything about anything then please inbox me I'm not going to give you medical advice because we can't do that we're not allowed but if you're struggling mentally if you need some help with PPE or COVID guidelines or anything like that please send me a message because I can try my best if you can't find it obviously look yourself first don't bring it all on me come on guys I've got a job to do I've got three jobs actually that I'm doing at the minute so yeah but my inbox is open I will reply and respond and help and if I cannot help or for something weigh out my expertise I can sign post you to the right people so yeah so my inbox is always open so give me a message if you need to and if you just want to say hello or send me a fun gift to cheer me up Claire I will do that no problem at all so have a great day everyone and I shall see you next time


understanding and example. Queen Elizabeth was a life well lived, a promise with destiny kept and she is mourned most deeply in her passing. That promise of lifelong service I renew to all today. Alongside the personal grief that all my family are feeling we also share with so many of you in the United Kingdom in all the countries where the Queen was head of state in the Commonwealth and across the world a deep sense of gratitude for the more than 70 years in which my mother as Queen served the people of so many nations. In 1947 on her 21st birthday she pledged in a broadcast from Cape Town to the Commonwealth to devote her life whether it be short or long to the service of her peoples. That was more than a promise. It was a profound personal commitment which defined her whole life. She made sacrifices for duty. Her dedication and devotion as sovereign never wavered through times of change and progress, through times of joy and celebration and through times of sadness and loss. In her life of service we saw that abiding love of tradition together with that fearless embrace of progress which makes us great as nations. The affection admiration and respect she inspired became the hallmark of her reign. And as every member of my family can testify she combined these qualities with warmth, humour and an unerring ability always to see the best in people. I pay tribute to my mother's memory and I honour her life of service. I know that her death brings great sadness to so many of you and I share that sense of loss beyond measure with you all. When the Queen came to the throne Britain and the world were still coping with the privations and aftermath of the Second World War and still living by the conventions of earlier times. In the course of the last 70 years we have seen our society become one of many cultures and many faiths. The institutions of the state have changed in turn but through all changes and challenges our nation and the wider family of realms of whose talents traditions and achievements I am so inexpressibly proud have prospered and flourished. Our values have remained and must remain constant. The role and the duties of monarchy also remain as does the sovereign's particular relationship and responsibility towards the Church of England. The Church in which my own faith is so deeply rooted. In that faith and the values it inspires I have been brought up to cherish a sense of duty to others and to hold in the greatest respect the precious traditions freedoms and responsibilities of our unique history and our system of parliamentary government. As the Queen herself did with such unswerving devotion I too now solemnly pledge myself throughout the remaining time God grants me to uphold the constitutional principles at the heart of our nation. And wherever you may live in the United Kingdom or in the realms and territories across the world and whatever may be your background or beliefs I shall endeavor to serve you with loyalty respect and love as I have throughout my life. My life will of course change as I take up my new responsibilities. It will no longer be possible for me to give so much of my time and energies to the charities at issues for which I care so deeply. But I know this important work will go on in the trusted hands of others. This is also a time of change for my family. I count on the loving help of my darling wife Camilla. In recognition of her own loyal public service since our marriage 17 years ago she becomes my queen consort. I know she will bring to the demands of her new role the steadfast devotion to duty on which I have come to rely so much. As my heir William now assumes the Scottish titles which have meant so much to me. He succeeds me as Duke of Cornwall and takes on the responsibilities for the Duchy of Cornwall which I have undertaken for more than five decades. Today I am proud to create him Prince of Wales to Wusig Cymru. The country whose title I've been so greatly privileged to bear during so much of my life and duty. With Catherine beside him our new Prince and Princess of Wales will I know continue to inspire and lead our national conversations helping to bring the marginal to the centre ground where vital help can be given. I want also to express my love for Harry and Meghan as they continue to build their lives overseas. In a little over a week's time we will come together as a nation as a Commonwealth and indeed a global community to lay my beloved mother to rest. In our sorrow let us remember and draw strength from the light of her example. On behalf of all my family I can only offer the most sincere and heartfelt thanks for your condolences and support. They mean more to me than I can ever possibly express and to my darling mama as you begin your last great journey to join my dear late papa I want simply to say this thank you thank you for your love and devotion to our family and to the family of nations you have served so diligently all these years may flights of angels sing thee to thy rest. That was the national speech there from London from King Charles III as you were just listening now I'm going to be introducing our guests for you our correspondent who you heard from a little bit earlier Hamda Salhout as well Professor Anat Skoltinoff sorry who joins me in the studio here she's the professor of public law from the University of Winchester in the UK and also we've got on the line for us all the way from London joining us writer and political commentator Adam Schwartz. So let's start with Professor Anat in the studio here with me as you just heard the king's speech there he spoke about the queen's dedication as sovereign throughout her lifetime how she never wavered during all of these times under any circumstances is how symbolic is the monarchy now going forward since her death well obviously there's an important symbolic aspect to the monarchy but I would say it's more than that it's a constitutional monarchy and that's something that we heard in the speech just now so the king mentioned the parliamentary government as the system and as well he mentioned the constitutional role and tradition so in fact and I think that's something maybe that is not widely realized the monarch of the United Kingdom actually holds in law a lot of power it's not merely a figurehead or symbolic role in law has very many powers including the decision to appoint the prime minister the decision whether to give the royal assent to legislation so indeed will it's quite a lot of power but that power will only be practiced in a constitutional manner and that's something that as we may be expected the new king has expressed as well so I would definitely not say it's a merely symbolic role and that leads also to maybe two further questions one and which maybe he hinted a little bit a little bit in his speech whether the character of the monarchy will change somewhat under the new king and the other question whether there is even any possibility or wish in the United Kingdom for the system of government to change from a monarchy to a republic and that's something that might also be raised on such a day so I'll maybe turn to the first of these and this is something that he hinted at maybe you talked a lot about tradition but I also caught sort of a hint there when he talked about the United Kingdom today is a multicultural society that's something he's talked about in the past as well we have to remember that the monarch is the defender of the faith i.e. the Protestant faith and he will in the Council of Accession tomorrow be making that affirmation that he is indeed of the Protestant faith and will be head of the Church of England but maybe that's something that he wants to change slightly the character of that in view of the more multicultural society in the United Kingdom today well crossing to you Adam over there from London what did you think about some of that speech what's your take on what was just said by the king well I think firstly on a personal level I think anyone can empathize empathize with a son having to speak about their mother only a day after she passed in front of entire nation indeed the whole world having watched the speech I think I would probably break it down to three main themes that Charles really thought to sort of indicate I think the first is that he really wanted to of course contribute to his mother the queen I think in doing so he really was able to sort of connect with the wider British public in this very traumatic time I think that's something you saw earlier as well as you can see when he was meeting crowns outside Buckingham Palace I think the second thing that he did was to provide a sense of the continuity and stability now of course the system is very clear and Charles to go to throw in the moment his mother passed away but I think it's still so important that the British public saw a sort of visible sense of continuity particularly in the time when you know the government as well has changed with UK's new prime minister this week and thirdly I think what Charles was trying to do was try to sort of convey a sense of what kind of king he will be he's quite an unusual king in the sense that he takes the throne at the age of 73 now that's the oldest that anyone has ever taken to the throne in the UK and indeed he's been the longest heir in British history and the consequence of that has meant that actually the British public already have a sense of what Charles Prince of Wales is like but they don't necessarily have a sense of what Charles the king will be like and I think you know the fact that he referenced the fact that his roles will change and he won't be able to devote as much of his time to various aspects such as his charity work really indicates an acknowledgement that actually he's gonna have to change his style quite a bit but what I would say would be that you know the main challenge for Charles you know as he sort of takes his role as the king will really to be maintain the relevance of the monarchy in the 21st century in a excuse me in a modern democracy that the UK is I think he's going to have quite a lot of pressure to do so particularly from younger members of this family basically from the newly created Prince of Wales Prince William who will really want to make sure that actually during Charles's reign actually the royal family maintains that popularity that it had when Queen Elizabeth at her reign so I think it's going to be quite a difficult task but naturally every single monarch has the responsibility to take forward the royal family and the position and really make it their own in a way that's relevant to the modern democracy that the UK is Thanks Adam well onto Humda now in the field there. Humda as you just heard the king spoke about his Prince Harry and Prince William he also said that it's a time of change for the royal family as well including his wife Camilla and that William now assumes the title of Prince of Wales Prince Harry and Prince William have also been relatively quiet though since the news broke out about their grandmother are we expecting to hear more from them do you think well we could definitely expect to hear more from them as Prince William now ascends to this new title we also know that Prince Harry and his wife Meghan Markle the Duke and Duchess of Sussex have been layered in controversy with the royal family and we do know that they released a sort of bombshell interview a few years back after leaving the royal family but in a situation like this it is it is hard to imagine that they will not release words when it comes to the death of the Queen we also need to keep in mind that King Charles's popularity is not as great as his mother's we do understand royal commentators are saying that he will be met with a lot less enthusiasm polls taken just in May of this year said he had he had about a 56 percent approval rating and that is behind the Queen's at 81 percent where his son now the first heir to the throne coming in with 77 percent approval rating so a lot on the hands of this new King and a lot on the hands of the of his children the next heirs to the throne well and out to back in the studio here speaking of approvals as Hamda just touched on that what's how will the king deal with all of this and his relationship what's it going to be with the common wells going forward yes so I think that's important because of course he's not just the head of state of the United Kingdom but in fact of 15 other states as it has been the case in the United Kingdom he becomes immediately the head of state in all these other states such as Australia New Zealand Canada various Caribbean states now regardless of the personal approval rating of Charles I think that in the United Kingdom there is generally a wish to retain the monarchy but that might not be the case in the other states in which he is head of state and some of these commonwealth states so just last year we've seen Barbados decide to become a republic and no longer have the Queen or now King of England as head of state maybe Jamaica may or may not follow that and that might be a time of reckoning for some of these other states as well where having the English monarch as head of state is also some relic of empire of colonialism that they might be trying to shake away in a state like Australia that's obviously the considerations are somewhat different again several years ago there was there a question of whether to become a republic or not that was defeated in a small majority so I think it will be interesting to see what happens in these states as I said in all these states he immediately becomes King nothing else needs to be done that doesn't matter when he's actually crowned which might be a few ones even down the line but they still might be a time of reckoning in these states and it will be definitely interesting to see if there are any constitutional changes there Adam over in London so obviously there's this has triggered a series of ceremonial and constitutional steps what role do you think William will now play well I think you know there's no really a set constitutional role for the air other than of obviously to ultimately support to the monarch in their role and of course eventually a seat to the throne but I think that very much depends on really what he himself will see the role to be and also what Charles will want him to do I think partly he will have to take on some of the responsibilities that Charles will leave behind the fact that he's no longer you know in his previous title will naturally pass some responsibilities to William but I think what William will try to do will be to build on his existing work that he's already achieved in his sort of previous role when you know the Queen has been around for the past 30 years and I think he's had a really really important role in trying to sort of modernize the image of the royal family and I think to some extent there's only so much that you know King Charles can do that on his own I think he will really need the support of Prince William to do that and I think Prince William has really looked into lots of different areas that were perhaps previously looked as taboo in the royal value or indeed the wider society you know he's talked quite widely about his mental health struggles as has Prince Harry following the death of his of their mother so I think that's something that they will build on but of course I think as we see you know just we saw the Queen age and Charles eventually take on more responsibilities I think we'll also see Prince William over time over the next few decades perhaps take on more responsibilities sort of in preparation for that role I think the fact that William is no longer you know two places away from the from being King rather than just one I think really will be quite an important change in his perspective and really it'd be a much more vivid concept that he will one day be King so I think we're going to see his change his role change but ultimately build on what he's already been doing in his previous role and turning to Hamda in the field now so Hamda obviously we know that there's still going to be some processes left in this like the state funeral for the Queen and also the 10-day national mourning period at what point though will the world turn from mourning to celebration well we do understand that just today Buckingham Palace announced that the royal period of mourning will be observed from now until seven days after her funeral making it actually a total of 17 days of mourning until after the Queen is laid to rest but we can expect celebrations when the new King has his coronation the United Kingdom will still be mourning though because the Queen was very beloved and as I mentioned earlier she was popular with more than three-fourths of the country more than three-fourths of the United Kingdom approved her leadership and her reign so the 10 days of mourning the seven days after that and then perhaps we can see the United Kingdom spirits lift when the new King has his formal coronation back in the studio now a professor announced what do you think what other states will the King be head of in your opinion well as I said he immediately becomes head of all these 15 states but we might see in some of them wish to become republics following as I mentioned last year Barbados but I think we can ask in the United Kingdom that there going to be any constitutional changes there again is nothing immediate that will be changed but it could be that the character of the monarchy will change for example we know that other European royal houses are much more scaled back in terms of the number of members who are royals and that might be something that the United Kingdom might move to as well so we could see some constitutional changes although none that arise immediately I think again going back to the point that was made about King Charles and this perception may be in the public eye he has definitely been more outspoken on public issues than his mother the Queen Elizabeth II and it's a question whether that will be the case as well when he is monarch so the idea of a constitutional monarchy the way the Queen has seen her role is to really be out of the public eye be very seen as very neutral not to take a position on public issues and that has maybe led to her success as a constitutional monarch it's a question whether that will somewhat change under King Charles or not obviously is in a different role now but it does seem to be the case that he has some viewpoints on public issues maybe that's contentious as well and of course the Miniti expresses views their opposing views as well so of course we still do not expect him to be part of the political process that would be undermining the constitution right monarchy but it might change to some extent. Professor Anart thank you so much I just want to thank all our guests Professor Anart firstly in the studio with me here Anart Skolkanov Professor of Public Law from the University of Winchester in the UK Handa Salhut in the field for us our correspondent and Adam Schwartz from London writer and political commentator well moving on now