We're back, we're live. Welcome back to Think Tech. Here we're on Likeable Science on a Friday at 2 p.m. That's what we do at 2 p.m. on Friday. And we have Ethan Allen, who is our host on Likeable Science. And he is in Aloha Tower, two blocks away. But he is there with the Hawaii Public Health Association at the 2016 Hawaii Public Health Conference. And in fact, he has guests and people that he is going to interview. So welcome to your own show, Ethan. Thank you, Jay. It's good to be here. You take it from here, Ethan. Yes, and with me I have Dr. Christian Gloria. Welcome, Christian. Thank you, Ethan. Thank you, Jay. Thank you for the invitation. I'm happy to be here. Christian is a person largely responsible for getting this conference together. And it's been a remarkable event. We're in day three of a three-day conference. We're winding it on down. We've had hundreds of people here, public health workers, doctors, nurses. Nurses, educators, policymakers, stakeholders, pretty much really everybody in the community who's interested and involved in public health. And the big theme this conference is health is everyone's kuleana, right? Everyone's responsibility. Right. And so the theme this year is health is everyone's kuleana, building community momentum to promote action. And so we are trying to push for the concept that we do a lot of talking, but it's about time that we start really working together and actually making change. Yeah, and this gets to this idea of collective impact. Some of the public health challenges are these very large, so-called wicked problems, right? And no one agency or one group can solve them. They have many, the roots lie in many places. Social status, economic factors, environmental factors, civil factors, policies. So it takes a lot of different groups working together to address them effectively. Right, exactly. And so as I have conversations with many different public health professionals, whether they're doctors, nurses, educators, policymakers, non-profit organization managers, what we realize is we do a lot of great things on our own, but without that collective effort, it's really not taking us where we need to be. And so we continue to face and see the same problems that we've faced for many, many years. And we're making effort, but not fast enough because the problems are only getting worse. And so hopefully as we join forces together and come together in conferences, like these, not these conversations, I will be able to find ways to actually collaborate and cooperate. Exactly, it's sort of this race between these escalating problems and our advancing abilities and willingness to collaborate for another, which is gonna win, right? Exactly. While you're working on some of these high-profile items, for example, the Genki Sushi disease, Zika, what about SARS? Is there any action on SARS? And what about mental health in Hawaii? There's all kinds of talk about that. Is that within public health? Yes, actually, I'm glad you asked that question because the repeating theme that we've heard through all of our speakers locally, statewide or nationally, it's all about the fact that everything is public health, even if you are in the Department of Transportation, that is public health, even if you're in business and finance, that is public health, because at the end of the day, it impacts all of our well-being and the stressfulness, like you said, that could impact our mental health as well as our physical health. Are you tackling some of these headline stories like Zika? So we did talk about, we had some sessions on Zika, as well as some of the other epidemics that we're facing today. I don't remember seeing a session on SARS. It seems that HEPA, and there's a session right now actually that's going on discussing efforts on HEPA and prevention in Hawaii. So it did take, for example, a whole community to figure out where the infection was coming from. And so that's why it took us a long time having to work from different sectors within the community to figure out, for example, like you said, that it may have come from Genki Sushi among other places. And ultimately they found out that it might have come sourced from the Philippines. It took a long time because it involved a lot of people to find out where these epidemics might be starting. Right, this is very, a lot of public health is not sort of simple diagnosis of a disease and treat the disease. It's looking at, in many cases, the social determinants of health in large scale. Right, exactly. Well, often it's a matter of health infrastructure. I mean, for example, a laboratory, a biosafety laboratory. Say a class three biosafety laboratory, such as had been contemplated in Kakaakoa, and I think it was also contemplated in Waimanu Home Road. And the question is, is this being discussed? How important is infrastructure like that regional biosafety laboratory for public health in Hawaii? Oh, yes, tough questions. Sorry. It's not as my area of expertise, but I do know that, for example, that there are some construction happening in downtown for such things as those laboratories that you're mentioning. Given our location, given our very small size in terms of our land and the fact that our land's always moving, whether it's an earthquake, whether it's a tsunami or a hurricane, we do have to make sure that we talk about all the potential ways of keeping our infrastructure safe, right? And so with all the constructions happening that I know about, for example, at Port Street Mall in downtown, so that is one of those things that everybody's asking questions about. So we're being very careful and making sure that our infrastructure is very safe one way or another. Infrastructure affects public health and other ways too, that is the whole infrastructure of neighborhoods impacts the health of the residents there, are the neighborhoods that are friendly, encourage people to get out and walk, people get more exercise, that encourage people to interact, people get more socializing. All of these things are important people's well-being on various levels. So yeah, this is what Executive Christian was saying earlier, this isn't just about health professionals, it involves everyone. Yeah, it's really about building that community that promotes health naturally, right? And so just like what Ethan said, I'm actually very passionate about the built environment. And I know we've had some effort here in Hawaii, for example, building more sidewalks and bike lanes so that we could promote using of bikes and walking with each other and making sure that our communities and sidewalks are safe enough that people will actually use it. I do think we have still a long way to go. I've been in different communities in the mainland, particularly in Austin, Texas, where I had gone to school for 15 years, where we were quite progressive in making sure that we had very bike-friendly, pedestrian-friendly lanes and that we had safe communities so that people actually use them and go to parks where they can be more physically active. You know, one of the big concerns, I think, that I would have about public health is whether our public health organizations, such as they are, and however they are coordinated among all of them, are adequately prepared for extreme storms, because one of the things that happens as a result of an extreme storm, of course, as the public health is affected, sometimes dramatically, you've seen that in so many places, most recently, I think, in the Philippines. And I wonder where we are on that and wonder whether your conference here at Aloha Tower is covering that. You know, I'll be honest with you, I wish we had more discussion on that and only in the conference, but really all throughout the state or really all of our neighbor island friends throughout the Pacific, especially myself who was born and raised in the Philippines. So I'm very familiar with those kinds of problems. I'm actually quite vocal about having that conversation even very locally, like, for example, at the university level. I often question, especially with the new development and the new opening of Aloha Tower being now a Hawaii Pacific University facility, that is one of the first questions I asked when they were still showing us the master plan. What is the evacuation plan? What is the emergency response in case something happens? And it's funny, you mentioned that I had, was actually talking to the event coordinator here at 8 a.m. just yesterday. And sort of kind of ingest the sort of how I approach these things lately. I asked her, so now that we have a conference here, we've got at least 250 people attending this facility, which is beautifully at the waterfront. What is the evacuation plan? Is that part of our obligation as the host of this organization to talk about what the evacuation plan is to start. And the response to me was that, well, they have an obligation to the students, the residents who live upstairs, but because we are just sort of a transient group, that they're not necessarily obligated by law or any kind of policy for us to have an emergency plan for a conference. Wow, wow, wow. And so it makes me nervous. And so it's not, unfortunately, it's not only an issue of concern for small gatherings like this. It's a concern for all of our islands. I was just at disaster preparedness training a couple of months ago, and they talked about how if we are faced with the extreme tsunami and the super tsunami that we are pretty much overdue for, we can expect all of our coasts to be at least 30 feet under water. And really, nobody wants to think about it. Nobody wants to talk about it. And we still continue to live in places that are very dangerous. But a lot of work still needs to be done. A lot of talking needs to be done. And I'll be honest, it makes me nervous. And I know I'm one of the few people when I move into an apartment, I make sure I'm away from the flood zones and I'm high up in the mountains so that I don't have to possibly deal with these kinds of problems. Yeah, but isn't that true that a storm and the water coming in on the land and affecting our systems, our plumbing, our water systems, our sewage systems and so forth has almost an immediate effect on public health. And it can be disastrous. It can wipe out populations. And I don't think people realize that. Right, because within the first three days, your drinking water system goes down in the first three days, people running out of water and they're starting to die. Yeah, absolutely. And so one of the things that I actually learned in my training a few months ago for disaster response and preparedness, we have to make sure that we train our community members and find community leaders who could take the lead in case of an emergency and in case of situations where responders are unable to get into the communities, maybe because roads are destroyed or blocked. We'd have to train our community members and community leaders to make sure that they can self sustain themselves for at least a week, if not two weeks, because it could take that long for responders to get to those communities because our roads are so limited. And oftentimes we only have one in and out pathway from one neighborhood to another. Well, we're gonna take a break in a minute, but let me ask you one more question just in the interim, Christian. And that is, this is the first time a conference of this nature, magnitude and consequence is being held at Aloha Tower. I mean, we had the Hawaii annual code challenge in one of the multi-purpose rooms over the past month or so, but that was small compared to the conference you're involved now. How are the facilities? And this is a new deal here for Hawaii Pacific University. How is it working? You're just like Ethan's response. It's very well received, it's a beautiful facility. It's everything's brand new, renovated. We have great waterfront views. We have restaurants like Gordon Buresh. And we're also very much ingrained with the academic culture. So it's a great place for learning and for having conversations and creating networks. And it's also a great way to connect professionals with students because students are always wanting to have opportunities to be a participant in these conversations. And so it's been a great venue in that sense. We are nicely located downtown surrounded by all of many of the non-profit health organizations. And so it's been very convenient for everybody. So it's been great and I highly recommend the Aloha Tower Marketplace. All right, we may not be able to pry Ethan out of there, eh? No, it's great. Which has very different on beyond than a standard conference center.  Here, one routing outside and it's really very pleasant. That's great. A sign of things to come. More conferences there in the future. Okay, then with a short break, that's Christian Gloria, PhD from HPU, Public Health. And of course our host, Ethan Allen. We'll be right back. Aloha, my name is Josh Green. I serve as Senator from the Big Island on the Kona side. And I'm also an emergency room physician. My program here on Think Tech is called Health Care in Hawaii. I'll have guests that should be interesting to you twice a month. We'll talk about issues that range from mental health care to drug addiction to our health care system and any challenges that we face here in Hawaii. We hope you'll join us. Again, thanks for supporting Think Tech. Hi, I'm Stacy Hayashi and you can catch me on Mondays at 11 on Think Tech Hawaii. Stacy to the rescue. See you then. Aloha, it's summertime in Honolulu, Hawaii. My name is Steven Phillip Katz. I'm your host for Shrink Wrap Hawaii. We're on every Tuesday at three o'clock and we talk about mental health and general health. Join us, thank you. Hello, my name is Crystal. Let me tell you my talk show, I'm all about health. It's healthy to talk about sex. It's healthy to talk about things that people don't talk about. It's healthy to discuss things that you think are unhealthy because you need to talk about it. So I welcome you to watch Quok Talk and engage in some provocative discussions on things that do relate to healthy issues and have a well-balanced attitude in life. Join me. Aloha, my name is John Wahee and I actually had a small part to do with what's happening today. Served actually in public office. But if you don't already know that here's a chance to learn more about what's happening in our state by joining me for a talk story with John Wahee every other Monday. Thank you and I look forward to your seeing us in the future. One, we're back, we're live. We're here again, Think Tech Hawaii, likeable science on a given Friday at 2 p.m. With our host, Ethan Allen who is doing on location here at Aloha Tower. With the Hawaii Public Health Association in the 2016 Hawaii Public Health Association conference.  So welcome to the show, Tom. Well, thank you very much. It's good to be here. Ethan, why don't you reveal what Tom does and why he's there? Tom generously came out to talk with us. He is the president-elect of the American Public Health Association, the big national organization of which the Hawaii Public Health Association is just one, one fifth, one fifth. One of 54, 54 affiliates, yes. 54 members, right. So he runs the whole show basically and he's a longtime public health practitioner, if you like to say, from Marion County, Ohio, the health commissioner there has been actively involved in all kinds of health, public health approvals and let's say authorizations, but accreditation processes and it gave wonderful talks here, both at the meeting and now at the conference. Tom, it strikes me that with the speed at which medical research takes place and the speed for that matter at which epidemics take place, the whole field of public health has to become more and more global. And you've probably seen those trends, those seed changes in the past few years, you know, in your role with public health. Can you describe that to us? What is the global process? What do you see happening in the field of public health? Sure, well, global is a very good way to describe public health, not only in the most literal terms of international and global thinking, but in terms of systems, because public health, there truly isn't anything that's more than a degree or two separated from the actual specific field of public health, whether it's environmental or it's related to communicable disease or health policy or health care, any of those things, those are all part of the, under the big umbrella of public health. So whenever there's a conversation going on, whether it's a local conversation, that's just sort of a microcosm of something that's going on at the global level, or it's a global conversation about something, for example, like climate change, these are all public health issues. They all have trickle-down effects on individuals as in their health, but also populations and the health of a population in general. We're doing a much better job, I think, in public health of drawing attention to issues that are more emergent, things like Zika, things like climate change, things like, you know, any reemergence of what are vaccine-preventable diseases or superbugs, things that are becoming resistant to historical treatments. Those are all on our radar, and it's a big radar. Well, you know, I guess it was about a year ago that Hawaii had a huge conference about brain research. We had it in the Hawaii Convention Center, and there were a huge number of people from all over the world who were involved in brain research, and I walked up to the table with my cameraman, and there were three or four fellows sitting around the table, and I said, you know, can we get some comments from you? And they said, no, you can't. We're busy writing a paper right now at this table. We're collaborating. Watch us collaborate and leave us alone. And I took that, you know, as a good-natured remark, but the fact is, this is all about collaboration. Can you give us an example of how collaboration takes place at this conference now at Public Health? Sure, and so the first example that comes to mind is the collaboration between the academic institutions and the Public Health Association and the various entities that the Public Health Association represents, whether they're practitioners or they're policy folks. So at the systems level, there's tremendous collaboration between the association and the academic institutions. The academic institution here is really supporting the venue to allow this conference to happen. My participation with my role at the American Public Health Association and being an invited guest of the Hawaii Public Health Association gave me the opportunity then, yesterday and the day before, to meet with folks from the Hawaii Pacific and from the University of Hawaii. Thank you very much. It's been still dealing with jet lag with those academic institutions and speaking with the students and connecting them to the Hawaii Public Health Association. But then also just yesterday, I had lunch with the state health director in Hawaii to talk about the national accreditation of the state health department and had a very, very good conversation with her about the value of that. So those are all sorts of, at the systems level, it's not writing a paper on brain neuroscience or something, but this is really about systems collaborations, which is really a little bit more what we focus on in public health. It's the population level stuff. Sure, Ethan, can you get a handle from Tom on where we are in the continuum of this conference? How far into it are we? What are we doing right now? What programs are going right now? And what programs have yet to happen? Well, in terms of the conference, we're basically almost done with it. We're in, I think, the very last session or the next to the last session of three days of conferencing. It started with some sort of pre-conference activities on Wednesdays and rather extended dialogues. Where we looked at the same issues we had dealt with last year and saw what progress we made on the whole built environment issue, what progress we made on these fronts that we were tackling and we talked about last year. Then we had that Wednesday evening, we had the annual meeting of the HPHA, membership got to sort of here, an update on the years, activities and all got to meet Tom. And then we burst into a little conference all day yesterday and all day today, basically, many different panels on different topics, ranging, as Christian was saying, from A to Z, basically. And these conferences are wonderful. I've had an opportunity in a variety of roles with the American Public Health Association to participate in a number of different affiliates, so the state level conferences that are a little bit shorter than the national one, but it's really interesting to see the parallels that exist in the presentations, the issues that are being talked about, the dissemination of information, whether it's programming, best in emerging practices and programming, or it's advocacy, public health advocacy issues, or more scientific sorts of things, they really do parallel, it's nice to see that we're not as disjointed as we might be given the very broad diversity of the field of public health, that we really are, it's by accident, but we really are hanging out of the same playbook, so I'm glad to see that. Yeah, we have some nice pictures, we were showing some nice pictures while you were talking Tom about people getting together and it looks like a very happy and satisfied group of staffers and participants in the conference. But now that it's almost over, I wonder if I could ask you what you'd be taking back with you? What are the most memorable conferences or lessons or revelations that you have had or seen during this conference, aside from meeting Ethan Allen, and aside from being on SYNC Tech? Yeah, well, Ethan is one of a number of just wonderful folks that I've met here, again, both at the association, at the universities, and at the state health department. There's the public health stuff I'll take back, but this is Hawaii, I've never been to Hawaii. So a lot of the conversations I'll have with folks will probably start off talking about Hawaii, and then devolving, if you will, to public health and issues there. One of the things, one of the messages that we'll probably go back with is how the National Association and the local affiliate can support and sustain one another in terms of our dissemination of information, our public health advocacy work, and so forth. Hawaii is really leading, one of the things that I learned as a product of being here is why it truly is leading in some of the public health advocacy and policy work, whether it's with regards to the importance and the communication of the importance of the impact of climate on health, or whether it's what you're doing with tobacco and the agent folks are able to purchase tobacco or sugary drinks and things like this. You're setting an example that is so valuable for the rest of the country, and I will do my best to always give you credit for that. No, thank you for that, thank you for that. You know, you can do medical research online for sure, and you can study and see photographs and movies and charts and graphs of people doing medical research from public health research all over the world, but you know, it's different when you get to see them in the flesh, when you get to shake their hands, you get to meet, for example, the state health director of Virginia Pressler, because then there'll come a time, perhaps, when you need to talk to her, or she needs to talk to you, and when you make that call or send that email, it's different when you have physically met her, no? Well, and you've really described it just an absolutely critical point of public health, and that's the relationship building, and whether we're dealing with, in my case, in my day job, I mean, my involvement with APHA is voluntary, but my day job, I'm a health commissioner in Marion, Ohio, as Ethan was saying, and it's all about the relationships, whether it's relationships between the health officers and the health department and the community, because if we go in and we have the answer, it's the wrong answer. We need to get that answer out of the community, and that involves a relationship, or whether it's a relationship between the public health associations or between, again, my opportunity through my public health association to meet people like the state health director who under any other circumstances, the health commissioner in Marion County, Ohio, is not ever gonna meet the state health director of the state of Hawaii, and you're absolutely right. I can send out a group email to every state health director in the country, but I know that I can pick up a phone and call your state health director and say, hey, remember when we had lunch at the Tower Marketplace, you know? Great word and beer, you know, so it's a big deal. Well, Ethan, we're almost out of time. I'd like you to close. I'd like you to tell us how you really feel about Christian Gloria and how you really feel about Tom Quaid and otherwise wrap up our discussion today. Should I leave for that? I've been so, really, I've been totally amazed and pleased to be just a small part of this conference and have the honor of meeting Tom and the pleasure of seeing all of Christian's hard work as Christian was really the driving force to organize this conference. So it's been really wonderful to see this. See, it's all come together, see the different groups get together and talk and exchange ideas and hopefully some real good collaborations will grow out of it. So I think it's been a great win-win conference all around. Thank you very much for being here, Tom. Oh, it's been my pleasure. Thank you, Tom. Thank you, Ethan. Aloha, you guys. Great conference.


ERA A5 is a major upgrade from ERA interim, providing improved meteorological forcing quality that will enable a new generation of land surface developments and applications. This article was authored by C. Albergil, E. Dutra, S. Munir, and others.


That's the one we've been waiting What's going on guys welcome to another video first day of this practice today if you guys saw the update video and you guys know that I did not fish yesterday just because the weather conditions is like and really bad. It's really rough So therefore we didn't really get to fish but today's the first official day of practice Alan out here. I actually threw a clearly like first cast literally right by the bank and caught a fish right So pretty much through first cast right by the bank and just caught one right away I should have been a recorder. It's just like a two-pounder there, but later like second cast I'm just messing around while he's fixing up some stuff, but we're about to start this day off guys We're not gonna be catching mini fish today. This is a practice day one and done on every spot Let's see how this day goes. What's up guys? Well, I'm editing this video right now very ticked off right now because all right So we had two days of pre-finish we had first day and second day the first day I call on more fish You know I was trying out new spots I pull up to a spot and to make the first cast catch fish move on da da da I did pretty much was out of town is after you know I went out fishing what I would do is I would save all the video on to into a folder So I'd say like day one of practice or day two I put all like the files in like a folder. Well, this is like a week and a half ago I'm just not getting to edit this video because it's a very long video after edit Literally a whole day one of practice is gone and it was literally here about a week ago Let me show you what I'm talking about. Well guys as you can tell all right, so So I got this seminal folder right here. I opened up practice day one practice day two Well, when I open up practice day one, I had two video cards because I ran out of space on one of them. So this folder right here was Actually called card one and it had all pretty much all my footage in it the second card only had like a few clips on it and Literally nothing is in here like All gone and the crazy part is it was in here about a week ago because I actually saved a few screenshots Like this this is from literally Practice day one Like I literally saved screenshots from it and now literally everything's gone So I guess we're not gonna be doing practice day one I do have a final clip where I met up with a few buddies that I can show you guys real quick guys That sucks. I really apologize for that But that really sucks because I like a lot of good footage in that I still have a good bit of footage in practice day two Not all the fish catches on film but I believe I do have a handful that I did film and I am gonna show you clip from practice day one because it is the One clip that I have and it's pretty much my buddy Christian and Hunter He was fishing a high school tournament. He was out there practicing. He's a big fan of mine for a long time I actually have like pictures with him like years ago where he actually came up and met me and everything and Christian was out there fishing with him and they really wanted a cool picture So at the end of the day we met up and held up our fish So I'll show you guys that says pretty much how practice day one went for me and Alan and Christian and held up some of their fish as well I really apologize for that but we're gonna hop into day two and you guys are gonna watch that footage as well But I hope you guys enjoy the rest of this video. Let's get to it right now Me and him are tall, so you think you can see us all from right here Should have been don't make another pretty little fish you release them you look at it You can just tell there's a split If you're having trouble with it twist it to where that split is where the hook is Straighten trailer back there run at a run better Little chunky guy nothing was shallow. That's one. We've been waiting. That's what you call a fish, right? Fill your buddies Oh my god, dude, he was joking on that thing. I thought you were All right, we got a yeah, we don't need to hit this all of this is good, you know I thought that one this morning over there I'm thinking of This could be like our third spot Right there All right guys, this is a low down right now. What's going on? I Just put some cheaper out chops on these hooks were already rusted. I just snipped them right off Um, I didn't even do anything. I'm gonna cover some water with this as you can tell nothing on there If you guys are wondering why snips off my hooks island and same same thing you guys are wondering why I snipped off the hooks We literally can't afford to catch any more fish, you know we're just hurting her fish for tomorrow tomorrow is a tournament and um, I Really wanted Alan to catch a fish so we kept on fishing and um, that's that's that's what it is So we're gonna see if we can get some more bites We really think we're figuring something out right now, so we're just gonna keep on moving keep on duplicating these areas Hopefully we'll get on them tomorrow Thank God. Did you see that? That was a big dude. Don't even we don't need this Did you see him run go you heard it in my rod? Right when I said that oh That's strappy rods. I'm gonna take this over there. All right guys, so that is just the gist of this video I really wish I had that day one because we had a lot of good fish on camera had some decent weight And I did not we had a lot of other fish like we shook off I didn't want to add all this because I'd rather not make this a 20 minute video and Just for like if you guys don't know if you if not if most of you guys aren't like avid tournament anglers The reason why we weren't hurt hooking those fishes because it's the day before the tournament The main reason was the first day of practice Which I'll also the footage for Alan ended up not catching one and God, I wish I had that footage. I'm telling you guys. I had probably like 10 10 on camera God, I wish I had that but Alan ended up not catching one and I wanted to gain his confidence up It was his first bass fishing tournament his first time on a bass boat So I really wanted him to know gain some confidence and you know catch a fish or two And you really feel confident what he's doing so that second day we went out there and you know max I really wanted was five bites and you know got him to catch that one after that You know, we decided to cut off her hooks and we started throwing worms as well Just it's easy to pull out of their mouth and bury that hook good in that worm And that's pretty much why we're doing that Well, you know, you don't want to sort of lift your fish a day before the tournament I usually find new areas if I catch one, I'll leave that's just usually how it is I'm not over there beating the fish up But guys if you guys enjoyed this practice tournament video Be sure to smash that like button be sure to comment below and let me know what you guys want to see out of these tournament Videos because I want to make these you know tournament series videos again because they're so they're so good in my opinion There's a lot of value in them and they're really fun to watch as well But thank you guys so much for the support really means a lot and our next tournament is on Lake Gunnersville Which is March 3rd I want to be filming a lot of that term as well But thank you guys so much for support be sure to like this video be sure to comment below what you guys Want to see next be sure to subscribe and hit the little bell and I'll catch you guys in the next Please like this video, please comment below your goals for 2018 I want every single one of you to comment at least one goal and I want you guys to go Execute and achieve that goal. Don't be normal. We're gonna change the world guys. Thank you guys so much for the support I'll catch you guys in the next


The abstract background of this paper discusses the ethics of conducting clinical trials on selective digestive decontamination, STD. It then goes on to describe how the results of these trials have been inconsistent, leading to the conclusion that there may be a spillover effect from STD that could cause harm to patients. This effect has not yet been proven, but if it exists, it could lead to serious consequences. This article was authored by James C. Hurley.


Food tells a story of each one of us, who we are, where we come from, how we live, what we believe and who we will become. Our actions today have an impact on our future. It is time to take action. We all have a role to play in improving production, nutrition, the environment and our quality of life.


It's called the animation minute. It's going to be a weekly release where I summarize all the cool things that I found within the animation industry. And this will be covering Twitter and Instagram and LinkedIn, but usually I try to keep it on the Twitter sites that people have direct access. If it's on LinkedIn, you might not have a connection there. And the way I'm structuring is that whatever I see during the week, I put a like on my Twitter feed. If you go on my Twitter, you can see all the likes is basically a summary, kind of like a bookmark of all the cool things, but it was kind of lost within the long Twitter stream. So I wanted to do something where you can always check it out visually with the links. So every week on Monday, 8am, I'm going to post my weekly summary. And sometimes you might see a tweet where it says whatever date that's earlier, but I saw it during that week that I was looking at and then I was retweeting it and liking it. So for me, it's what I saw during that week. If you see a different date, then that's because it was published earlier potentially. I hope you like it. I hope it's helpful. It was a lot of fun to do. We'll see how it is developed. So I'm going to tweak it, but for now, check it out. Let me know what you think. Comments are open. I'm curious what you think about this format and the content. And that's it. Just want to give you a quick summary of what am I doing. And I hope you stick around for all my other content. Thank you.


Hi, everyone. As you can see, I'm Eroslav Desnik. If you don't know me, I'm working at Red Hat for the Product Security Compliance and Risk Team.  So, and what I do, I cover the government certifications. So I will explain you what government certifications are about, but I will also talk a little bit about the commercial certifications and other stuff. You can see I call this, you know, talk from security to compliance and back. I will explain why because one thing is like, you know, I will try to answer is if compliance really, you know, leads to a better security and if you have this, you know, security and you are compliant, if you are good or not. So I will try to answer this question and you will see later. I had a very similar talk, I think like two weeks ago and after the talk I was told that it's pretty depressive topic.  So I'm trying to hide all my gray hair under the cap because compliance is not easy and you will see it's not easy. Yeah, so what we will talk about is, the first thing is now I will try to explain what compliance is and not only what it is but why we are doing it because it's important thing to answer. We will talk a little bit about commercial certifications, more about the government certifications because it's where I live and then we can stay here for, I was told this is the last talk today so we can stay here by, I don't know, 10 a.m., sorry, 10 p.m. and people have enough to talk about. Then we are in the EU, so there is some new regulation coming in the European Union so I will touch that thing too and especially this is a developers conference so I expect people are more like this, looking into another practice, how to do things over a noted theory. So I will try to give you some, you know, like overview. Okay, more people are coming, welcome. So I will try to give you more like, you know, these hints and tips, what to do, how to do things, like I think I do this for like eight years now so I believe I have a pretty, you know, good understanding what needs to be done and then at the end I will try to answer this, you know, question, does compliance leads to better security or not? That's the question. Okay, so first, why we do some compliance, why we do try to comply to some standard, it's in the word, we need to comply to some standard. There are, you know, like different ways, how can you look into this is like, you might be forced by your customers because customers wants to see the stamps you have and if you have more stamps, then it's kind of like, you know, competitive advantage over your competition because you have, you know, more stamps, there might be legal reasons, especially, you know, like recently you can see there's a lot of like supply chain attacks, vulnerabilities, hacks, whatever, you know, data breaches, the regulation is getting stricter and stricter, not only in Europe, not only in US everywhere, so there are executive orders by White House for supply chains attacks and so compliance is becoming not only like nice to have, you know, to be able to compete with your competition but it's basically like the legal requirement. In the past, it was okay to wave, wave it like, hey, do you have FIPS? You know, we don't have FIPS yet, so okay, we want your product to use, we will, you know, wave it. Now, it's impossible, almost, because everyone, you know, cares about compliance and everyone will check that you comply to the standards that are required for procurement and you will not get to the list like the, for example, the government list, this is the software you can buy.   So, yes, I'm trying, you know, to collect Pokemons. These are my Pokemons. Okay, so then you have like this, you know, different certifications. You can take a look on certifications from different angles.  I will talk a little bit more about these, like the ISO 2700, it's SOC, PC, IDSS and other things. Then you have this, you know, government-securated certifications. So we will talk about common criteria. We will talk about FIPS. So we will touch briefly FedRAMP. Then, of course, it's not only about, you know, security, but you have the other compliance work. Again, we will show something like VPAT, USGV6, maybe more. Then, of course, you can take a look on this from, not only this, you know, like commercial versus government certifications, but also like a service or process certifications compared to product certifications where you certify a product. Sometimes it's, you know, kind of like combined. I will tell you more about this, you know, FedRAMP, because to have FedRAMP, you need to have FIPS. So even if FedRAMP is more like the service-oriented certifications or even not certifications like audit, then you need to have this product certifications underlying that deployment. So this is for different certifications. And yeah, the talk subtitle was, you know, global overview. As I said, compliance is now required everywhere. So these are just, you know, a few countries. I would probably be able to fill in this map with all different, you know, acronyms. So for example, in the US or North America, it's usually like FIPS, CC, FedRAMP, Australia, there's IRAMP and other regulations. In EU, we will talk more about this with EUCC, the Cyber Security Act, Cyber Resilience Act. I could probably also put like, say, Asia, with, you know, South Korea, I know they do CC a lot and everywhere. So the map will getting, you know, fuller and fuller over time. And it's becoming, and of course, you can imagine that if, you know, EU is going to do something different to US, do you have to do both? Yes, you probably have to do both.  That's very common that, you know, these standards conflicts in, you know, many ways. So it's going to be interesting and it's becoming worse than ever.   So recently is the ISO 2700 family. So there are, you know, several standards. The 2701, 2717, 2718. So it's basically an international standard to manage information security. It's the original 2701. And for the 17 and 18, it actually adds something more to this. So it's more about, you know, the cloud service providers and the 18 adds the privacy and the data privacy to management, to the cloud. So it's pretty common, almost everywhere.  So this is one of the, you know, the big commercial and it's not a product. Certifications is more like, you know, this, you know, service slash process certification. Then the SOC, the service organization control. So this is the voluntary one again. More commercial by the American Institute of Certified Public Accountants. And they're like the five areas, this, you know, SOC is looking into it. So security, availability, processing integrity, confidentiality and privacy.   But I will move to my realm so you can see I'm now smiling because it's what I know. And as I said, I can talk about this for like weeks and it will not be enough because it's pretty, you know, difficult to pick. So I will start with common criteria. I really like this one because it's called common. It should be like, as I, you know, there was this, you know, global map. It's like, yeah, we have a common criteria, certifications, but it means it's going to be common. No, it's not common at all. US is doing something, Europe is doing something, different requirements, the mutual recognition. There are, you know, some issues and so on. So basically common criteria should be that international standard, the big one, as a framework for the computer-securated certifications. We are already facing some like a division in this, you know, common criteria thing. So I personally call common criteria like a split criteria because one thing where the split is there are so-called two ways of, you know, how to do these certifications. One is the EAL, the evaluated assurance level, kind of like with the custom security target and there's also so-called protection profile-based common criteria evaluation. What does it mean? As you can see, I will try to, these are, you know, SFRs and ARs, the security functional requirements.  It's like, you know, these, you know, ciphers are used, TLS is used in this, you know, way. Secure boot exists and is tested for secure boot, whatever.   So you build your own EAL certificate, security target. I will talk, I will show you a security target later. But protection profile way is doing it different way. It's basically like a template from these SFRs, for example, for operating systems.  And you have to follow it strictly. That means in this EAL, if you realize that you don't make one of, you know, these SFRs, if it's not something that would probably, you know, make the government angry, you just, you know, remove it. We don't care about it. It's probably not, you know, that's secure. So just, you know, remove it. With protection profile, you need to make it, you know, like 100% pass of what's in the protection profile and what needs to be tested. Basically what you can do, for example, we do certifications with NIAP. That's in USA. NIAP only recognizes the protection profile certification. So if there is, for example, for operating system, there is a protection profile. But for some like other, you know, let's say, you have containers, there is no containers protection profile. So the only option is, you know, to go to Europe and Europe in Europe, we still do EAL. Or other option is like, where is, even like the virtualization protection profile, but if you don't fulfill it, you go to Europe. And Europe is going to be okay. Yes, don't worry, we can, you know, get you a stamp. Even you don't have everything from the protection profile. Then there are, you know, two main documents. Or the main document is security target, but actually no lists. How your product, you know, fulfills these requirements. I will show you later how this looks like. And then important thing is the single target of evaluation. That's basically, you can't certify everything. You need to, you know, make that, you know, target of evaluation as small as possible, because then it's easier to pass the evaluation. For example, the nice example is like there.  Some kind of like that remote webcam. And the target of evaluation is like, yes, the webcam is part of the target of evaluation, but it can be connected to internet. That's, you know, it's easier, you know, to certify something that's not an internet, connected on internet, but if it's a webcam, is it useful? I don't think so. So basically what are you doing? What do we know this testing? There's a lot of documentation that has to be written.  If you want to do Common Criteria, first what you need is you are the vendor. You need to hire an accredited lab. That's some company that's accredited by the government that they can, you know, do the testing. And then after they, you know, finish testing by the documentation, they send it to the certification authority. From this, you know, like labs, what you can, you know, we can hire AdSec, you can hire InterTech, Acumen, LightShift. These are all labs we work with in the go summer. Then you have different, you know, national schemes. So that means NIAAP, the BSI in Germany. I have a nice story about this one later, OXIS in Italy.  If it will happen, I don't know.  There is some kind of like the Common Criteria Recognition Agreement. So you can see these are the certificate authorizing members and the certificates consuming members.  So you don't have to do it in every single country. Of course, there are buts. Different countries have different requirements on what is, what requirements they have. And also this CCRA is now very limited. I told you about this EAL. So EAL has seven levels. But now you can do, for example, EAL4 plus, you know, floor remediation. And you want it recognized by other country. No, it won't be recognized because the EAL4 will be, for example, recognized in Germany. But in any other country, it will be recognized up to EAL level two.  And trust me, you don't want to do anything that's above EAL2 because, well, EAL4 means someone will come, you know, to your site and they'll be doing this, you know, audit, like I told you about the badges. Then they hear, okay, so you have another office? Yeah, we want to visit that, you know, another office. Yeah, in another office. Yeah, you have servers in another server room. Yeah, we want to see that, you know, physical server you ship your software from. So then you can have like, you know, I don't know, five side visits everywhere, especially for companies like Red Hat. We are a global company. We have offices everywhere. And then they realize, okay, you have remote people? They are working from home.  So this happens. And I can show you how these, you know, where you can find more information. So let's try this way. Yeah, so there is this, you know, commoncriteriaportal.org. It's the standard, you know, government kind of a, you know, website. It should be designed soon.  So for example, let's go to operating systems. And you will see that there are, you know, different operating systems certified.  For NIAP, for US, it's called product compliant list. If you are not on this list, you have bad luck. So make sure you will get there. And basically, this is the same, same one, just for, just for US. You can see, for example, RAIL 8.2. If you click on it, you will see the certificate, the security target, that's the document I told you about. Interesting document is this, you know, administrative guide that actually explains how you should configure your product to be in the, you know, evaluated configuration. So it's a target of evaluation. Again, everyone, you know, tries to limit this to the smallest footprint and do some additional hardening and so on. So this is how CC looks like. And let's, let's continue. Now, yeah, I can see a lot of, you know, FIPS people in this room. So there's another standard. It's called FIPS 140-2. Now it's 140-3. So it's a federal information processing standard publication, 140. Now we have this, you know, 140-3 version. It's pretty, you know, recent. Formal, it's the North American standard, but it has now the ISO. So they try to, you know, make it ISO standard. Trust me, it was so difficult to get this, you know, ISO standard to PDF copy. It took us, you know, several months to get a copy. It was probably better when it wasn't standard at all. And this is all about the validation of cryptography.  It's under NIST. It's like a U.S. Meteorology Institute kind of thing. I was at one talk and they told me, or actually at the talk that the person said, hey, we are NIST. We know how to measure steel. We are the guys who measure steels.  So they are like fighting, you know, what they should do and how they should do things. And basically what you'd certify is not like a product as well, but you'd certify that, you know, cryptographical primitives or Cypher suites that are in that, for example, library or some hardware module like Ubiqui, whatever it is. Jump to this. One of the things that FIPS is slow, it's challenging because of, you know, many requirements. It could be difficult on both engineering side and financial side. So it's definitely not cheap from the, you know, like investment perspective. Just, you know, to give you how slow FIPS 140-3 is. So in the past, I think like it's mid-June. So in these almost six months, NIST was able to issue only one FIPS 100-3 certificate. And they have another like 146 in the queue. So basically I believe I will retire before we will receive all the certificates we need. So that's one of the challenges there. Then there is a document called security policy that basically explains, you know, how you should use that module in the compliant way. That means, you know, what API you need to use, what algorithms are actually approved and they're tested. And in Red Hat, we validate five cryptographic modules. That means OpenSSL, NSS, Kernel Crypto API, NuTLS and LibgCrypt. And we try to revalidate often. We tried in the past to do it with every minor release. But then I told you, like, it could be, it could take, you know, one year to receive that certificate. And then the lifecycle of the minor release is six months. It doesn't make much sense to spend money on that. And I will tell you more about how slow this thing is, but I have a special offering for you. So if you want fast FIPS certificate, talk to me and I can give you a certificate within a few weeks. I can. And now let's jump to something like that builds on top of it. You can see that we are adding things. There is like this big thing for basic any, you know, cloud deployment or cloud service in the US, FedRAMP. FedRAMP is the must, but US government will not talk to you and will not, you know, buy your cloud service without having FedRAMP. It's the Federal Risk and Authorization Management Program. So it's the US government program to complain that, you know, there is no standardized approach to security, assessment, authorizations. Continuous monitoring is a big part of that of cloud products and services. That's basically FedRAMP. There are several levels. You can have it, you know, tailored. You can have FedRAMP medium and FedRAMP high. Basically my understanding is if you don't have high, it's useless to some extent because everyone wants the highest security. It's always, you know, nice to have the highest security. Then, you know, there is no two ways how to do it.  That means you will, you know, find some, you know, US government agency and they will be, you know, willing to go through this process with you. Basically, in the end, it's going to be approved for use in this agency.  Then you have this, you know, another JEP route. It's joint authorization board. If this, you know, JEP approves your, you know, FedRAMP, then any agency can use it.  It takes more time. And so usually, you know, what people do, they start with some agency.  Instead of lab, these, you know, companies who do it for you are called free PAO. It sounds like from Star Wars. It's not C-free PAO, but for whatever reason they liked it. And this is that important part. As I said, we are building things on top of each other. FIPS is the requirement. It kind of like makes sense. Like we have a standard for cryptography in US government, so we should, you know, use it.  I will just, you know, quickly scan through this, you know, other certifications. One is the VPAT. It's for accessibility. Mandate it through this, you know, section 508, Rehabilitation Act in US. There is international version, and it's based on WCAG 2.0 standard. Then another thing is like USGV6. It's the testing that your network device or OS, whatever it is, is compliant to IPv6. I believe actually in our Czech government also, you know, like ask for IPv6 support, but nobody tests it in US. Yes, they do. Like, you need a stamp. Yes, this is my product, you know, works in IPv6. And now I talk to the lab and they told me, hey, we have actually a new test. Now there is a testing like it, it works for real in IPv6 only network. So it's going to be fun. What do you expect in the new? Yeah, I have a question. Who likes open source in this room? Not that many hands as I expected. I'm surprised, I'm leaving. Yeah, so what's going to happen in Europe? No open source, no more. Sorry.  This is the Python Foundation, Warns, EU, the Cyber Resilience Act, they all, you know, sync open source. Yeah, so what's going on in Europe? There are two things, the main things is like the EU Cyber Security Act. Under this act is, you know, EUCC, that should be the one standardized scheme for common criteria in Europe. The EUCS is for cloud services. So basically EU is building on common criteria based schemes. The EUCC is almost approved. The EUCS, it's not yet approved. Where was this, you know, private draft? It leaked, then after it leaked. So it costs, you know, like a lot of, you know, fuss in the cloud service providers community. So we will see how this will work. But this, you know, EU Cyber Resilience Act. I really like this subtitle.  It actually makes perfect sense, you know, that what we use in Europe, whatever it is, hardware, network, hardware, device, whatever it is, software is resilient to cyber security attacks. But the main problem here is like it puts, you know, too much liability on especially, you know, open source projects and how it could, you know, threaten open source project is that there is extension for non-commercial activities. So you can say, yes, open source, it's non-commercial.  So the question is like, is it, you know, extant or not? So for example, the Python software foundation, they say that they might, you know, turn off the PyPy repositories in Europe because they can be accountable for, you know, what's in these repositories. They can be, you know, fine.  That's one of, you know, the proposals. Well, you'll see, you know. So Europe is going to be interesting if you read about it, if you are open source enthusiast, you know, talk to your, you know, MEPs, your favorite MEPs and explain them that this can, you know, pass in this way because it would threaten open source. Yeah, so we are likely over time now.  So this is, you know, how long it can take. You can see that, you know, it could be like a year, two years, three years. So basically like all the work that you need to do. One interesting thing about NIAB is like, they are super strict. You need to finish within 180 days. If you don't finish within 180 days, you fail certification. Okay. So yeah, just, you know, one last slide before we will go to QA is these are the tips I promised you. One thing is like, get ready, be prepared but expect, unexpected. At any time, some you know, changing the standard can come. They are pretty frequent standard changes. The standards are strict, but often very subjective to who reads it. So one person can read in way, another way. So there's, you know, one big thing and of course, vulnerabilities. All these standards hates vulnerabilities in the process, for example, for CC and NIAB CC, there is rule that there can't be any known vulnerability at the time the product receives certificate. This is impossible. Like there's always some vulnerability somewhere. So yes, and in the window of 30 days, it's almost impossible to make it. Maybe one last tip, and I like this one, be honest with your lab, with the government. It's usually, you know, nice. So one of the replies I got recently when I explained to one of the governor, government guy, something he was like, instead many vendors are acting like embarrassed teenagers trying to pretend they don't have ACNE but by not talking about it. So be transparent, but also be careful because you don't want to know sometimes it's close too much. And yeah, yeah, so for the answer, does compliance lead to better security? That's no clear answer. It gives you a better culture. It adds complexity. So it could actually cause additional issues. And if you have time, I will show you this research by the Masary University. I can see one guy from the Masary University here and we can talk about it later. So are certifications useful? Yes. Should you have it? Yes. But you know, be careful. It can take time and it can be expensive. So that's all I have. Any questions? Do you know the European certification? So you know if it would be process based or...? Okay, so the question is like for Europe, is it's going to be the process based or more checklist based? It's Europe. So I expect it's going to be more on the process side because Europe likes processes. So yeah, US version is more like this checklist. Like you need to test this, this, this. If you pass, you are okay. In Europe, they will more be interested in going through this checklist. Usually for every certifications, you need to have some periodic certification. But the validity of certificates could be for like, for example, my app is two years. FIPS is five years, BSI is five years. So it depends country by country. Okay, any other question? The common criteria, certification, do they use the configuration described in the security terms or not? Okay, so the question is if customers requires the common criteria or certification and they will use that, you know, how it's described, how they should use that product. It depends. There are customers who care only about or maybe not customers, like people who care about the stamp. So if it has the stamp, they can, you know, you can sell to the government and government might be okay with just that stamp. There are customers who will read, you know, that maybe security target, security policy, letter by letter. And if something is not what they like, they will tell you, no, it's not enough for us. Especially this, you know, question is when, you know, for example, you have this, you know, certificate on version that has CVEs. Exactly. So I have to respond to them that they should use that, you know, certified version. If you know that remark, but you should be secure. So there is, yeah, I can answer you because it really depends. Yeah, you have to recertify, but again, it takes several months. There will be another CVEs. So I can see no more questions. So yeah, thank you for listening.


I was just crossing the road back there this old lady was crossing the road towards me and she dropped her hat in the middle of the road and she was struggling to bend down to pick it up so I literally had to stop the traffic I bend down and pick up her cap for her and then get it to link my arm to take her across the rest of the road you know what she was so so she hugged me she squeezed me she was so grateful bless her any one of us would have done what I'm telling you I did I think what I want to say to you is where can you create any small ripple of kindness in someone's life today kindness lives long