Hi, I'm Brian May. It is that time of year already. Just the sign of sprinklers can be some welcome relief from the heat. California saw our first near record temperatures this week and our first excessive heat warning. So what does that mean? Well, it means extended periods of extremely hot temperatures and very little cooling relief overnight, which leads to a high chance of heat stress or illness to the elderly, kids and animals. So how can you prepare for the heat? Well, some simple ways are drinking lots of water where light colored clothes stay away from strenuous outdoor activities during the hottest times of the day. Check on the elderly, kids and pets and try and find some place to cool off. Libraries and malls make great spots inside the National Weather Service Office in Sacramento. They keep a 24 seven watch on the forecast.  And I always joke that, well, you weren't, you know, you were yelling in May, it's so wet and cold when some are going to get here. Well, it's here. All jokes aside, Michelle Mead gets very serious when it comes to warning people of the dangers that come with this extreme heat. All activities outdoors, you should either do early in the morning or after sunset. And now that we're getting close to the summer solstice, keep in mind, sunset is close to 9 p.m. now. It's hot outside, so we want to go to the cool water. But the water right now is only in the 50s and low 60s. And that's about the temperature that folks can get hypothermia pretty quickly. And one last but very important piece of advice. As cliche as it sounds, remember, it really does only take a spark. If there is red flag conditions out or fire weather watch, don't do outdoor activities.  Anything can spark just a mower blade on a rock can send a spark. And you don't think anything of it. Next thing you know, the field next door is on fire. Of course, with the heat comes the increased threat of wildfires in California. And to that end, we are all going to be hearing a lot more about public safety power shutoffs, our PSPS. A public safety power shutoff is a preventative measure that the utilities take when there's forecasting for really extreme wind conditions and other types of weather that could be very favorable to fire conditions. And in California, we've seen some pretty catastrophic fires. This is a step that they're taking. Hopefully it's a last step to prevent a wildfire being caused by down power lines or other pieces of equipment that the utilities own. As far as what someone could expect with a public safety power shutoff, those conditions are going to be different for each event. So the power could be out for a matter of hours. It could also be out for a matter of days. And what we're asking folks is to be prepared for that longer term power outage because you may not know until it's already happening how long that power could be out. And they could potentially tell you a one time frame and that could get extended with very short notice. We're going to hear more about these public safety power shutoffs because it's a new step that the utilities are taking because a lot of the catastrophic fires recently have been caused by utility equipment in rural areas or in areas that are extreme or high fire risk. We've got a lot more information about staying safe during extreme heat events. You can go to caloes.ca.gov and look for the beat the heat town. For all of us at CalOES, I'm Brian May. Thanks for watching.


okay James P. Madonna here mega life 21 I'm here at the doll's zone and here's a great old-time cologne for men I use it as an aftershave only a dollar each Florida water okay comes in regular blue blue I picked an extra one of these lavender an exquisite extract of oranges cinnamon lavender and florals great value in my opinion or you hoity-toity snobs out there I feel you have to spend a lot of money on cologne and aftershave screw you saw your old morons prestige is all in the mind


Hello everyone, because this is a Linux Foundation event, so I thought I should do something fun and go through all the GitHub repos on JVAIs that I could find. It turned out to be an impossible task. So when I just went to GitHub and entered LL, I immediately followed 26,000 results. I was like, okay, let's try GPT, and it's even worse, like 100,000 results on GPT. So I had to narrow it down. So in the end, it decided to go and search for repos with at least five restores, and end up with 800 repos. For those who are curious, so these are some of the GitHub accounts where I can find the most number of repos on my list. So this is not, of course, they are like very regular suspect, as in the usual suspect like opening up Microsoft, and it's not a comprehensive list. I feel like if I keep on searching I probably can find more, but at some point you have to stop with those obsessions. So now that I have data, and the next thing I thought about is like, okay, now how do I run some analysis? And the first thing I thought I should do is to try to categorize these repos. And they thought, okay, how should I go about it? And they taught you a bunch of people, and in the end we said to break it down into like different layers of the stack. So as a top layer, then we have a lot of applications, right? First of all, chatbot, image, editing, and all of these like ridicule applications. You can use the phone or desktop on the browser. And then just below it is the, we call it the application development layer. So we call it like AI engineering when you would develop the applications for end users. And just below it as a model development is when you actually create output models, something like Lama or like other Michel. And of course there's always infrastructure that's where everything happens. Like, so for most of the layers you don't really have to know a lot about machine learning. So, but one layer is model development when you actually deal with the model weights and change model. But the rest of the layers you don't really change model weights. So for infrastructure, so some of the categories are like compute management, right? For example, like Skype pilot or like Hexville or like Ray or like inference server monitoring for more development, you have something like modeling and fire tuning. And this is where there's a lot of exciting things happening. And also like there's an inference optimizations like GGML, TensorFlow RT or Trident. And as AI engineering level, you can see like AI engineering framework like LangChain, GPD4, all Lama index. And then we would have a lot more of those as we go through the process. Oh, I think this is the oldest slide. But so when we try to like categorize breakdown like which number of repos, then we see this like most of the number of repos we found in the AI engineering and more development. But what has really surprised me is like the number of open source applications out there. Like it's very easy to go like whatever you want to do, you can pre-fight or get repos with exact, with the exact need and totally open source. If we can break down more further, it can show like subcategory. And I just thought I would go and show in detail like what some of these subcategories are doing. So one thing to know that really jump out to me is like the number of repos that related to like inference. So like inference optimizations and inference server. So these two categories are very closely related because they both solve for latency and cost. So like if you want to like solve the latency for the end users, you can either do it as a model level. Like you might want to quantize a model, make it smaller, faster, or you can try the new exciting techniques like faster decoder. For example, like Medusa is a framework that allows you to like use multiple decoders so that you can do faster inference, faster text token generations, or you can use something like look ahead decoding. Whereas the inference server is you deal more with something or like dynamic or sequential or continuous batching or some newer techniques. For example, like you might try to like host multiple LoRa's adapters concurrently. I can do something like packaging and loading of models. So I think a lot of the tools in either this category might also try to do the other because it's soon for the same problem. Another category that I find interesting is prom engineering. So when I talk to my friends that like so I actually recently went through like a list of like use case studies of my 22 enterprise A.I. use cases. And something that's like a lot of these case studies mentions is how challenging it is to like do prom engineering and managing prompt. So it was when I filed this repo, it was like, okay, so what are these tools that help you tackle prom engineering doing? So and I tried to break them down. And a lot of them tried to like give you less and be guilty. So like language models or like A.I. models probabilistic by nature. So like it's very hard to like guarantee like what's the output's gonna be. So like the input might change. So like of course you can set things like temperature equals zero. But for inputs that changes slightly, it can change the output very, very significantly. And for a lot of applications, well that depends on the certain format of the output. It's very hard to guarantee for that format. And OpenAI recently, it's a depth day or now the function calling to allow for, to make it a lot easier to like get the expected output structure for of the models. And a lot of the tools deal with for prom engineering deal with like structure output. And also another category, problems that prom engineering is solving for is the memory management. So in real world, like you might chat with a chatbot for a while and how to make sure that how can you keep updating the memory of the chatbot so that it knows what you're talking about. And we see a lot of application like that, not just a personal assistant, but also like in gaming, in educations. And it's a very exciting area. So when we go into open source, right? Open source is just not open source. Like you quote a lot of open AI recently, like open source is nothing but I miss people. So there are a lot of like, I was wondering like who are the people building on this amazing work that the today AI depends upon. So the first thing I thought about is like, okay, let's just try to break it to this account. So on GitHub, for each account, we can see like whether this account is an organization or an individual user. So it's like, okay, so like let's see like what is the percentage of these repos are hosted by individual account versus organization account. And it actually pretty surprising. So like a total of these repos, a total of the most popular repos on gen AI actually hosted by individual account. And of course, if you go through the different, different layers of stack and you see that's the level of the stack, the harder it is to build this by yourself. So originally it's like, can I do this alone? But I realized when you do open source, it might start it, but you never really built it alone because it can be the whole community built with you. I'm so good to see more. Here's a more of a breakdown by subcategory. So it's almost you probably don't ever see any tool like compute management, factory databases or data management built by individual. But for this category, you need a whole team to do that with you. And another thing I was curious about was this like, okay, so like comparing all the repos like hosted by individual contribute, like individual users and organizations, what's the status distribution is gonna be like. And it's surprising to me is like when I saw that like, oh actually the repos hosted by users on average I shouldn't have more stars and more forks than the repos hosted by organizations. Of course we all know that's like the cow of stars, not the perfect metrics for impact, but what this thing is is interesting. But then I tried to break it down by category. So it really depends on which category you are. So for, I play for most of the categories, it's actually repos hosted by organizations that have more stars and forks, except for like applications. It seems like it makes sense because you can see a lot of users spend a weekend view some really good applications and they can get very, very popular and then they can start like a company on top of it. So when I was going through this and just some things that I was worried about is just like, sometimes I see some people when will contribute repos, right? Like people really committed to their repos, like they started repos in this one should they work on it and they don't want to like contribute to other, but that was not the case. When I was going through the list of developers, so I was able to map out like 10,000 developers who contribute across 800 repos. And among them I found that's like a quarter of them contribute to at least two repos. And you can see a lot of them contribute to like a lot like 18 or like 15 or 10 repos. And when we're trying to plot this and I found that I couldn't plot the distributions of repos of like the number of like repos each person contribute to because there's one outlier. There's one person who contribute to almost 300 repos. And I was just like, who is this person? So I looked at that person up and that person actually contribute overall like I think over 2,000 as a repos not just in gen AI, right? And a lot of the repos are like smaller commit. For example, like fixing the typos here and there. But I mean like it's meaningful. And I think like what, so I found it's very educational for me to went through this person's like all the contributions and see like, oh, there are a lot of cool interesting tools that that person found and it didn't before. So I noticed like, this just made me realize it's like how easy it is for us to get started and fire repos and then make some changes to that work. Okay, so that is pretty much my work. So like my talk. So I have the full list like of all the 800 repos here if you want to like check it out more. I noticed like there are tongues that I missed. So if there's anything you want to add, please do. And I hope that you can find like on this list you wouldn't find some repos that can make the work or the life in the future a bit easier. And so hope that they can also like motivate you to maybe make a start. If you haven't already, I know that it looks foundation event so you probably contribute to open source. But I just want to say that like it's very easy to get started and contribute to open source. And I will see that a lot of the very impactful repos we see today actually started by individual and not organizations. So I hope that maybe if you haven't already also start building something and share that with the community. Thank you very much.


Hello, hello. Hi, Stani. Hey, Alon, how's it going? Hi, I love it. I was just commenting backstage. You're wearing the most finished outfit right with the speaker shoes. They're very traditional finished shoes. They're actually very finished and very comfortable. Yeah, which I think is on point because you're quite a local celebrity here that I've learned.  So, yeah, you have quite an amazing story. We're sort of old friends right now. We've known each other for a few weeks, which in the space of Web 3 seems like eternity. It feels like ages actually. Yeah, so you dropped out of school, high school, when you were 16. Then you like found your way to get a law degree, but that didn't cut it through you and you ended up starting what now is the fifth largest bank in Finland which, you know, by assets under management. Yeah, tell me about that. Like, how did you get into space? Yeah, I mean, kind of like, I would not say we're running a bank. Yeah, okay, we're not saying, yeah. If there's some... But yeah, we're building like technology that actually might be the infrastructure of the whole financial ecosystem in the future. And, you know, it also creates sort of opportunities to innovate for young people like me and I stumbled upon on decentralized finance in Web 3 pretty much by accident, mainly because, you know, I was just very eager to finish my degree here in Helsinki and I had a programmer background and I loved finance. I used to build FinTech applications where, you know, you innovate a lot of things in kind of like a front end of the applications and user experiences and in DeFi and decentralized finance you kind of innovate in the back end of the systems. And I wanted to finish my degree and find like something to write which is like tech, using tech and solve legal agreements and found like Ethereum and smart contracts and like my mind was just blown away like what you could do. And you also volunteered at Slush three times, right? Before now running a really impressive organization. Yeah, that was one of the, you know, best experience here, you know, in Slush and like I think my time in Finland as well. You know, I met so many cool people and it's just like it's all about like the culture and I pretty much like people who did talks here like I still like remember them and I feel them, so yeah. That's incredible. So let's get everyone on the same page and imagine I'm your grandma and explain whatever is to me and to everyone in the room because it's, you know, we know it's a P2P, it's a decentralized, I mean, it's a protocol running on the Ethereum blockchain. What does it mean and why should everyone in this room care? Yeah, I think the easiest way to explain Aave is that well, one thing Aave means ghost and finish but as what the product itself does it allows to grow your cryptographic assets in interest and why it's important is that, you know, cryptographic assets and blockchains pretty much are a very efficient and secure way to store value meaning that essentially because it's safe and secure you can store any value on chain and it doesn't need to be direct value but just representation and pretty much like one of the biggest storage of value at the moment is so-called stable coins which are representing the US dollar, they don't fluctuate like traditional like we know how cryptocurrencies fluctuate and that's pretty much one of the most kind of like popular things to do you have stable coins, you supply them into the Aave protocol and you earn quite a lot of interest compared to the low interest economy we have now in real life. So the reason people should care is that they can, you know, get their wallets, they can start using Aave and they can actually have much higher yield on whatever little or a lot of assets they own. Yeah, and I think it's more about opportunity because like it's nice that you have assets that are growing in their amounts and your earning interest because you're kind of like fighting against inflation but I think it's more about the accessibility to financial infrastructure because what decentralized finance does very well is that it just as a permissionless protocol, a network it allows anyone to participate. I don't understand permissionless protocol but I'm assuming. Yeah, well protocol means that, you know, it's just accessible. Protocol is accessibility so internet is a protocol, you know, domains are protocol so when you hit Aave.com in your browser, you know, there's protocols behind that redirect to you to a server and it's all like in short, like in Vep3 everyone is talking about protocols and it's very confusing but essentially it just means that it's accessible. So let's say that if I supply assets here in Helsinki, I live here, I have the same kind of like opportunity that anyone else is supplying from India or let's say Brazil or Argentina and we have like an equal democratic right into the financial infrastructure. And I think this is major, right, because like this space and I think we can talk about it in a second if these are right reasons or wrong reasons but has the PR problem, I think even talking about, you know, the social impact or like the, what is the impact of this space and what is the PR perception of this space, I think a lot of people are rolling their eyes and they're saying, yeah, it's a bunch of people like playing the global casino, people changing their avatars on Twitter to like a JPEG and like starting to communicate in memes and you know, I think some of that is probably justified. We can talk about it in a second but it is also true that right now we take certain things, especially when it comes to access to banking services and certain financial products even if they're not great for granted and there's many countries in the world where you just don't have access to that and like there's no way you can, you know, you don't maybe even have an ID to like register properly with, you know, so you don't have access to those services which I actually think there's a strong case for economic empowerment that it took me a little bit of humility to realize because I was very much on the train of, yes, crypto is extremely exciting, I mean, the space is moving extremely fast but I think there's a real question like which I would love to talk about, you know, there's a question of access and obviously bringing, especially globally which is like not something we think about all that much like people give that access to opportunity but, you know, I think it's all, I would love to talk about, you know, how you think about in general taking a step back from other, this space, you know, is it increasing global inequality or is it sort of, is it increasing access, like is it, like how do you think this space can evolve so it's actually this exciting tool where the claims of decentralization are actually going to play out in a way that's building a positive future for more people and not making, you know, the 1% have crazy amount of yield on the assets that they already have. Yeah, I think that's a very good point because like the part of all decentralization value is that you're working with a model where you are putting the network kind of like business model ownership to the users and we can talk more about that but essentially what you are trying to do is that you're trying to empower a lot of people but also give them the decision power of actually how these protocols will evolve in the future and I think regarding to kind of like how in fact all the technology is I think like there's multiple aspects there I think the accessibility is of course one thing but it's not just accessibility to let's say you know like financial services it might be stable coins that are built on top of for example Ethereum that allows you to if you're living in a country where there's a lot of inflation you can actually hold an asset that doesn't lose value on a constant basis but also it's more about letting the users and people decide what kind of financial services they want to actually use because the whole financial infrastructure is built in a way where I would say that you know it's based on consumers giving their funds to someone else to manage and everyone is focusing on their day time job and they expect profits but it's more about you can choose as an individual as well what do you want to empower so if you want to use particular protocol and be part of that community you can empower that way as well so the thing is that today we have more information as users we have the internet we have more data about financial markets and finances so we are able to manage it even better than the traditional financial ecosystem and decent as finance proves it quite well but I think there's still a lot of work related to if you want larger empowerment because we definitely see that these D5 protocols are helping if you have capital but then the next step is to help like how do we get all the billions of people more capital but whether it's actually useful to be a D5 F3 user we have actually a lot of examples where by using these protocols just by once or twice the projects and the founding teams are rewarding the users by giving them governance power and that governance power might be worth tens of thousands of dollars what are some of the examples like for the people here who I've never seen any of the airdrops I think the recent one was ENS so Ethereum Nain Service where if you took yourself an ENS normally Ethereum address is 0x like 1, 2, 3, 5x blah blah blah but then I could actually mask it by just having stunning.eth if someone wants to send me NFTs here so that's how you mask it it's a simple application and people can use it to send me NFTs or use it in applications in a programmable way but also because I created this and claimed this ENS domain I received an airdrop of being part of that community and these airdrops are it's a new way of taking the value where traditionally shareholders are having the value loops back to the users and letting the user decide how this most important infrastructure in the next internet are governed so I think it pays off to be a user I think that's an important I guess heuristic in this space that the user own networks and whether you care about finance and whether you care about DeFi I think we will see many more of those ways of how things are done in the web 3 how everything is done one of those ideas is that the user own networks so why should people care explain what does it mean and how maybe give me a good example of now we take a lift we never benefit from the fact that we take a ride but how does it work in ways of doing things in web 3 and why is that important normally how we see businesses being structured for example everyone or someone here I'm pretty sure took a Uber when you came here to the sludge from your hotel or wherever you were staying and pretty much you paid for that service but that value goes to the company and the rise to the shareholders well in web 3 the model is kind of different because for example when you supply funds into the other protocol on each every second you get governance power and with this governance power you control that particular network so it will be the same as every meter mile you take with Uber you get part of Uber equity and you can basically decide and participate in the meetings and why it's important for me especially is that because this infrastructure is very important for the future and I think when we are talking about finance we're talking about the most foundational protocols I think they shouldn't be governed by companies they should be governed by people who are using them actively this is why what web 3 is all about it's user owned networks and they become communities and they can be in a particular community because everything is code anyone can take the other protocol code for it create a better of it or if they don't like the way things are handled in the current governance they can create their own how is other user owned maybe explain like how like user governed yeah so example like when you deposit funds every second you get the governance power and you use the governance power to vote on changes and the other team can't go and just change the code and the code is the thing in web 3 meaning that let's say that if the interest rates want it to be changed or any kind of infrastructure how much the as a DAO so the community governance means and user ownership that there is a DAO decentralized organization that is collecting part of the yield from the activity and then using that for grants and improving the protocol and hiring folks so it's a new term that was introduced here I want to make sure everyone is on the same page a DAO a decentralized autonomous organization I'm sure many people already know what they are but for those of them I'm going to explain and then you can tell me how I messed it up it's this idea of a decentralized organization where there's no that's fully user owned I mean there's a future where it's fully kind of run by the code but I guess now and practices mostly community governance with a certain set of rules and the promise of DAOs which I'm sure you've all you know read about sort of on the high level is that people can organize in a way that's not necessarily a cooperative it's not a corporate sort of entity and a company and people can join and just essentially say I want to contribute in this way and essentially join start benefiting financially through their labor or through some other participation without anybody having to like formally hire them or so it's a new way of organizing and tell me about again like what I messed up about the definition and also what is the other DAO and how does the DAO yeah and how is the DAO involved in the governance there yeah it's it's very simple like anything any kind of a change that needs to be applied into the protocol it has to go to governance process so there is first fearless discussion in the governance forums and whether something should be done there's some part of politics related to that which is interesting to follow but also there's this attitude of like you know getting things done and you know making the protocol more efficient you know competing with other protocols and communities and ensuring that the users are getting most out of the protocol yeah and you know they come together and once the proposal goes on chain into the blockchain they come and vote with their tokens basically and always interesting as a protocol because it's cross-chain and there's cross-chain governance which is kind of a new thing that we what does it mean for yeah so you these interest finance and web three kind of was it started in Ethereum because it was like very active community and it had smart contracts but now the same you know infrastructure is a bit in other networks you know Ethereum is becoming very busy meaning it's it's becoming a bit more costly to interact with and now there's other networks so-called polygon avalanche and and and these are another communities as well networks are communities as dowels too yeah and the protocol has been deployed on these other networks and also the the avadao in other communities governing cross the different networks and normally why it's so interesting is because the networks do not talk to each other unless there's some sort of like a bridging facility and we have this kind of like a governance bridge that we created and I think like it's just about like different kinds of communities end of day yeah so we have maybe eight more minutes I want to make sure we sort of take a step back and also get back to the talking about how how some of the amazing intellectual and creative energy in this space and just the speed at which the space is moving can be used to solve big problems in the world and hopefully not contribute to too many new ones so speaking of dowels so everyone here and this is like it's confusing it's like oh my god like what are those things what about go join a dowel like find one that like you like you don't have to like be yeah like we all actually joined we're part of the same dowel which was a real world dowel called the constitution dowel and do you want to it's like a yeah do you want to do you want to say what it was yeah sure and also we can create the slush dowel you know if anyone wants to sign up I'm down for it too and yeah and yeah the constitution dowel I think there was this young kid came to our office so always you know if web tree community is very open you know people come to our office in London as well and you know work in different projects and one of this young developers Miguel was telling me that they're raising funds to buy the constitution of the United States and I was like well that's a good idea how do you plan to do that and he basically said that they're going to have a dowel where everyone can contribute to Ethereum and and then once they have enough Ethereum you know convert that to dollars and buy that constitution and the idea is that all the dowel members jointly owned the constitution of United States so a pretty simple idea just if you're if we're losing anyone here essentially it's almost like crowdfunding in this case people said there's this remaining piece of the constitution let's raise enough money so we can bid on it and we can buy it and then donate it to some place so it's not held in some private collection but it's displayed to the public and the thing that dowel was doing was pooling funds and then having a governance token where people would be able to vote what happens with that constitution so the dowel members would essentially be putting in money and then governing what happens so a very simple model of like what was the goal of that dowel and I think like they they were outbid by a trad fi so traditional finance guy my hedge fund guy which was a bit sad in one way but it was a lot of work to do to bid the traditional finance or get them to join us but I think like it proved very interesting point is that you know, Web 3 and blockchain are an interesting way to get people gathered together for one particular cause and this same like playbook can be used everywhere else you could use it to rescue some sort of forest fires in the same cause and have a joint effort and ventures so it's a way to organize and have kind of like a voting transaction that is on chain transparent and it definitely is a way to and dowels don't need to be like everyone needs to vote you can delegate the voting power to like a smaller sort of people that the dowel trust to make things efficient it's just a very very efficient way to manage kind of like the voting governance and capital together it's likely that there's already an issue you're passionate about there's probably a dowel that's trying to do something about it so there's dowels that are trying to like buy in all the sort of scientific research that like locked in academia and commercialize it for free so like you can be involved there and see what those dowels should be purchasing and how they should commercialize it there's like dowels trying to impact the climate and it's interesting because those organizations are managed in a very specific way using native tools of Web 3 and it's an amazing learning curve I think right so I know I want to talk about two more things that we chatted recently I know you're also excited about some of the universal basic income projects tell me about like how this space could be applied to you know further redistribute the global wealth and hopefully make a dent in reducing the income and equality I think like two interesting parts now like in terms of research that we're like doing it now and thinking of course is that one is social graph because that kind of creates identity and solve some of the issues in current social media social graph essentially the idea that like social graph or Facebook or Twitter right now it's owned by companies right you're trying to do an open public good social graph that yeah tell me yeah so currently you know if you go to Twitter you have 3,000 followers that you know are loyal to you and you want to port your followers somewhere else so for example there's another application that is getting traction they have interesting way to interact with the content and user experience you can't port your audience there but for example if you have something on chain meaning on the blockchain you could actually just create an application on top of this kind of like a public social graph where you own the content so let's say if a developer across the world creates an application on top of this social graph you come with your wallet cryptographic wallet you connect and you see all your audience there so it's a way to populate your audience but also kind of like create a bit of identity around you and the next thing we're thinking is that like how we can actually expand the impact of web tree and universal basic income is very interesting experimentation because it's you kind of contested properly in real life economy because real life economy is very fragile we're very scared to touch it which is very kind of smart thing to do because you don't want to experiment with economy we did that in 2008 and it didn't work out and in DeFi you can do a lot of experimentations so DeFi isn't just finance it's a big big sandbox there's protocols like everywhere we build for institutions like larger capital adoption but you can experiment a lot of things and universal basic income is a nice experimentation area because you can actually try to create some sort of a system where you know as you generate the cryptographic address you get daily income there if you subscribe to it and I think it's a way we can actually manage to do in a very scaled way because anyone can generate a cryptographic address any part of the world and if you start to receive funds there you know that's a way to empower masses in the future and when the reason it matters and I like I hope I just keep bringing it back to like the grandma is that a lot of people especially in the developing world they don't have a way to receive funds right now so there's not even an efficient way of sending them something right so there's many projects in that space and if you're excited about this idea of like hopefully people getting unconditional cash transfers just before because they're alive and just because you know that's the human right to have enough money to you know feed yourself and your family there's actually a lot of crazy positive energy in that space with quite a few really advanced projects that I think can finally make a dent I'm like the first time in many years I'm actually optimistic of like maybe the goal of UBI being achieved because of Web3 because of what's happening there and I don't think it was possible before and yes there's many very different things happening in this space but I think it's important for everyone who's like trying to make a positive difference to like not discard it and actually take it for like the incredible potential that it has yeah anything else we should like we should you want to mention I know Al is launching something early next year. Yeah I think we should really do this launch now I mean if anyone is into it I mean Drava today in one of the other kind of like parties and if anyone wants to talk like I'm very excited to build something like that they're throwing a most amazing party tonight so yeah if you're hope you can make it I think we're at time so this is this is about all we have but thank you so much for thank you for listening yeah thanks


My name is Andy Done, and this is Ricardo Salvetti. We work at Foundries.io, where we help device makers secure IoT and Edge devices to market faster, and then we kind of help them manage through the lifetime of their product.  It's Bruce Schneier here, Daniel Bernstein. All right, so if you're not holding your hand up right now, you're in a group of people where we probably shouldn't be inventing crypto or our own security ideas. So that's what this talks about today. How can ordinary people start to handle sensitive information on embedded devices? This kind of goes through a lot of different topics. So feel free to just interrupt, raise your hand if you've got questions. It may be kind of hard to have the context later on if you wait till the very end. So anyways, we're happy to answer while we're going. So the presentation is kind of one of those classic memes on the internet, how it started, how it's going. We had a customer that had what I thought was a relatively simple question about how they wanted to interact with the big cloud service securely. And the support question kind of, well, I kind of looked around and asked a support ticket and they kind of come back, well, you just need unencrypted credential file on a device to work with this. Now to be fair, I wasn't talking to their A plus tech support team. So maybe there was a better thing, but I thought it was kind of a more industry wide thing. This tends to have things boiled down to and it kind of drove me nuts. I think there's better ways that we need to do this and I mean, that's the mission of our company is to do these things better. So that's where we've landed on having this talk. Just before we get going on this, you know, some people may be like, well, what's the big deal about putting sensitive information on devices? And I don't know. I'm going to claim this is my own law of internet security. I'm kind of crazy like that and hyperbolic. But my bigger point is credentials always get leaked. And like sometimes you think you're doing something clever or you've got some idea of how you're going to make your device secure. There's just guys out there like Matthew Garrett who are going to see your device and after a couple of days, they're going to find that you are at your head or they're going to hook an oscilloscope up and start pulling keys off your TPM or something. So if you don't do these things the right way, you're just at risk. And some of these security talks kind of get bad. It's all like doom and gloom and we're all going to die. I will say on a positive note, I think our industry, we have a superpower. It's like how hard could it be mindset or, you know, in Texan here, hold my beer. And that mindset's done us really well. You get individuals that create some open source project on GitHub and they'll topple an entire proprietary software company. You know, we've done really neat things. It made us naive enough to create a startup company. So we do these and then we create a startup company and I was like, man, I don't like Jenkins. I'm going to create a better open source version of it. And I mean today it's like a backbone of our company. But when you start talking about security, it is hard in that how hard could it be mindset starts to fail us. Security is necessarily complicated. You can't really simplify it. You can kind of streamline security, but you've got to do a ride. A common thing, I work on software over the air update stuff on the client server side. So I tend to bump into people that have ideas for, oh, here's how you could do a secure OTA. I kind of love pointing them at like the tough specification. And all the things that they've gone through that you have to do to make it update reliable and secure. The point being, unless you're like a small handful of experts, you're attempted customer security is probably going to fail. So then how are we going to do this? I kind of hit a problem every time when you start talking about security is it means different things to different people. So there's a lot of layers to security and there's different dimensions to it. And a lot of times I see people in meetings and they're trying to talk about security and they're kind of talking by each other. Because you might have a hardware guy and his view of security is just like, well, I'm building this HSM and it supports these elliptical curve algorithms or you talk to the ops guy and he's worried about how TLS is secure between the device and the cloud. And then maybe you get like more probably the people in this room. Maybe you're more interested in the firmware stuff and you're talking about what are the keys for signing the bootloader and the operating system. But he's talking to the dev ops guy who's talking about keys for talking to TLS. So all of a sudden these words like keys and security can get a little bit confusing for everyone. So I'm going to kind of present some building blocks here. This is possibly my worst slide. That's why I kind of put this silly picture of Nick Jonas up there. There's some people that are going to be like, this slide is completely obvious, of course. And then there's going to be some people here that are like, well, this is too much information. So for the people that think, this is a little bit boring. Of course I know it, I'll give my sports analogy. Professional baseball players hit off a tee every day. So every now and then is like professionals. We got to look at some building blocks. So just to get us all level set here, I think the first like big building block when we're talking about security is public key infrastructure, PKI. I'm not a big fan of it. You can kind of see my snarky comments, X509 and ASN1. The good thing about PKI is this has been scrutinized and looked over for a long time and the stuff works. So to explain PKI just really high, I'll get into it a little more in a second. This is how we're going to establish trust between different entities, say devices and the cloud trusting one another. Once you have your PKI in place and you've got these credentials, you can start doing some neat stuff like encrypting things. Most people tend to, I think people will start with symmetric encryption. Both people share a key and you can encrypt and decrypt with it, which is okay. But then you get into some cool stuff, asymmetric, which we'll talk about. And then maybe even more kind of primitive to PKI is this notion of signing things. So you can prove that you're the person that possesses a private key. And so we're talking about all these keys and all this stuff here. All of a sudden, where that key lives becomes critical to your product. So this is where the HSMs come in. They're able to keep a key in a way that no one else is going to be able to see it. And then when you put all that stuff together, you make Nick Jones happy with his chef kiss. So here's a PKI at kind of a high level. You start with this root certificate authority. And this is again, as I start talking about this, that people tend to, we're talking about keys and certificates. They come together in what we call a key pair. Now your root key pair is going to be a private key. It's going to be some certificate that's signed with it. And it's going to have some metadata that maybe says when it was created, how long it's going to be valid, things like that. Because this is a root to everything you have, this key becomes essentially too big to fail. And I would say there's very few people who's like levels of paranoia aren't justified for protecting this key. Because this key is so important, you can't keep it around on computers and stuff. So you have to create what we call intermediate certificate authorities. These intermediate certificate authorities, they've got a private key and they have a certificate. And inside that certificate you can see, hey, that was signed by the root certificate. And that CA may have this ability to create other keys for people. Now we're talking about these certificates. The way these certificates start to get created and traded around is using these certificate signing requests. So the certificate signing request is a pretty simple thing. Like a device can say, hey, I need a certificate. Here's some metadata I'm hoping you'll put in it. Here's the public side of my private key. And that intermediate CA can look at it and say, yeah, I like what you want. I'll sign that. In the certificate, these things are okay to share around in the public. Because the way that certificate works is you do operations the only way that you, there's a ways that you can verify that person possesses the private key of that certificate. And some other interesting things like with these certificates you can start to do is say in that metadata, you kind of have a field in your X509 that says like who the owner of it is. You can start putting some things like say the device is UUID in there. And now suddenly a device is cryptographically pinned to that name. So as he tries to access things on the web and says, hey, I'm Bob. You say, no, no, actually, you're cryptographically Alice or something. And once we, oops, sorry. Once we get PKI set up, really the first place that we start seeing this use for embedded devices is with mutual TLS. So you've got this key infrastructure. Essentially everyone in your infrastructure knows who the root is. So then MTLS is a great way for clients and servers to talk to one another. So a client can talk to the server and say, hey, I want to talk to you. Who are you? And that server can say, hey, I'm this guy, I've got this TLS cert. And he can do some cool things with this private key to say, yeah, yeah, this is my cert. And the device can say, okay, you've got a valid cert. And it was signed by the root that I trust, so let's talk. Then the server's like, hey, but who are you? The device is like, here's my cert. And he's like, yeah, that's right, and I trust your root. So we're good to go, we can talk. The nice thing when we're doing embedded development, these mutual TLS is essentially widely adopted. Everyone has it, especially like these big cloud providers. So like Amazon, Azure, Google, they all have things, usually called like an API gateway. And you can give that API gateway your root cert, and then it can create a TLS cert, give you the, sorry, it'll give you a certificate, a signing request, you sign it. And then their API gateway can start handling TLS traffic for you that you've authorized. So you've never seen their private key, they've never seen your private key, but all of a sudden you've got this trust. And then if it knows that root, devices can just start magically talking into their services and trust them. The next thing that we tend to talk about, and this is where the talk started with was encrypting content. So symmetric encryption, it's not bad, and a lot of times you need it. But the thing that always makes me uncomfortable is symmetric encryption. There's a lot of people sharing this thing that becomes super powerful. So some really smart math guys came up with some other techniques for encryption called asymmetric. And this is pretty basic. If you know someone's public key, you can encrypt data in a way that only the person that possesses that private key can decrypt it. So this is pretty handy. This is something I like when our own customers are wanting to give us like sensitive configuration for their devices. They can give it to us, and I don't know the content of it. And if something bad happens, they don't have to worry. You don't have to trust the person that's hosting it for your devices. Only that device is gonna be able to do it. Just a little kind of pro tip on the bottom, this may be obvious to some people, but usually you're gonna need to kind of keep that config data on the device stored persistently. So keep the encrypted one stored wherever you want on disk. But when you decrypt that thing, because a lot of services are still gonna wanna read a file from disk, put that in tempfs.  And then here's something, as you start doing things the right way, you're gonna bump into this thing called ECIES. So asymmetric encryption for RSA, it's pretty well known, well supported common way. And if you're doing encrypting certain sizes of payloads, it's just slam dunk easy. The bigger ones, there's a couple of ways to do it, but it's pretty much a set and stone thing. Everyone does that pretty well. Elliptical curve is a little bit less so. And the thing is, you need to be using elliptical curves for all your encryption these days. It's a better way, RSA is not so great anymore. So the problem is how do we start doing encryption with elliptical curves? Cuz it's different than the RSA technique. So the standard has emerged called ECIES. I don't wanna go on like a standard ramp, but this is one of the standards where it's a standard, but they're not interoperable with one another. But they're doing things in a way you can kinda trust. So the experience I had in our product, we have this command line tool called FiOctl and it's written in GoLang. So I was trying to find a way to do this ECIES encryption in GoLang. And the first place at the time was Ethereum was doing this. And they have a small library in their overall Ethereum project. So we were using that, it works great. But I do get GitHub warnings on my repo all the time. There's a security issue in Ethereum. You've gotta update your version, and you start looking around. And it's not the encryption stuff that we're interested in. The problem is there's now an ECIS Go library that showed up afterwards. It works fine, but it's not interoperable with the way we do it. So all of our devices that have this encrypted payload that I can't now decrypt, we can only decrypt it with the Ethereum implementation. So it's just kind of a heads up as you start going down your own encryption journey. Now we'll get into HSMs. These things are really cool. Essentially some magic piece of hardware where a private key is done correctly. And the mathematicians have done really neat things and it all works. And with the HSMs, the ones that we kind of like and the more or less I think everyone does this. They'll support some common libraries. Like the main one that always interests me is called PKCS11.  And once you have PKCS11, and it's such a standard, things like OpenSSL, know how to use that as an engine, and if you're using OpenSSL, now you can use Curl. So you've enabled your entire ecosystem through this. And all of a sudden your device with this HSM with a private key that only exists inside this piece of hardware can talk to anything in the world in a secure way. So now I'm gonna hand it over to Ricardo to kind of give you guys the bad news about all this. So yeah, what I wanted to kind of cover is when looking more on the embedded side, as Andy was saying, you have the PKI and you're using asymmetric keys and you have all of that, you're using the best practices. But and even with HSM, unfortunately, life is not that easy because it's hard enough when you're already there. So it's simple because for security, it's only really strong as your weakest link. So you might have like HSMs, you might have a lot of protection, but if you have an open door in there, people can explore that. And from that on, you basically lose access to whatever that you're trying to protect. And this is also like something that Lena said on the keynote, and when they're talking about security in the kernel, is the only way to do secured right is to have multiple layers of security, right? Because in case you have an issue with one of the layers, there's always additional layers to be protected, right? So for example, using HSM is good in that sense. It's one layer, but there's also no additional things that we can do on the platform side on the embedded side of things. And if you see just security in general, embedded Linux, for you guys that are around for several years and have been working with products for embedded related products for more than 15 years, is that security is not taking seriously at all most of the times? And it's just really bad. It's not something like as we're seeing on these conferences, the cloud is pushing ahead and trying to be more protective and having new methodologies and so on and so forth. And it'd be kind of delaying the adoption on the embedded side of things. And it's pretty common for you to see devices, for example, that are using root by default, exposing UR to data being exposed. Things not signed, SSH running by default and services exposing ports and things like that. So yeah, it's pretty bad overall. Of course, we're improving and we're trying to improve the idea of this presentation is to kind of show some lines of the things that it should be concerned with. But yeah, it's pretty bad. And then looking at the platform and the DOS side of things, things that it should be concerned as well, like additional layers that it should be concerned with your final implementation. There's some that are pretty simple. For example, making sure that I have secure boot, in the sense that the hardware is only capable of booting images that is signed with your, for example, key with the product owner key. That is one kind of protection. The other thing that it can do as well is measure boots. You can measure, after you boot it, the only thing that you know is that it booted a valid image, but you don't know if there was compromise or not. So there's ways that you can measure the boot. And with the measured data, you can even perform remote attestation. That is something I said, for example, what you could do is that you have secure boot, you have a bunch of things that you added in there. And if the device is trying to reach, for example, remote server, you can ask the device to attestate itself. Right, so show me what is actually running. And if it is not matching with what would be expected, you can block the device, you can disable the device. So you add a new kind of layer, even though you might have HSMs and so on. The key might not be, it might be able to extract the key, but someone can still sign if it has control of the element. One other basic thing, the disk encryption is something else that is not that common, unfortunately. If you see a bunch of devices out there, it's pretty easy to extract content from the MMC and so on. So there's also a new level of protection that it can do. You can also attach, for example, of course, with disk encryption and any sort of encryption that you have, you need, of course, to control the key. There's ways to bind the key into a secure boot or whatever secure element that you have in there. So you don't actually leave that key as well. So that's another good thing to do. And just general hardening and surface attack reduction. Of course, if you're not familiar with thread model, you should be, for whatever product that you're designing, thinking of the thread model and all the things that are exposed on that device and just try to reduce the most you can. For example, you are, maybe you need it, but maybe you don't, then you can easily remove JTAG, for example, it's a big issue. If you don't block that, people can easily extract things on memory that are on the running system. And just one minor thing, for example, maybe on the application, we have the OS, right? But let's suppose you're thinking now about the application. One thing that's common thing these days is to try to contain the application, for example, in a container, and there are several different methods of doing that. And Sergio Prada is doing a presentation covering security aspects on the container. So it's something that if you guys want to have a look, I suggest going there on Friday. And even then now, just talking about HSM, even with dealing with that HSM, you need to know and be aware of some good practices as well. Like as I said, hopefully the key is not, you're not going to be able to extract the key. Even by having physical access to the hardware, but there are things that you should be aware of. Like for example, how do you do the communication with the element? Are you encrypted in the communication? So there's actually a protocol called the Secure Channel Protocol Tree in which you use to start to establish the communication with the secure element, and you can encrypt that communication. Of course, there's the key that is used for doing that encryption, but I'll get that in a bit how to better handle that. The other thing as well is reducing access to the element. So you don't need to give access to all the users on your system. You can reduce permissions for groups, or even through abstractions. Like for example, as Eni was saying, the Pikesa-Salavan implementation, the library, you can use that. You can use, for example, this other project that ARM is pushing for quite a bit lately is called Parsec, the platform of destruction for security. And the idea is to have some sort of like a service in which the service control access to the secure elements, like TPM as well. And then your application only have to deal with the service. So you can have multiple containers talking through that service, without having direct access to the element. And that service is no more responsible for abstracting the assets. And then you can have policies and so on and so forth. And the other thing as well, especially on ARM SoCs, you have the trusted execution environment in which you can run the Secure OS. So that's another kind of good abstraction that you can do is just have the secure S-take control of the HSM. And going a bit further into that, something that just covered some of the work that we decided to do, we had some customers that were really looking forward on using the NXP Secure Element, called SO 50. There's 51 now, which is why the X. And we decided to have the implementation in a way that you could abstract the access to the element by using and leveraging the trust zone technology. So that's something that we did and we worked with upstream is adding support in Opti to manipulate and take control of the element. So you would basically put the system and then the Opti, which is the Secure OS, would initialize communication with the element. And then all the rest of the stack gets, when it needs to communicate with the element, it needs to go through Opti. So you add a new level of protection. The good thing about that, you can extend the hard root of trust because when you're performing, for example, Secure Boot and Opti OS is one of the elements. It's one of the binaries in the OS that you start on the early boot, so we can't extend that as well. The encryption, as was saying, to the element, if you're leveraging, for example, the Opti and it does an implementation that we did, even if you want to encrypt the communication with the element, you need to store that key somewhere. So by using Opti, there's a nice functionality in which if the hardware provides a way to generate a harder unique key at runtime, you can automatically derive a key from that key and then use that key that you derived for doing the actual encryption. And this is nice because then you bind the element to the SOC. So if you remove the element, replace the element, the harder unique key is going to defer. It's not going to match with the element. And the same thing with the SOC. If you just try to replace it for abusing it, it's not going to work because it's just dynamically derived from the harder unique key. And the also great thing that we did, which isn't like we also help it a bit, like on the PKS-11 implementation in Opti, and then because we have this integration done in Opti, and Opti itself has a trusted library and it has a library and a trusted application for PKS-11, you can simply just use that library to, like an underneath Opti is going to use the element, but you don't need to know about that. And so it's transparent to the application. And then the PDF is on the schedule, so in case you want to have a look as well, like Jorge Ramirez will work with us as well, like he did a presentation a couple of weeks ago on embedded recipes, just talking a bit how the implementation was done, how the integration was done, so I suggest you to have a look at that if you're interested on the topic. And also like for any, like for any of these validated items here, like we could do a presentation in its own. So if you have any question in particular, if you want to look how we did, you know, like on our OS and so on and so forth, which is all open source, we can, you know, like get the details, we're happy to provide details there. Then I'm giving back to Andy. There we go. So yeah, I mean, NXP has a, as Ricardo was saying, they've got a pretty cool product called SEO 50, now the 51, you can put that on an embedded product right now and it works. They also kind of, they also have a really neat product that's called Edgelock to Go. And this is kind of a software as a service, I guess, offering that they have in the cloud that helps you manage keys. So, you know, the thing with PKI is how you're gonna distribute all these keys and stuff. And Edgelock to Go is this cloud service they have where you can start to delegate different things to it and it will create intermediate CAs. You can sign them yourself if you want to own that route, but then they have intermediate certificate authorities that can start creating certificates and hand them out to all the devices in your fleet that have these SEO 50s. So, you kind of, instead of building out your own like PKI distribution, like piece of software, you could like leverage Edgelock to Go if you'd like. And then like for me, I was doing with someone earlier, I'm trying to work my way up into the cloud and not have to get into the weeds and solder stuff anymore. So, SoftHSM is a project you can use on any device and it acts like an HSM, but it's just pure software. So, it's a great way to prototype stuff. You're trying to make sure that like, you know, theoretically things are gonna work according to your assumptions. And sometimes people ask, well, what about my RPI? And this is just kind of my snarky. You can have an RPI or you can be secure. You gotta pick one though. It's not gonna work for you. So, now we're kind of getting to the end of summarizing things. There's some things that we can start doing to be secure with our devices. So, use Mutual TLS. And once you have Mutual TLS sorted out for your fleet, you can keep those keys in your secure element. And now that we know your device is public key, we can start giving it like configuration data, however you wanna manage that for your fleet. You can encrypt that asymmetrically in a really nice way. If you're using third-party systems, like I was saying earlier, the good ones all support Mutual TLS hooks for doing whatever you want. And then, as like Ricardo was kind of talking about earlier, like we can start building our software trust from the hardware root of trust and work our way up. So, we go through all layers of the operating system as we're working on this. And things we can stop doing. So, let's stop putting stuff in clear text on devices. There's ways that you can prevent that. So, we have to look at that more seriously. In particular, Amazon, and I'll be honest, I'm not a big fan of AWS. I kinda joke that they're the cloud C++. And I mean that in all the bad ways of C++, but also all the good ways of C++. It's some really powerful stuff. That Amazon has their AWS IoT project, which is a pretty cool thing. And they have this process called just-in-time provisioning where using TLS, you can have devices just automatically connect into AWS IoT and start being managed there. It's a little tricky to do. At the risk of mixing metaphors, their identity and access management system, AIM, and in AWS is kind of their version of SC Linux. And it's really hard. It takes great restraint not to just disable SC Linux and do the right thing. But if you work through it all, and I actually, I had a lot of trouble figuring this out when I was trying to do a blog. So, if you wanna follow my blog there, if you ever get interested in AWS IoT, it kinda walks you through how to do it. And it's all command lines that you can copy and paste because the problem with AWS is their tutorials, especially anything with IAM, it's click this, click this, click this in a UI, and you never remember how you got there at the end. Now, if not AWS, like I say, and MTLS is supported by all the big players. And what I would do, now that I'm telling you, stop putting these credentials on a device, is my more generic advice is set up whatever your cloud provider is, they're gonna have some API gateway, set up MTLS on that. And then they're gonna have, if you wanna be one of the cool kids, let's do a serverless Lambda function where you can start accepting traffic from your devices. Maybe they'll say, hey, can you give me the temporary credentials to talk to this service? And that Lambda function can now give like, here's a credential, it's good for two minutes and then it goes away. So that's how I would start trying to think about like talking to cloud services in a safe way. And then Ricardo kind of added this toward the end of our thing is like, we gotta stop thinking of securities and afterthought. Like you gotta do this early on in the project, you can't bolt it on at the end. So that's everything that we had. If you've got questions, if you wanna ask a question, I can repeat it. Okay, yep. So the concept behind like key rolling would be like, you may remote out of state early in the root of trust or maybe for a device that has minimal or no network connectivity, maybe it has only one hardware root of trust. And then each, and then you subdivide the system into very small modules and each one contains the key that out of states the next one. And they're never the same, right? Like maybe you're using one style for this and like, right? Is that a waste of time in your opinion because it's a lot of overhead, it's a lot of work, but is the payoff there for all of that work? You may have to get up. Yeah, all right. Yeah, I might need to go into here. So I think so.  Like, of course, like it complicates development as well. It's annoying.  But I believe it pays off in the end because you have like so many different layers and like either abstractions and so on. And even if you have like probably one of them, you can still be kind of, you know, like conscious that nothing necessarily bad is gonna happen, right? But of course, like it's a pain. So yeah, but I think it's even worth it, no. You know, when we were creating our company, one thing that we kind of did early on was, we kind of took this mentality of things are hard. Let's just do it more often. And I think that's one of those things like, you will, it'll get easier if you just force yourself to do it. And we did a lot of hard things that were painful, but it's kind of paid off for us. One thing for example, as we did, like as we suggest to customers, like for example, even for secure boot, right? You have to fuse and so on and so forth. But even at the beginning of the development, what we suggest them is just create a development key, just fuse and play with it, get comfortable, you know? And then later on, you just swap the keys. You don't need to redo anything and you're more comfortable with the stack as you go as well. Any other questions? No problem. I was just curious, when you talk about disk encryption, are you thinking full system disk encryption or just focused on the like data partition, kind of the modifiable properties? So that usually depends on, if you don't need to hide anything, you don't have like proprietary, for example, information in the root file system, what we suggest is just not encrypted necessarily. If it is just like open source content and so on. But most of the companies, they are like concerned about leaking, even what they are actually using. So usually, what I see is that people want to prefer go like full encryption for everything, not only the system, but for the data as well. Of course, there's penalties in performance for doing that. Some devices offer, for example, an XP offers with the Cam, you can do like crypto accelerations and you can use that acceleration for disk encryption as well, to facilitate some of that. But then it depends on the kind of customers that it would have. But my initial thinking on this is that as long as you don't need to protect the IP, you shouldn't necessarily be encrypting, right? It just creates another layer of complication in a way. But at least we're all, of course, like for private data and so on, then you encrypt. A short one, what are your thoughts about secure JTAG? You mentioned that disabling JTAG, of course, is one thing that we should be doing. But I think that lots of vendors, lots of SOC vendors today offer some kind of secure JTAG functionality. Mike, did you ever play with secure JTAG? Secure JTAG is great if you can afford it. It can be fairly expensive if you, I don't know if you've ever looked into licensing of those units and how you use them in production, but if you can afford it, use it, it's always, it's another layer, right? You have another layer of protection. If you don't want to disable that, if you want to be able to recover devices in the field, then you can leave it enabled and you have keys to protect the JTAG access. But oftentimes it can be kind of prohibitive and you'll see as companies will only use them at the very, very beginning of their product development and then they very quickly move away to something else. You've mentioned a lot with using the Lyftical Curve as part of the encryption. And every now and then I get a flow down from the bosses of well, how do we start protecting against quantum computers? And I know NIST has a working project of trying to find the right algorithms, but is there a general timeline that you all have seen of when people have to start migrating from a Lyftical Curve to the next algorithm? I'm not up to date on that stuff. I tend to just go with what they're saying now. And yeah, so we do ED2551 high and it's like the kind of the curve people use. Yeah, usually at least like what we see is that, and at least like with the customers that we have there, of course they do want to protect the product and APNC but they're not that paranoid at this point of like because they're thinking of course like a product like five to 20 years lifetime. And in the hope of of course like we create something that you know like it's able to later on to resist to that kind of you know like attack. But which is why like one other thing you know like as a button and put it in the afterthought in there that you should start doing is like allowing decision to be updateable like from not only the OS and application but the whole thing right as well. Like even so much like for example the NXPHSM there's like I think like a Java based at OS that you can even update the OS itself inside the element. So hopefully you know like if you have the possibility of you know like updating the system at any point in time then once there's a solution you can try to roll it out. And then of course like create new certificates new keys and roll all of that. So yeah. I think we're out of time now. Can we take one more question? One more question? Oh yeah. Yeah. Could you please explain why you decide to go with Opti instead of trustee? This is first. And the liveries you use with Opti I guess you are unbatteless right? Or something else you do use? So we did Opti mostly because like we came from Lenaro and then like when we're looking at you know like the more kind of generic you know like OS for Lenox in general. You know like that was kind of the OS to go. So we decided to stay with that. Of course I think I don't remember if there's you'd be even using on Android these days. But so it's more kind of you know like the at least the one that we have familiarity we contributed before. So it seems to be coming you know like at least like for SOC such as NXP and Xilinx and even TI now like they're all supporting Opti officially. So we decided to go that way. And now for the library like for example what we use like you know like even with Opti there's a pkss11 based library that matches the trusted application and then we just use for example the open SSL like pkss11 engine and then it just goes through there. So we don't we don't necessarily have to do like a specific TLS implementation or embedded TLS or someone. We can just simply use in the open SSL engine for example. All right thanks a lot everyone.


Five African billionaires Forbes missed in its list. Five. Mary Oppenheimer's slack net worth 8.5 billion US dollars. Nationality, South Africa, Source, Mining, Inheritance. Four. Benedict Peters net worth 2.7 billion US dollars. Nationality, Manchuria, Source, Oil, Mining. Three. Femi-Otodola. Net worth 1.85 billion US dollars. Nationality, Manchuria, Source, Power Generation. Two. Rostem Aziz net worth 1.1 billion US dollars. Nationality, Tanzania, Source, Telecom. One. Tomi Elumeleu net worth 1.4 billion US dollars. Nationality, South Africa, Source, Banking, Real Estate.


This is Mises Weekends with your host Jeff Dice. We're not far out from the U.S. election next Tuesday, and Donald Trump seems to be coming back from the dead with even people like Michael Moore supporting him. What's the latest betting with six days to go on who's going to win the election? It's very interesting. We talk endlessly about this, and we get endless polls about this, which are increasingly, it's important to note that polling is increasingly an inexact science. The proliferation of mobile phones has really forever changed the way polling is conducted. So we don't have households in the same way we had households in 1980, and most pollsters are still operating in that same mode. So I question polls, but the other thing to understand is that the electoral college is really a unique mechanism. Only the United States has anything like it. So national polling is pretty meaningless. The only numbers I really look at are the states that, I look at the states that Mitt Romney won in 2012, and I figure out, well, can Donald Trump hold all those states and thus win those electoral college votes, but also win about an additional 70 electoral college votes? And that would require him to first and foremost win Florida, absolutely. But it would also require him to probably win some combination of Ohio, Pennsylvania, maybe Wisconsin, Virginia, which is very unlikely because Hillary's running mate, Tim Kaine, is a Virginian. He'd have to hold Utah, which Mitt Romney won handily, but the Mormon churches issued a bit of a fatwa against Trump. So if you just look at the hard, cold math, even with these most recent developments regarding Hillary's e-mail trail, it's still very, very difficult. But he should underestimate how much of an upset it would be for Trump, and it would be an equal upset if they'd run a more garden-variety vanilla Republican. Frankly, I think Trump's probably doing better than a Ted Cruz or a Mitt Romney would do, but it's a very steep uphill battle for Trump. What we're more interested in is whether there's going to be some sort of contested result that there's going to be abnormalities in a state like Florida in the voting machines because none of us really understand how these voting machines work and are reported. You'd have to go state by state, and there's contractors, vendors involved in the electronic machines themselves. So it can be very fascinating. We could end up with one of those weird twilight zone Wednesday mornings where it's not clear who won and no one's conceded. And there's the possibility of litigation, and lawyers are gearing up on both sides, and that's what we had in 2000, which was kind of a surreal period in America. I like it. I like the idea of not having elected anybody. I'd be perfectly comfortable with leaving the position vacant going into the next year. But boy, if you stuck a gun to my head, even today, I'd probably say Hillary wins. Now we've seen actually on Google Trends as well, we've seen lots of people trying to reverse their early votes. Now I'm assuming that's trying to reverse their votes for Hillary. Now we're not going to have hanging chads, and we're going to have hanging XML messages, but could she already actually have won with all this huge kind of early voting?  So some people are voting up to, I think, more than a month ahead of time, voting absentee, and that's a long time. So who knows? She has huge advantages. The deep blue states are blue, and they're blue for good. Some of the deep red states are getting less red every year. They're getting more and more purple. And it won't be long before states like Texas are in play. Once Democrats control Florida, Texas, New York, and California, Republicans won't win any more national elections. We can talk all we want about, we, I shouldn't say we, I'm not a Republican. But Republicans can talk all they want about outreach to Hispanics or millennials, whatever they want to do, but the simple demographics are against them. And very soon they're going to become a minority party at the national level anyway. Well, it's always been said, hasn't it, that democracy is a kind of long term form of communism, which gradually gives you the socialist state, whether you were wanted or not. Now, I'm going to ask you the $64,000 question then. It does seem to be a race between the undead of Frankenstein and Dracula. Are you actually going to vote in this? And if you are, who are you going to vote for? Or are you going to take a more kind of pure Hoppean or George Carl in position of not voting? I'm not going to vote. I don't view voting as evil or ill-libertarian necessarily. I think it's morally and otherwise valid to vote if you believe it's in your interest to do so, if you're voting strategically as a libertarian, if you were voting defensively and viewing as a matter of self-defense. And I certainly think on state and local issues, council issues in the UK, things closer to you. There can often be a tactical reason for voting. If some new tax is going to be imposed on you and your town is small enough that your vote or you and your friends and families vote might make a difference, why not? And I think Murray Rothbard talked about this in the context of slaves being able to choose between a kinder or a cruel or master. So I'm not one of these people who denigrates voting per se. It says, oh my gosh, any voting is complicity with the system. You should never do it and you're just part of the problem. If you've, you know, I'm not sure I agree with that. And if people think that voting for Donald Trump is somehow going to create an opening for at least in a few areas, a slightly more libertarian policy, you know, knock themselves up. But personally, what it comes down to for me is at some point, the United States is going to continue to be involved militarily around the world. So at some point after the new president takes office, there's going to be bombings and killings and collateral damage of civilians. And that's where I personally struggle because even if I saw Trump as someone who's throwing a hand grenade into Washington, D.C., something I want to do, boy, thinking that I was at least in part complicit with his ordering a bombing and some child gets killed somewhere in the Middle East, for example, it's just a little too much for me to take. So, you know, you can call that a cop out if you will. But I don't plan on voting next week. Well, I'm with George Carlin myself on voting. If you just need to watch the George Carlin video on YouTube on voting to get that opinion. Now, speaking of the Middle East, the U.S. does seem to be fighting some kind of semi-secret proxy war with Russia in Syria at the moment, which is very confusing and the mass media just doesn't kind of get into it very well. Do you think Trump might stop this kind of proxy war if he got in? Well, I hope he would. It's really an absurdity. If it weren't so serious, it would be hilarious to see the left suddenly worried about the evil Russians. Thanks. But more importantly is this neo-conservative grip on both parties in the U.S. and they're abandoning Trump and going to Hillary now. And they're absolutely enamored of resuscitating this non-existent Cold War. Russia is no threat to anyone. If you look at the size and scope of Russia's territory, this is a country of 145 million people. They are shrinking. Their territory is getting smaller and expanding. Asian and Middle Eastern forces are going to increasingly move into what is currently Russia and change its borders and change its culture and change its ethnic makeup, its religious makeup, its linguistic makeup. 145 million Russians are shrinking. This is not a growing imperialistic threat. It is no threat to the NATO countries. It's no threat to America. And it just shows you the degree of desperation among these endless military interventionists. I mean, even the war on terror is not enough for them. Apparently it's not hot enough for them or steady enough for them. We need another boogeyman. We need to resurrect Russia. And Putin is a convenient scapegoat. So it's, again, it would be funny if it weren't so dire. But Hillary's insane if she thinks that Americans want her to be engaging us in potentially a serious conflict with Russia over Syria. Most Americans don't care about Syria. They don't realize that we're responsible in large part for cracking the egg that is now Syria and we're responsible for creating these refugees in large part. This is not what Americans are dwelling on in this election. So if she does win and if she does intensify our engagement with a no-fly zone or whatever it may be in Syria, this will be something that she's doing at the behest of her foreign policy advisers and at the behest of some people who back her. It won't be at the behest of the U.S. people who, sad to say, are pretty indifferent. Now a lot of economic problems in the past, such as the 1930s and so on, have been covered up by a major war. And some people think that maybe a war is being instituted to kind of cover up the huge crisis since 2007. Now if Hillary does win, there seems to be a pause in economics at the moment with everyone waiting for this election result, what do you think is going to happen to the economics of the United States if Hillary wins the election? Well, she's going to wish she hadn't would be my prediction. Because what we do know is that she'll keep Janet yelling. So Fed policy will remain the same.  So I think with Hillary, you will get a head in the sand hit and hope mentality. It'll be a continuation of the Obama fiscal and monetary policy, which is basically let's ride this out. Let's continue to inflate the dollar as needed. Let's continue to keep interest rates as low as needed. Let's continue to resuscitate the patient and hope that somehow the US economy and the West's economy come roaring back to life despite these depredations. This has been the policy since oh wait, we keep waiting and waiting and waiting for this real economic growth to come, real increases in GDP, real, real organic growth amongst companies, not this financialization where the share price is going up through buybacks and other financial mechanisms, but the underlying productivity of the company. It's not finding emerging markets or new customers or great new products. That's not happening. So we've got this kind of phony growth among equity prices and share value, but we don't have any real organic growth happening deep down at the company level in terms of capital expenditures or productivity. So I think Hillary will inherit a very tough situation. How much longer we can keep the dollar propped up? It could be a long, long time because currencies are relative. And as long as the currency is better in the certain sense than the euro, as long as it's more widely used than the Swiss franc, as long as the Japanese keep doing what they're doing, as long as the Chinese keep doing what they're doing, the dollar will continue to look like the fresh assert in the laundry. So in that sense, she might buy herself some time, but can we take four more years of QE or alternatively, will raising interest rates and ending QE put the economy into a tailspin that Hillary wouldn't accept politically and would go direct to Yellen to halt? Boy, the idea that that won't happen in the next four years seems awfully remote to me. Yeah, it's kind of a dug case is eye of the hurricane, isn't it? Now, just to be even handed, some have predicted that if Trump does win his first act as president in January, it will be to sack Janet Yellen. But just before that, just to kind of spite him and using her kind of Keynesian thinking, she will increase interest rates deliberately to cause a problem. Now, do you think that this raising of interest rates to a more natural level, whatever the market decides the natural level would be, is actually something that should be done to sort of take the pain now, that's built up over the last 20 years, and then to grow the US economy and then hopefully the global economy in two or three years time when the huge recession that that will probably cause is then worked through and then all the malinvestments are cleared out? Well, absolutely. I think that's something that should be done. I think it's something that has to be done. The recession is the cure. It's not the problem to be solved. It's the cure to the problem to be solved. And that involves some pain for a few years. And that's why it's politically a dead end. No politician wants to run on a platform of saying vote for me. And I'm going to rip the Band-Aid off and employment's going to spike. And there's going to be massive layoffs. But you know what? We'll be setting the stage for some real economic growth three to five years down the road, not a winning platform. And that's that goes to Hoppe's point that this is what democracy creates. It creates high time preference even amongst voters in the political class where we just want everything now for free. And we want to pay for everything somewhere down the road. Hopefully after we're dead or for politicians after they've gotten the votes and they're out of office. This is a feature, not a bug of democracy. It's one of the great problems with democracy. And it's especially acute in a multicultural welfare state like the U.S. where you've got so many competing interests and so many ugly social divisions. People don't even have the sort of unity of goals that they once had in a small homogenous country like Norway, for instance. So it's very, very tough. And I think that I don't care what the Fed does in a sense because I don't think the Fed ought to be in the business of providing money or setting interest rates. But for the time being for the very near future anyway, we're going to continue to have central banks and they're going to continue to control our currency. So the least bad thing the Fed could do would be, yes, to allow interest rates to rise and to start getting back to an economy that is actually based on saving and capital accumulation instead of consumption and debt. This is how human history has evolved. People consumed less than they made and they put money away for a rainy day, whether that's for their family and kids or whether that's in a corporate environment. The fact that we've upended that forever and ever, if you talk to Larry Summers or even to Ben Bernanke, who now says we shouldn't even unwind, the QE purchases that the Fed has made since 08, that's more than just technical monetary policy mechanisms at work. That's an actual ideological sea change in how we live our lives as humans, whether we want to consume or whether we want to save. It's an existential question, not just a technical question. Now, we are seeing these ideological things changing around the world. We saw Brexit a few months ago in the UK and the rise of Trump is being said to be a part of the Brexit global movement. Trump has a huge ego. Do you think he could actually be a politician who isn't affected by politics and who could actually let natural interest rates come back into the marketplace? Yeah, it's an interesting question, isn't it? I think he does have a deep-seated psychological need to be liked or loved or admired. I guess that's universal, but in him it seems amped up 100-fold. The question would be whether he wants to be loved and liked and admired by the political donor class and his political consultants or whether he wants to be loved, liked and admired by the American people, two different things. But at this point, we're so far beyond any sort of political consensus in this country that this myth of democratic consensus is going to be laid bare. And if Trump wins, the left is going to be apoplectic. We're going to have a period of division, probably like we've never seen before. There are going to be some very deep-rooted interests that don't want to see Donald Trump as a healing force in American politics. They want to see quite the opposite if they don't get what they want, which is, at this point, I guess, Hillary. So, boy, will Trump be able to do the right thing? Very, very unlikely. He's going to be pressured from all sides. And this is a guy that we don't know. We don't know how he would respond to that kind of pressure. We know how Hillary would. And I think that's that's what people who like Trump argue in the US. At least with Trump, we don't know. With Hillary, we know. It'd be nice if he appointed Ron Paul to be his financial advisor. Now, we've seen all these banks around the world, the Japanese banks, the UK banks, the European banks, the US banks all printing money, buying their own debt from their own governments that own them. The traditional barometer on this has been gold. And we have seen a rise in the gold price over the last few months. But it's paused for a little while, waiting for this US election probably. Do you think gold could be the canary in the coal mine, which starts to signal the end of this endless Keynesian quantitative easing immediately after the US election, let's say, if Hillary wins? Well, it certainly could be. Gold goes up and down for some mysterious reasons sometime. But gold never goes to zero, that much we know. So, I don't consider gold an investment. I consider it a form of money, a base form of money. So, really, when you're buying gold, you're engaged in forex, in a certain sense. You're saying to yourself that I think gold is going to go up relative to other currencies. Not that it has, not that it's going to go up like an investment goes up. It's not an investment. It's money. The thing holding gold back, ultimately, is the fact that in most Western countries, it's not used as legal tender, which it could very easily be used as such. We could come up with electronic gold where you have a store of physical gold somewhere in account, and then you simply use a debit card that can shave off tiny fractions of it. So, we don't have any problems with actually handling physical gold at a cash register or point of sale. And the fact that this is illegal, you basically can't do business in the US or remit taxes in the US using gold. That's considered a form of barter or a capital gain or capital loss transaction. The fact that it's effectively banned skews the gold market. It skews its value as a currency. I don't think gold is going to go to $5,000 or $10,000 because there's another looming crisis. I think if it was going to do that, it would have done that in 2008. But I do think gold will very soon be at $2,000. I don't think that's a stretch. And I'll just say this. There's never been a time in history where Grandpa died with a bunch of physical gold and left it to his grandkids, and everyone was sad about it. It's always been a good thing. It's always been happy.  So I'll just say that. Okay. Now, getting away from the Republicans and Democrats because we spent a long time on them, let's have a look at the libertarians. Now, Gary Johnson is a candidate in this election, and he's been a big disappointment to a lot of people. Would you have preferred to see somebody like John McAfee to disrupt things and shake things up? Or is Gary Johnson just fighting an impossible battle? No, I would definitely rather have seen a more engaging candidate, someone who is really going to shake things up and to ask the hard questions and to campaign vigorously and also to campaign honestly and to talk about libertarianism as an ideology and as a political theory and give it a little bit of intellectual heft and weight and not just try to be a retail politician because by trying to divorce libertarianism of any ideological or intellectual basis and just having this kind of hippie-dippy approach which says, well, low-tax liberals, we like social inclusion and we just think liberty works better. Well, frankly, that has worked far less than having Ron Paul give a purist message. I mean, the Ron Paul campaign was a much bigger deal than the Gary Johnson campaign, even though Gary Johnson's had the advantage of four more years of the huge social media environment and all these other ways. He's had a lot of media exposure, but he just hasn't captured anyone's imagination because he says unimaginative things. So I don't understand what he's doing. I don't really understand his motivations. He doesn't seem to be self-motivated, self-interested. He seems like a nice enough guy. I wouldn't say he's using the LP as some sort of platform for his own benefit if he is doing a very poor job of it. But for your listeners in the UK, it's really been a sideshow at most and Gary Johnson 2016 does not have the feel here of a revolution like Ron Paul 2012 did, not at all. Yeah, that was a fabulous campaign. I still remember the blimp in earlier year, which was brilliant. Now, you were heavily associated with Ron Paul doing a lot of work with him and for him. I'm short of cloning him in a singularity. Are there any future kind of Ron Pauls on the horizon out there? Well, I wouldn't clone Ron because he'll tell you himself that he's not the greatest public speaker, but part of that was also there was an upside to that because people always knew his responses weren't canned. They weren't polished. They weren't tested like Mitt Romney.  So his lack of polish was balanced by sort of a home spun likability. It's interesting the Rand Paul phenomenon. Rand didn't get the traction he thought he was going to get and he had to ultimately go home and work to make sure he wins his Kentucky Senate seat. We have to sort of step back and ask ourselves, look, the Republicans have had three chances to vote for a libertarian Republican. They had 28 with Ron and John McCain. They had 2012 with Ron Paul and Mitt Romney and they had 2016 with Rand Paul and a slate of other candidates. In all three instances, they declined. So at some point, they declined overwhelmingly. So at some point we have to say there is no libertarian wing of the GOP. There's no working within the party to get it to be more libertarian. There's been some mild success with that at the state and local level. But at the national level, this is not a libertarian Republican party. This is a statist, corporatist, militarist, globalist Republican party. So if the Republicans go away or cease to be a force on the national scene, I say good riddance. They're not doing anything. They're not conserving anything. They're certainly not the party of liberty and capitalism and markets and opportunity. No one would say that about them. So having, we ought to just treat the Republican party as sort of a wing of the Democratic party and get on with it. Is there another Ron Paul and the wings? I think Rand is very seriously considering running in 2020 and there are some other good younger people in Congress like Justin Amash. But boy, you know, it just seems like if by now a libertarian was going to get some traction within the two party system, they would have gotten it and they haven't. So I think we should roll up our sleeves, not put our faith in the white knights, but rather just look in the mirror and say whatever we're going to do, we're going to do it ourselves. Do you stitcher and SoundCloud or listen on Mises.org and YouTube?