Do-do-do-do-do-do-do-do Hey, Bill, how do you pronounce your last name? You're not gonna be able to say it, but uh, it's Damir Kapu Do you want me to try it? I Mean, I I don't care. I I won't get offended if you don't say it Looks like we are live. Yep, we seem to be live. All right Welcome everyone I want to Introduce Bill. Bill. I just tried to do your last name in my head and I was not successful at it So I'd like you to say it for everybody if you care to Sure, it's Damir Kapu. All right. Thank you for that. That was uh instead of me murdering that I wanted you to try it So I'm Bill did a talk on demystifying modern Windows root kits This is your opportunity to ask questions of Bill So there are a few questions already coming in through the Track one live QA channel. Let's just go ahead and get started So Ergon asks what is the what are the easiest features? To find that might reveal a modern root kit via static analysis I think a good place to start for a static analysis is going to be the I'm obviously the strings because if they leave any debug strings behind or any unique strings for that specific binary That's a good thing to maybe you know add to your signatures, but another opportunity is going to be The imports of the driver for example of a driver imports a bunch of undocumented functions And that's obviously going to be a little bit more suspicious given that Legitimate drivers tend to try to stick, you know with what's documented and with what's stable So if there's any functions that it imports that is not stable or is it's very you know It's just not really known about it's something to look at So anything undocumented that's getting pulled in you're thinking that's going to be your opportunity for For shenanigans on that side. All right. I Did you Was that pasties? I was gonna say that the potential shenanigans could still be what's in it. That's true So next question from RP TK 2015 did you actually find any p-key when searching in grey hat? Mentioned in the context of using a legitimate key to sign your driver Yes, so um, I didn't of course crack any of them But I mean some of them were pretty obviously related to code signing for example I remember one that had like code signing in its name So it was it was pretty clear that these were probably associated with I code signing in that there was it's potentially If you crack it you could use it for kernel kernel code signing. It all depends on the type of certificate It is and you know what type what vendor it came from and stuff like that But I have definitely I can't confirm that I've seen potentially viable Is the private keys on grey hat? Do you know if there are some keys that are like more trusted than others like some that you can use to sign? Code but there aren't trusted for like kernel level drivers or something like that. I assume a like a Microsoft Signing key is like the golds, but Yeah, yeah, so usually what how it worked is that you have like these Certificate companies that issue these code signing certificates and they work with Microsoft to get what's called a cross-signing certificate So this means that Microsoft says yes, so you can use this This vendor or this roots this root authority can issue certificates for kernel mode code signing just to give you an example there And and so what you can do there is you can so some vendors will don't have a cross-signing Cert and they probably will not work for kernel mode code signing while others do And so there's that's usually the different levels is whether or not the vendor has You know deals with Microsoft or has a cross-signing certificate from Microsoft Where would I look up that information if I wanted to find out more of a specific searcher? Yeah, so I think a Microsoft has like a list of cross-signing certificates on on just there On on MSDN Microsoft documentation. It's yeah, I found a page here. It's like Cross certificates for kernel mode code signing Gotcha, okay, so a follow-up question on that one would be what's a good place to find leak certificates? Were I to decide I needed one? Yeah, so one of the places I mentioned that it's a good place to start for looking for leak certificates is going to be On D is so cheating related forms There's quite a few available there that some of them have been out for years And I still think that so you can use them because a lot of the a lot of anti-virus simply don't have Detections in place for these leak certificates even ones that again have been out for years So if you're out looking for a leak certificate Look at game hacking forums look it like search for leak certificates And then the game hacking forms names and I'm I can guarantee you that you'll find some That's an interesting crossover. It totally makes a ton of sense But I was it's not something that would have come to mind if I was ever gonna go look for that Yeah, especially considering who's making these things and you know who builds a lot of the games out there RPTK has another question there Can you explain a little more about why would the kernel accept a driver signed by an expired certificate? Yes, so when you see a Let's say you go into the digital signature section of a driver and you see a certificate there And it says the certificate has expired. Well, what do you what you're seeing there? When you go to digital signature section is the result of wind verify trust, which is a user mode function Whereas the kernel mode co-signing policy is completely different because that's in in the kernel So what you see returned by the wind verify trust function and rule Generally speaking not always be what the kernel mode co-signing policy checks for and what I mean by that is if the wind verify Trust returns. This is expired or this is revoked There are some reasons that a kernel code That you might be able to sell low that driver is because at the time of signing it was still valid So even without a time stamp it the kernels Just assumes that since this was at some point signed by a valid certificate even if the certificate expired It's still it still should be loaded Yeah, yeah, I think it's mostly going to be for compatibility reasons That's what I I guess assume, but it's it's speculation given that no, I don't work for Microsoft So I don't know the reason I'm sure there's a whole lot of history there so we have a another question Trinsky is asking if you have any interest in creating a road map of resources courses or tutorials on your blog The person can get to your level of reserve reverse engineering competency Yeah, so for that question It's mostly, you know, most of my I guess knowledge comes from just experiencing and the best recommendation I can really give is to I just try things out You know do CTS if you want to learn reverse engineering, you know, do the CTS and really, you know, one of the ways that I go about, you know Looking for even projects or stuff to do is I always stay curious and what I mean by that is if I see some weird Functionality by a program I'm using on like in real life on my living machine I will probably quickly try to check underneath of what's happening here You know, why is it doing this one weird thing and oftentimes I found that that can actually to other issues Like actual security issues. So if you're looking for what, you know, what what projects to do or what to reverse It's really just going to be the software you use in your everyday life And in I don't have any plans to do like a course or something on Just, you know tutorials on how to reverse engineer for example, but it's going to be really going out and finding finding your own projects at that That you find interesting So that you'll continue pursuing it that's that's I guess the trick I did the reason that I was able to learn so fast was because I always did stuff I was always interested in and I was you know in specifically game hacking I love games and I'm bad at games so I had a you know self-interest to continue reverse engineering of these games and Figuring out how they work and maybe how the anti-cheat works and then you'll you'll end up learning a lot from just You know trying out things a try trying to reverse new programs. You might have not had to look that before stuff like that Well a quick step back then so you said you watch as a program does something unusual It's not exactly the words you used but What types of unusual things are you expecting what types of things would sure sure make the radar go off? So just to give you an example of like a vulnerability. I found a few years ago was in the software called Dell support assistant how that worked was when I went to Update my drivers because I installed new SSD I needed drivers for that one machine the website claimed to be able to update my drivers But from the website itself, and I was like how does the website update my drivers? Well, it turns out that Dell pre-installs this software that I basically allows It's own website to communicate with it and install a stuff like updates Well, that's kind of weird You know because allowing a website to have that sort of access and then I reverse engineered it further And I found that the restrictions there weren't quite as strong And I found a way to bypass the restrictions the application had but so the weird part there was Well, it's a website claiming to you know update my drivers. That's that's not normal in the websites It normally can't just do it automatically update my drivers itself You know it might be something I have to install and do it myself, but so in that case that was something weird It's just basically finding these, you know, why does this thing happen? Why did they design it this way? I and it's looking for those logical flaws in their like design or just their code itself Yeah, so this is one that I've actually hit myself RPTK 2015 asking Another question I like keeping coming this dudes. It's pretty or chick. I don't know Could you explained on how secure boot blocks some of the driver signing methods? I've definitely noticed that some drivers work with you EFI and some don't and it's usually a driver signature problem Yeah, so the main issue you're gonna have with secure boot is if if you're like going after Using a leak certificate or if you're buying your own certificate The thing to consider is if the certificate was issued after July 29th 2015 That's the cutoff date Then you're going to need a EV certificate so extended validation certificate on your versions of Windows 10 so what that means is you're going to have to basically the Certificate vendors that give you these certificates the code signing certificates have to you know do extra validation and Typically the certificate is given to you on like a USB drive instead of just sending you to private key file So that you know it for versions of Windows 10 that have secure boot enabled You're basically preventing drivers that aren't signed with an EV certificate To be loaded just because that that's that's the policy it follows and in the in those newer versions And so but if your leak certificate was released before Issued before July 29th 2015 then it will still work on these On these newer builds with the secure boot protection, I guess you call There is sort of an extension of that When I when I encountered this issue there was a Registry flag that you could set that was Sort of bypassed it. It was unattended upgrade. It was from Windows 7 to Windows 10 upgrade Did you try playing around with that to see if you might Like I know most because the least certificates like you can just the ones publicly available are issued before that cut-off date So, yeah, I mean it's like there's like almost all of them are issued Yeah, I mean at least right now, you know the least certificates I used was when when I found it was issued before that date So I haven't actually found the least certificate that was issued after it yet So it's easy enough to find it that you haven't had to hunt down that possible other way to get it done Right, right, right And so there's a quite different quite a number of ways you can approach the problem of you know getting your driver loaded and at at that point Well, if you if you don't even need to look into it, you know other ways there. It's it's not it's a non-issue I guess you call but it's something to keep in mind, you know going forward once those least certificates start to run out You're probably gonna run into that issue of that date restriction And at that point I'd probably recommend you have the second method of Loading a driver and abusing a another legitimate driver that has been signed with like an EV certificate But again, the problem with that in my talk I mentioned it is that you cannot run into a lot of stability issues when abusing another driver and trying to load your Own just because there's oftentimes going to be stability concerns like race conditions That makes sense So Trunsky is asking did you test your route kit against any of the top EDRs? No, I didn't but the one of the I took EDRs into consideration when designing the application and for example, how I hook Communication between the AFD driver and user mode applications. I always went for methods that would try to Make it as expensive as possible to detect Because I feel like that's the best approaches. I not security through obscurity it's going to be how can I make the Antivirus have to go through an it very expensive and time-consuming process to detect me because oftentimes they'll reconsider for those reasons or another another perspective might be how can I Cause compatibility issues like if there's an application that already does these suspicious operations Maybe I can go in like impersonate that application and the antivirus would have to accept it because the legitimate application also does suspicious operations Trigger bad false positives that they can't work around themselves Right, right, right or it's very difficult to detect around that Yeah, it makes sense. Yeah, I mean I feel like a lot of security is just making the other side do more work to get to the same goal so RPTK asks another question here and there were some Some method you're able to see there were not HVCI compatible, can you please explain a little bit about HVCI mitigations? Yes, so the HVCI let me look what it stands for. It's like you have virtualization based protection of code integrity So essentially what it does is it's a mitigation if you have virtualization enabled you should be able to enable it That basically makes it so the once the driver is loaded into memory Especially it's executable sections. It can never again have those executable sections set to writeable The memory fly memory protections will it will never be able to see be writable for that Memory page because it's an executable section. So essentially it prevents code hooking for example Or basically modifying the actual bytes of the driver's executable code That makes sense Okay, so I Apparently miss this. Can you talk a little bit about your piece major project and how it compares to specter? Sure, so piece maker was a Basically, it was a proof of concept EDR that I wrote a few months ago Which was basically the opposite of what I'm doing now instead of writing a real kid I wrote a driver to detect malware and The way I mean the biggest difference between the two is the fact that one of them is a blue teaming Defense application while the other one is a root kit But when it how does it compare? Well a piece maker is going to be I believe it's a little bit less efficient in general And I followed a stricter code design policy for myself In in this latest one So I mean it those are I guess how it compares, but they're two different projects for two different reasons That's fair So speaking about other projects and other places you might want to push this research You already mentioned a little bit about a gap of the upgrade process for If you end up running out of certificates that were signed before the cutoff date What other interesting things are out there for somebody who wants to do research in the same field that you're in? What would you recommend for somebody who is looking for a neat project to jump in and start working? So for I guess neat projects of Where to start it would first of all be um If you're interested in learning more about the windows kernel or the internals of the windows operating system The best recommendation I have is besides experience is going to be some of the books out there include the windows internals Seventh edition is the latest one that really goes into depth about the internals of the windows operating system but it's really going to be finding a way to make security interesting for you or make learning interesting to you and That's the best way I can recommend. I guess of how to what's the best way to go about learning these difficult topics is Is to gamify it and is to incentivize the research itself But yeah in general it's it's going to be most of most of your Experience and knowledge is going to come from experience and just playing with things trying new things and for it for projects You could do it's it's really it varies you can try looking at like reversing drivers for vulnerabilities in their I octal interface That's what I've I started with at least And you can try to find a way to abuse those drivers Like the abuse legitimate drivers portion if you're looking for some drivers to I guess that might be vulnerable a lot of OEM drivers Have security issues in them. I'm I'm just always shocked just look on it's I've become desensitized to it Just almost every OEM driver has something questionable in it And I guess so that's that's the place to start if you're looking for vulnerable drivers It almost sounds like as you're approaching these projects looking The new thing pops out at you. Maybe not from Getting a depth into a I'm gonna find all of the drivers out there But what are you you're looking for other things you're learning everything you can and then The the context for your next project kind of filters out from that Or do you find that you have to you have to go searching for what you're going to attack next? So in general not even just like Windows kernel stuff I generally don't search for projects to do again It's just finding stuff that might be interesting like you know if a program's doing something suspicious there you go That's a project right there find out why it's doing that thing or anything similar that's doing that could be called into question But for Windows kernel, you know one thing I do is I'm I try to get part of the Viral scanning platforms out there like when I am part of is like hybrid analysis And what I'll do is I'll occasionally search for drivers on there and download them and just take a quick peek under the hood And you can see see what's going on there And so that's a good place to I guess find these driver files if you're trying to search for them Sorry go ahead I was gonna say are like are those already infected drivers or these just like a reference or these just like tons of driver Like repository kind of thing. It's just a repository like these aren't necessarily bad drivers or vulnerable drivers These are just Potent like might be legitimate drivers. Well, so it's just a driver repository Have you looked at any other driver infections just to see how they are doing those hooks to Get basically similar ideas and work back from like the attack side rather than being like, oh, this is weird Said like oh, this is an active attack. How are they doing this could this apply to other situations? So basically do you look at malware or do you just look for new things in weird drivers? I look for new things in weird drivers. I don't specifically just look at like drivers I know that are malicious What I do is, you know, I'll reverse engineer like I said OEM drivers And that that's a starting point. Those are legitimate and so And I'll just look into what I can find is there first of all is like auditing attack surface is finding out What can you actually talk to and then it's finding out now? You know what you can talk to what are the access controls in place that limit? How much you can talk to the application and you know, it's going from there It's it's that type of investigation of you know, what can you access and how can you manipulate what you can access? So truansky asked a question that fits into kind of the direction we I was pointing there How do you balance your personal life and doing research so you're clearly deeply involved in this at what point? Do you at what point is this all you do and how do you fit in the rest of the stuff you want to do with your life? Yes, so well specifically how I manage my time is going to it The big thing is, you know over the summer. I didn't do most my most my research was performed bodies in school So before you know any internship or summer of work. So it's going to be in school I've just I've got too much free time And so I just spend that time researching or you know, I spend some of that time trying to research things And it's different, you know, if you have a full-time job I don't know if I have a recommendation for you because a fact is I know how it like 40 hours a week is rough You know, you'll probably be tired When you get home so a you know doing research then they can be difficult sometimes and so I don't know if I have any Recommendations specifically to that but in general I try to use this to a free time I have as much as possible like a valuably I guess and And and since I have so much free time in school, you know, I dedicate a portion of that to doing my own research That's awesome So not that we want to point towards anything specific But you did mention that there were some CTF's out there that are good at training resources Maybe this is a good time for you to say. Do you have a favorite CTF for teaching this type of material other than You know, you were talking about the windows windows internal stuff that you can read the 30 pound book So it's actually really unfortunate. I find that a lot of CTF's don't really focus on windows related challenges It's really rare. You'll see like an actual challenge.  Maybe running even on the arm architecture, but I just rarely see I don't have any good CTS recommend for windows related stuff Just because oftentimes you probably won't see windows related stuff You won one of them I can I know I can mention that it's pretty good It's I guess you call my favorite CTF overall is the flare flare on reversing CTF They have some really interesting challenges there, you know, it's not just gonna be windows stuff It's gonna be, you know, reversing a bunch of different architectures and applications figuring out what they do It's it's it's one of the favorite ones I participate in so Also, I mean, I guess that also kind of exposes like that that CTF sounds awesome It seems like any for anyone that's watching that there's a gap in the community windows CTF's There you go Next Defcon Talk Well, so what's next for you if you could pick which direction you would point for your for your next research topic Um, that's simple to say I honestly don't have the next direction. I don't have the next project I I'm I get I kind of just go with the flow. I see it really is literally just a Looking at the everyday software I use and then if I know that I just tend to notice stuff I like this is weird and that's how I how I go about doing it for this specific for my talk How I came up with it. I guess you could say is Is our schools or our schools security club a red team needed a new we wanted new malware to use against our best blue team competitors So we run competitions where we do like we simulate a corporate environment And you have a red team that tries to maintain persistence and a blue team that tries to kick you out blue teams also have like uptime and these challenges that they have to keep services up while the red team tries to mess with them and so There was just a need there for me to develop some tooling against the kids are top blue teamers And so that's why I decided to look into this, you know, maybe like two birds with one stone type thing You know, I thought it'd be interesting. I know and so there's educational resources about root kids out there like books I know for sure But I haven't really seen open-source tooling around You know when the kernel level windows or kids out there, it's rare to see it. So I thought it would actually be a pretty interesting project Yeah, looks like it turned out that way Did you did you end up crushing the blue team with this? Yes, yes, definitely I remember having conversations about, you know, like When I when I suggested that I was abusing legitimate communication explaining to these blue teamers How is doing things?  Because they were of course looking for malware and I was using so they have to have certain services uptime, right? So they have to have these services always up So I was just using that fact to get into their machine because they could like take down that service as so even if they knew and they didn't That I was abusing these legitimate services for communication You know, they they would firewall everything except for those services and I'd still be able to get access Because you know going a community game through their services. So yeah, it was it was a really fun time Um One person is asking for a clarification on the ctf like where they can find it the flare on They found flare hyphen on dot com Yeah, it is it is the flare on flare hyphen dot com is the one I mentioned And another question from rptk 2015 In the resources you proposed reactos. Could you explain a little bit about that? Yes, sure. So reactos is a essentially a bunch of and engineers reverse engineer to windows kernel and Wrote it one to one I wouldn't say obviously it's not one to one a hundred percent, but it's actually like insanely accurate Of the actual windows kernel. So it's it's kind of like an open source windows kernel Uh, you'll find that a lot of the functions in the actual kernel has been re-implemented in there a lot It follows the same structure. It's it's it's it's just quite literally an open source clone of windows Um, and it's an amazing resource because uh, sometimes you'll find, you know Undocumented functions. You don't know what it does and luckily you can go to the reactos Project and just take a look at the source of that because people have spent hours reversing that one function for you Now some of this is going to be outdated because the reactos kernel Replicates the xp kernel. Um, but still the core functionality is going to be pretty similar Excellent. So we are right at the end of our scheduled time. Is there anything else you'd like to impart upon us before we We call it for the day Yeah, I mean not really I I appreciate everyone for coming out to my talk. Um, you know, keep in mind that that uh Rukits are I even I'd like more red teamers to start using windows kernel level rukits And going that route because I think there's a some Interesting, you know more advanced actors use it and I feel like more red teamers need to start Like simulating those advanced actors that have been using these root kit techniques for years I just feel like, you know, we have so much. We have such a good community for a user mode malware But we rarely see much for kernel mode. If that makes sense. So I guess that's a parting message is Please start looking into it because um, the real adverts adversaries out there already have this ready to go That makes sense. Well, we'll get you to post all of your contact information into track one and let people Find you wherever you tell them that they can find you and I really appreciate that you gave us some time today to Both give that presentation and then spend this time in the q&a So, um, thank you very much and hopefully we'll see more from you soon Yep, have a good one. Thank you, bill


Hello everyone, welcome to this talk called what's federal IOT. My name is Jose Noguera I'm a software engineer in ref that and thank you very much for your time on this talk So a little bit of context about who am I? I'm Spanish as you can tell from my accent. I've been working in In red hat for almost three months now and I've lived in Spain. I believe in Austria where I did my Rasmus I lived in Dublin for for a couple of years and now I'm living in London I love traveling I wanted to be able to do again But I'm waiting, you know for for everything to be safer that is now I consider myself a jack of all trades and a master of maybe one or two I was you could say a generalist I'd like to know a little bit of everything and then Specialize a little bit on some stuff. I'm a very very curious person And I'm always learning and I am the new maternity of Greenwood Which is something I support that we are going to talk about in this talk So what are we going to talk about in this talk? It's we are gonna cover a little bit of context on what's IOT and what edge computing We're gonna talk of course About if you're IOT we're gonna do a little overview in the beginning Then we are gonna speak about live Austria and RPM Austria their features and peculiarities We are gonna speak about Greenwood as well About Cezare, which is the provision platform and finally we're gonna speak a little bit just one minute About run for edge and yes, that's not the Greenwood logo We don't have any logo yet So if you are willing to contribute, please do because I think it could be pretty pretty cool to have a Logo and see actually thinking I have a couple of mine So we'll see we'll see but anyway any contributing will be very much appreciated. So Internet of Things, what is it here? You can find a quicky video definition, but In plain words, it's basically Anything that it's not a computer and it's able to gather information and send information to a to a remote location or a server And it's connected to the internet That's could be a very very mundane Definition by definition that I could say to my to my mother and to my grandma It could include cars, fridges, air conditioners, speakers, TVs and basically anything called smart You know, if it's a smart bulb, it's you can say that it's a part of this Internet of Things Network and Regarding edge computing, Red Hat defines it as The computing that takes place at or near the physical application of the user or the source of the data The most clear example for me is an autonomous vehicle It wouldn't make sense that the sensors in the vehicle send the data They are gathering to a remote server in order to decide whether the object in front of them is a stop sign or not It just would take too much time and could lead to catastrophic consequences like the car crashing or the car running over a pedestrian What makes sense is that this decision of whether this object is a stop sign or not Is done in the computer inside the car closest to the source of data And this is edge computing and in case you don't get it, the picture is they've hauled events They you to guitarist and best known as the edge and yes, and you can see he is computing I know presentations and puns are not really my thing Now for a quick overview on Fedora IoT and it's defined as a foundation for Internet of Things and device ecosystems their main features are continuous applications security in mind Multiple architecture support web-based provisioning and this is Cicero Bruton that we are going to talk about later on and reliable operating system and Regarding this last matter is what we are going to dive in today in this talk LiveOS 3 formerly known as OS 3 and actually OS 3 is still very present in the in the LiveOS 3 documentation But I guess that in the future The name of live OS 3 will gain more weight on this. So what it is? This is a No spoiler alert. This is a rather intense slide. Let me sum this up for you The key points here are that live OS 3 is an upgrade system that perform Atomic upgrades of complete file system trees What does this mean and how does this help us? Well these help us by giving us a chance of rolling back to previous state of the entire file system tree Making it possible to quickly revert errors in configurations for example And I really like the summary of git for operating system binaries I think it's a very very good definition as the deployments are defined by commit hashes You can actually check out to two branches or refs in the variety jargon and perform commit actions So if you're familiar with git concepts, you'll be familiar with live OS 3 concepts in no time On top of the previous features live OS 3 also brings in bootloader configuration management of slash See as we'll see in the following slides and some other functions that make this library ideal for IoT devices A power street Can be used alone But adding a package manager on top of it is killer combination that will allow us Create a hybrid tree package system as we will see in the next slide and This killer combination in federal IoT is called RPM OS 3 It uses live OS 3 for the image system and It uses for packaging it just leave DNF accepting RPM of both client on server side The features described in these slide Align and extend as you can see the features that live OS 3 offers git like Atomic upgrades rolling back without affecting user data Back to layering on client side and easiness of making our own derivatives So moving on with what makes federal IoT's file system peculiar we have for example slash user Which is read only in each deployment Slash user will point to slash OS 3 slash repo slab objects. We will talk about slash of a street later But for the moment Let's just say that this path in particular is a repository for all slash users user files and binary binaries In order to save disk if deployments share a file They will both both have a hard link to the same file in this directory But new or modified files will be hard link to each correspondent deployment So while if needed, there is a command that allows the user to make slash user readable This is RPM OS 3 admin unlock This removes the read only bind amount on slash user and replace it with a readable Overlay file system, but all changes in the overlay are lost on reboot So it allows the user to test different configuration without compromising the system stability however, in case this This change is an origin fixed fix or we just want to make this change permanent I think the suffix slash last hot fix will create a new deployment and the current deployment will be cloned as a pullback target and by the way, I know I talk a lot about deployments and Let me just define this for you. These are the different atomic versions of our system tree If we add a new layer to it here, for example, installing a new application. This is considered a new Moving on with what makes Federal IoT's file system peculiar. We can see that slash user is read only in instant deployment it will point to slash OS 3 slash repo slap objects that We will talk about this Slash OS 3 later on but for the moment, let's say that this path in particular is a repository for all slash user files and binaries In order to save disks if deployments share a file They will both have a hard link to the file in this directory as we can see in the image It would basically show us the win bash binary that in two different deployments Have the same inode number that the one that is in slash OS 3 slash repo slap objects But for new or for modified files These files will be hard linked in each different Uncorrespondent deployment. So when I have two versions of being vash that will Have different inode and they will be both hosted in O3 repo objects and the different deployments will just hard link to these path As well if needed There's a command that allows the user to make slash user Rightable and this command is rpm dash O3 admin unlock this removes their read-only bind mount on Slash user and replace it with a rightable overlay file system But all changes in the overlay are lost in reward So if you want to test different configurations without compromising the system stability, this is just perfect for you However, in case you need to make these changes permanent You can add the suffix dash dash hotfix and this will create a new deployment based on the current File tree and the current deployment will be cloned as a wall-backed target And by the way, I'm no I'm talking a lot about deployment So I'm gonna stop here and define what's that deployment is and these are basically the different Atomic versions of our system tree. We add a new layer to it via for example Stalling a new application. This is considered a new deployment More stuff Slash bar directory is shared between deployments You can edit a file in slash bar in deployment one go to deployment to edit the same file rollback and the changes will persist Slash ETC on the other hand is unique for each deployment For every new deployment a new slash at C partition is created via Three-way diff between the previous default configuration the active systems at C and the new default configuration It's noted here in slide files will be copied won't be hard linked as with a slash user Contents will be the same, but they will have a different item. I know number Now we arrived to slash o3 Which in fact is a sim link to slash Cs root slash o3 Which were all the previous magic and differentiates differentiation between Slash it is slash bar and slash user happens in a way It contains several directories, but we'll focus today on the deploy one Deploy contains another sub directory, which in Fedora IoT will most likely have the same name Fedora dash IoT, but in roll for edge came varai, which is the system name As said in Fedora IoT the name of the system name is going to be Fedora dash IoT But in roll for edge this name can be specified by the user Inside these deployments slash system directory we found two directories var and again deploy Var is where the shared var partition is mounted Deploy is the set of files specific for that deploy in party Now escaping from the file system features we find Grimwood Grimwood is a framework for system data allows administrators to define the desired and needed state for applications after booting It performs a series of checks that basically are bash scripts Included by the user These checks can be required for things that are absolutely necessary for the system and wanted For things that are interesting for our system for our system, but they are not essential Let me show you an example Required could be that the device has port 80 listening and engine x up after every single update or boot Unwanted could be if the device is able to connect to a non essential service after this boot I hope that clarifies it a little bit What happens if after an update all the required checks pass well This boot will be marked as green and if defined Grimwood will run another set of pass script If they're why they require test don't pass Grimwood will mark the boot as red Another optional set of bash scripts will be run useful for instance to send logs or alerts to a different location And Grimwood will reboot the system for a defined a defined number of times The default one is the three times if after these times the boot is still marked as red It will roll back to the previous deployment Regarding what happened if the wanted checks failed Grimwood will show Which scripts have failed so admins could check what's happening, but the system won't be restarted or rollback If you're wondering how to access your devices after you have burned the Fedora IoT image onto them You can either customize the base image and add your credentials be it user passwords or Such keys or you can use Cesare So sir is offered via provision.fedoraproject.org and is a platform for provisioning your IoT devices You don't your SSH public key or keys if you want and when Fedora IoT first boots It will connect to Cesare and say hey, I'm an unclaimed device connected from this IP Then you soon your Fedora account and connected to the same IP as the device You can log into Cesare claim the device and this will shadow the copy of your loaded SSH key onto the device After a short period of time normally 10, 20, 30 seconds You'll be able to log in into your device using this SSH key And now it's demo time. Let's pray to the Depot codes To ensure that everything goes fine. So first thing first. I'm gonna show you guys Hey folks, sorry Cesare This is the provision portal as you can see here. I have no unowned device from these devices from this IP address So I'm gonna create a new return machine. I have already downloaded and extracted Fedora IoT raw image. So just going to use that one Yes, that's uh, yeah, I think this is fair So this is the first run and So you can see it says browse to provision.fetarooperator.org to configure the SSH key deployed I'm going to do so Fresh and now here I can claim this one Well, we can see that the address ends in 8584 claim it go to device management and Submit, this is the one 8584 submit provision request and Here you will have three options after I install Fedora IoT stable and Fedora raw height in this case We are using Fedora installed because that's what the documentation says and we're gonna schedule and I'm gonna to pause the video Because it takes a little bit to to get them to get the SSH key provision anyways I'm gonna have this first is the IP of the return machine and See you in a couple seconds Okay, a few minutes has passed and I'm gonna try to re-login to the return machine Yes, I trust this and as you can see I just enter into the The new machine we've provisioned this device this virtual machine via Cessaric I want to show you folks as well how Greenwood is working. So we are going to do first and We're going to the first installation of HDTPD. So I can show you how the atomic upgrades work That's gonna install HDTPD I'm gonna pause the video until it's installed and It is now installed. Hmm. I'm gonna reboot the system because it is what's needed to In order to to get into the new deployment I want to make sure that we are able to see this. So I'm gonna move into this and Then now I'm gonna system settings and control reboot And let's see what happens here So as you can see now, there are two deployments. I hope you have what I will to see it And now in the new deployment we have HDTPD HDTPD.service and We have now this installed. Now let's test how Greenwood works and For that what we are going to do is we're gonna install ZSH and we are going to Create a script in Greenwood Check directory and we're gonna create it in the required script So this script needs to pass in order to for Greenwood to mark this new deployment as Or this boot as a green. So what we're going to do is make sure that SSH ZSH is available and it is present in the system and We're gonna now reboot and The next boot we are going to see if this Is has passed Okay, so that's rebooted that's reviewing and we have a new deployment with ZSH installed and It seems that everything went fine As we can see here. Yes Everything would find properly and everything is good. Now what we are going to do is uninstall ZSH and reboot and But we are not going to remove this script so in order for What will Greenwood is going to do is going to check if ZSH is installed and as it's not it's going to reboot the system several times until it marks the this deployment as attained and It's going to roll back to the previous deployment. So we are going to go now and see how that works Okay, so now it's trying to To boot with a new deployment There are some feelings here and it's going to try to boot again again. It has encountered some fails One more time or fails and now it has selected the previous deployment The one that was marked as green and now I'm gonna try to again And we can see here that this is a fall boot that acted the default rps RPM of the street deployment has been rolled back and as we can see this script as the ZSH has failed So and this is how Greenwood work. Well, and that's the end of the demo Come back to the presentation Just one quick note. There is a downstream supportive version of federality It's called roll for edge and has some extra features Which are the image builder? Which is a very cool tool to create blue blueprints of the base images that you want to provision your IOT devices with It has a well as well support for For that had insights and of course all the good stuff that comes with your real subscription If you folks have any questions, just find me. I'm Jay Noguera in IRC You can post any questions as well in the IRC channel Hashtag Fedora dash IOT and This is a list of the references that used for creating them for create this presentation I hope you you folks enjoyed it. Thank you very much for your time


So I'll just start with an introduction of the committee work, and I'll list off the committee members, and then I'll turn it over to you Alex to introduce yourself and your organization. And then we can just start jumping into discussion. Does that work for everybody. Awesome. Alright, so for everybody online. Welcome to an information gathering session for the committee on ocean acoustics education and expertise. We've had multiple information gathering sessions on other topics. Pirate education, ocean acoustics education, early career folks and a missing one workforce development. And so we had one on outreach also and Alex you weren't able to attend that that general outreach meeting so we wanted to make some time to speak with you individually because you come from a sector and organization that wasn't represented on the outreach information gathering panel. So that's sort of the background and us wanting to pick your brain about what is going well and what we could do better as a community in terms of ocean acoustics outreach from an energy sector perspective. So that's really the background of why we're all here today. I'd like to introduce myself. I'm Jen mixes old. I'm the chair of the committee. And I am from the University of New Hampshire where I am the director for the Center for acoustics research education. In order to be brief, I'm just going to run down the names and affiliations of the different committee members. We've got Andrea on wireless from Penn State University. Art bagger from MIT. Lisa huddling from Idaho's education. From the University of Washington. Carolyn Rupo from USGS. From the University of Rhode Island and Preston Wilson from the University of Austin, Texas. Most of our committee members are online today and this is being recorded for both the public and for other committee members that aren't online. So if you don't see someone's little face in the square right now. You'll have access to this video a little bit later. Alex, I think you've already been presented the statement of task for this particular committee and outreach really falls into number four exploring strategies to one raise the profile and value of careers and ocean acoustics, including education training workforce development recruitment and retention. And so we're really going to focus on those sort of outreach topics today, not research. And then that was the only other slide I had so I just wanted to keep this I'll leave this up there for just a minute or two so other people can read it from the public. And with that, I'm going to turn this over to you Alex for an introduction of you and your organization do you have slides to share. I do yes. Okay, then let me stop sharing. Here we go. All right, let me see. Share that. And hopefully you'll get the right screen if not please do let me know too many monitors. Hold on. I just moved so I have reconfigured my entire desk and now I'm trying to figure out my setup once again. Oh my goodness. Okay, hold on let me start over. However, if you just get to slide view if you don't want to do presenter we can still see your slides perfectly from before. This should work. Do we have it now. Nope. Just you. Huh. I guess I have to click share if I want to share. Sorry about that. Yeah, I am my family just moved up to Wisconsin this last weekend and so we're still kind of figuring out the the ins and outs of our desk setups because we've just been back to work for a few days. So thank you so much for having me. I really appreciate you making time for me. I was on parental leave while we had the last meeting and so the next generation of women in science is currently in daycare. So I really appreciate you having some time for me this morning. I am the scientific director for the energy alliance. Some of you may be familiar with us and our previous iteration of as the IGC we rebranded to the energy alliance in 2022. Just to update the name of the organization to something that better aligned with what we actually do IGC had become somewhat outdated. So we are the global trade alliance for the energy geoscience industry so our focus is on the exploration activities that come prior to any sort of energy development. What makes energy unique from some of the other energy geoscience trade associations is that we have number one a global focus so we work all over the world in country wherever we're needed. And we also are the only organization that has a full time scientist on staff in order to advise on issues related to the environment and specifically sound in the marine environment. Our governing members you may be familiar with so these are the organizations that conduct offshore seismic surveying and whatever form that may take. And we also work closely with the broader energy industry so here you see our industry partners. Primarily our focus has been hydrocarbon development but we are also beginning to branch out working with some of the offshore wind development and our intent is to also focus on carbon capture as that gets on board in the US so anywhere that there's geoscience involved energy is engaged. I like to show this graphic when I talk to groups because I think it's important to emphasize that energy and whatever form it looks like right now generally involves something going into out of or through the ground. And if that is something that we need to do then there is a geoscience component involved and I think it's quite obvious it's a short step from geoscience into a need for a strong foundation and acoustics so this is really something that's going to continue to be a challenge. 40% of the world does not have access to clean fuels for cooking and 13% of the world does not have access to energy or electricity at all as of right now. So I think it's easy for us to take it for granted sitting here in the Western Hemisphere the lights come on when we hit the switch. But really energy access is one of the most important aspects of lifting communities out of poverty providing access to education. And that energy need is going to continue to increase so by 2050 we're expecting total energy use to increase by about 50%. And that means that we need to look into a mix of energy resources whether that includes natural gas hydrocarbons nuclear renewables other alternatives. And of course carbon capture is going to be a part of that to in order to offset some of those emissions. So the reason why I'm so focused on acoustics and the importance of education is that we need to have folks that are able to look at a graphic like this and this is a seismic survey signal a single pulse. And look at that and say okay what does it mean for graphic like this. And these are two sectors that generally do not talk to each other very often so we need to be able to translate the acoustics piece and the propagation of sound in the aquatic environment. And the potential impacts to marine life and so that is somewhere where there is there's quite a gap right now and we're not seeing a focus on education in that specific area so I know for me I had a background in fisheries and a marine mammal behavior. But I learned a lot of the acoustics on the job and so I think given you know we've seen that the increase in energy demand is coming we've seen that the increase in global population is coming. And there's a real opportunity here to include that acoustics education piece and also the environmental education piece and those two communities have struggled to speak the same language at times and that really makes it difficult for us to accomplish what we need to accomplish as a scientific community but also as an industry. And so I'm very pleased to see that there is a focus with this committee on that and then I guess I'll just leave it there and we can jump into any questions and discussion. Awesome thank you very much Alex. Do you want to continue to share your slides so you refer back to them or do you want to stop sharing so we can we can probably stop it I can pop them up again if you need them. All right so I could start us off and then committee members might have other questions that they want to ask specifically either on a different topic of outreach and education or training or following up on what I ask so. Yes, I continually want to call it IAGC so I'm trying to make that transition. It took me about a year to get there so I can totally understand. So, as you are well aware, acoustics is a highly interdisciplinary topic. And so outreach is is quite interesting because as you said you did a lot of on the job training and learning in order to do your job well. And so I was wondering what does your organization or is there anything that your organization does to target outreach opportunities, knowing that this is interdisciplinary so where do you go for that and what do you feel has been most successful for your organization in reaching a broad audience in a highly highly highly interdisciplinary area. Even if it's an acoustic related you may have a really good example for something not ocean acoustics related at all but still a great outreach strategy and we're definitely wanting to learn from other interdisciplinary topics that may be doing outreach in ways that we can learn things from. Yeah, I think one of the most important lessons I've learned doing this job I've been here for about five years is that you don't win friends with science. That can be a tough pill to swallow for those of us who like to have the facts and the figures and see the numbers. So the key is the vast majority of the general public is kind of put off when they they're bombarded with information that they don't understand and so being a good translator is really critical to ensuring that folks are engaged and interested so we are typically not engaged at the academic level our focus is more on engaging with the general public. The key of the outreach that we do relates to community engagement and government engagement and we've seen governments all over the world the capacity for understanding acoustics and understanding the effects on the environment varies greatly we'll see areas like the US areas like Australia and a number of places in the EU where regulators are very competent they understand this and they have folks on staff who are acousticians and then there are other places that are developing countries I'm actually headed to Uruguay next month, where they don't necessarily have a firm background and how the acoustics and environment pieces interact. I think that's been the most important part for us is ensuring that we're meeting people where they are, and providing that engagement on a level that's appropriate for the audience and so the way that we'll talk to a government regulator that's well versed in acoustics and environmental impacts is going to be very different from the way that we'll talk with the general public. Another piece of that too is also ensuring that we're getting out and having these public facing conversations so whether that might mean you know we're, we're supporting a general outreach meeting we're actually stepping into this public engagement meetings. It might mean that we're doing things like documentary or news interviews to provide some foundation and some facts. I think the most important piece for reaching students though is that people just don't know that these opportunities exist. I certainly didn't know when I was a graduate student and that's that's a message that I try to drive home whenever I talk to graduate students now is that it's just not sufficient to be good at one thing anymore. Our field has just become increasingly interdisciplinary and so if you can marry those two pieces and have that background in acoustics but also the environmental piece. That makes you a really attractive prospect for job opportunities and as we start looking into the future when we have more environmental impact reviews to conduct. More of these types of public engagement meetings and we need scientists who can act as translators who can say okay you know, yes I understand the technical specifics but I can also bring that to a level that the general public can understand. That puts you in a really powerful position as a scientist to be an advocate for an industry that's going to be increasingly important as we move forward. Awesome. Thank you. You echoed one of the same sort of areas where we need to do better, which is you called it translators, a previous outreach information gathering panel conversation called it science communications. And so it's really the same thing you know translating that and you had a great point where people are at their level and that's important. So, your your answer reinforces the answer that we continue to hear other committee members questions. Carolyn has her hand up go ahead Carolyn. Hi, Alex thanks for that overview. I besides my science of the USGS I do all of our marine compliance and work with NSF extensively on the seismic components so some of what you guys encounter are the same issues that we encounter. So that that actually you started to actually allude to this and what you were saying you were talking about this different kind of outreach which is the outreach to the public to help them understand without getting into the science the facts behind things. One thing that has concerned us and I was an academic for a long time has concerned us in the community for a long time is that doing active acoustics work. I mean it's always constantly seems threatened to the people who are involved in it in the suit for the students to, you know, even 20 years ago, PhD students were saying why should I do this, because everyone's trying to shut me down right. So one thing I'd like to ask you is, in terms of the kinds of outreach that can both help. I'm not trying to get a job security issue here but I'm saying we do need acquisitions, and people are afraid their work is getting shut down. So instead of being reactive, I guess one thing be interesting to hear from you is how one can be proactive with outreach about what ocean acoustics is about how it's important, etc, and the timing of that and sort of some of the strategies. So a we don't get shut down, and, and be, you know we can further what mankind needs with with wall respecting the environment. That's certainly one of those places where you know I'm sure on your side working in trying to ensure that you have access to those authorizations it can feel like everyone's trying to shut you down for me working on the regulatory side I call that job security. And that is one of those places where you know the community is just there's there's a lack of information and there's also an abundance of misinformation about what acoustics is. So if you use the word proactive that's been my buzzword since I started at energy I actually put the word proactive into a name of a program that we launched a couple of years ago because that's something I've been trying to reinforce with this industry. I think for for a number of years we've seen the energy industry be highly reactive. There was this impression of well we're going to do what we need to do, and it's okay if people don't like it, and we're just not going to get out there in the public and expose ourselves to risk. And that's still something we see particularly with the large energy operators is they are extremely risk averse. They don't want that exposure and so that's where organizations like energy will come in. We really view our objective as being those science communicators for the broader community that you know those those companies that maybe aren't willing to take those risks have some cover, but also that they can point to an expert. I, you know, it is a challenge because we're living in a society right now where we're seeing kind of this death of expertise there's a mistrust of scientists and experts. And that challenge is working with some of these environmental NGOs that are willing to promulgate let's call it misinformation or disinformation in order to meet whatever those end objectives might be. So we see quite a lot of misinformation around what seismic surveys are because that's you know that's the easiest way to shut down energy development you shut down exploration energy development follows very quickly behind it. And there are some comments like seismic blasting is louder than you know whatever airplane taking off you know it's and it's just incorrect it's simply just incorrect. And so that's one of the most important places where I think the scientific community needs to get engaged is we need to be the ones that are out there in the community. We need to recognize that we're going to have to have some hard conversations we are going to have to talk to people that we don't agree with. And I think the key in this role is really building bridges with some of those organizations so trying to sit down at the same table with people that we don't agree with and have a conversation. That collaborative mindset has been very constructive in the past and of course you know there are always people who just are not going to be interested in hearing what you have to say and you have to be comfortable with living with that. I know that we have that collaborative and interdisciplinary mindset I think the more constructive we can be but it certainly is a challenge. And actually energy has a communications a public outreach campaign launching I think next month. And it's going to be called energy starts with me and so the focus is going to be kind of humanizing the energy geoscience workforce it's actually going to be interviewing folks that are engaged in those projects day to day and focusing on why we believe that energy access is so important to ensuring that the world has you know a high standard of living how we do this to ensure that it's done in an environmentally sustainable and safe way. You know I tell people all the time I'm a marine biologist I didn't go to graduate school for all of those years to try and kill whales and dolphins with the seismic survey if I thought that's the way that this worked I wouldn't be here. So my job is to ensure that we're doing this in the most environmentally sustainable way for the long term but I also consider myself a pragmatist and that means sometimes you know we have to have these hard conversations around look. Oil and gas is going to be a part of the energy mix that's just a reality and I frankly I would personally rather it be coming from somewhere like the US Gulf of Mexico where it's tightly regulated. Emissions are low per barrel rather than importing from the Middle East and so these are the types of conversations we have to have it can be a challenge for sure because these are not you know. These are not sound bites about seismic blasting killing the whales and we're starting to see some of that rhetoric off of the East Coast as well related to offshore wind. And so really just that education piece and being willing to have those tough conversations is what's going to be most important in the future. I love that you identified that one of the outreach components that we may not have highly highlighted or identified in previous outreach information sessions is the sectors or the discussions where people don't agree. With ocean the ocean accrued community and so that that's a really important part of outreach that again thank you for highlighting that that's not something that usually comes into my mind when I think about outreach I think of students and the public and so forth but not people who oppose that topic so that's that's an important sector or component of outreach that often gets overlooked that we're going to make sure that we have to capture in our outreach sessions. Yeah I can be tempting to slip into that echo chamber of I'm talking to people who get it you know you kind of understand but the reality is some of those conversations that I've had with people that I strongly disagree with have been some of the most productive conversations that I think I've ever had you know and it's it's important I think and there's a slip away from having those kinds of conversations and having a mutual respect with people that you don't agree with on a scientific basis and I think that's where our community can really set an example of look we can we can disagree we can still be civil we can still get along and we can still work towards constructive solutions and so I think the more that we can emphasize those conversations and share that with the public the more positive the overall outcome will be for everyone. Yeah that's a form of outreach we don't often hear and it really moves in nicely to the next topic is outreach related to DEI, because that that outreach with people you don't agree with is a form of diversity in your outreach going outside what's comfortable. So I kind of like that that sort of role into the DEI effort of outreach. Any other committee member questions. I know we don't have a whole wait for four minutes oh my gosh we're just talking about. Well I think on the DEI friend I just want to emphasize again the importance of mentorship. I have been incredibly fortunate I have had wonderful female mentors at every stage of my career and I would not be here. And so I think you know if we all have that mentality of a community as look once I get a leg up my first priority is to turn around and reach a hand back down. Making time to mentor those who are coming up and learning is just so critical because having a mentor that understands where you're coming from understands the challenges that you're facing. To me it was partly as you know a woman in science coming up as a young woman it was in a to an industry that's heavily male dominated that that was a challenge and so having people who have been through it. To talk through some of those questions is incredibly useful and so I would just encourage, even if it's not necessarily a formal mentorship program, having those conversations with with students is incredibly important. Preston, I'm going to give you the last question here. Wow, thank you. That was a great set of slides I really enjoyed seeing like, okay here's the sound field and here's the hearing thresholds, thinking about mapping those over so I think it was a good example. My question is about kind of a specific kind of outreach so. Are you all trying to kind of find people who want to make these processes better for the environment is that part of your outreach so you know, let me make a finer description of what I'm asking. You know, there are ways we could potentially mitigate environmental concerns by modifying, like surveys and other things that we do to kind of minimize exposure, while still getting the information we want so. Are you all trying to find people who would not have normally wanted to work, saying seismic surveys, but if they can do so to improve minimizing environmental impact that they might is that something you guys try to do. Yeah, thanks for that question press and that's that's a really good one to end on I think so we haven't been super engaged in finding people that don't want to work in seismic and trying to encourage them to come in. But a piece that we have been focused on for sure is ensuring that our membership understands the importance of environmental stewardship. We have a comprehensive environmental impact assessment guide that we publish it's about 450 pages and it walks through how to minimize or mitigate potential impacts from surveys, and step by step basically so I think that's where sometimes there's this confusion of well we're just going to do and that's all that matters but the focus is always on look if you can separate the sound source from the from the receiver that's always the best option. And so if we know that there's a time that there's a sensitive population there. We try and plan around that it may not always be possible because it may be you know there's there's operational reasons that you can't work in a certain season. But that's always the preference is minimize those interactions as much as possible and so I think that's where as a community we can focus on sharing that that is something that we do because I think maybe there's a perception that that's not how this works. But I think if we can share that with the public that you know this is something that our industry prioritizes and we understand the need for minimizing interactions for providing these comprehensive in depth mitigation measures and also recognizing that planning is the most important step of mitigation that in the field mitigation is the last resort. If we're able to plan around certain sensitive periods, then that's always going to be the preference and so I think our industry could do a better job of championing what we are already doing to encourage folks who maybe are hesitant or thinking that that's not something that's happening to participate in those conversations with us. Thank you. Before I finish up Alex, do you have any last thoughts that you want to share with the committee. Oh gosh no pressure. I would just like to end on the note of it's, it's encouraging to see that this is something that's being taken up this is something that I have been struggling with recently. I'm looking to bring on a new hire to somebody who can support me because I just do not have hours in the day, but right now I'm a department of one, and that skill set can be extremely difficult to find somebody who understands the acoustics well enough and who understands the environment well enough to speak both languages and work both ways but then there's also a personality piece that that comes into it. And so I think that focus on those interpersonal skills, those soft skills, learning to build relationships is something that we really need to encourage in our student populations. I know as a student I was so averse to networking and they're still a part of me that goes ah too much socializing. But building those relationships is really how you build rapport and from there you can have those constructive conversations and so emphasizing that with our student community is going to be really important moving forward. Thank you. I want to finish up to and say, if you, if something comes into your mind later while you're driving home or so forth, please drop an email to myself or any of the committee members that we will share amongst the committee. So, in case you something like pops into your head that you're like, I forgot this please don't hesitate to let us know. And if there is any literature that you could point us to within your organization that you can say hey you know this has really been one of our biggest successful outreach campaigns or efforts or material. Anything that we can have that we can share and archive for the committee would be fantastic. Absolutely. Let me get with our communications director on that because we have lots of public resources that I think might be valuable. That would be great. And we'll take the time to look at those and at least make them available to the public in addition to the written report that we write there isn't an archive of materials for for the public. All everything we do everything we collect is publicly available. And so anything that you have that could be helpful in in this endeavor we greatly appreciate you sharing it. And I very much thank you for your time. I love talking to you all the time you guys definitely have a wide sector of people that you reach both in the industry and outside the industry so I very much appreciate you spending this time with us today. Thanks so much Jen the feelings mutual and if anybody has questions please feel free to shoot me an email is just a Guerrero at energy alliance that work. Sounds great. Thanks so much Alex have a great day. Thank you you too. Bye.


And now on sports news, the Super Falcons of Nigeria have defeated the Lady Elephant of Côte d'Ivoire 1-0 in Abidjan to reach the finals of the 2022 African Women Cup of Nations Alcon, Nigeria. The nine-time African champions qualified for the 2022 Alcon by defeating Côte d'Ivoire on 3-0 aggregate, having beaten their opponents 2-0 at the Moschouda Biola National Stadium in Abuja on Friday after a break from Kotham FC striker E-former Onumono. And Falcons coach Randy Wildrum made two changes to the starting lineup from the first leg, bringing in midfielder Regina Oto and forward Francisco Odega, and this worked. Fresh news updates


George is an MCN. That's right, we can now partner YouTube channel starting today, December 1st is our first launch. We have so much to build, but I just wanted to share with you that we can now create a YouTube partnership network that will let you be free. That's right, a no lock-in contract forever. My promise to you as a YouTuber who never wants a lock-in contract, why would I? You will never have a lock-in contract when you partner with us at Freedom. That's the name of our YouTube partnership network. Freedom, be free. So much to share, so much to build, so much to create. I hope you'll join me on this journey as we build a new, better YouTube partnership network that's about being free, not locked in, having all the freedom to do whatever you want except one thing, and that's copyright. No, you cannot upload Britney Spears or Family Guy or your favorite movie to your channel at Freedom. That's the only thing you can't do, but everything else under my promise is that you will be free. I will be personally handling every partnership application. We have our own CMS. We have a direct relationship with YouTube. We are not a subnetwork or under any other network, we are YouTube and you will now get to see how that helps you grow when you work with us and I actually get to make the final decisions on all matters that deal with this YouTube partnership network. So I'll be partnering all the channels at the end of the process. I'll also be unpartnering all the channels. Anyone who wants to leave, you have my promise that you can leave for whatever reason at any time and I will make sure that'll happen. All right guys, stay tuned for a lot more exciting news. This is just the first of many great announcements talking about freedom and about how that helps you grow on YouTube. Join Freedom and be free. How? We'll let you know in the next video. All right guys, till next time. Zaijian, bye bye.