I didn't think this through ladies and gentlemen welcome back to the channel. My name is Jack the Buster I should know be today we have a sub 1771 of our one piece watch through in the last two We actually got some Kobe and how meppo development surprisingly enough and in this one I'm guessing that we're going to finally arrive on little garden and see what's in store If you need a channel chop a sub and let's hop into these bad boys title card right off the bat Little garden, how do you know it's the Grand Line?  Oh, they go over the bird or duck? I don't remember what it is. Where's uh, Nami. He's teaching him Oh hell yeah, wait, I have a feeling these are alcoholic or something and they're getting this bird drunk, bro Why does she look so upset?  They're all just so light-hearted Let's go Karu that's his name. Oh, that is a cute dolphin. How big is that?  That's so mega dolphin. I was nice of him not to land on the ship Why are they freaking out? Is the dolphin gonna do anything look at a word together though? I think she's seeing like how seriously they can take things just in an instant. Look at them go. Hell. Yeah Oh, they are trying to escape the dolphin Just faced with like an insane scale of something like that. They're all just chill about it They know what they need to do to survive Turn to port. Oh shoot. Is that it little garden now again It teased that there's like some large monster on this island. Oh Okay, it doesn't look like a huge island. He's scouted out more actually never oh never mind It's got like two volcano looking things a mountain. All right. Let's check it out What is this is that a resort on top of a tree that's the high life, baby. Oh Oh Mr. Three I wonder if this is where crocodile is the mr. Three is here Just vibin. Are they like technically not undercover? Yeah, I wonder how else they would be able to find out my goodness. Oh Panda in the back. I saw it Okay, so I'm guessing crocodile isn't here if they they're getting an order like through a letter.  Too Yeah, to them someone with the devil for powers and a big deal on the grand line I'm guessing he has one fully utilize it like you're just like straight up like battle confident with it I'm guessing Lesson so he's gonna be the one after him now, but how is he gonna find them unless this all Sunday tells them But she seemed to have like other motive. I don't know. She was a very interesting character Why is it called a little garden? Yeah, it's kind of large Tara incognita Yeah, she said it's unfortunate that you're going there then they should probably be worried I Feel like it's safe to assume on every island in the grand line. There could be a monster there Yeah, I think you're gonna stumble upon one for sure. They're all swirly It's hot dude His eye bro Usa I'm so kawaii bro that birds looking at you like food bro. That is low-key terrifying the eyes. Oh my gosh A lizard. What was that if I it's not like something fell It wasn't actually I mean I wouldn't be shocked because the two volcanoes that you could see from afar We were like smoking and usually doesn't that mean they're kind of like somewhat close to eruption? Or like it's a sign that they could be oh That's not too scary. Well, how big is it though that dolphin didn't look scary either, but it was the size of the Titanic times 14 Did you spit blood? Oh It was so beautiful. I Think it's too over exaggerate. What's in this forest the king of the jungle falls as soon as they get there Just stay here Even Nami doesn't want to go now. I mean, but like Sanji said they need food man. They need to restock Luffy wants to explore He's itching He's like shaking bro Let's go. That's my emcee, baby Adventure Let's go.  Oh Oh VV's about it. Hell. Yeah, I love how he's just That distract herself a little bit true. I hope things are going okay and all about so I feel bad for VV Yeah, I knew we'll defend a lunch of love Is that just gonna be like a news thing now is drinks I just like how invested they were the fact that they could teach him how to use a straw Oh, I made him a little a little knapsack and it got to do a drink. That's so cute Sanji MVP, baby Yeah, true actually. Yeah, I'm surprised Zoro's not going. Okay. There you go. I figured that's about his speed Don't want to walk alone. He's gonna sit him on an air and find something a pure edible No, oh no The ego battle, baby Wait, so they're both leaving the ship, too Bro Navi and Usob are like sitting ducks now if they're attacked and they're both Both a bit scared to leave. I think they'll be fine on the ship though Don't cry.  Oh She has oh shoot. Oh, no I feel like she's gonna find something really dark out about the island and it's gonna be like too late because they're already gone And I was about one Pokemon squid shellfish. This is the Pokemon like ammo something I don't remember. Yeah, this is such a bad idea low key. Oh Surely Literal like t-rex bro. Oh my gosh That's a large beast to take down though that'd be good in his competition and if he just one shot it like that doesn't matter What's the world can find though? Oh? Dude, these are literally dinosaurs. What is this Jurassic Park? Where oh? My gosh. Oh, I forgot the name of it a bronze Montosaurus something. I don't know.  Me so this one just stayed in the dinosaur era. I mean that's not inherently a bad thing Is it kind of interesting of anything? Oh? No, he's gonna try to like ride it or something. Oh my goodness. I think those are aren't carnivore They're herbivores though. I think he's fine How rude not to go down in one kick.  That's kind of hurt this forget. Uh, do I call it a t-rex? I mean it is large and has like small small hands Oh my gosh He's like I order you I still think Sanji's t-rex is bigger, but they said kilo says like weight is a weight-based battle I guess if that means more meat the heavier it is well not necessarily well Maybe yeah, actually yeah, I don't feel like they're gonna be like neck-and-neck like they'll be the same weight or something That's what we saw we saw a footprint that looks like a person bro. Oh, that's what you read in the book Yeah, when it first sees the island it showed a footprint, but I thought it looked like a barefoot. That's why I said bigfoot What is it? Everybody else is too far away to hear. Oh, maybe not took the bat signal for Sanji It's like a little garden Lui or note discovered little garden, huh? I wonder if so he said he would describe it as a little garden Maybe it's like gigantic like a gigantic person that takes care of the island like a garden That's my only guess that's like the way that's why he's describing it in that way, but that looks terrifying It looks like a Viking bro, it's straight up looks like a Viking from his shadow.  Oh My Brogy we just beheaded it with one swing. Brogy's a freaking baller Thank you. He'll feed us for years. I'm guessing he doesn't get visitors very often They're like a boss. I'm small Great view for lunch. I Love this birds like a facial expressions. Yeah, those look like they're about to erupt I have a bat mounds with huge holes Like is that from like volcanoes erupting? Yeah, he seems nice. Look at him I'm a feeling it's like eluding to the fact that it's gonna be like how the dinosaurs ended up with the volcanoes destroying everything I don't think he can understand look not a thought behind those eyes, bro He just eat eat leaf Loopy he's just minding his own business Those horns. Oh my goodness gracious. Those are large. It sound like horns Maybe there's more people I feel like there's more people here because Broggy said I'm the strongest like I don't remember what he said But I'm guessing like of his people No, those are other dinosaurs They're so cute long boys That's always worried about I think he's like Luffy was like picking on like the baby or something Yeah, it's way smaller than all the others. Hey, these these ones look mean though. Hey yo Maybe not not these at least it's like bronzo or brocchio I don't remember Luffy's just having a good time Because even if he falls all the way to the ground it wouldn't hurt him She's like no, I'm good She's getting a real look at the who Luffy actually is Maybe just seeing him narrowly avoid death every five seconds. That one's all all scuffed up It's got a bunch of scars they landed on one of you the thing with the holes in it Is either from like other like maybe the volcano erupting like oh, it's like kind of like a skull in a way Yeah, that one looks way meaner Well, and that was it. That's the show Luffy dives to a dinosaur. Oh, okay. Yeah, we're good never mind. Oh Oh more of them. Yeah more warriors. Oh, these guys are wait.  Oh Wait, he calls himself the strongest warrior Elba Yes, are they straight up just giants He's like intrigued intrigued by him. I'm glad they're on these guys good side at least. Oh, no He's giving us up Yeah, yeah, yeah, yeah, yeah. This is so chaotic. I'm here for it.   I guess I would be petrified too.  Oh, oh, no, they're gonna try to run away I don't think he would stop them though. He just wanted to treat them to food Stop so goofy bro. Look at this man This is running maniacally. Oh, he's gonna turn around be like where'd they go? I feel like they're like 10 feet away and he can just like look over and see them guys You probably wouldn't feel like a millionth of his stomach. He needs dinosaurs. Oh Well, you need him now Yeah, why don't you goofy goober's bro? There oh a bigger fish to fry For the same or two tigers Another giant. Oh, it's him. He's just wants more food, bro. He's like guys Yeah, no wonder the the tiger at the very beginning was like the smallest fish here Yeah, he's trying to be a good a good host just accept his gift.  What else are you gonna have the opportunity to try dinosaur, man? They're so dramatic guys. Oh My god, I know waste of a good chunk of dinosaur Maybe we can escape Meanwhile, Sanji and Zoro still probably like fighting to find the bigger animal. Oh My gosh No shot. Okay guys.  Oh, he gave him his meal. That's so cute He said oh shoot wait. He got serious fast. Oh my goodness. I don't think Luffy was joking though, bro Yeah, I'm wondering the same. Oh buff. Yeah. Yeah, okay. Oh So they're from there, but it's not here What? Oh Him and the other guy. Oh my gosh. I'm gonna be honest. He looks way more intimidating than the other guy I think it's the facial hair though, but also that's sword. I guess the other guy had the axe Hundred years man Yeah, what why what are they even fighting for just honor so they just chill until they find each other Or they have fights and back off. There was no way he is dragging that. Oh, no, there's Zoro, too I guess I have a feeling it's gonna be the exact same weight. Oh, there they are Hey They're both confident. Yeah There's no way to check it.  They're both around the same size I mean like length doesn't matter. Oh No No shot will they target like the Giants, right? Is that cannibalism? Oh, what did I say there it goes? Okay, they got time on it now Wait, why do they like fight every time it explodes? Oh It's I just started glowing was that just like an exaggeration effect. It's showtime. Yeah, I think they do fight when it explodes That's my guess So just every time they fight they just doesn't resolve Oh, why are they so casual about it 100 years and they don't even remember I would love to see this duel That's gotta be badass. It's ridiculous. It's absurd. Let's hear a member. Oh, is it straight up? Just honor. Oh shoot Here he comes it is it's pride. Uh, dang dude.  What happened took his breath away Wait, is that what is that? Is that bait? Oh, oh Shoot they're here.  Oh the plot thickens, baby. What is this thing? Is it a house? Oh It is a house. Oh, they're here Man Okay, how strong is mr. Three then well, who's the other girl? I'm assuming it's another miss something Oh, they're wanted you should have helped big as the bounty Dorian braggy Like they're not wanted anymore. He's like two birds one stone hundred million per head. Oh, man Does that bounty still hold up then? What and then like split the amount of berries cut through any mountain Mr. Three has quite a bit of confidence I'm very intrigued to see what he actually does but nonetheless We are introduced a little garden in a fantastic way I like the concept of these these two soldiers and how it kind of so slowly came to realization that it's they literally don't know What they're fighting for it's just pride and that they've been here for a hundred years just because of that and their spirits are still high I don't know. It's kind of wholesome to see and just a sheer scope of the fight in general I knocked Luffy away. He loves that kind of stuff just fighting in general, but at this size It's absolutely insane that guys has been from some 70 and 71 of our one-piece watch through drop a comment down below We thought the episode we thought my reaction and as always I hope you have a wonderful rest of the day as per usual I'll catch you in the next one base base


In this episode, you're going to hear what's getting in the way and limiting how impactful design is in enterprise environments. And most importantly, what do you do about it? Here's the guest for this episode. Let the show begin. Hi, I am Tricia Wong, and this is the service design show Lucky Episode 123. Hi, I'm Mark, and welcome to the service design show. On this show, we explore what's beneath the surface of service design, what are the hidden things that make a huge difference between success and failure, all to help you design services that make a positive impact on people and business. The guest in this episode is Tricia Wong. She's a tech ethnographer living at the intersection of data design and digital, obsessed with discovering the unknown. She's the co-founder of Southern Compass, where they look for new ways to turn insight into action in a data-driven world. The reason I'm really excited to have Tricia on this show is that we're going to discuss how designers tend to get in their own way in enterprise environments, often without realizing it. We're going to look at anti-patterns and discuss alternative solutions to them. If you stick around until the end of the episode, you'll know why and how you can become more of a guide and less of a guru as a designer. If you've just discovered the service design show, welcome. We're at episode 123, almost five years in. We bring a new episode like this every two weeks. So if you enjoy these conversations, make sure to click that subscribe button and of course that bell icon so you'll be notified when a new episode drops. Before we jump into the chat with Tricia, I want to give you a quick heads up. There is some strong language in this episode. So if you're listening with your kids around, now would be a really good moment to put on those headset. Having said that, it's time to sit back, relax, and let the show begin. Welcome to the show, Tricia. Hey, thank you for inviting me. We finally did it. We finally did it. It took a while, but I'm happy to have you on the show. Tricia, for the people who are watching the video, they see some boxes. What's going on? Yeah, this is my Zoom background. In this Zoom background, what it's saying is that it's the mood for moving. So that's why I put it on. It's not actual real life. It's much better than those virtual backgrounds where you're on a beach. So I prefer this. Tricia, some people might have Googled you already and if they did, they probably came across one thing you're famous for on the internet. Can you give us a hint? What's that? Let me guess. Would it be thick data? Yes, and especially there's one video that got me really excited about also chatting with you. Yeah, would it be the TED Talk? And I just checked today 1.8 million views. So it's awesome. It's a really good talk. I recommend it to a lot of people. Check it out for yourself.  Tricia, I don't know. How long is the TED Talk ago? When did you do it? I think it was a couple of years ago in 2016. I introduced the concept of thick data. I think it was then? Yeah. And what do you do these days? I do the same thing that I was doing back then, which is my company, Set and Compass, we work with our clients to make sure that they're making decisions, using data in the most human-centric way that all of the things they do for building products, making marketing decisions, it starts with the understanding of people. And so we've developed a whole practice called Unlock Sprints that we teach. We've open sourced some of those things on Google, so anyone with Google Design, so anyone can download it. There'll be links in the show. But we're very much committed to open sourcing a lot of the tools that we design so that other people can use it. We don't want to keep that as our secret sauce. A lot of consultants are very protective of what they make. And we're like, no, we're here to open source it.  Awesome. I'm happy that we are going to have this conversation on the show. I'm expecting some firework, as I said, based on the sort of the outline that you shared with me.  So the goal is to answer these questions as quickly as possible. Are you ready? No. Let's do it.  Because it's never the answer you want to give, usually. We won't do a take two. So it has to be now, Trisha. So question number one is, what's always in your fridge? What's always in my fridge is oatley milk, because I love oatley. And I fell in love with oatley before anyone else in the world did. It comes from Lund, Skona, Southern part of Sweden, the best kind of oat milk ever. Got it. Noted. Which book are you reading, if any, at this moment? I am reading Barbara Smith's incredible book called Ain't Nobody Going... I forget the exact title. I'm going to butcher it, but you'll find it in the show notes. We'll add it to the show notes. Ain't Nobody Going to Let... Ain't Nobody Turn Me Around. Ain't Going to Let Nobody Turn Me Around. That's it. It's added to my read list. What superpower would you like to have? To melt people. Yeah. Okay. A note to that one. And this one, what did you want to become when you were a kid? What did I want to become when I was a kid? I remember I wanted to become an astronaut. Well, still possible with people like Elon Musk these days. I am an astronaut. I mean, that is the first line in my bio intent is that I use astronaut not eyes. I think that the earth of humans is just as exciting to explore as the surface of Mars. Human beings are the unknown. They are the last in final frontier. So if someone's going to figure out humans, you let me know. That can be a theme that we talk about today is that no machine can figure out human beings. We are truly the last and only frontier that is going to forever remain a mystery. Forget about AI. We have to use honor means. Final question. Do you recall your first encounter or memory of service design? Yes, I do. I remember very, very crisply. I was living in China, living in Wuhan, where I had a research center. And I remember for the first time I read Panthea Lee's incredible post on reboot design, which is one of the first service design firms that were she founded in order to change the way people design, to undo the long procurement process that's bureaucratic. She wrote this incredible blog post that said, what is service design? And I was like, I want to get to know this person. And her work is incredible. Follow her on Twitter. She really is one of the best writers out there on service design and who will talk about the ins and outs of it. And she showed 124. Got it. Well, 124 is already taken, but we've got many more to come in the future. Thanks for the tip. Awesome. I haven't heard this background story often. So Trisha, let's migrate into the theme of our conversation. And that's going to be the way you phrased it, is how to elevate design in an enterprise context, right? Correct. Yeah. And the thing that makes it interesting is that you have a take that service designers get in their own way of actually doing that. Now, we're going to reveal what it is and why you think that that's the case and what we can do about it. But first of all, I'm curious, what do you mean when you say moving design, elevating design in enterprise, and how did you come to value this topic? Well, as someone who didn't study design and as a consultant, what I see, what I saw happening as someone who was not formally trained in design, I think I was freed from all of the pretenses that designers often come in with hang-ups, you know, and like of what a formally trained designer should do. So I had no definition. To me, being a designer was always seeing the world from a new perspective, designing experiences. I didn't have a formal definition to say that design was only UX. Design was wireframing. Design only was mainly prototyping. Design was experimentation. It's like, to me, design is all of these things. Design isn't just innovation. Design is also looking at accounting, you know, and changing design is also the work that a CFO does. And so when I started consulting, you know, I always had a design mindset. Even though I wasn't formally trained, I've always worked around designers with designers to the point where I feel very comfortable saying that I'm a designer myself. And I have a design mindset. And when I started seeing as a consultant that I said, you know, I said, I want to become a consultant because, one, well, first it was very practical. I couldn't find a job. When I was on the job market, I wanted a position that would allow me to work with quantitative and qualitative data. I wanted to, you know, I didn't care about the title, but I was like, at least I want to be accountable for integrating that and making sure that whatever business question that, you know, is trying to be answered, whatever product is being designed, that these two things are being brought together. And I was always offered the position of like, you can be the head UX researcher, but it didn't involve quantitative data. There was no accountability to it. The data scientists were in another room. I didn't have any connections. I was just like, I can't deliver, you know. And so I started consulting and I said, where is the power? Where, if I want to design equality into systems, enterprises are big. And that's where a lot of decisions get made. And I think design has a humongous role in that. So take us back to the moment where you were in those positions and weren't able to make the impact or influence the decisions that you wanted to make. What happened there? So I would say that before I went into consulting, I was, I was working in research and I was at the research lab in Palo Alto for Nokia. And this is part of the theme of my TED Talk. So you'll, when you hear that, it's essentially me recounting what I failed to do, you know. And so I, I remember that I had, as a researcher, as an ethnographer, I essentially surfaced an insight. I surfaced data points and emerging insight about why the very thing that they thought their company would forever sell, which is feature phones and to the clients that they thought they would sell to, which is a low income people around the world. I told them that this would change, that they would want smartphones, that smartphones would be here to stay and that they're, that one day we'll have affordable smartphones. And I took a design mindset to that and that I was like, well, the design mindset means you come at things very openly, you know, and I had said, in order to, to iterate on this insight, I need to work with quantitative data and I want to be able to start prototyping what that future phone would look like, you know, what, what kind of features would serve this community that's not existing in current product right now. So there was a lot of things I wanted to do, but I remember I ran up, there wasn't a value for design within Nokia, it was a very engineering led company. And I remember I just got a lot of pushback from like, I could even find out where the designers were, what department they were in, I could even figure out who had the quantitative data from the marketing or from the analytics side of who I would talk to back then, it wasn't called data science yet. It was, you know, pre data science, but there were people who worked in analytics. And I just remembered that they didn't have, even though I was working in an innovation lab, they didn't have a design mindset to being open to the unknown and to create new realities. And I think that's the responsibility of a designer to always keep the company as close as possible to the people. And I, I failed and that you can say it's like I failed, but they just, they couldn't, they couldn't hear it, you know, and I couldn't find the right people to work with. Yeah. Yeah. And I think the story already resonates with a lot of people. I'm curious. Okay. So you get into the situation where you're not able to get the rest of the organization to follow along or to at least join you on this journey. At which moment did you feel like, okay, it's not them, it's me who's having the issue because that realization has to come in order to look for solutions. I mean, I think it's like, you know, when I say I failed, that's like putting it all on me on the individual. I don't think it's on me. I think it's institutional, it's infrastructural, we are in systems and so they're complicated. I think, but I did have to look at what you said was just like, okay, aside from all the institutional infrastructural problems, what can I do? What could I have done to make it better, right? To make it even easier or to try and do things differently? And I realized one of those things was that there was no shared language for talking about data to value qualitative data because their reaction to me was like, you're just an ethnographer, you were living in China for like 10 years on and off and all of a sudden you say there's a big change and you talked to like 20 people last few months, regardless of how, you know, they associated that number with a very lack, a lack of meaning or lack of understanding. It was just like, but there was no shared language to be like, well, actually I spent hundreds of hours and you can't even translate that to like a data, a quantitative data point because I have really deep understanding and I just didn't even have that language to and then people didn't even know what qualitative data was. They didn't even know what it meant when I was like, let's design with qual and quant or like they just didn't appreciate it. A lot of people didn't know what ethnography was, qualitative interviews, UX research, these are all newer terms. More people do know it now because there's established departments in the field, but you have to imagine 10 years ago, no one, like people still didn't know what UX was, the service design was, totally new fields, right? And so I was just like, I'm not here to invent a new field, qualitative research is the thing, market research is the thing, you know, people who do this work, ethnography, anthropologists within corporations, that's the thing. But what I can do is create new language to make it really easy and make it so sexy so that data scientists and engineers and business decision makers can understand within 30 seconds what I'm talking about when I say you need to integrate qualitative and like just as, and value it just as much as numbers. And so I remember that was a moment where I'm like, I want to introduce new, a new conceptual framework and new language to the world for everybody to use. And that's what I love.  So I was like, you know what, if your data is big, then my data is thick, you know, we'll just talk about it. And it's like, and you don't compare it's apples to oranges, we can value it and they they both offer different things. But now it's like I can pitch it and make it sound just as sexy as big data. And that helps that that term has caught on. So and it's caught on where it's disconnected from me. I just want to say like it's really important for people to know that as a movement designer, I am not attached to the term thick data anymore. And that to me was always success. That was what I said from the beginning, KPI is that I will be successful people don't always cite me that there are going to be like jobs for thick data capabilities, thick data scientists. And I see that out there. Now I talk to people and they don't even know I'm the one who came up with the term. And I'm like, that's awesome. So a lot has to do with language about a lot has to do about creating common common ground, building bridges. I think that's what we should be really good at as designers. But the way another sexy phrase or word that you introduced to buy language was anti patterns. Right. And we I didn't make that up. That's like sure. No, okay, that's fair enough. And I'm patterns have been known for quite a while. But anti patterns in the way that service designers or designers in the non traditional design space have developed for themselves to prevent them from actually becoming more impactful within organizations, right? And how did you come to observe these anti patterns before we dive into very specific ones? So, you know, through our consulting practices that encompass we get brought in to coach a lot of designers to elevate their practice, to elevate the work. And it's not that like they're not doing amazing work. It's not we're never usually we're rarely ever teaching people how to do better design or how to teach better research. Actually, I would say 100%. That is not our work. What our job is as consultants, you know, at certain compass is we're teaching people how to communicate the work. That is the problem.  And that's incredible. But when you get put into an enterprise environment, you have to somehow balance your soul as a designer, which is to create things and like live in your mind and like create these new kind of landscapes and features and products to an enterprise setting, you actually have to collaborate and it doesn't work in that old way when you were working as an agency or on your own. Yeah, it all comes down to communication and collaboration. That's a whole different set of skills that I don't think that designers are taught. And that's where I see the anti patterns coming up of getting in their own way. Amen. There's a reason why I started a course called selling service design with confidence to bridge that gap between designers and business people. And I think. Yeah, you know this work more than anyone, right? You've been, you've been teaching this. Yeah. And I guess the, oh, it slipped my mind, but you mentioned something. Gosh, it sometimes happens in these conversations. I think we're going to share a really interesting wake up call because I would like to invite you to share one of those anti patterns, which I think you're deeply passionate about. And yeah, tell us more. So one of the anti patterns, you know, one of our goal is to see that, that I think in order to elevate the role of design with an enterprise, designers have to stop being obsessed with being the gurus and always designing the bridge. What do you mean with being gurus? Let's unpack that. What is that? I mean, I think designers used to being like, I made this thing. What do you think? Like I did it, you know, and I came up with the idea. You told me a problem and I'm here to solve it. That is what designers are trained to do. Give a designer a problem and they will come up with a solution. But I think designers have to move from like, you know, using your metaphor of like, you're not, you're not just building the bridge anymore when you have to work in an enterprise setting. And I'm just talking about enterprise settings. I'm not talking about designers in the wild who work on their own who are agencies and blah, blah. I'm talking about in an enterprise setting, you have to move from being the one who designs the bridge to being the one who helps people conceive of what is that linking point between two gaps? It may not even be a bridge. It may be something else completely. It may be an airplane. It may be a supersonic, you know, atomic zapper. I mean, my point is, is that like in order to get to that idea, though, you would have to sell it in and you have to guide people to that. And so your role becomes more of a guide to get people to imagine the unknown, to imagine new, new futures. And that's why the designer has to be so close to the customer, to reality. And I think there's many anti-patterns that get in the way for designers to do that kind of work. And it's anti-patterns that are created through education, through habits, through the things that we read on medium, right? We're in that bubble and we need outside in perspective to show us that these are actually anti-patterns. Let's dive into one. Do you have an example? What is an anti-pattern? Yeah, so in order, well, before I get into the actual annotator, I want to explain what it means to move from a guru to a guide, because I don't want to obsess over the anti-pattern because it's just like a symptom, you know? But in order to move from being a guru to a guide, I want to give some examples. You're not just designing the product, but you're helping shape and conceive of the product and guiding people to it, right? Whereas traditional design is all about just using qualitative data. And I think to shift in an enterprise setting, because it's so numbers-driven, because it's all about KPIs and metrics, you have to get more comfortable with integrating qualitative and quantitative and working on that from day one. I think designers have to stop being used to always having to give the answers and coming to meetings, asking questions, and guiding their PMs, guiding their business decision makers to what that future bridge or thing would look like. And I think those are the kind of shifts that need to be made, and just the mindset just changes because you're no longer being precious about what you make, you're moving into a more iterative way of working. So let's make an assumption here. The reason why it's not happening is that a lot of the self-identity and ego of designers is tied to the things they create. And though it's really scary to let go of that being in God mode, as you will, to create and come up with the solutions, is that one of the reasons why it's holding us back? I mean, I would say so, being a whole new way of working means that you're no longer the center and it feels like you're giving up power, but actually you're augmenting your power to bring people together to design something better for the customer. And so this is why it's so important that the designer moves to the role of creating new perspectives and not just bringing their perspective. Exactly. Yeah. And it's so scary at first because you start to sort of think, what's my value? What's the thing I'm adding by just asking questions or guiding people or showing the process, but you just have to go through it and experience it. And then that's the only way to get over it, right? That's at least how I've experienced it. But it's super scary at the start. It is. And like, so, like, you know, one example of an opponent, when I really wanted to talk about today that I've like just, it's just been like a thorn, you know, where I'm like, I want to address this in what I've been interviewing people about is the anti-pattern.  It's so known that it's now just HMW that any designer knows any innovation department function knows what you mean when you write HMW, right? And it's the hell might we and it is, I think is one of the worst anti-patterns. What is your beef with how might we? Okay. I don't, and I want to be clear, I don't have a beef with the how might we itself because I think in its original purpose, it is still very useful. And I still use it sometimes, you know, when appropriate. And its original purpose, it was just to open up people to new ways of thinking so they weren't just stuck and especially to open up non designers. That's a very useful starting question. My beef is how it's used. It's currently used and so misunderstood and so overly used. And by who use, my beef is also with who uses it. So let's just tackle those two things separately. I will go first. First, I will tackle the, the who let's tackle who uses it. No, no, let's talk about, no, no, how it's used first. And then we'll go how it is, how it is often used because in its original use, it was just to open up people to, you know, new ideas. The way I see it used now is that leaders are weaponizing the how might we just to push their ideas through. And for example, you know, I, I also see people just seeing like they end the presentations on how might we like when you have nothing else better to say, they'll just end like what the, what the slide on how might we, and I'm like, are you joking? Like how is a business decision maker or a product, you know, manager supposed to do something with your how might we, you need to give actionable steps, but were you just too lazy to think through or did you just get tired and I get it, you know, and, and, and so that's oftentimes I see that how might we being used, or you see that how might we just being restated, you know, where it's like a group is figuring out how to design an app and you see how might we being like, so how might we design a new app? And it's like, why are you using that? Like it's just like literally a restatement of the question. And, and so I think this gets back down to like, the how might we is just so overused. And part of the issue is I think who is using it? You know, the who is we really have to examine who was the we and the how might we.  It's mostly upper class middle upper class, oftentimes white or Asian people in a room and they assume they automatically assume that the we refers to them. So I'm going to interrupt. Yeah, I'm going to interrupt you here because that's one of the things that I realized when preparing for this conversation. The the we doesn't reflect the the end user we're designing for it actually reflects we the people in the room. And in that sense, it's not user centered at all. It's me centered. It is we centered. Yes, the people in the room, not the people outside of the room. Yeah. And what it creates is this fake sense of empathy, right? Because it's like, oh, we asked to how might we so we feel so good, you know, we're actually thinking how might we, you know, like I've seen it be used for like a group literally asked how might we reduce poverty in this part of the country.  You know, I don't want to shame people for it. But I think it's just like, that's why I think it's an anti pattern. I think a lot of people when I talk to them about they're horrified. They're like, you're right. I actually didn't realize I was using how might we that way. It's like a tick for designers, you know. So to which extent is is it just semantics versus if people are doing this from the right perspective or right intention, like, does it really matter how we phrase it? Well, here's the thing.  And she was like, I love that out my way. She was like, I use it. And I don't she's like, when I say the we, I don't think it's me, you know, or the people in the room. But you see, she comes at it with that mindset. So it's not just semantics. It's like, how do your what is your interpretation, the context of the we. And I think it's of no surprise or coincidence that Veta being a black woman who has had a diversity of experiences, you know, of racism, of sexism, that she obviously would never be presumptuous enough to think that the we is just her to figure out all solutions. She has a more inclusive sense of the we. And that's the that's sort of the wake up call, I think in this conversation that if you haven't thought about who the we is, then now would be really a good moment to start doing that or to ditch the we in general, in this case.  You were taught this drug from a very young age of your design career. And so it's okay. I just want to point it out that it's like, you're participating in something that is a larger project of expression of colonialism of, you know, of of where you assume of like even America's way of like spreading democracy. It's like, we assume in this very Western-centric way that we have the answers and we know better. And we're going to fix your government, we're going to fix your company, we're going to fix your product. I think it's all part of the expression, the same issue that you think you can solve it all without without actually talking and understanding that people who are expecting these things. So let's, let's start this back to the first topic we started with. And that is elevating design in enterprise context. We went from killing the how might we, because we want to be more guides, less gurus, and that that helps us to find a stronger voice in an enterprise context or how would you sort of connect the dots? Well, how I connected dots is, look, you know, in an enterprise context, it's even more complex because you have more users, you and a company, you have a product that serves way more people. So you have to be that more attentive to who is the we in the room and who is the we outside? Who are you addressing? Who has the right to say that they represent the voice of the customer? And what a guide does is they would never say, I am the voice of the customer. A guru would say that they would say, I've talked to the customer, I've done X studies and I'm the guru, you know, you have PMs who say that you have UX researchers who say they fight to represent the voice of the customer. And I get that because after you spend a lot of time with customers, you realize you want to like stand up for them and defend them and be like, no, no, no, what you're doing is all wrong because I talked to the customer. That was real time. I spoke to real humans. But what a guide would say is, let me enable you to understand the voice of the customer as a guide. I'm here to bring all of you on the journey so that we can all understand the voice of the customer because that's going to speed up the design process and the product development, you know, timeline. That's what a guide would say. They don't try to own the voice of the customer. Got it. So what have you found to be a viable alternative for the how might we? Yes. Well, my thing is like every time you want to just use the how might we just be like, what I would advise that you just do is just all you have to ask is who should we, WSW and why are we WAW, you know, and those things will help you like even if you do the how might we then you'll start to answer like, well, why should we do this? You know, why are we taking this approach? I mean, that's why I think you are then using the we explicitly. It's like, we are pointing to the we, why should we take this path when it comes to design? Why should we? Why should we take this path and design? Why should we choose this timeline right or choose this option? And then the why are we it forces you to answer why are we pursuing this? Why are we doing this? And so in these two cases, the we is pointing to the people in the room. Got it. And then and then there's another one where I always say who else, you know, you should ask yourself, who should we talk to?  So that way, it's not just like, you know, us in the room of the why are we and why should we, but it's like, who else should we be talking to? There's all these like little plays on it. And I'm not like trying to say, you know, if you only if you don't say these things, you're screwed. But my whole point is just to say, I want you to be intentional about when you're thinking about the we and to be intentional about about bringing other people into other customers and users or, you know, cross functional partners process. Yeah, creating awareness around this, because if you don't, like you said, it creates maybe a false sense of empathy that creates when you own the voice of the customer, it's an us, us against them, you as a designer versus the other people in the room. There are a lot of negative consequences of having dead stands. Yeah. So yeah, go ahead. And I think like a lot of people have been wrong about this is not just me who are talking or critiquing about the problems with empathy. You know, Panthea Lee has a really great essay about this. Darren, who's own wrote design thinking is a rebrand for white supremacy. You have Bruce, you know, no spams design thinking is a failed experiment. So and then you also have, you know, design thinking is kind of like syphilis. You have all these critiques, but I think like, and I think that's all important, but I think all of these critiques of what they're, what the hell might we as part of this problem, you know, that they're all trying to point out, which is why is design thinking so not willing to admit that it is lax diversity? Why is it the designers who claim to represent people's voices are so not willing to look at themselves? And I think these kind of anti patterns are, are the things that get in their way. And this is why I'm looking to organizations like project ink block that really talk about diversity and design, or you have Antenoy Carroll's, you know, creative reaction lab where they have their very famous and popular webinar called how traditional design thinking protects white supremacy. We need to have more conversations like this and have real conversations about how the very tools that we thought were near and dear to designers perhaps could be getting in our way and that we have to look at them and use them, use them with more awareness. Wow. A lot of people, I think, will be listening and sort of there will be a voice in their head saying, but I know I'm doing this from the right intentions. I want to do good for the user. It's like, it's coming from a good place, I think, with a lot of service designers, at least the people who I meet. Like, what would you say to them? I would say that good and bad is a false binary and that a lot of murders have been committed in the name of goodness. People spreading democracy, colonialism, hundreds of years of empire building was all done in the name of saving people. So I would advise us to get out of the good and bad binary and say that's like, it's not, I mean, your intention is great that it was good, but what I want you to look at is it's not, this is not about shaming you, you know? Like, I don't think that you should be like getting me to acknowledge that you are a good person and you did this with good intention. That's not that you don't don't search for. I think designers want to be like, did I do a good job? And it's like, don't search for that.  And part of that is developing an awareness and muscle for assessing what kind, you know, something you've talked, you know, I've talked about this slide. It's like, what do your networks look like? Who are you, the people you're inviting in the room? I don't care how good you've tried to be, you know, that's awesome.    Could you share a few of them? Yeah, so we have, there's three things I want to share that I think like to, you know, one is we've developed this, my business partner, Matt LeMay, who is a well known product manager and leader in the space, developed a tool, it came out of, actually, he developed this tool for himself and for us, it's called One Hour One Page. And it's a website, One Hour One Page.com, and you can go sign the One Hour One Page manifesto. But what it means when you sign the manifesto is that you pledged to not, that you promised to spend no more than one hour or one page before you share something out. This is such a simple thing that changes how teams work. And we did it for ourselves, because we were like, I was like, I think, I think one time I was like, Matt, why did you work on this deck for so many hours?  And he would give me the same critique and be like, blah, blah, Trisha, I don't think this works. And I'm like, but I spent a week on it. Don't you see? And I designed this deck. And it's like, well, he's like, why don't you just talk to me earlier. So we're like, you know what, we're going to have a tool called One Hour One Page. You can do the work, but you have to share it. You have to be okay with sharing that. And so now we make all of our partners sign this tool called One Hour One Page. Whenever we work with someone, and we say anyone in the world can sign this pledge, and it will, I 100% million promise to you it will change the way you work with yourself, with your life is that when you are forced to share unfinished work, you cannot put yourself at the center. You cannot be precious about it anymore. And you're going to be so much more open to feedback. So it's these little tactical kind of hacks that make it real when I'm like, don't put yourself at the center. Well, what are you going to do with that advice?  So I'm like, you know what, One Hour One Page it, that's how you're going to un-center yourself, you know, just do that and it'll change everything.  Well, I wouldn't say that. But what this does for me is we talk a lot about the shitty first draft, but then still people find it really hard to what is a shitty first draft, you know, even after 20 hours, you can say, yeah, this is my shitty first draft, I can spend another 80 hours on this. But forcing somebody to just deliver work in an hour is or in One Page. Awesome. Like you said, it's sort of, we don't talk enough about it in the design space, but it's these small tactical nuances that make a huge difference in practice. And I think we sort of skim over them because, yeah, whatever, it's just one hour, one page. But these are the things that actually make a huge impact. So yeah, you do. And now when you say all you have to do is people send, I did a one hour one page, here it is. It's no more, oh, it's just a draft. I only spent a week on it.  And so now there's no more disclaimers. It's just like, here's a one hour one page. Let me know what you think. Send it back to me after you do your one hour one page. And then we just go back and forth. Got it. That's collaboration. You had two more. So let's go. Oh yeah. So the other tool that we have is called changing the business question to human question. And that's the first step in our unlock sprints, which is teaching people how to communicate insights. And so like I said, any of these tools we create is never about teaching you how to do research or how to learn about customers or how to do design. It's always how do you communicate and collaborate. And all it is, so the business question to human question is, we say every time, make sure before you start a project, you always know for the client or for your team what the business question is and then shift that to a human question so that you never abandoned the business question, but you also never abandoned the human question you have things side by side. For example, one client would be like, one example was like, you know, how do we improve, increase 50% of subscribers to moving from freemium to premium?   That's important for their stock prices is more for their shareholders important for their employees. So what are you going to do with that as a designer? It's not very inspiring, right? And so a human question could be like, if you, you know, let's just say the app was about playing like teaching people how to cook, right, from freemium to premium plant. You might just be like the human question is, you know, what makes people want to cook more? What makes people want to pay for a service that they used to, that they'd love was free? What makes people, you know, want to spend time together? It might not even be about cooking or the apps, you know? And so we have this all up online. We've open sourced many of our hacks, our tools, and they're all with Google design. We have a partnership with them where part of their work is featuring a lot of our sprints, a lot of our hacks that we've made up through the unlock sprints. Because again, we believe that we've made this stuff up, but we want people to use it. And if you want to bring us in, we're here to teach you how to do it better so you can communicate better. But we don't want to be the blocker, like use these things, start it, now out of us. Run with them. Yeah, yeah. Run with them. Yeah. And the third thing is it's almost like it's not a tool. It's literally just like, you need to start getting comfortable with coming, showing up with unfinished work. And when I read that, I was immediately thinking about a book by, I think it's Austin Clee and Wright, show your work, who literally says, share everything you do and make the process super transparent. I think we sort of try to communicate that, but it's really hard to live by once you get attached to the stuff you create. Heading towards the end. How would you recap the last, what is it, 45 minutes? What is the summary? Oh, you're putting it back on me. This is very hard. I know. I would say the summary. Let me make it easier for you. If people remember one thing from this conversation, what do you hope it is? You're not the guru. You are the guide. You're not the guru. You are the guide. It's not about you. I think great designers know how to make it not about themselves. They make it about the customer and they enable other people to understand the customer. When people want to send you fan mail or hate mail or learn more about your work and all the things we've mentioned here, how can they reach out? Is there a way to reach out? Yeah. I have a website, trishowong.com. They can DM me on Twitter. My DMs are open as long as I don't get too high of a flood of hate mail and racist mail these days. It's not easy, especially with all the attacks on anti-Asian attacks in the US, but I'm very easy to reach and I would love to know what you're doing, what you're replacing with, how you've iterated on it, on the who else should we bring in or why should we? I want to know what else you're doing to make design more diverse and to de-center yourselves. Awesome. I would love to know as well. It would be good to expand our vocabulary, expand our question vocabulary to, like you said, make design more inclusive. It's definitely a topic that I haven't spent enough time and energy and attention on. I'm happy that people like you are raising awareness to this. Also, for me, I will do my best to have more people on the show around this. That's awesome. I can't wait to give recommendations. Wow. That was quite a conversation. I'm really curious. What is your most important takeaway from this chat? Leave a comment down below, answer Trisha's question. Let's continue the conversation over there. And if you made it all the way here, I'm guessing that you're enjoying chats like this. If you want to stay up to date when new episodes come out, make sure to click that subscribe button if you haven't done so already. Thanks a lot for watching. I'm looking forward to see you in the next video.


The Kaduna State government has flagged off a free community eye surgery for the rural populace across the three senator zones in the state. The free eye surgery is an initiative of the government with support from the Qatari Charity Foundation to deliver qualitative health care to the citizenry. At least 3,600 people from the three zones of Kaduna are to benefit from these surgeries. For too many of our citizens, our denied access to essential eye care services due to the economy constraints, geographical location and limited resources. The Kuba Sanilep Administration of Kaduna State in partnership with the Qatari Foundation group has embarked on a mission to bring quality health care to the low step of our rural populace where it is needed most. To provide comprehensive eye care services including screenings, consultations and surgeries, free of charge. To understand communities across Kaduna State, our objective is not merely to restore sight, but to restore hope, dignity and opportunity to those who have been marginalized by visual impairments. While commending the Qatari government for their support, the governor, Arsane said the state has put a mechanism in place in the health sector. He urged citizens to take full advantage of the initiative. The government and Qatari Charity, eye surgery exercise for our citizens, especially the poor and vulnerable in our state, to condone regular medical outreaches to the communities in the state with a view to bringing quality health care services to the low step of our citizens. Our optalmic care has been organized as an important yet neglected area in health care service provision in Africa and in Nigeria in particular. Therefore, this area was prioritized and jointly adopted for interventions in order to prevent the dreadful complication of loss of sight. I am calling on our dear citizens, especially the poor and vulnerable, to avail themselves of this opportunity. Call for one for the free ice cream and surgery. Your health is our responsibility. Also, the country director of the Qatari Charity Foundation explained the essence of the initiative. Hello, hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


Oh, yeah They can never keep me down. I'm going and if I ever fell just know I'll go again I never quit cuz I know that everybody lost me lead to another when I'm going I bet when I landed gonna tell me it's lucky get that I'm winning this heart of the watch I'm setting the stage. You should give me my prize. You ain't got a soul. You like in the spirit You talk about your neck. I'm gonna show you I'm with I'm really happy you to see the watch me win again And win again and win again. What's up, folks? I'm here at open-air frown felt in Switzerland It's a music festival and there are lots of people coming here to see famous artists perform on Stage and today I'm gonna show you how to make your iPhone shots look amazing at events Shooting an event can be a fun and challenging experience But if you're not prepared it can also be frustrating now I'm gonna give you some few tips on how to shoot an event with your iPhone so that you can capture the best moments What's up, folks? Ben and Grace are here with smartphone filmmaking comm the best online course That will take your mobile videos to the next level. So like I said, I'm at the open-air frown felt music festival here in Switzerland It's a four-day event Yesterday me and my crew we shot some content for Red Bull and this is our third day here And I wanted to take advantage and show you guys how you can make your iPhone shots look amazing at events Don't underestimate your smartphone cameras. It's powerful enough to shoot great videos Just like any other type of filmmaking shooting an event requires some preparation You need to know what you want to capture and how you're going to do it So the number one tip I have for you guys is to treat your iPhone like a professional camera It all starts up here. This mindset is important because it will change the way you approach your event Videography instead of just pointing and shooting take the time to think about your shots and what you want to capture This will help you create a more polished and professional video be confident about yourself filming with an iPhone And don't let others tell you that you can't shoot great videos with one. Remember. It's not the camera It's the person behind it My next tip is to get to know your iPhone's camera settings It's important that you learn about your iPhone camera settings before you start shooting an event This way you can be sure that you're using the right settings for the situation for event type videos I like to shoot in 4k 60 frames per second This gives me a lot of resolution to work with when I'm editing and it also gives me the ability to slow down Also important locking your exposure and focus will also help you get consistent shots throughout the event If you don't know how to do that make sure to check out this video up here But my third tip is to use a tripod or gimbal if you want to get really stable shots using a tripod or gimbal is a must I would recommend using a tripod if you're going to be shooting static shots like performing on stage If you're going to be moving around a lot then a gimbal will give you the most Stability. I recommend the DJI OM4 gimbal. It's what I use and is amazing Make sure to check out some of my gimbal reviews to find the best one for your need And if you're looking for cinematic gimbal moves to create I also have you covered by watching this video up here Number four is to enable the rule of third simply put the rule of thirds is when you divide your frame into thirds Both horizontally and vertically then you place your subject at one of the intersections This will help you create a more visual appealing and balanced shot And to enable the rule of thirds on your iPhone go to settings, camera and grid and turn it on Now use the rule of thirds to frame your subject using the intersections And you will see a difference in your shot So number five zoom in or use a wide-angle lens for interesting perspectives Zooming in or using a wide-angle lens can help you add interest to your shots If you're shooting a performer on stage try to use the built-in telephoto lens Or if you don't have one use a third-party lens like the one from Sandmark Or zoom in to fill in the frame with their face This will help you capture the emotions of the performance Avoid zooming in too much as this will reduce the quality of your video You can also use a wide-angle lens to capture the whole stage or venue This can be a great way to set the scene and give your viewers a sense of the event Number six is to get people involved When you're shooting an event there are always going to be people around you And they can add a lot to your videos Ask them if they want to be part of your video Get them to do something crazy dance or do a pose and capture their reaction shots This will help you create a more engaging and immersive video You will be surprised at how willing people are to be part of your video Even if you're shooting with an iPhone because they don't feel intimidated By a small camera like that And number seven get creative with your shots Think about using different angles shooting through objects Or using ultra slow motion or hyperlapses By doing this you'll be able to add some visual interest to your shots And make them more unique Imagine how the viewers would feel if they saw the same shot over and over again It would get boring So make sure to mix things up and keep your shots interesting Now as a bonus tip be prepared for anything You never know what's going to happen at an event So it's important to be prepared for anything Bring a power bank with you A small LED light Have enough storage space on your phone And bring some extra lenses If your phone doesn't have additional built-in lenses like the iPhone 13 Pro Max By being prepared You'll be able to capture any moment that comes in your way Now planning and preparing for your event video can seem daunting But by following these simple tips You'll be able to capture great footage with your iPhone Experiment with different shots and angles to find what works best for you And most importantly don't forget to enjoy the event If you're looking into mobile videos and want to learn all of the pro tips Then you don't want to miss my smartphone filmmaking course It's packed with over five hours of exclusive content Including how to edit videos like this event Tips on how to get the best shots How to make your videos stand out from the rest And more So check it out now and see how you can take your mobile filmmaking to the next level Make sure to also download my free smartphone filmmaking guide Which includes my 10 step process to filming great videos with your smartphone Now if you are finding value in this video Make sure to subscribe and hit the notification bell so that you don't miss any new videos Thank you so much for watching Happy filming and see you the next time I'm going to tell you what, I'm going to tell you a story I'm going to tell you a story


Okay, so I'm gonna be talking about NSEC 5 which is a proposed modification to the domain name security extensions We've been working on this project for a couple years now So actually today I'm presenting completely new results in the sense that we've spent a lot of time implementing and optimizing this scheme So the performance results that I'm showing you are completely different and new and this implementation and optimization is both on The DNS side and also on the crypto side. This is joint work with a whole bunch of people money at Weitzman Demetris Previously at BU now at Maryland Leo at BU Yan at CZ Nick and now at a company called NS1 and we also have collaborators at Verisign Labs Okay, so before we get into DNS sec. Let's talk about how DNS works So here I am on my laptop at home and I would like to send a query to I would like to get data from a comm so I Need to know its IP address So what I'm gonna do is I'm going to ask the the DNS for the IP address for the name a comm The way I do this is I'm gonna go send a query to my local recursive resolver The resolver will go out to the internet find the name server that is authoritative for the comm zone Send the a comm query to that name server get the IP address in response and then relay that over to me And now I know the IP address for the a comm website and I can go visit it and I'm happy Okay, so that's DNS in a second DNS sec focuses on the exchange between the resolver and the name server The goal of DNS sec is to provide integrity. So very simply speaking We want to prevent a man in the middle from modifying the responses we get from the authoritative name server. Okay So what is NSEC five so NSEC five deals with a very particular problem in DNS sec It's the denial of existence problems. So in this little picture. I'm showing you I'm going to Q dot BU dot EDU Which is a website that doesn't exist the name doesn't exist So what the DNS has to tell me is that this name doesn't exist So there are various proposals for authenticated denial of existence showing that a name doesn't exist and sec five is one of them All the other ones are standardized by the way. This is a modification So what NSEC five provides is integrity not only against man in the middle But also if the name server itself is compromised It also has a second property which is the prevention of zone enumeration I'm going to tell you what this means later in the talk So new results that I'm gonna present today. We've spent a lot of time optimizing NSEC five So NSEC five we now have it based on elliptic curves, which is a new result I'm gonna talk about we have fully specified NSEC five. We've submitted a draft to the ITF I'm also presenting results from implementation and performance results that Demetris just got yesterday So these are completely new so before I get into the performance results I have to tell you basically what NSEC five is and in order to do that I have to go through sort of the history of the denial of Existence mechanisms used in DNS sec. Okay, so this is the the background All right So how does a denial of existence initially done in DNS sec? So DNS sec has a public key that for the zone This is known to all resolvers using DNS sec mechanisms that we're not going to talk about today We have our name server. We have our zone. These are the names that are present in the zone These are NSEC records. These are the way you answer queries for names that are not in the zone Okay, so what these NSEC records do is they take all the names in the zone They sort them lexigraphically so you see them alphabetical order here Then you take every consecutive pair and sign them using the secret zone signing key So this record is signed it can be verified using the public zone signing key Okay, so the query comes in for q.com. We can see that this name doesn't exist in our zone So we need to answer the query what we're going to do is we're going to just look up the NSEC record that covers this query You can see that q.com falls between c.com and z.com So you know that this NSEC record proves to you that q.com is not present in the zone Okay, so that was denial of existence in the DNS sec the very first version of how it worked But if we look at what's happening here our resolver not only learned that q.com is not present in the zone It actually learned that sorry that's validating. Okay, so it also learned that C.com and z.com are present in the zone. Okay, so it's learned some additional information It's learned that these names are in the zone and actually it's pretty trivial to enumerate the entire zone to identify all the names in The zone so here he's asking a query for b.com which comes before c.com He's learned that a.com is in the zone and you can see how this leads to an n query way of enumerating all n names in The zone if there ends names in the zone, okay So this is not just a theoretical thing These are this sort of enumeration attack is built into network reconnaissance software you have for example a plug-in into nmap that will Do this for you This was enough of an issue to lead to the development of NSEC 3 which is designed to raise the bar for zone enumeration attacks Some of the reasons given for why zone enumeration is an issue for example the RFC's mentioned that Registries may have legal obligations to protect their zone contents from a more technical Standpoint you can think of not wanting to expose all the names in the zone to any arbitrary person that's querying your DNS So for instance think about Internet of Things devices in there You may not want to expose their addresses You might think of a DDoS mitigation where you want to hide the names and IPs of servers so that they can't be attacked But they still need to be in the DNS so zone enumeration kind of squirts all of these security mechanisms So this could be considered an issue. So it was enough of an issue to lead to the development of NSEC 3 Okay, so here's how NSEC 3 works. We still we have the names in our zone I'm now showing you how to pre-compute the NSEC 3 records. We have the names in the zone We hash them each each one of them. So this is just the shawan hash of each name. We get these three values Then we sort them lexicographically So here you see they are in alphabetical order and then we do the same thing that we did before We sign every pair using the zone signing key and now we have NSEC 3 records Okay, so these are just like NSEC records But instead of having the names in the clear we replace the names with their hash values Okay, so as before we give these NSEC 3 records to the name server And now every time he gets a query in he again will look up an NSEC 3 record and return it How does he do the look up? He takes the query. He hashes it He gets this value here and he looks for the NSEC 3 record that covers it So we can see that C blah blah blah falls between a blah blah blah and D blah blah blah This is the the covering NSEC 3 record and now the resolver can verify that this is the correct Proof that this name does not exist in the zone because the value falls between the two values here And he can validate the signature with the the public zone signing key. Okay, so that's NSEC 3 So now we need to talk about zone enumeration We can think about zone enumeration in this setting actually there still is a zone enumeration attack here This was first talked about by Bernstein. It's been implemented by lots of people Maybe not first anyway. It was talked about by Bernstein and various people have implemented this thing So I've got this NSEC 3 record here. It's got two hash values here So what my zone enumerating attacker is going to do is he's going to just collect values from NSEC 3 records And here he can just send n online queries just to get all n hash values in the zone So now you've got all the hash names in the zone now. This is just a hash So now we just do an offline dictionary attack similar to password cracking And we re-reverse the hash values in the zone. Okay, so this has been implemented again This is you can use this as part of nmap if you want to do NSEC 3 reconnaissance for a zone and this this research paper found that they could reverse 64 percent of the hashes in the comm with one GPU so Zone enumeration is still possible with NSEC 3. It's just more work Okay So actually this leaves you in a problem because if you want to use DNSSEC today And you don't want to have zone enumeration at all you have to you move to online signing Okay, so what online signing does is it changes what's happening here? Previously our name server had pre-computed records that it was just using to respond to queries What we're now going to do is we're going to give the zone signing key to the name server Which by the way means that if the name server is compromised the entire security of the zone is gone Okay, but in any case you give the key to the name server and now whenever a query comes in You're going to compute an NSEC 3 record on the fly. So I'm just going to hash the value Here's the hash and I'm just going to take plus one and minus one of this hash value and Generate an NSEC 3 record that contains those two values So you can see that this value here falls between these two values and now we know that this is a covering NSEC 3 record for the query that was generated on the fly and this is great We don't have zone enumeration because these hash values are independent of any names that are actually in the zone They just depend on the query. Okay, so this is how we do the prevention of zone enumeration now with DNS sec Okay, so just to go over these are the different schemes that we have We have legacy DNS which never had a zone enumeration problem in before it with legacy DNS If you'd like to learn the names in the zone You need to send an online query for every name you suspect in the zone is in the zone That was the state of the world with DNS, but of course there was no integrity So there was no authentication for the for the no no signatures on the messages So a man in the middle could tamper with the messages Then we have NSEC 3 which has this offline zone enumeration through the dictionary attack that we talked about So you can make n online queries and then do offline zone and dictionary attacks to recover the names in the zone But it does provide integrity against a man in the middle and then we have online signing which doesn't have this offline zone enumeration problem and doesn't have a problem with Outsider attacks right, but in this case you have to do an online cryptographic signature and give the zone signing key to the name server Okay, so I have two things to say about that We can see the downside of online signing is that the the secret key has to go to the name server So if the name server is compromised the integrity of the zone is lost And another thing is in a paper from a couple years ago. We proved that any scheme that both Prevents offline zone enumeration and provides integrity against outsiders must necessarily perform one online Public key crypto operation per negative response So in a sense online signing the fact that we are doing online crypto here We do need to do online crypto in order to have both of these properties and this is sort of why we see the state of the world like this Okay So what does NSEC 5 do and sec 5 prevents offline zone enumeration without having to give up integrity when the name server is compromised Okay, so that's the trick that we use in NSEC 5 and now I'm going to show you why this works and just I wanted to note that In order to do this we do have to perform a public key Operation not a signature, but a public key operation for every negative response. This is necessary. We showed it in this theorem Okay, so now let me show you how NSEC 5 works. Okay, so just revisiting why was zone enumeration possible with NSEC 3? The reason was our attacker just collects all the hashes in the zone Which he can do with n queries and then he cracks them and the reason he can crack them is because he can compute hashes offline by himself Okay, so he can hash by himself. That's the crux of the issue So what we're going to do in NSEC 5 is we're going to get rid of this hash function Which was what was used in NSEC 3 and we're going to use a new kind of quote-unquote hash function Which is a verifiable random function. So for cryptographers most of us are cryptographers. Maybe you've seen this before This is basically like a keyed version of a hash function But it's a public key version of the hash function So there's a secret key that's used to compute the hash and a public key that's used to validate that the hash is correct Okay, so this is what we're going to use in NSEC 5 Okay, so here's how it goes. We have our names in the zone and now we're going to hash them quote-unquote With the VRF with the verifiable random function. This hash uses a secret key, which is the secret key of the VRF Okay, so here's basically what my hash is I'm going to take the name I'm going to do something to it with the secret key and I'm going to get a value in a second I'll tell you what I'm going to do to it. I'm going to do this for each one of the names. This should look familiar This is exactly what we did with NSEC 3. So we do a VRF Computation on each name. We get all these values We sort them and then we sign them using We lexic graphically sort them and then we sign every pair using the zone signing key So we get these NSEC 5 records. Okay, so this is exactly the same as before except instead of using SHA1 here We use the VRF Okay, so what is this VRF? So the first version of NSEC 5 that we presented a couple of years ago this VRF was based on RSA So in this VRF the pi function here was basically a deterministic RSA signature So I was a full domain hash RSA signature and this hash function here was just SHA256 Okay, so we basically take an RSA signature apply SHA256 to it and that gives us our VRF output Okay, the new version The new version of NSEC 5 that we're gonna talk about now I'm actually not going to show you the crypto behind it But the crypto comes from this paper by Franklin and Zhang actually the construction appeared in there It wasn't supposed to be a VRF. It was being used for something else So we proved it's a VRF and actually this construction turns out to be much more performant than the RSA construction I'll show you the performance results in later slides So in that construction this pi is an elliptic curve Comes uses elliptic curves. I'm not gonna tell you more about it than that Okay, so that's our VRF So here's our NSEC 5 records that we pre-computed and now we give them to the name server Okay, notice that I have not given the name server the secret zone signing key However, we do have VRF key that we have to give So first of all the VRF comes with a public key that everybody learns using the usual DNS sec mechanisms And then there's also a secret key for the VRF and that's what we're going to be giving to our name server So the secret VRF key is given to this guy here in a second I'm gonna tell you why this is okay, but for now, let's just talk about what we're gonna do with this thing Okay, so how does NSEC 5 work when a query comes in The name server needs to figure out what NSEC 5 record that has to deliver to the to the querier So how is he gonna do that? Well, he has to basically quote-unquote hash the query So he has to compute the VRF value So the first thing he's gonna do is he's gonna take this pi function apply it to the name and get this value That's using the secret VRF key Then he's going to hash this output And then he's gonna get this value here this value is Now he's just gonna look up the NSEC 5 record that covers this value So you can see that 3 blah blah blah comes before 7 and then 8 comes after so this NSEC 5 record covers This value here and now he delivers it to the resolver. Okay, so at this point you should say wait a minute How can you verify this thing right because the resolver cannot compute this hash value on its own? How is he going to verify this so what we do in NSEC 5 is we provide an additional piece of information which is called The NSEC 5 proof the NSEC 5 proof is just the output of the pi function So we take the output of the pi function and we send it along with the NSEC 5 record Okay, so the name server computes this thing sends it along and again in our RSA version This is just an RSA signature We send this along and then to verify we have two steps The first thing we do is we check that the NSEC 5 covers the proof So we just hash this value and check that it falls between these two values Then the next thing we do is we check that the proof and the query actually match So again in the RSA version the proof is just an RSA signature on Q comm So this amounts to an RSA verification. So we take the query we take the proof We verify them and if they match we know that these match and of course we verify the signature on the NSEC 5 record And now we know that this name doesn't exist in the zone. Okay, so that's NSEC 5 We have to give a proof record. We have additional keys Which is specifically used for NSEC 5 and we have to do this online computation in order to respond to the query Okay, the online computation by the way is comparable to what you do in online signing today in order to avoid zone enumeration They also have to do an online computation Okay, so to compare these different schemes Why does NSEC 5 prevent zone enumeration very quickly? We cannot compute VRF hashes on our own So that means that the zone enumerator cannot actually do these offline dictionary attacks because he can't hash by himself We do need to perform an online crypto operation when responding to a query But this is necessary by the theory that we theorem that we proved And finally I need to tell you why this provides integrity and that's what I'm gonna do next So here's my proof of why NSEC 5 provides integrity even if the zone's even if the name server is compromised Okay, so here's our attacker. He's compromised the name server. He stole the key So now he has this key and he needs to convince us that something is not in the zone Even when it is that would be an attack, right? So he's I'm gonna ask for a comm and he's gonna tell me no this doesn't exist in the zone That's what he's trying to do. He's trying to give me the wrong answer as you can see a does exist in this zone All right, so here's what he's gonna do first thing he's gonna do is he's gonna compute a proof record Actually, this is totally easy for him to do because he has this the VRF key and he can compute the proof on his own Remember, this is just and basically in the RSA version. It's an RSA signature on the on the query So he can produce this proof on his own The important thing is that the VRF has this property that the proof at least the RSA VRF and this follows to the other VRF as well the proof value here is going to be unique given the query and the public key Okay, so there's only one value that could possibly appear here And so this value better be correct also because the verifier is going to use the VRF key to verify the proof So this proof value is actually the correct proof value, okay? So now our attacker needs to give us NSEC five records that convince us that a comm is not in the zone But he doesn't know the zone signing key the secret key because it's not given to the name server So he can't forge NSEC five records. So he has to replay them Okay, but now if we look at the NSEC five records He has available actually none of them are going to work in terms of replay this one doesn't work It doesn't cover the hash of the proof value which starts with nine This one doesn't cover it if actually it matches it This one doesn't cover it and matches it and so none of these records work There's nothing to replay and that's why you integrity is preserved even if the name server is compromised and this the VRF key is leaked Okay, so that's how we get the security events like five and if you think about it This is exactly why NSEC three is secure if you just get rid of the VRF and just think of sha one This is exactly why it works. Okay. It's the same idea Okay, so I just showed you why we have integrity even if the name server is compromised and so this is kind of this state of the world these are the options you can have Offline zone enumeration be robust to name server compromised, but not and not do online crypto Okay, so if you don't care about zone enumeration, this is a good solution if you care about zone enumeration in this solution You lose integrity of the name servers compromised and you have to do online crypto versus NSEC five where you do not lose integrity If the name server is compromised and you also have to do online crypto Okay, so that's basically the state of the world and now I want to show you some of our new performance results So we've actually gone and implemented NSEC five our implementation extends existing DNS Commercially available open-source software. So our name server implementation uses not DNS and our recursive uses unbound We have both versions of NSEC five implemented the RSA version from our first paper and then this new elliptic curve version I'm going to show you that this version is more performant in a second also Some really cool things that we incorporated in the new version is that we looked at some optimizations that the DNS community developed for NSEC three, but they were actually developed after NSEC three were standardized So they were never actually used so we actually are able to incorporate these optimizations into NSEC five and that gives us a much better performance I'm not gonna talk too much more about these I can talk about this offline So nine thousand lines of code we use open SSL which was already inside these Implementation so there's no new dependencies. We didn't really need any new crypto. We just use the crypto that was in these And also the optimizations that I'm talking about are all protocol level Ontanizations we did not do systems level optimizations here. This is just extensions of existing implementations Okay, so the first thing that I want to show you is the length of the responses. So Let me let me just read to you this chart and then I'll tell you why we care about this So this is the response length in bytes. This is the length of an internet packet And these are different versions. This is NSEC three using RSA NSEC three using ECDSA This is NSEC three online signing using ECDSA. So these things are roughly the same NSEC five using RSA and NSEC five elliptic curves, okay So first of all, why do we care about response links with with DNS sec? There's two reasons for this first of all in DNS when you send a query it goes over UDP And you want the response to fit in a single packet because if it doesn't either the packet get fragmented and bad stuff happens Or you have to redo the query over TCP which adds more latency So it's really nice if your response fits in a single packet and we can see that our RSA version of NSEC five actually did not the 1024 2048 version of NSEC five also doesn't fit into NSEC three doesn't really fit into a single IP packet either So these are bad things but When we move to elliptic curves, you can see that NSEC three does and NSEC five also does and in fact that the NSEC five based on elliptic curves in terms of length is roughly comparable to NSEC three based on elliptic curves Okay, so this comes from the fact that we've done the elliptic curves optimizations and also the DNS optimizations The other reason why we care about this is actually Because the DNS can be used as an amplifier for distributed denial of service attacks You can imagine an attacker spoofing the IP address of a victim Sending a query to the name server and the name server responds to the victim if that response is really really big then the victim You know the rate of packets going to the victim gets higher the rate of bits going to the victim gets higher and that's bad So we don't want to blow up the length of responses. That's another reason why response length matters Okay, so when we do NSEC five with elliptic curves, we're actually not losing much in terms of response length relative to NSEC three Okay, and this is based on our implementation Actually, the other thing I wanted to say is that today most of the DNS sec uses RSA 1024 Not 2048 so this is what the response links look like basically and many implementations now many deployments now We can see that moving to elliptic curve and sec five is actually shorter than what's currently being done in the deployments Okay, the last thing I want to show is the throughput of our name server So what we did here was we set up a name server And when I say we I mean Demetrius and Schumann So there were 24 threads running on 40 virtual CPU So this was a big box what you might imagine be acting as a DNS server What we do is we send queries to this box at a steady rate You can see we started at 8,000 queries per second up to 128,000 queries per second and we see when the box can no longer respond basically we're in max is out Okay, so this this line here is the NSEC three line Remember that NSEC three you actually don't have to do any online crypto You just have to do a hash and a look up so this scales basically perfectly, but this is a log log scale So this line is linear Okay, so NSEC three has no problem scaling, but when you start to turn on online signing This is an online signing implementation from power DNS This is by the way everything here that you're seeing other than this purple line is not DNS Reason we use power DNS is because power DNS was the only open source RFC compliant thing that we could find that was doing Online signing so we use that in the evaluation We can see that online signing with power DNS is maxing out around I think 21,000 queries per second Our RSA implementation of NSEC five maxes out similarly around like 19,000 queries per second If we look at our NSEC five elliptic curves into implementation, we're maxing out at 64 thousand queries per second, so we're pretty excited about this result I still can't really put this into context because this is from yesterday this figure and One thing that we did to do is we looked at the average query rate at the root And that is about an order of magnitude lower than this on average, so we think that these numbers are pretty good I'm happy to talk more about what these numbers mean again. They're really new So this is an ongoing Project we are continuing to do performance analysis, so we haven't tested the resolver performance yet We have to do that We're also going to use captured traces as opposed to this these synthetic queries that we're coming in at study Rate that I've shown you and we have an internet draft We're hoping to get this included into the DNS specs and the implementation is publicly Is publicly available so with that I'll stop these are some memes that we didn't make we just found on this website So thank you, so we do have time for questions, so let's go right ahead Thanks for the nice talk, so I have two questions one the obvious question is what happened to four What happened to two as well The real question is so you talked about replay and and how replaying doesn't work But what how do you prevent replays from a previous time when there really wasn't an a dot-com? Yes Okay, so that's kind of not my problem in a sense because that DNS tech has this problem anyway So the question is how do I prevent steel records from being replayed? So DNS honestly, I can't answer this question very well because there are all these mechanisms like TTL that are being used And figuring out exactly what the right TTL is and when you should expire your signatures to make sure that things are expired before you add The new data so anything that's dealt with in that way in DNS tech We just like drop into our scheme here, so you know, I don't really have a better answer than that So Trevor Perrin has a very fast and simpler VRF called VXN at DSA So Did you consider using any other VRF or would you consider that for I have I didn't know about that That's really interesting. So I'd love to look more in that. Maybe it's even the same VRF. I don't know So yeah, I'd be very interested to see which one you're using exactly But yeah, it's one that we proved was a VRF. So it may end up being the same thing. Could be okay. Thank you Hi, my name is Victor de Chauvin a Work on Dana bunch depends on DNS sec I'm not sure if this is exactly a question or a comment, but for many domains, the highest risk is operational More than than crypto people forget to redo their offline signing and their domain disappears off the internet So for folks without very strong operational discipline and you know support teams and so on Actually having the key present on the name server is important so that you can keep signing Right so that the NSIC became a lot more reliable once bind implemented Automaintain and people could leave their keys online and have the name server automatically Resigned I understand of course the roots and comm and so on have ways of doing offline signing reliably But for the sort of average much smaller domain The keys do have to be online because otherwise the the risk of going dark is much higher than any risk from compromise So that's sort of a trade-off That people have to be aware of in that offline signing is cool, but most people can't do it reliably I think that's that's all I have to say for the moment Okay, I guess I just I just wanted to say to that, you know, I I take that point. I think Just what we can I get my slide back up, please All right, I Just wanted to point out that in the case where you want all of these things This is this is the way that we're proposing that it will be done Right. So again, if you don't care about zone enumeration, then you shouldn't be doing this But if you do then this is this is the way to do. All right, so let's thank Sean again