Thank you for all the implications. So before presenting open access policies in horizon 2020, I will briefly introduce open access and open science. So what is open access? Open access means online access at no charge to the user to peer reviewed scientific publication and also to research data. And this is online access and so it's open access means open access means also reuse and not only access to the data and to the publication. So why open access now? The main idea of the aim of open access is to optimize the impact of critically funded research. The Europe strategy was smart, sustainable and inclusive currently underlined the central role of knowledge and innovation in generating growth. Fuller and wider access to scientific publications and data that can help to build and produce research results, foster collaboration and avoid duplication of the thought, accelerate innovation and finally involve citizens and society. So in a few words, the expected benefits of open science are sorry to interrupt you. So open access is good for science, for the economy and also for society. Open access is integrated into a broader context which is open science. Indeed, the transition towards a data driven economy relies partly on the move towards open science. Open science is the global process of transformation and opening up science and research through ICT. The expected impact of open science are to make science more efficient, transparent, interdisciplinary and also to enable broader societal impact and innovation. Among very prominent part of open science we find open access, as say, citizen engagement, e-infrastructure, research assessment and also metrics. Now, our commissioners view. So, Commissioner Ottinger, who is a commissioner for digital economy and society and Commissioner Moudache, who is the one for research science and innovation, stated together in June this year that open science is about making sure that science serves innovation and growth. It guarantees open access to perfectly funded research results and the possibility of knowledge sharing. Open science is definitely a priority of Commissioner Moudache so, we say he has three goals, open innovation, open science and open to the world. Now, let's talk about open access policies in horizon 2020 and let's begin with open access to publication. So, what open access is not... Oh, it works now. Sorry. My fault. Open access is not an obligation to publish. It's not at all with patent here. You can see in the graph here. And it doesn't mean that the open access publication is of a lower quality. The peer review process is the same. So, in this mandate, each beneficiary must ensure open access to all peer reviewed scientific publications relating to its results. So, the beneficiary must deposit a machine-related copy of the published version of final peer review manuscript accepted for publication in a repository of the research choice and possibly open-air compliance. Suddenly, the beneficiary must ensure open access on publication or at the latest, within six or 12 months. This is called an embargo period. The beneficiary has also to ensure open access to the peer reographic metadata that identifies the deposited publication via the repository. The aim is also to deposit, at the same time, the research data needed to validate the results. They are called an alive reminder. So, there are two routes towards open access to publication. The two routes are the following. The first, open access and the green open access. Under the green open access, which is also called self-archiving, the beneficiary has to deposit their published article of the final peer review manuscript in an online repository before alongside of after its publication. In this case, they must ensure open access to the publication within a number of periods during which publishers sell subscription. Under the gold model, which is also referred as open access publishing, the beneficiary can publish immediately in open access journals. In this model, the payment of publication cost is shipped away from readers paying their subscription. The business model, most often any control is based on article processing charges, LTCs. I didn't mention in my slide, but for your information, the European Commission organized in October of this year a workshop on alternative publishing models. Indeed, new and alternative open access publishing models are now imaging that would optimize existing arrangements and put forward new ones. The outcomes of the workshop are made available online and the final report with the synthesis of all these imaging and already existing models is still in writing. So, about licensing. So, the commission and provides all tools to retain their copyright and grants adequate licenses to publishers with, for example, very creative commands and licenses. Concerning the cost for all publishing, so these costs are eligible during the grant, as is FD7. There is also a pilot for FD7 first grant open access publishing. A few words on it. So, the European Commission has launched the PILA pilot to fund open access publication for finalized FD7 project through the OpenAir project. This 24 month pilot is being developed in the context of the OpenAir 2020 project. It's a mechanism to support open access after end of grant. This pilot provides an additional instrument to make FD7 project research result open access. The pilot covers open access article processing charges for FD7 project up to two years after the end. The maximum of three peer-reviewed publication per project will be funded. Publications should be deposited into an OpenAir compliant repository. Open access monographs are eligible for the pilot. A budget of four million euros are being provided to support the pilot. The maximum of 2,000 euros per publication is provided for covering the fees. It's also important to note that the funding only applies to fully open access journal titles. This means that publication in high-grade journals are not supported by the pilot. The pilot started its operation on June 1 of this year. So it's therefore too early for a statistically significant analysis. And recently, a letter has been sent to the eligible project to inform them of the pilot. So we are waiting for the request. Now, let's talk about open access to research data. So this pilot is a novelty in Horizon 2020. It aims to improve and maximize access to and reuse of research data generated by projects. The quick key questions are the following. Which areas are covered? What data is covered? What are the requirements? And what about data management? First of all, the areas. So in the latest work program, participating in the open access data pilot are the following two pages on it. So future and emerging technology, research infrastructure, leadership in an open and easy industrial technology, ICT, nanotechnology, advanced materials, advanced manufacturing and processing biotechnology, societal challenges, security, sustainable agriculture and forestry, marine and maritime and water research and the bioeconomy. And also climate action, environment, the social efficiency and raw materials, developing a changing world, inclusive, innovative and reflective societies, and a society that is different for society and prospecting activities. Project in other areas. Which means areas that are not covered by the scope of the pilot are encouraged to participate in the pilot on a voluntary basis. Project made of the art of the pilot on open access data in 2020 in the series of cases at the submission stage. First, if the project will not generate or collect any data, you cannot opt. Second reason, if there is a conflict with the obligation to protect results. In our world, if the result can reasonably be expected to be commercially or industrially exploited. Another reason is confidentiality, another one is security, another one is the rules concerning the projection of personal data. And finally, is the achievement of the action's main objective will be jeopardized by making specific parts of the original data openly accessible. This has to be explained in the data management plan. It has to be noted that the participation in the pilot is not part of the project evaluation. This means that proposal will not be evaluated more favorably because they are part of the pilot and will not be penalized for being out of the pilot. Another important thing is that all thing out during the project is also possible. We will need a contract amendment for this and an explanation in the data management plan. First important thing, being in the pilot does not mean opening all data. The process of the pilot is on encouraging good elements of research test practice. The pilot applies to two types of data. First, the data needed to validate the results presented in scientific documentation. The underlying data. It also applies to other data as specified in the data management plan. Beneficial is participating in the pilot. We will deposit this data in a workshop data repository of their choice and also, they will take measures to make it possible to access mine, exploit, re-produce and disseminate free of charge. And they also have to provide information about tools and instruments at the disposal of the beneficiaries and necessarily for validating the results. Where possible provide the tools and instruments and cell, IG software code, algorithm, analysis protocols, etc. The approach is following as open as possible and as closed as necessary. The data management plan, the EMTs are mandatory for all projects participating in the pilot and is optional for the authors. The EMTs are not part of the proposal evaluation. They have to be generated within the first six months of the project. It's possible to update them since the EMTs are expected to mature during the project. The purpose of the EMTs is to support the data management life cycle for all data collected, processed or generated by the project. The EMTs question are the following and you can also see the easy template in the NX1 of our guideline everything is explained. In a few words you have four main questions. The first one what data will be collected, generated what standards will be used, how will metadata be generated, what data will be exploited, what data will be shared, opened and how will the data be curated and preserved. The EMTs are tools to determine what datasets can or cannot be opened. So which tool for this data management plan. We recommend to use the DNV online which is developed by DCC in the UK. This has created DNV based on the EC template. In the midterm view should we have the EC DNV tool? I have no answer for the moment. It's under discussion and it's very complicated to implement due to an internal constraint. So for the moment, we recommend to use DNV. So what about the cost for data management? So these costs are eligible as part of the LIZON 2020 research grant. There is no extra money assigned to them. It has the article 6.2 D3 of the unnotated new day grant agreement which refers to costs of other goods and services which include dissemination costs, IE, notably costs related to data maintenance of storage. So it's not written data management but it's under this section under this code. And there is no amount of money on this. As we discussed the first course of LIZON 2020 and on the basis of the third signed grant agreement, you can see that 34.6% opt out of the project. In other words it means that 65.4% of projects in the firm areas participate in the pilot. Concerning the pilot that are not covered by the pilot, quite 12% opt in in the pilot. So we have to be aware that 100% participation is not feasible or even desirable given that not all projects generate data. So why the opt out? The opt out the major reason is IPR protection Participating in the pilot is a chance to co-shape policy. Opening up research data is a new frontier after opening up scientific publication. It's an ambitious yet there is a pragmatic design of the pilot to the extent the scope is broad but you can opt out, you can voluntarily participate in and you can also when you are in the project decide that certain data will remain closed. So it's really a flexible pilot. There are numerous safeguards in place and the plan is to kick start the future circle. The uptake of and experiences with the pilot need to be monitored during the complete life cycle of the project from application to grant preparation, execution and final reporting. So once again, participation in these research data pilots means co-shaping role and policy and opening up research data. So here are the resources needed. So we have our guidelines which are activate also this one with the list of data repositories, the list of open access role and also the link for DCC and DMP online. Thank you. We have a few minutes for questions and I see only one in here. Good morning, I'm Michael Stryich, legal NCP in the Netherlands. You mentioned that projects can opt out. My question is can also single beneficiaries opt out. Next to the project can opt out can also single beneficiaries opt out. What do you mean by single beneficiaries? Just one beneficiary not the whole action not all beneficiaries of the construction but one beneficiary which opts out while the rest is opting in. Maybe the solution is to close the data which will be problematic for this beneficiary but I'm not sure that opting out of the project will be complicated if the other one is still in. So if the problem is linked with the data, maybe they can close this data but not opt out from the project. So the project is really effective but it has a trust between the solution but I didn't clear this kind of situation but I think it's not. Other questions? Yes, I also have questions about opting out. So if participation in the pilot on open research data from JEPA guys achievement of the main aim of the action what is meant by that? It's open because it depends on the project and on the data generated. There are so many skills that we had to think about the large possibility but we can't synthesize in the guideline or in our policy works that shows this hypothesis because there are so many projects so many data that we can't think about this situation that well we have this kind of hypothesis but in any way the project we have to explain in the data management plan to reason but for instance we have no feedback about this. It's totally different. Is there already some feedback on the financial side of financing storage and long-term preservation because I guess it's not supposed to be another way of the cost of this in the first place that we try to find solutions now and then they have to add more budget to it so it should not be a problem or not, I don't know. And we are not the first one to raise the question but in our documents we only have this article the annotated grant agreement and I'm looking for much more information but I have no idea of the cost that we generate and it's too early to have feedback on selling these codes absolutely no idea of the amount and once again I think it will depend on the project on the field, on the project, on the direction there are several factors and it's really, really difficult I have no idea about this and there is no amount so I'm sorry not to help you maybe the next time I will answer but now I'm from Open Air from the University of Athens the question that I have is you mentioned something about the data management plans and the mining what kind of information do you hope to get out of mining this is one question and the other part do you have criteria for the evaluation, have you established the criteria for the evaluation? So, what was the first question so we have the 10 dates in our in our galleries, you see an X1 and X2 and there are many questions relating to the data you have to raise for the project and concerning mining the idea as you know and it's really important for research is to enable the searcher to do test and data mining on the content so those open access policies if the game is allowed and there is this question at the moment in the commission about the curriculum on this topic and the idea for us in our recent years to enable the searcher to do this to perform this for the progress of science and so on so it's really really important for us that mining could be allowed so concerning the second question, we are not the first one so and we have not enough reporting experience to prove conclusion about GMD currently there are many questions about how to deal with the project in the city, there are many requests and for the moment we have no answer I'm sorry so there is a current discussion in the European Commission at the moment and we have many questions we reflect about the review of GMD in the mid-term of final review with experts in data management and we also reflect on the there is no evaluation of the first six months in GMD because it's the first time we do this and it's the first one but I think we pay off for the moment with GMD and they just take a look at it in the form and in the content and that's it so we reflect for a deep review but not now, maybe later in the project so it's in effect at least the discussion this is the most question why would there be a need of the ECC DMP tool I'm sorry, what? where do we stand? there is the ECC DMP tool and then there will be a bullet point the ECC might need its own DMP tool it was indicated on the slide that you see us thinking about it your question is about the ECC DMP tool why? why not? because we just raised the question internally it may be easier for the project participating to have a central DMP tool but I guess that for the moment the one developed I need to see it's really good for us it helps create the DMP with our content it's under discussion but we didn't take any decision we definitely did so we just reflect okay, thank you Caroline we are here during the break so if you have more questions you can ask her thank you again for explaining that


I work at optimism. I focus on security in our protocol. I previously was an auditor and co-founded Diligence with Gonzalo and have had the good fortune of working as a client with these three gentlemen and not yet Sertorra but have had an opportunity to get to know them really well. So I really feel in my element and I'm excited to have this conversation. So I'll let them introduce themselves quickly. If you could you know give us your names and tell us about your firms and what makes you special. I can go first. Hey guys. And thank you Rajiv. Yeah if you're watching. Yeah we co-founded Consensus Diligence almost six years ago now or going to that me and John who's now at Optisanism unfortunately and Consensus Diligence is a crypto-native security firm that it has for the entirety of its life done security services and has also a product side which might have seen so Mythex and more recently Diligence fuzzing and a bunch of other smaller tools that are all open source that you can check on our website. Hi everyone my name is Chandra and I am from Sertorra. Sertorra is a automated auditing company. You can think of it as that way. What we do is we use formal verification techniques to prove certain properties about your smart contracts and I'm personally more on the R&D side and one of the things that we are focusing on these days is how do you have more trust on the specifications that you write because at the end of the day that's really what we are using as the ground truth for verifying your smart contracts. So if you have any questions about formal verification I would love to hear about those. Hi everyone my name is Mehdi co-founder and director of Sigma Prime. We're in information security consultancy focused on blockchain technology doing a lot of smart contract auditing as you can imagine but very comfortable diving deeper into other layers of the stack. As John mentioned layer 2 systems, new L1s and whatnot. We're also the founders and maintainers of Lighthouse, the Rust implementation of the Ethereum consensus protocol. Some of you here I'm sure are running validators, some of you may be running Lighthouse as well. We had the merge a few weeks ago, massive milestone for everyone, massive milestone for Sigma Prime and yeah. Hi everybody I'm Jonathan Alexander, I am CTO at Open Zeppelin. Open Zeppelin we are a security advisor, security auditor, we also work on Open Zeppelin contracts, Open Zeppelin defender and we are core development contributors to Florida. And hi everybody I'm Nick Selby, I'm with Trail of Bits. We are an audit and research company based in New York but people are all around the world. In addition to audits we have a research group that mainly works on just sort of pushing the edges of a bunch of different technologies including blockchain and where things going next. And we make some pretty popular open source tools like Slither and a Kidna which probably several of you are you know familiar with. Thanks I'm glad to be here. Awesome thanks everyone. So first question I think is like maybe a bit of a softball just to get us going. And I'll I'll pose this to Mehdi first and then just let the conversation get going. So it's been three years since the last DevCon. What do you see as the biggest changes in that time? Maybe it's something you're excited about, something you're worried about. We'd love to hear it. Yeah interesting. Let's see I think what I've been noticing is the quality of the projects that we've been reviewing has somewhat improved over the past three years. There's caveats obviously. We still get the occasional you know DeFi projects with you know lack of access control and the typical unsafe external calls and re-entrances but I'd like to think that thanks to some of the tooling that's been available, Trail of Bits been doing great work on that front. Developers have a lot of abilities these days to pick up the low-hanging fruits. Contracts are getting more and more complex in the DeFi space particularly. Some of the lending protocols that we've been reviewing are pretty hectic but yeah I think you know the amount of money getting stolen on a weekly basis these days is probably greater than what it was three years ago I'd say but it's probably due to the fact that there's just so much more so many more people getting into the field. A lot of new projects being deployed and obviously you know our time is you know constrained we can't unfortunately service everyone all the time but yeah so goods and bads I guess. We've seen a lot of projects come and go too and a lot of money come and go so yeah I think that even I fully agree with Maddie the quality has definitely improved and I think the bear market kind of helped at that. Okay anybody have something different to say than better quality? I have a mixed bag. All right. So like three years ago it was a simpler time. Things were a lot easier to look at. Things were a lot more self-contained and as you just said right that the complexity the maze of dependencies the complexity has kind of exploded at the same time that there's more and more value so the stakes are much much higher. I think on the other hand you're right the tooling has gotten a lot better but it's also I think all of us here working with firms that are we're getting used to the risks we're used to the threats we're inured to the patterns we can see them a lot more clearly. Everybody here has a lot more experience in finding things and on the other other hand three years ago I remember being describing to board members of a of a pretty large crypto company about nation-state threats specifically talking about North Korea and they kind of looked at me with blank stares and they were like well you know so what and I think that over the past three years that that nation-state involvement has gone from a kind of a risk to a definite and definable threat. Chandra. So well this is my first DevCon so I wasn't there in the the first the the one three years ago but what I've noticed is that there seems to this is a very fast moving field and there's like new terms new buzzwords new concepts that keep getting thrown around a lot but I think you know the main thing that I would you know say here is I think it's important to remember that at the end of the day like companies like Sertura or like you know formal verification companies or like any company that is building tools for verifying smart contracts they actually rely on a very fundamental concept and I think that even though this field is very fast moving the fundamentals are still the same and you know those ideas go really far and I'm actually excited I think that we should be able to scale some of these techniques pretty well to some of the more recent concepts that are coming around in this field. Nice okay I'm gonna I'll give you the next question but let's we'll keep it moving so yeah so we're done with softballs Jonathan what responsibility do auditors bear when code they've reviewed has been exploited thanks for you know if that's targeted you take a sip of water yeah yeah well I think first of all I think all of us because we I think everybody up here we take our work so seriously that the first order of responsibility of course is dealing with the issue that's found and I think that I know we had open Zeppelin make every effort if we've had situations I'm not gonna say we've had situations where things we've missed have been found but customers we work with maybe have a situation arise and you are a trusted security advisor to them you're gonna rally to help them in the situation and that may be in discussing what are the potential fixes and reviewing fixes and even talking about public communications and that is a I think if you are with a trusted you know we view these relationships as partnerships then that's what what we're gonna try to do I think that in the case in a specific case where something is missed in an audit which sometimes like we've had some situations where we'll do an audit and then before thankfully pre-release an issue is discovered that was missed in the audit maybe because there was another you know set of eyes on it or maybe there was internal testing and in that case we always view our responsibility is to do a very thorough postmortem on what happened exactly what was found have our team analyze itself as well as get other people in our team and other get the customer involved so that we can all learn from that and figure out and explain to ourselves and improve our processes going forward so I think that's the very common approach so so we've heard from Jonathan that it's I think this is just like like to the preface on the same topic but Jonathan has been open that the top tier auditor can miss something and so you're lucky right like it got caught before it hit production that can happen to anyone so let's like put that out there as anybody on the stage like actually had something they've audited be exploited in a significant way I'm curious not really but we've had stuff being disclosed after it's in production yeah like I think that like we establishing and we've said this many many times we're not insurance companies right so that's the baseline but there's an ethical and moral code that like that we uphold to and so if something happens obviously this is also a case-by-case on a case-by-case basis it should be analyzed differently because if it's if it's our if the problem was created by us specifically then we might react one way whether if if the if there it was just like a miss we might react some other way but at the end of the day we'll try our best but we're not obligated to anything right nor can we be because that actually destroys the entire relationship well I'll go because I'm just gonna jump onto it we we actually don't I don't think that we have a different way I like what you said about the moral responsibility I think it's really it's really important I don't think that we have a different process we have a we have a pretty stringent process to determine whether whether something was missed but but much more important is what happened and how can we help and how can we reach out proactively they're gonna be an incident response mode they're gonna be their hairs on fire there's gonna be media involvement there they're in a world of hurt a lot of us at Trail of Bits have worked in the incident response field so we're we're very accustomed to understanding what they need to do right now to stop the burning to stop the leaking and and get things done so our first reaction is to to refresh ourselves as to what we know about this project and then reach out to try to offer as much assistance as we can I'm very very pleased to say that the entire wrecked leaderboard does not have our name on it today that that will change but you know as of right now but but this is a process that we take very seriously because it can happen there are no guarantees in audits we we always do our very best but I think to stick with the customer when they're in a bad time as well as when they're in a good time is the most important thing you want sorry I'm at it Jenna just give us like an insight into what that process looks like like just one I didn't hear you actually the process of choosing whether to help the customer or not in in one of those situations so the the helping the customer I mean I let me be clear because I made this same mistake in Stanford I don't mean free necessarily right we will help obviously for nothing there's certain things that we can do as auditors and as experts in in the field where if there's more services required if it's fixed reviews if there's other things but the first thing we want to do is reach out and say hey we saw that this happened do you need any do you know do you want to talk to us about stuff that you're that you're doing right now you said that pretty well can we agree that audits is probably the one of the worst terms to describe what we actually do do we all look at yeah okay cool so like cyber we just inherited I know I know it's terrible I feel so bad using the word auditing or audit every time I do but these are really time boxed security assessments let's just all agree on this as John was saying these things are not bulletproof right bugs will be missed and we allocate a certain amount of time to do our best to find these vulnerabilities in your code but guess what if you give us double the amount of time chances are we'll probably find more bugs so let's just you know make sure that we're all clear on what we do up here in terms of security reviews and security assessments okay by the way that's that's not just a CYA it's not you you said the word partnership or you said the word partnership people wait a long time for audits it's a very important part of the process of going live with with a product especially a product where a lot of money you know if it goes bad a lot of money can go out the door customers have their own priorities customers have budgets customers have realities and usually it ends up that we're not negotiating actually about money but about time we're not negotiating about money but about the number of engineers who can be looking at it so while we can't guarantee that a three-week two engineer audit will find all the bugs we can guarantee that a three-week two engineer audit will find all the bugs that can be found by three engineers by two engineers working for three weeks and that that's a different sort of guarantee it yeah okay so I think I think many said this up well in that by saying like like just the semantics of what this is what we're doing how is defined so we're saying time box security reviews now do we need do we need a set of standards to make it clear whatever word we choose do we need to have a set of standards for this and I'll give it to Chandra to take crack at it so standards for auditors you mean for yeah I mean one that's a good place to take it as well if you like I was thinking more for what an audit is for what what needs to happen during the course of this yeah review well so you know I can perhaps speak from a more automated auditing point of view but then I think some of the ideas probably also apply to human based auditing I think the hardest thing is to come up with what like the specification right like even when you're auditing like what are you actually looking for I think that's one of the main questions that you should very carefully think about right and you know I think one of the things that's kind of difficult for auditing is it's hard to be very precise and if you're not precise then you kind of think that you did a proof or like you have some kind of guarantee that this bug isn't there but I think you know unless it's very easy to feel like you you know audited really well if you don't have the specification correctly in your head and perhaps a related thing is in formal verification there's this notion of trusted computing base and I think that idea also you know maps to auditing like what part of the code did you audit what parts of the code did you not audit right and you know you can only say confidently well with some confidence that the code that you did audit maybe doesn't have some vulnerabilities but the parts that you didn't you can't say anything about them right so it's very important to be very explicit about what the TCB is and what you verified and what you checked or whatever you audited anyone else I would say I'm a little frightened of the word standard in what we do because I think sometimes it comes from the place of people hoping that we're going to simplify down to some very simple set of rules what needs to be covered and then anyone could cover it and so I do think we need common language we need and many just helped us with some of our common language and understanding so that we're working together but I think what's important is if you're if you're a team and you're engaging auditors it as opposed to you want to have common language about what will be done what won't be done but this is people also and people with experience so I think getting to know who are the actual auditors and not just I think we were talking about this before not just the team or the you know the label but who are the specific people what is their experience because those are the people you're going to be working with and and what's more important probably than standards is agreement with who who is going to provide you the security review and who are those people what are their skills and what are their what's their experience yeah so I'm gonna like that I'm gonna go to the other side of that the interpretation of the question of standards and well I'm really I'm gonna just steal the phrasing from Rickard who I was talking to the other day he said who odds the auditors and so you know as a project and I experience this now as somebody who's audited before and understands the industry far better than most still scary like talking to like trying to evaluate the auditor like for the code that I have that I want looked at does this odd is this the right audit firm and do they have the right people available when it's there's so many moving parts it's crazy but back to that who are the others like is there some way that we can that we can or should be holding it I don't want to go back to like holding ours accountable and the skin in the game thing that we can go around round about but yeah like how can how can we help non-auditors evaluate the others that they're working with should there be some kind of third party watchdog that's ranking you all like there's a I think it's a place like this a good plug here would be like to talk about its trust and I think we all participated in the standard in one form or another and I think it's like a dangerous proposition because what the proposition with trust is that there's levels of how secure your code base is there's like kind of a risk assessment of how your code base will look like after you have done certain things right so so this this this is part of the EA the Enterprise Ethereum Alliance and I think it was Tom Lindeman who started it I think it is a dangerous proposition but it might actually be helpful if you are not super embedded into the security industry right again it has it is useful but it is but it should be taken with a grain of salt because like if you take level three or like formal verification as a panacea that will probably be a disservice to you so I'm mixed on getting standards for what a good security practice looks like all right this is a scary one so but I'll go ahead I actually think in terms of security work there and and I think about other niches of technology the work that let's say these teams here do is very public it's very public so in some sense we're watched yeah very closely and so this idea that so our reputations are on the line all the time all the time and honestly I know all of us up here we lose sleep over it right like and and I will say too that like it opens up when we work and opens up on contracts and we've had issues and you know so we're our reputations are very public and we're all glad we're not on the rec leaderboard and so we can talk about I think it's perfectly healthy to have conversations about how could we provide more transparency and more info but I think we are actually very well watched right now okay yeah now there still is the thing about what's the right match for you as a project and I think that's an important consideration yeah yeah and I like how you said like you lose sleep over it I think you know everybody in this room loses sleep about either the code that they're running or the code that they're auditing so we should all go easier on ourselves um so I just want like I think it'd be fun to get some questions from the audience so if you have a question raise your hand and meanwhile while the mics are getting handed out we're gonna try something overrated underrated lightning round no people no firms these are concepts okay so where should we start Nick plain English specs overrated or underrated underrated twice it I was actually just on feist is here is ahead of our blockchain and he was saying you know you can pick the tool you can you can pick how it is that you want if you're not able to put down in English what what are the invariance what are the things that you're trying to accomplish here you're you know once you do that you're 75 or 80% of the way through it also it just speaks to a number of things not just for security review but also just for your own understanding yeah to be able to declare this is what this thing does yeah you can't put a value on that yeah a Gonzalo overrated or underrated contract upgradability okay expanding upgradability is a bug not always we went through this so there's a there's a longer conversation about this that happened at the five security summit I think that is available on YouTube so I could rent on and on about this there's also a bunch of articles on the not on the internet about this but generally speaking it you are just injecting another attack factor in your code base okay all right Chandra how do you feel about sorry overrated or underrated reading the code very carefully it's really underrated I think we should read code so we can't just write rules and you can't just write rules no you definitely need to understand the code before you start writing your rules for my verification is not a silver bullet it's definitely not a silver bullet really but really like how you know like it's how do you know what kind of guarantees you're getting from formal verification I mean yeah I think this is a very good question right like you this kind of goes back to what I was saying before you know it's important to think carefully about what you're proving right and your spec is really all you have and you know when you say that okay we have a formal guarantee you should be very careful when you make these kinds of claims and I think it's very dangerous to make these claims because you know the spec could itself be wrong and even if the spec is reasonable I mean there could be a bug in the formal verification tool and like then that's you know that's also bad and you know just because there is a specific bug that you verify verify your code against does not mean that there's you know it's just bulletproof and you can just trust it with your life right so yeah okay Maddie yeah you're up have I asked everybody something you're okay so you're after Maddie you'll get something don't worry Maddie alternate virtual machine design so not the EVM overrated or underrated overrated I don't know I don't know I've been spending a lot of time in on the EVM so yeah I'm getting familiar and you know it's got its quirks of Stockholm syndrome probably yeah probably yeah look now we've definitely done a bunch of security assessments targeting different execution environments don't get me wrong but obviously most developers are operating with slidity viper at the EVM level it's got its quirks but it's kind of working I'd be excited to see the upcoming upgrades particularly EOF EVM object files that might change a lot of things with regards to security guarantees or assumptions that we make with the EVM but yeah I don't know quite like it by now all right Jonathan how do you feel about like insurance against smart contract vulnerabilities overrated underrated I guess I mean if I probably say I'm gonna say underrated because I don't really think it's widely adopted and used at this point and I think it's a it's a it's based on where we're at as you know our risk tolerance is really high and our you know our skin in the game is really high and and and our risk levels are not well understood so it's hard to get insurance yeah if not impossible for a lot of us so I think that'll change that's gonna change for sure and so that's why I say underrated I think it will change and then yeah there'll be hedges and insurance and I mean it is happening it's not like it isn't happening but I think it'll it will happen more and hopefully you know some of the work that some of us do up here will help everybody understand the risk better so that insurance will be obtainable and things like that for those who want it yeah I do I do like I will give one I haven't given many opinions I don't think but I think that having somebody try to price risk who is not an auditor auditors don't want to price risk they like look for bugs right but and it's a totally different thing to be in an actuary spoke there should be actuaries and maybe they are the ones maybe they audit the auditors they have an incentive to do and we're working what I'm what I'm hoping and and we're doing some work with with the actuaries and and with the insurance companies to make sure that insurance in this industry does not go the route of insurance in quote cyber security where I mean I thought it was quite hilarious what a week ago when Lloyds of London got hit with with a site and like they can't set actuarial terms if they can't even secure their own systems yeah what what we're really hoping for is that that people doing security reviews can set those standards so that that the insurance companies are actually as passionate about what they do that they're getting into it not just because oh look at that it's a new adjacent market that we can get into and much more around wow this is really innovative stuff we should get in there to make it safer and we're working with several people like that and I'm very hopeful so I'm with you about underrated interesting okay is the audience ready does anybody have a mic and a question yeah I do all right let's just Mike if you I can hear you so if I'll repeat it oh somebody's somebody's set up okay go ahead please hey so I was wondering because of all the monitoring tools that are coming out like photo for example and there is also private mempools is it really overrated hmm oh it's you you keep I like you're using the format what's the question is is mom it's about monitoring is monitoring like mempool overrated or underrated specifically mempool monitoring I think is that is your question monitoring in general is monitoring over yeah yeah so for for example like there are products out there that claim that they could like maybe detect hacks and all that or maybe secure your smart contracts that kind of thing but a hacker could use like a private mempool to like really send these transactions across and to even to react right you your transaction maybe I'm gonna say let's talk after not sure it's real but what I'll say is that I don't think there's anybody claiming that we've solved monitoring in the ecosystem nobody's claiming that but that we can stop threats but I what I will say is that I think we're all I think there's a lot of agreement that security is not just a time box security review if you if that's all you do good luck and and there are things you should be doing upstream and considering like formal verification and fuzzing and various techniques so time box security review part is part of it and there's things you should do so pre-release pre-deployment post-deployment there's things you should do and monitoring is part of it and so there's value to an end-to-end security and I think that's where we're starting to appreciate that and I want to sneak in quickly while we move the mic over yeah go ahead Alex you're up next don't worry hey do your clients request public reports and when you write reports who do you write the report for yes so I was telling one of my team members the other day that what we sell effectively is PDFs obviously joking a bit but yes yes it's critical the output of the work that we do is a security assessment report which you know contains your standard executive summary detailed description of all the vulnerabilities identified and recommendations who do we write that for that's an excellent question we write that for our clients now the problem that we may see quite often in our space is you know readers sort of going through all users of the protocols that we review going through our reports and not necessarily understanding again the concept of a time box security assessment in a lot of cases the scope that we actually go through is a limited part of the entire protocol this happens quite often particularly with very very complex systems and unfortunately some users may use our security assessment reports and say look this protocol is absolutely safe because this auditing firm has only found a couple of you know mediums and lows and informationals and they've all been resolved because they passed your audit right exactly that's right they passed the audit big check mark none of us here provide you know any big green check mark in our auditing reports there's plenty of other firms that do that unfortunately so yeah I think I think you're absolutely right the audience of these these security assessment reports is is a tricky one let me sneak another question in if a client asks you to remove something so or rephrase something are you writing it for the client yeah this happens quite often I'm sure I'm sure that like it happens quite often yeah I'll take it no no no no I mean I mean a client can argue on the severity of a bug right and that's absolutely fine you know we're more than happy to have that conversation and be like okay why do you think this is not a critical like look I've got systems off-chain in place to prevent this from happening that I would actually drop down the likelihood of exploitation I'm like okay fair I'm happy to drop down the likelihood which would effectively impact the severity of the bug but removing a bug from a report if it's valid hell no now this goes against the trusted advisor role which we play and and how to read our reports or I think all of our reports is that it isn't that check mark and what I want to see from a customer is I want to see them come out with our original report which we will not change and so you as as the public can look at the report and see the problems that they faced and then you can look at the fix review report which is separate or an appendix it's just it's it's different and see okay you can actually watch the progression as they're taking the advice they're understanding not just how to fix that bug but how to fix bugs like that from happening at all and and some companies are afraid to do that because people will think that they're not good at security I look at is the exact opposite a company that is proud to say look these are the challenges we faced and here are the innovative solutions that we came up with to address them that's where I want to look because now they're they're actually taking our advice and they're and they're doing what they should do with an audience is there I want to like is Chandra is there a difference in the way that like a report needs to be presented when it's like heavy on formal verification I mean I don't think so I mean we have very similar reports and like Mehdi said right like we have the severity of the bugs and we explain exactly what property we wrote and why that corresponds to the bug and I think the only additional thing that we very much emphasize is that you know like this like be careful that don't just take this as like the you know this is not a silver bullet and like the yeah I think there's no difference to be honest in terms of the reports we write okay Mike thank you for waiting so disclosure I work with Jonathan open Zeppelin but I didn't tell about the question ahead of time so there's no front-running here if you could wave your hand and every single developer in the space but most especially your clients just automatically fall to best practice without you having to tell them ever again what would it be yeah yeah it was a bit echoey but if you could magically like if you could be sure that every client if there's one best practice that you wish every client would would adhere to what would it be whose field yeah all right I've got one do not change commits meet the reviews please thank you should I should I start formal verification at the very beginning and continuously throughout the project or only at the very end that's such a good question so the question is do you want should you start formal verification towards the end or do towards the beginning of your development so this is a very interesting question you should start as early as you can that's based on you know our experience I think that's the right place to start thinking about formal verification I think the most important thing there is you know you it really helps you sort of write your code in the most simple modular way because that's really what is best suited for formal verification and you know it just it automatically just prevents you from making certain mistakes and I think it's extremely important even if you are you know no matter what kind of verification technique you're using the earlier you start the better and along the same lines you know writing your specs out in English and also like you know gradually making them somewhat more formal I think the earlier you do it the better like once you've already implemented your code trying to come up with an invariant or like trying to write down the pre and post conditions and stuff it's it gets really hard so I think there's like I like the shift left security meme which is like it basically just the idea if you think that your time and your process is moving from left to right writing writing your code then writing your specs and test is doing it on the right-hand side so the more that you can do any of these things your specs formal verification test writing earlier in the process generally the better your outcome will be absolutely yeah yeah yeah so I have a question for you I think Jonathan and Nick were touching upon it but crypto is a very narrative driven industry in general and if we zoom out a little bit and get outside of the security eco chambers what are some narratives that you want to see and what are some narratives you want to correct that are floating out right now in terms of security did you catch I'll try to so you said you said it was this is a very we're in an early stage right now we're in an echo chamber of security conversation and we need like I'm struggling yeah I was gonna say if we make an assumption that security community within crypto is is on the on the table and there was a broader developer community outside as well who are developing building the tools who are susceptible to certain narratives what are some narratives that are floating around around secured around how people see security audits around how people see security in general that you want to take the chance to like correct if you see anything wrong what does some way I think I alright so I'll just repeat it for everyone what I heard and correct me if I misheard bad narratives in our industry that should be corrected okay hopefully you know quickly and early on so anybody that's all I got that where are you angry about I'm angry about a lot of the raises that happen in the security industry recently I think they that money and capitalism is creating legitimacy for for people that have not demonstrated proficiency so this is a narrative that really grinds my gears for example and yeah yeah yeah yeah I'll give someone else that I'll sneak in a smart contract to a probability here alright since Gonzalo started with things that make us angry I'll do one too that well I think that the our desire for cost efficiency and time efficiency is not in our best interests and I mean gas savings and speed of transfer from a layer two to a layer one through the bridge that was just developed yesterday like and our lack of acceptance on latency on anything so that we could do more security verification so I think these things work against us and I understand why we're doing them and how they're helping initially but I hope the narrative changes so that we aren't as worried about gas savings and we're more and we aren't as worried about speed and we're a little more worried about security and safety for the users hello everyone my question is is if auditing is good enough or would you consider like alternatives like open arena or bounty vaults like hats finance for example or maybe deploying two medium tier auditors or just one top tier auditor per contract consider in timeline so I'm not sure I fully understood the question but I think it's please correct me if I'm wrong but I think you asked if auditing is good enough then why do we need the bounties let's make it more general I like we sort of I think I think I'll get we will get this is like like just generally we have some new alternatives to audits that have emerged giant bounties and and like Coderina's and Sherlock doing these like auditing competitions they're a little bit like a time box bounty program so how does that how does that like substitute or compliment auditing I don't know if anyone's like we might yeah yeah my answer is is back to what I said a little bit before which is a bounty can give you that this bug which is interesting but it's not really as interesting as as how you are working with this is a this is a holistic view of all of the code by by engineers who are deeply and intimately involved with the code to the same extent that that your internal people are but they're seeing it from it through a different lens they're seeing it through the lens of people who have literally watched everything that could go wrong go wrong and being able to see mistakes in everything from documentation to just your your overall maturity it's a different set of things if you want if you want to find specific bugs and fix those that's great there's other things that are that are outside the the general scope of what we do in a security review I'm not suggesting that that audit or security review is the be all and end all but it's also different from a lot of things that I'm seeing out there and as far as automation goes we use automation to find sort of low hanging fruit or to point us in the right direction so that humans can look at it and make educated decisions about what we think and there's a lot more than just run this tool see what you get and hand over the report anyone else quickly we're running low on time sorry no no no sorry sorry no no that's I meant on the stage like if anybody wanted to alright I'm gonna be selfish too there's something I but in the time we have I really want to plant this idea as much as possible is that it's not the auditor's job they're not selling you security in my opinion they're selling you like insight into your ability to write secure code so you need to take responsibility for writing secure code and not act as if like you just get to write code that does cool stuff and then give it to the auditor and they will make it safe for you so you need to focus on being able to write secure code whatever process you think that might need whatever tool you think that requires and then you give the other your code so that you can understand how close you are to being able to write secure code amen it took me a long time to get there so it's a bit of an epiphany I'm trying to unfortunately we see what John was describing way too often and yeah it'd be great if we can all collectively shift towards a different yeah definition of what our work here means yeah thank you thank you okay there was another question so let's have it yeah so foundry when foundry first came out I was surprised by the fact that it included fuzzing so my question is when does fuzzing make sense on these code bases which are generally open source and small and how do you approach fuzzing in your use for auditing fuzzing makes a lot of sense all of the time it's we going to the like the shift left shift security left narrative and all of that like you should use all the tools literally you should write specs if you have specs fuzzing will work better right so yeah you should just do it all the time use foundry and use all the other tools use a kidney use Harvey by the way forgot to say I've been announcing this the entire week but this is the panel we intelligence will be open sourcing all our tools just like drill bits we are a bit behind schedule but at least very late than ever so even Harvey yeah yeah yeah all the code bases so yeah did you I just yeah I guess I to add to what Gonzalo said I think using tools is actually good so fuzzing makes sense to me I mean you know again it's not a guarantee but you know I think it's just like good software engineering right like you write code and you want to write tests and you want to do fuzzing and you want to write specs and these are all good software engineering practices and I think they also just are they carry to this domain as well so make sense the one the one comment about that you just made well both of you like that the declaration of things the ability to set forth a spec and then fuzz around that that's really important that first part is what just a lot and Gustavo are going to be doing tomorrow there's going to be a two-hour workshop on how do you declare these things how do you actually set out and describe invariance and how how can you use those to make your fuzzing more effective so I would really recommend that that you go to that so just be fair I know like we're a time by this timer let's give every speaker like 30 seconds to sorry alright so we started the questions way early we've got tons of time I should have read the manual did Brian I know Brian has hand up at one point and okay you please just yet just like I'll repeat it through the mic so go ahead that's that's cool is there a way to make like the the output of of audits machine readable and it's interesting because we we do actually that's later right yeah yeah I was gonna go there I was gonna go that that's really interesting and I think we're gonna take that up and talk to us hit us up afterwards I think you're gonna really depend on the writing style of the security firm that you engage with but it is something I'd like to think about a bit more yeah perhaps we could parse some of those reports into a readable format or a machine readable format that shouldn't be too hard to do we rather report in reports in latex so should be pretty trivial for us to do so at Surtra actually we do have you have been working on that related thing so I don't know if you've ever heard like there's things like deoxygen or doxygen I don't know how to pronounce it and like there's also Nat spec is another similar library so the nice thing about you know if you are if you have a formal spec it's actually a little bit easier to like sort of convert that to a format because you can annotate your code and then you can automatically generate some kind of a formatted report from from that so I think it's a good idea hey guys Kevin over here hey friends so haven't come from sort of the security side and now being protocol engineer and founder I'm wondering about this this line you tread as an author of being very slow methodical you know heavy testing core protocol must be super secure to now okay now I'm wanting to move a bit faster maybe their integration contracts or something that's not in my core protocol you know how much time am I spending in testing in and auditing how much money am I spending there versus move fast and see if things work I wonder if there's I have my own opinion but interested to hear what's on the stage I'll just quickly I'll say the most secure code is the code that never hits mainnet so just keep testing I also think it depends on how much money you raised or how much money you have I know like it's very it's a very practical thing you know like you can spend a lot of time and resources doing doing writing tests but at the end of the day if you run out of money and you only have the tests you're probably fucked okay cool it might come off as somewhat pedantic but I'm curious looking at the different way that auditing firms do severity or impact and then difficulty slash likelihood I'll be honest I like when I preferred likelihood so that it's like difficulty is low when likelihood is high so I was wondering you know high likelihood and high impact would equal high severity have you seen clients get confused about this different and without being overly like strict as the industry is still developing I'm also curious about like how we might classify things trail of bits has a nice classification SWC seems like outdated and not updated as well as or maybe it could be going forward are there things that we can do as an industry to improve and start to I hate to say solidify but structure our information architecture a little bit more so that clients can understand when they're getting multiple audit reports and reduce confusion I think I think it's yeah it's a great point as you said well for us at for us at CPP high likelihood high impact critical and I think we all use perhaps similar types of risk rating matrices it's probably beneficial if you could standardize on on how we would rate severity so as you said it's typically likelihood of exploitation impact of exploitation but there's different levels so we only have we got four of them at CPP so informational low medium high and critical that's actually five but yeah I think I think it's a great idea there's been a lot of initiatives over the past few years on the ETH security channel to try to standardize some of this stuff it's never happened I don't I don't really know why but I think it would be quite beneficial I'm gonna give you a bit of a left field question so there's been a few regulatory proposals that includes software security best practices in the proposal what sorts of standards that are driven by regulations could be do you think could be damaging to the space and what ones do you think could be good like so so almost like yeah the typical like regular comes out of nowhere and they're maybe a bit naive what kind of damage could they perhaps do by misunderstanding well I think I don't know if it goes to like the intent of your question having to do with structure of code I think we all know we're concerned about regulations that would impose requirements on protocols to be able to block certain parties as an example so I think the biggest are a lot of our concerns around regulations that would have requirements I don't know if that goes to your thought about the question having to do with specific developer processes your contracts must be upgradeable for whatever reason those things are always damaging if you're talking about regulations at the code level I think there's no way they can be good you know like I think that as an example having worked in security before and in the in the cloud space the sock to standard and actually I believe it has a lot of really good aspects to the software development the secure security focused processes of your software development lifecycle and I think those are good practices and if teams were transparent about the processes they follow I think that's healthy and if held to a certain standard all those things always have downsides in terms of the effort that goes into auditing them and proving them the lifecycle of regulation is really tough getting getting regulators and government officials to understand the key areas they have a goal of what they want to accomplish but usually they're they're rather far behind the technology I think it's up to us everybody here we certainly do this and I bet everybody else up here does this spent a lot of time talking to regulators about what is possible and what isn't we spent a lot of time talking about the intent and trying to come up with sort of more more open suggestions to industry as opposed to specific because if you say thou shalt do the following it's always going to be out of date by the time it passes and it just becomes very very difficult so I think that the best thing that we can do the most practical thing we can do is educate those those people who would regulate us thanks for clarifying Brian yeah that makes a lot more sense just to give you guys maybe an exotic perspective I was catching up with some of the regulators in Australia a few weeks ago and this is exactly what they were asking for they said what should we be you know requesting from projects to do in terms of security practices in terms of security development secure development and you know what should we be regulating in the space so I try to sort of convince them to go down the educational part and and yeah this is this is spot on I think it's certainly something that is happening at least in Australia these people are starting these conversations and are starting to realize the need of you can't enforce these things on projects but at least you can have these set of guidelines and point your users your you know citizens to these guidelines and get them to demand these standards the set of minimum requirements from the projects to interact with thank you


and and we can we can read them. So Chiara are you there? Hello, good afternoon. Hi Chiara, nice to see you, can can you share the screen? Sure, so do you see my presentation? Yes, it works, very good. Okay, perfect. So let's move to the next presentation by Chiara Poletto and understanding the impact of cross-front dynamics on pathogen diversity. Thank you very much. Thank you. So thank you so much for the invitation. Yes, my name is Chiara Poletto and I'm a researcher at Team Ceramic Paris. And okay, I think I will just introduce myself at work on mathematical modeling on infection transmission from human to human. So it seems to me that it is a very different scale with respect to what I saw so far during these talks. But I'm not an expert of molecular epidemiology or classmates, but I hope that in terms of let's say, approaches or perspective, you will find the method interesting. In particular, I would much appreciate your feedback in such that what I'm going to present you is some theoretical works, let's say on on some interaction, ecological pathogen, ecological aspect of pathogen spreading. And now we are continuing trying to figure out the implication of our results in practices. Okay, so let me start. I'm interested in the structure of human to human contacts, contacts that may get a transmission of pathogens, and in particular this contact network. We know that as a critical role on the risk of an epidemic at the population level and on the epidemic trajectory. And it's also important for the design intervention. However, the majority of studies. There is a strong attention on like epidemic of a single pathogen spreading on the top of the nest, this network. But actually it's not true and clearly there is, there is, there are many pathogens circulating at one time or also we may be interested in considering the structuring of a pathogen. In in in its multiple strains, because this may have an important role concerning emergence dominance coexistence or ecological patterns patterns in pathogens and we know what clearly you know more than me how this is important in terms of antimicrobial resistance but also I'm interested in other infection like influenza infection like covid and this this is important for a vaccine design or for anticipating the trajectory of epidemics. So, if we are interested in in the drivers of emergence of new strain for instance or dominance coexistence patterns among different strains we know that there are multiple factors we need to pay attention on, we need to pay attention of course on treatment or interaction mechanism that may act, act among strains so we know that strains can compete or cooperate or they, maybe they don't interact too much it's depend on the pathogen. Actually, I'm interested on on a higher level and in particular, actually, how the population behave the human population behave and interact may affect like the ecological dynamics between strain given that strain spread on the top of this population. And in particular, my specific focus would be on contacts so the structure of the population network and this specific subfield let's say it's a field in which there is some interest that I'm reporting here some, some publications. So the point is that if they consider to, let's say let's imagine two pathogens or two strains to spread the agents and let's say with different rates like different transmissibility or different, let's say duration and infection. And the typical question is which one is favorite so which one will dominate. Well, well, actually, there are several studies, each of these focusing on different aspects, but actually in common the point is that the answer to this question so which will dominate while the answer is depends on the structure of the population. So one pathogen may nominate in a certain population while another may be favorite if the population has other characteristics in terms of contacts in terms of behavior. And okay, we did some work on this direction and I want to let's say we'll discuss in particular for sure one publication maybe if I have time I will also discuss a second one. Okay, so let me start with the motivation of our work. I stress that it was a theoretical work, but it was motivated by, by the spread of Saferococcus arrows in hospital settings. So hospital settings have peculiar characteristics in terms of population belay behavior. There are a small number of individuals, relatively small so for sure less than a city or a country we have 10s under the units of individual confined space when we have three individuals a stochastic effect became become very important. And then we have a high turnover. I mean patient and turn the hospital spend a certain number of days and then get out and this turnover of course affected the interaction between people in the hospital but also is responsible for exchanging bacteria or pathogens in general with the outside of the hospital. And then we have a structural feature of the network like you have vards, and so people tend to interact more within the same world, but still we have exchange of people and bacteria across vards. And we know that there are contacted origin it is what does it mean that some people are more active so make more contacts than other people. If we think about the hospital of course we know that alcohol workers make a lot of contacts with all patients and among among each other, why patient is that move less in general make less contacts so alcohol workers cover an important role on the propagation of bacteria in hospitals. And these all these elements are recognized to be central in the circulation of bacteria infection in hospitals. And, and, but still, I mean, the study of this element was quite boosted recently, at least an important contribution to these was the use of network data to to characterize the pattern this pattern of interaction and in particular we have data on the exchange of patients across, across vards or across hospital, all the data of face to face interaction. So, while I would go directly to this slide so we present this study that is the individual based investigation of resistance dissemination this is the hybrid study. The pleasure to to to work with this data even if I was not involved in the project this project is a collaboration between different institutions in France like the pastoral in sermon. And what we did was a simultaneous so it was a long term, a facility, structured in five words, and for a duration of four months they monitored, monitored the face to face contacts, this can be done with the RFID technology means that it's a sort of tag that you wear. So there's people to wear this tag, and it's a highly sensitive in the sense that you can detect only face to face interaction because it's sort of signal that you send from attack to another. And the signal is weak so if people are far from the other, you don't see any any signal. And so you can detect really the face to face or also physical contacts, if you make the signal very, very, very weak. So these are the kind of interaction that may be considered a proxy of the interaction relevant for the transmission of of of nosocomial infection. But what he was interested is that in parallel with the collection of this contact data, they also collected the colonization data and colonization status. And so we, we clean as a swaps. And, and these, these, these swaps were subtype. So we could, we can observe a plot like this one in which we can see, we can see the different strain spreading week by week. And we can see that there is a dominant strain, other strain maybe are less, less prevalent. Okay, so that was, I mean, all of these motivated a theoretical question. The question is how the structure of the network contact network determine the plot that you see on the right so the ecology is seen at this level between the different bacteria strain. So the ecology here can be can be characterized in terms of overall prevalence, but also in terms of richness so that means how many strain and see, in terms of a Buddha so which strain in particular we can define also we can also analyze the indicator of evenness or dominance. So do we have that the strain dominating dominate a lot or do we have a steady situation which all strains are more or less equally distributed among infected cases colonized case in this case. So we can use an index using ecology that is called the Parker that is simply the portion of the dominant strain over over all strains. So if this is a high if this goes close to one clearly have a situation in which we have dominance so this strain is dominating. But if this value is low means that we have a equal partition amongst trains. Okay, so we wanted to understand how contact heterogeneities affect these ecological indicators and we did these true numerical simulations meaning that we can simulate a situation in which I mean we can simulate a network of of contacts that is say they produce the same property of contact networks in in the hospital setting and particular what what we design is a dynamical network in which every day not here I'm talking about notes about notes represent individuals. So we know that individuals every day make different connection or every hour every second so in this case connection changing time and we have also individuals entering the system so entering in the hospital and carrying with new bacteria or new pathogen in general. So, every time an individual entering the hospital many parties is that it brings a new a different strain. So in principle we have an infinite population of strains and we consider an ultra hypothesis in the sense that we made the hypothesis that strains are identical in the way, let's say in the epidemiological trade so transmissibility and duration of time so we speak about given that I'm a theoretical model that sometimes I speak about the infection or colonization I mean, in reality this represents more the colonization of of the field coco hours. And, okay, so if we compare it's an important point and it's a genius network with an homogeneous network what doesn't mean the genius network some notes are more acting the others. So they make more connection and these are present really situation like medical doctors and and like patient, why we compare this with the situation which we have an homogeneous network, which all individuals are more or less equal in the way they behave. Okay, doing our numerical simulation find something that more or less seems the picture of the data in the hospital so the stochastic dynamic of multiple security strain, but actually if we look at the indicators, we can see that according to the network, we have different outcomes to decide ecological dynamics is is different. So we can see on the left that the prevalence doesn't change so much. So we have that the homogeneous network. Here on the x axis I'm firing the trust me stability so I'm sprawling the political transmissibility of this pathogen. So increasing the transmissibility of course the prevalence increases and the homogeneous and the genius network prevalence values levels are more or less similar. So if I have a highly genius network so gamma represented the energy lower is gamma higher is it. So if I have very serious network I can see that the prevalence is like lower but the difference is not so big. Actually, I can see that the difference is bigger in terms of richness. So if I have an indigenous network and I have lower levels of richness, so I am more to accommodate a smaller, a smaller number of pathogens and okay, it's interesting if we still on on the right. The the burger Parker so the burger Parker quantify the the dominance that we can see that in the indigenous network we have higher level of dominance. So. Okay, so this is this which are to understand why the network may change in this way the ecological dynamics between strains. And what we find is that we find an explanation this maybe understood in terms of the property of the network itself. So there is a nice study by 11 telecollaborators that was published in 2015 that explained this mechanism, why in the genius network prevents. Let's say, in the emergence of new pathogens new strain. That's because highly active nodes tend to be in general always colonized because they are more easy to reach by infection. To colonize making the hypothesis of mutual exclusion. It's harder. I mean, for a for a new strain to to to to percolate in the network. And, but at the same time, and here is the plot that I'm showing the bottom, if a strain manages somehow to colonize a highly active individual it was spread through the network. And this is the so called super spreading event. So we will create situation of dominance. So, we try to analyze this with respect to the hospital network. So, as I told you at the beginning I was showing these these this plot in which we see the different strain circulating the data. So we have to check the burger park index, we can see, I mean, a certain level of the burger park index. And so we try basically to make simulation actual network data that was measured and compare the simulation with a randomization of the network. So we through randomized the network with destroy basically the properties of the network in particular the technologies. And what what what we can see is that the simulation in the actual network. This is the blue band that I'm showing the confidence with interval show a level of burger Parker that is more compact compatible with the data. And the simulation in the randomized network show a burger Parker that is lower. And it's less compatible with the data so this means that the heterogeneities in the network may, let's say, somehow explain part of the dominance of serving the data. And at least they contribute in explaining the dominance of serving the data. So I concluded this this part of my talk. And so we tried to do to use to adapt an ecological perspective to characterize chain population. And what we found is that contact heterogeneities in the introduction of strain from the from the outside and so these reviews the richness of an ecological system. But at the same time, the few as a successful strain are amplified and create super spending events so we have a situation of more dominance. So the model so far is very simple. In the future we want to account for others as moralistic aspect like, for instance, maybe not a complete mutual exclusion, or also differences in epidemiological trades. Okay, I think that I finished my time I was having another project my baby. I don't know if I would have the time to, to explain it so I just go directly to a knowledge mentor so I wish to thank my micro actor. And the worker presented was published before COVID pandemic. And here is the reference. Thank you so much for your attention. Thank you. Yes. So, any comment or any question. So, otherwise, we can move questions and answers to. I have a question myself so how important is this assumption of exclusion between pathogens. I mean, you say that when one individual is affected by a strain it cannot be affected by another strain. So how is this. So are you looking at a single say infection or a single pathogen and multiple strains and and you say that in one pathogen in one patient that is only one dominant strain. Yeah, so in my case I make the potages of motorist cruise if I could organize by one strain I cannot take the other. And this is, I think reasonable and now that people may be in the audience know that more than it depends a lot on the bacteria we are considering so first of all, I think this mechanism is really the key. Well, I don't think it's necessary that is a total mutual exclusion to obtain these results. But this kind of at least a partial mutual exclusion I think it's the key for for creating these these ecological mechanisms I was showing today. So I think this is in which instead there is sort of a you relax a bit this assumption and the and I know that the mechanism you may find that quite different. I think this is something we will be. I mean, we should explore more in the future. Thank you. Thank you. Thank you very much.


ఌ 벌 అఠిదలా big క౒వంగ్ �你要仔坦 సి DK జేత్త్లినాఆరో మాకవ్ . ప్యరాల이�్ప్. ప్తక్ట్స్డా  palavra�34 PendAN టిadesh precio� headlights రిముంద్anten ని నేధటి jarl devenir inter헌� Fortnite దిgrunts FRI సం. ბ, სლლ� crocodileus eligible your your Kor ונה, manuhohou pare baNatashathe saanuh manuhohou pare baba buf Ehre Kohre ke beshi manuhohou pare Union voila. Are correlated. Means it depends on both theger Money means conventional crowds Who voted with that TL  MUELLER మార్ాల౜న మిటి మార్బాలి మార్సరనారారి మారయిఇది గావకంరంలి. డకివర్నీమి మారూనాధి మిధారారాని పటారత్సి. సాదాల్ల్ బిరినివత్స౟రం రినిల్ల్ల్లా నియిమా. టాన్఩ం నివాఎం చిఆరి సోంరి మిఆరింరికి. Madhi elevation must or is there ever? Mars or is histoire agrigative individuals? Chuntum nai är lag adaptive individuals koshat dhoEEEE Je amar khisvan態 er prop츠fula seta amr laipot? Yater tok par PhiladelphiaESur Amar veins jo ogaya úit menebhi nuestra kommunikations Networke we have defined��도 laackobSc, Amit jitia, Amar nijo Details of your point expans zostak. Express kor riskers loggap charter give us uprat An BET Only using our TV channel Speaks kor Time is available Express kor riskers loggap sa, Discuss kor riskers hear Discuss kor tissue dhiso Titi ahola we audience category ate mi poor esa We going to pour the గి ముతోరినుమువరి ముమి కారిల్లిని గార్లినుముముకుటారినిదికానికైయతికువానిండిమేపొరలారి స్రికౌానిమీనిలినుప్. The compositional audience is continually shifting. It has no leadership or feelings of identity. It has no identity crisis. It has no mass audience character. The compositional audience has to shift. It has to be like this. In a particular place, it can be used as a lock power. It can be used as a bell. It can be used as a bell. These are the characteristics. First characteristics are mass audience. It may be spread anywhere across the world. It may be spread anywhere across the world. It may be spread anywhere from villages to villages or cities. It may be spread around the world like in the cities or villages, It may be spread around the world like in the villages or cities. When it will be spread where it is, it will be a good for mass audience. In other words, it is never confined to a specific space until and unless a very special program is broadcast or an item is published to a special audience in mind.  Testament  ఇరులానై వా మెటిజ పాఎథ౩ మేవాసినింది ఉౕాస్న మ౾రుస్పసిందిసినిక్ మేటులా స్లోపులా. మేవగివాసల్లలా. తోమ్లోలోనో మేలరాసల్సల్.  ఎరిొలె గాలీయట తా� ad హి వ� supernatural actions రౕ �úక౒మ౉ యిస్సLINGప్నౌఔం Polizeplaying of part of what � boy లూప్docసారన నrative�దరాప్ం. సుడృలులౄలిల్ ప్కొడ్టర్ 되�ప్టాలెravel�్కకరంచెల్. ቦៜ៛៟ Mario Budget น Brycefamily and research also respectively పటికైలాలiven Lucas sent me బానవరి lequel概鐘 మానఙాలియినంешь ప౮రస వివాడ్� మరండచ�到 వానిమాకేద్కుేమమడ� commod పికొమా contry learnt పాల యిలోనకి మరంపలాపానిలానిని మరిమరాకా మరూపిని మనరూ మరూపికి దావంతినంపి, ఫాక్నీని మనానినాపనడితూపతంపాస్త మరూపల్నీని మరధవ Volkswagen Vista Beta to the program the program He particular programme to H unaay sa ek hi ni ka tha dikhwagaázha dennki ni dearbana lagat américlaling jồi Ita oya se. Tite ye home aImar Dit ye aImar eke niz impedance me gratification akane A humor niz dependence me pleasure aega amar niz湿 har ideas khine aro to reinstate kor batane Ami he particular boosa duearte ghar o pa he particular informatno injection jyelnin lang Heto toke moiluses and gratifications, model ogrm Therefore, ito khoaga gasese the audience is very to reject మసాడివివాట్చినానినాతౌటామారంనా రూమా డిిమని. ప౟రకేకాదాకం దరంసమినాకారినతేకనా ప౟ర్కినాకికనా. সানানাॸসুতু সানার সানিস্ভাতু ডানিযিসা বগ�funding�ানি সানুতা Seok�ানি পরไিযুবাযুতু কারচিস্র নানিযুব পিসানে কিকানার নানিনানাযু আযু ව ව ව ව तनेलोके हे पाplerल् Kohri तटिर मैसे मैसे को परिकसट चाह एको हमेसशीं兩個 � Shortly from the treffen मुह अ कुन बाय सा sociedade हू squeez the मुह आगोद कुन बाय च्ट शूडृन सींन को... आऒ अग beneficiaries लेँ सिनैमा देख हpeł.  experiência cinema puti mojidiumbled II. There is a transnational communication between the audience and the media. The audience actively selects what messages he or she needs to pay attention to. In fact, the theory suggests that the public selects whom to select listening. They believe them to have more authority than other people. There is a transnational communication between the audience and the media. There are active audiences, they have to select what message they need to pay attention to. They are not passive audiences, they have to select what message they need to pay attention to. In fact, this particular theory suggests that the public selects whom to listen. They believe them to have more authority than other people. They believe them to have more authority than other people. Pulse Pollu campaign to Amitabhachan, Ashwarya is a very popularized crowd, a particular brand campaign. So here I am campaigning for the celebrity, the club. Or I am campaigning for the scientist, or for the doctor. This campaign has a lot of influence, in relation to other common people. So if I am campaigning for them, I will not be affected by them. Because I will not be affected by them. Or I will be in a status, a status too. I will be just as a layman. But if a celebrity is campaigning for them, or an authority is campaigning for them, or a government official is campaigning for them, or a doctor is campaigning for them, then there will be a lot of people. This is an optional audience theory. So what is this particular theory? So here I am campaigning for the audience as consumers. So what is this consumer theory? Because if I am campaigning for the audience as consumers, I will be able to understand that basically we consume news. We consume information. We consume different advertising products. So here, the mass media instruments of the audience, like the TV, the radio, the newspapers, they are not the brand or campaigners of the audience. So the audience is the consumer. So what is this particular brand or brand? And this particular concept too, the consumer of the audience is something like this, because I am the particular advertisement to Saipel. I am the particular message to Saipel. I am the message to LOM.  So what is this audience as consumer theory? Today as mass media organizations are driven by the urge to make maximum profits, they seem to be governed by extremely market friendly programs and consider audiences as mere consumers of media contents. And just as there is immense corporate competition among various products or services for gaining customers' attention, the same is the case with media contents also. So here, this particular concept of audience as consumers is something like this. I consume this. I am the particular news to, obviously I am the news to, I am the person who is the consumer. I consume this because I am the person who is the consumer. As a layman, as a particular consumer, as a particular audience, member of the audience, I am taking in that particular information that is being given to me by the particular media channel. Yes, sir. So, after that, I am the media rich and excess. What is rich and excess? Media rich means whether a particular mass medium is available in that particular place or not. So, I am the person who is the consumer. I am the person who is the consumer. This is because, there is no cable channel or online media channel. This is not what I am rich to. There is no rich of that particular media in a place like Namroop. This is because of media rich. So, what is the meaning of media excess? I am the person who is the consumer. I cannot access it. I already have this particular channel, this particular online media channel or this particular cable channel, but I cannot access it for any reason. It is because of this media excess. After that, I am taking into account that there is no relationship among the media, audience and society. This, I take into consideration the main set-up. I am aware of it. I am very proud of my work, I am very happy with what I have done. So, to me, beyond what I am doing, I am able to maintain my communication. I am able to maintain my relationships. I have completed my society. Before, I had worked in marriage. In the past, I had contacted లోయకినెవాకొతాలునీవిండి. ఇంటలినాస్పనెసతాలిది. మతారినెతిహా. మకమాస్ర్చాని సంకింళిమ సంకి వతూసత్చాన్చ పౚి మి కారిన్చా. choking గోరోని నిందిక బ్త్చైబ్ట్మానటిచ౔న్న్ట్ట్సానేశనికైనికైసాల౓ల్నగానిమిగాకైట్ట్. మాట్సిందిఝు సాణత్టోసికు. अद्ता.. एंवाय्मना तैस दे配 ती of the environment is coming कोई तू तु哇 ज़ु अँ ँ हु मार था क及 आमा Zu the environment is coming दिल ghee अदा ब सक टेर सूऊ या attrib the environment is coming आässा अंद्बआ आमेर आप ग़वे destin बे आप आप आसBIlly & more ऐसे उपश़ अद्ब़ुर वायमना था bhear a digital environment is coming గకిమెరసినామెనిమెని ఇచలెకిమెనిమెనిమంకిగెటనినియరికామిమిమాతిమార్చలేలులౚలూగానాని. ən USIC 드 accomunication through media channels communities depend on the aspberry rico-relationship between the media so-ographer audience. ইতা࡜� Note, communications effectiveness will an areamarks the relationship between belief systems. attitudes and values. The belief system, attitude or values feel鎂 in my mind is for changing things. Second, media, rule-and-agenda setting. It measures primary application, and enables for them to take information which is assigned based on the agenda. What is number two? Expansion of peoples knowledge and belief system. independently of our knowledge  ಬಹೂ ನಿದಾ ಬಂಲ wün ಹೂ ಲೇಸುತಡ್ ಆ ventilation why do we need our belief systems 我们相信自己 It is ourpace explanability for usbecause let us expand our belief system 我们懂得 So, while there are самиièrereso there's an effect of media 어�нова A teeny turner in these three ways it tries to ಎಾಡಿokee change the way we live in ಇ Try to change  Franco change the society in which we live in  ಚೊಥನಲ ಾಕữ as such there is a reciprocal relationship between media society and audience society and audience aekin ita koi aji amar ay bhi hoi to moi am apto kori su namaskar