Good point.
Gary, you can do book in?
We'll do that in the middle. Go ahead. I've already displayed those.
Okay. Alright, James, the floor is yours.
All right, so let's start this meeting for. Oh, what is it? October eleventh of 2023.
Just gonna share my screen here and make sure everything works. Being recorded. Yes, desktop one.
There we go. So, can I one see shut your pie hole in big blocky leathers?
Bye. I see it.
Fantastic. So this talk is about selling up and a pie hole what it is what it does why you might want it all those kinds of things.
So can I get a show of hands? Who here likes ads?
You know, as before your videos, ads on the side of your websites. You know with dynamic content so you go to click something and then suddenly it moves chips and you click on a web and you go to who knows where.
That's right. Only advertisers like, ads. Now us as techies. What we usually do is we usually install an ad blocker.
It's usually through your browser, but that doesn't fix everything. Like your phone browser doesn't have it, there are in app app ads.
Smart TVs can have ads streamed in from wherever and you know, there are other people on your network who come in and I want to use stuff.
And even if you have like brave, I use it blocks most of the ads for me. Keep stuff.
From being too obnoxious, but Sometimes those ads still take up bandwidth because they get streamed over, they get the requests and then they're blocked once they're at your device.
I don't like that. So I've set up a pie hole. It is another layer in your defense against advertising.
So what is a pile? A pile is a DNS server. Yeah, and it will.
You know, act as the in that server, take request, I'd like to go to google.
Yeah.
Dot com, Yahoo, Apple, anywhere. We'll resolve it, but if it's is going to a known advertiser site, so on, somewhere saying it's an advertiser, it will serve up a blank HTML page and said, So that request will never even leave your network.
Pie holes is great because there are a lot of community block lists for all these URLs and it will automatically pull and update them for you.
About once a day.
But wait, there's more! This pie hole it can act as a DHCP server.
It can let you set up your own DNS configuration, can set you set up your custom. Block lists and this is done through its Web UI, which looks pretty good.
Now, just to be. Cautious, just, no, it has some pretty high system requirements.
If all you've got is 19 nineties equipment. A whole half a get good by the ramp.
So it is intended and designed to be the deployed on Raspberry Pi's. That's a just a good.
Target platform for most of these things. There's 2 ways you can install it. Or about 3 ways.
You can clone the repo. Run, install script there or just pull the install script and pipe it through bash or use Docker.
Now before we get to. Demoing the install we might as well demo
What it looks like when it's running. So this is my instance of pie hole. It's running on my local network.
We can see it's not blocking that much. I have it pretty permissive just coming with a default list and everything, but it's still giving almost a percent of all queries.
We can look just total queries. Query types, total activity. See what's getting through, what's getting blocked.
All the time like, yeah, I've got a job set up to ping Apple to see if it goes down or if my whole network goes down.
I just can't reach the internet. But there's other stuff that, you know, I really don't need like Google Tag Manager or app measurement.
Dot com.
It's got lists of, you know, all the stuff.
All the devices. On your network and what connects to it and everything.
Check. Everything that's getting blocked when it's getting blocked what type of requests it was And if you do feel crazy or you know you need to be on that site, you can whitelist it.
And let's take a look at the add lists. So it's easy to just add new lists from the URL.
You just give it, sorry, from the web interface, you give it a URL.
Enable it and then it will refresh about once a day.
I don't have it's set up to do local DNS, but it can. See name records too if you want.
Then we have some more. Just tools if you want. Why dig into it like a debugging and stuff.
Yeah, you can change the theme. So in case you, anyone here is a Trekkie.
X Tricky.
Extract. Yeah. Well. Yeah.
Gary, hold up your hand.
Hi. Yes.
Hey James. Hi, I just got off the phone. I got a phone call come in. Can you give me 10 or 15 s or what pie hole is?
Sure, Pihole is a network wide ad blocker. What it is, is it is a DNS server.
You set up on your system and if it gets a request for a known malicious or just advert site, it will serve that serve up a blank HTML web page.
So the whatever it's requesting it doesn't know something's wrong but you do not get shown the ad.
Okay.
Now, because this is fairly simple, I thought we'd share or I would show you. How you install?
Can you just say that did not, did you just say that DNS was disabled?
So I used DNS, I'm sorry, DHCP is disabled, so I don't use the pie hole to set up IP addresses that's done through the router.
Yeah, Brave browsers got a lot of that built in. I don't know how it works.
I've never bothered to look. But when I watch YouTube videos It's amazing how many fewer ads I watch.
I had to turn on Chrome. I got I go to a couple of websites that'll only work on Chrome and you bring it up and you know you pop up a YouTube window and you oh my god look at all these ads.
Yep, so just a demo I've disabled, the ad blocker on my network and here is a Windows VM.
And we're just going to head over to msn.com, see how many. Adverts we get.
And of course I know Edge is basically a big ad in and of itself. So we have a giant banner at the top.
I mean, yeah, that's an ad you can tell by the little, thing that says add in the middle there in the corner.
Same here. Same there, so like half the news stories quote unquote or ads. And then you just have regular ads sprinkled in.
As you scroll, they load and it is maybe not unusable, but I definitely don't wanna have to deal with that.
Yeah, so let's.
No. And if you got if you got limited bandwidth like I'm running with That could be a real problem.
So let's just walk through the install steps on this. It's nothing special setup.
So in case you, feel brave. You can just curl this script into bash. I forget if you need this running as root or not, but let's see.
I have to install curl.
With luck you get today's new version of curl with less bugs.
With luck, I'll remember the password I put on this VM. Hi, I made it really simple so I wouldn't forget it, but I keep wanting wanting to type the other stuff.
Yeah. I did XI wouldn't forget it. Oh god, how many times have I said that?
Okay. So we've run the script. Is checking, running with non root privileges, so you still need to.
Run it as root. Or perhaps apply your password when it's running.
Okay.
Yeah.
Give you some warnings. It needs the DNS. I don't know, let's go with DNS watch.
Yep, we want that. Yes, we want the web interface. We're going to grab this.
We're gonna show everything.
This is a pi 3 or 4.
That's right.
This is an Just running locally and it's not very beefy. I think it has 2 cores.
But I have it running on my network on a Pi 4 as a Docker image or Docker container.
So what are the, you said 2 cores, how much memory?
Oh, I'm sure not much. It was whatever the minimum. Live for it said it could have.
Alright, info. Okay.
Alright, 5, 12 then.
You pews to cores. So just 4 gigs of memory.
Okay, so we can go to, looks like local host. And word slash admin.
And it's up, it's running. But we still have some more steps. We have a special password or admin password set up that we need to enter to access it.
It was on the other side.
Just make that window pull screen again.
Yes.
Thanks.
What? Oh no. The buttons are so big!
It's not blocking anything right now. But we have a way to get to it. So it's running at (192) 168-1220ne oh 8.
I'm going to minimize it again. And see if I can't remember how to set DNS on Windows.
Probably under the. Internet right? DNS settings.
Yeah, and then click the properties button up at that, that works too.
Here we go. We are going to.
Brian connect here. Oh, I don't have.
The clipboard.
We're just going to use that. Let's hop over. See, we have 2 active clients.
So probably itself. And that Windows client. Now let's navigate back to.
MSN and see what happens.
Okay, so either we have not. Connected correctly. Bye, I don't understand Windows networking or.
It's still cached. Let's go to another ad written website. Does anyone have suggestions?
CNN but the issue you're probably running into is that because Edge is Chrome based it's going to be using DNS over HTTP by default.
Okay.
And because it's edge, it doesn't because it's edge and it's chromium, it doesn't respect the canary domain.
So you actually have to go into the settings of edge and turn it off. Manually.
Okay.
So you just search for DNS and there you probably find it.
I want less secure.
Yep, turn that off.
Alright, well, we did have a request for CNN.
CNN that's constant negative news, right?
Okay. He, I heard it was chicken news network.
So there definitely seems to be a lot of new store. Here we have a blank box. Where an advertisement would fit perfectly.
Let's go and refresh MSN again, see what happens.
There you go.
Yeah, still it's probably cached in the DNS somewhere. But I mean, if it makes CNN easier to read, it's already worth it.
Maybe. You have to still pick out like the, advertisements that are paid for in the.
Written article probably.
So that's one way to install it.
Let's see if I can't. Exit out of here now. Where did my little button?
There they are. Hi, I'm not hiding from me. That's how you install it.
It's a 5 min script if that.
The other way you can do. In case you don't want to trust the script someone else has made
Let's see.
Is we can also install with Docker. And there's a separate repo set up for it.
It has Docker Compose.
So let's just do this locally.
Alright. And this is fine.
Yeah.
Let's try it.
Off that found a little bit James.
Sure.
Why did you put a period at the end of the foul name?
Oh, because I can't top, type when people are watching.
Don't you know that a live presentations are the best presentations?
So while we're waiting for the stock to compose to install, I actually tried using.
Pie hole when I moved into the new house that I'm in and we had a whole bunch of problems with various things.
Not functioning correctly because the Pie whole was blocking it like. Couldn't get updates from.
Apple couldn't get updates on Windows computers. A browsing history on YouTube didn't work none of our phones could get new applications are there different lists that you can subscribe to that are not quite as robust as the default one because it turned out it was all Pihole but just like trying to track down all the various domains that were in use for that was really difficult for me.
So it has that option to, just accept a different list. I have not run into any issues like that and I've thought that the default list is actually a little.
What's it called? The little week? You like, I have a smart TV.
It's still gets, YouTube ads from that. So no, I've not run into that problem.
There probably are other lists, just a matter of going through the forms and finding out which ones do what.
So the reason you're talking to compose isn't working who's because you've still got the the command the bash script one running so you got poor conflicts.
Oh, up in the VM. Yes, that would probably do it.
Oh, let's just shut it down completely.
Address already in use for port 53. I don't think I've got anything on port 53.
Oh, if it's pop OS, you probably. It's probably running a system D resolve D, which would be running on port 53.
No, yeah, that could do it. So yeah, so it's, still very easy to do with the script.
And the Docker composers available if you want to do it. The way I did it was with someone's ants will play books because that also let me get.
So nice. To show off. Here's my internet connection. So I'll also show you that and it was again very easily very easy to do.
What was the previous screen you had?
Oh, doctor's office.
Previous screen, I do not know. So this is the Internet Pi project. It will set up the Pihole for you and some internet monitoring so you'll get a speed test.
And just some up time and other pretty graphs.
I think he was referring to Griffin, James.
So this is Graafanna. It is an open source. Dashboard management and creation tool.
It can accept data from a lot of different sources. Prometheus is one I've been digging into and that is it's called a time series database.
It'll run on one host and gather metrics from a not a rest endpoint, but just a web page served by other hosts and I'll grab that, it will aggregate it and you can create and manage the dashboards and visualizations.
I have little to none experience making them, but they are pretty fun and colorful.
Take good notes. Maybe we can get it to, future.
We'll see. They make it fairly easy to just add dashboards that other people made. So that's still something we can do.
And you can. Like share a link to your dashboard. Or, or completely exported.
If you want just. A, it's called know that's border, but this is all the details about the host.
Specifically, this is the Raspberry Pi 4 that's running. It will tell you how much Rams use the CPU, the swap, root file system.
Network basics. And. And somewhere in here is temperature, which is fun.
All right, where's the hardware temperature monitor? Alert at somewhere like a hundred 10°C.
That's pretty hot.
Yeah, you could boil water on that.
Yeah.
But it's been, pretty consistent underneath. Looks like 40°C.
And this is the data for the last 24 h. We can go back. 30 days or more just basically for however long you've had this up.
Yeah.
No, what program are you running here to put up all these graphs?
Grafana.
Spell that?
Okay.
GARA GRAF A MAI never graduated from third grade. I swear.
It'll all be in every. It'll all be in the recording.
Yeah.
Do you know if there's any plans?
Program download or do you have to download 50 programs how does that work?
That's
Well, this is a Docker container, so that's probably the easiest way, but you can definitely install it as a single package, I believe.
More questions?
Questions, comments, concerns?
I used to, yeah, I used to play hall for quite a while.
So how big of a Linux distribution do you need for, like what's the minimum?
It is tiny, so. It needs basically half a gigabyte of memory and 4 GB of storage.
So how do you configure the like the minimum distribution need it?
Like what?
The installer script should function on any minimum install of, say Raspberry Pi OS or a minimum install of Debian or Fedora or Centos.
Yeah, to your
Right, but if you already have Raspberry and POS or I mean from When the repositories, you already have too much Linux.
You're not gonna need you're not gonna need
So if you wanted on say Alpine or something.
I'm wondering like how do you trim down Debian or? A raspian or something.
So. You have just enough to run.
You just do the base install. There's usually a minimum install for each distro. Leaving out all the X and all the extra craft.
Right.
There's one community project I looked at earlier, chip hole.
There. Have a little chip the smaller than banana that can block ads for you. But I do not know.
How feasible it is to go into Linux distribution and strip it down after install. Maybe if you were building your own custom ISO.
With busybox and stuff, it would be fine.
I was using our orange pie for So, but it is not blocking to my.
Tell a reason like from YouTube ads, but it's only blocking the the web related hats.
Yes.
Not that you to be at
So.
So because of the same thing that I was showing before, a lot of the, because this has become more common and also because many ISPs have terrible DNS servers.
A lot of the ads, especially on TVs. Do HTTP, DNS over HTTPS.
So we'll completely bypass any pi holds on your network. It just goes straight to Google or to cloud flare to get its DNS unfortunately.
Are they doing that because of this? Because this is getting more popular. Sorry.
Partially because of this but also partially because, like I said, a lot of times, name servers from ISPs Comcast specifically and also a legacy ATT customer.
So the DSL stuff. Their DNS servers will just do absolutely awful things.
When you try to put in a request it will it will give back their ads instead of the ads that the company is paying for and so they've gotten they've gotten fed up with it and they started doing this as a replacement to get around a lot of that stuff.
It's not so much about this because this is is fairly small, but it's mostly about the the things that larger networks like Comcast are doing of replacing ads with their own ads.
That is hilarious and I am somehow not surprised.
Yeah, DOH is like, it's like a 2 double sided coin, right? Because like it's good to like put your DNS traffic over HTTPS because then you're ISP can't snoop on who you're going to, but then also all of these, apps started using it to prevent things like platform from being able to block, ads.
So it's like, Good for privacy, but bad for ad blocking. And I used the pile for a really long time, but I ran up against this limitation that it doesn't provide DOH.
So there's some alternatives. One's called Add Guard and it does have a DOH implementation.
But what I started using instead was something called next DNS. Which is a paid for service where they run the DNS and the ad locking for me, but they also provide DOH.
And I found especially on Android, it's hard to get Android. To always use, your DNS.
Unless you specify a DOH resolver. Than my experience at least.
Or if you run a DNS client, like you can get a one dot one dot one dot one or quad 9, which actually implements it as a VPN to ensure that all the DNS goes through it.
But if you want to use any other VPN service, you can't.
Yeah, but one that that one that one VPN, I use that for a while to let us into ad blocking, does it?
But it will give you a DNS over HTTPS.
Right.
I think, next DNS also has an app. To do the same thing for Android because exactly what you said like it's even if you do change the the servers in the phone, doesn't necessarily do anything.
You still have the issue of like some apps will bypass it completely anyways. But yeah, it's, becoming a harder problem as time goes on.
Yeah, I noticed that recently like YouTube has started like, cause another reason why I use, next DNS is because it has parental controls and I'm a parent.
And I was using, the DNS to block YouTube after certain hours and it was working very well until like a month or 2 ago and what I think is happening is I think YouTube is just like.
Doing DNS at the app level rather than using the OS. That's my hunch because it was working.
Yep, they are.
Yeah, so you literally can't you like you can't force YouTube to use any DNS.
Yeah, so you literally can't, you like you can't force YouTube to use any DNS other than whatever it chooses to use and it's really annoying because it made my parental control stop working.
It does look like there's a version 6 bihole coming out that gets rid of, PHP, but I don't see anything about.
Dns over HCPS.
Yeah, have you guys seen the articles around lately that Mozilla is doing that? What is it like an encrypted hello or something?
I'm not.
Yep, the encrypted encrypted hello for SNI. Yeah, so basically what was happening before is and this is partially what made a lot of the parental control stuff work.
When you were trying to connect to a website. So for example, if you go query. Most of Google's services.
They're public facing services. They all get served from a very small number of IP addresses, like 4.
And so when you make a connection to that, It does what's called a an SNI hello.
So when you initially make the connection, this is part of the HTTP one. Dot one spec.
It's that old. You go to the site and you say, hi, I'm looking for name of domain here.
So I'm looking for WWW. Google. Calm and then the server will go, yes, I can serve that and then we'll give you back the correct response.
And that's how you can have multiple domains. On the same IP address. The this also worked with encryption as well.
So when you made a connection to a secure site, the first thing it would happen it was it would ask via an unencrypted protocol.
Is this domain hosted by this site or not? And the the point of ES and I is to encrypt that initial hello.
So that the encryption is still, is, cipher text to the site. It still does the hello in an unauthenticated encryption method.
But the point is like you can't. You figure out which site you're browsing just by watching the unencrypted traffic from it.
Which is very nice. It's, been a It's been a journey to get it deployed.
I was part of an organization that was trying to get that tech. Rolled out. 15 years ago.
Okay.
So it's been a long time coming, but I'm glad it's finally here now.
Yeah, but the server has to implement it, right? So it's gonna be a while before everybody turns it on if ever, you know, like especially corporate entities like Google might never turn it on, right?
Well, so they're one of the ones pushing it. So Chrome was actually the first people to get it out the door.
It's already supported by the major web servers and has been supported by the major web servers for several years at this point.
So it was just one of those things of Ironically, the missing part was the client. And Google was a first mover because again, they, they want to make sure that the ads get served, which is why they want the encrypted hello.
And the. The second part was once once Google put it in at the same time Firefox was putting it in as well.
Because Google has put it into Chrome, that means all the downstream Chrome browsers.
So your Braves, your Vivaldi, your edges, they'll all support it. I think the only holdout at the moment is Safari.
I don't know if Apple has actually committed to ESMI yet.
But if this was implemented everywhere by everyone, then basically your initial. Request to find the server. Is encrypted.
Oh no, you're, look up for the name, the IP address of the name is encrypted with DOH, right?
Can be, yes.
Correct.
And then your initial hello is encrypted with this encrypted hello thing. So really like even your ISP can't really, if every, if everybody implemented this all the way, even your ISP wouldn't be able to tell what websites you're going to, right?
Yep, that's that's the point.
That's pretty cool.
And there's a lesser known. Cousin to DNS over HTTPS and that's DNS over TLS.
And that will allow you to, you can run a local resolver. You can make queries to the resolver locally.
Via plain text and then when it has to go I don't know the name for this it can go actually make a TLS connection to a upstream resolver, to get that information.
It's similar to DNS over HTTPS. But it's a little more flexible because you can put multiple servers in you can break stuff out by.
Zone name or top level domain, things like that, which is kind of cool. It's DNS over HTTPS is really more designed for.
Client applications as opposed to for a network wide solution.
I think next week we're going to have a talk on. DNS over TLS.
Oh no, don't know how to check the website.
No, no, it'd be the Saint Louis.
Yeah.
I haven't updated it. Sorry.
You be determined.
Yeah, well, I think it's been determined. I just haven't updated it yet.
In the planning, PDF.
That makes it official.
Yeah.
Gary, are we at the middle?
Unmute yourself, Gary. Harry is muted.
Harry Gary is muted.
Gary?
I don't think he's even talking.
Now he's trying to say something. He's going on a long salute, reciting Hamlet for us.
Hey, there you go.
Yeah.
. That's great Okay.
Somebody asked, so I think somebody asked James if he was running this demo on a Raspberry Pi, but I think he might have learned his last things.
Yeah.
I'm pretty sure didn't last time you demo you tried to run something on a raspberry pi and like crash halfway through or something.
I tried to run on a Raspberry Pi 0. And that's why I crashed.
I was asking it to do way too much.
Gary reboot maybe that'll fix your microphone
Maybe he likes the microphone the way it is without him having to talk.
I don't know. Alright, anyway. Yeah. Maybe these billboards, this is the St.
Louis. Unic huge group meeting. It's all about Unix all kinds on the second Monday of each month Where an IRS, it's 501 c 6 designated non-profit professional association.
That means companies can can give us money and deduct it. As an expanse.
Well, not just companies. It is coming up to the end of the year. If anyone has any chairs, will giving they're thinking of.
Just keep us in mind.
Yeah. Yeah. Yeah, and the members we have to show up here are just professionals and network experts and system experts.
Hobbyists, students, a lot of retired guys that have done everything with every kind of operating system you can think of.
And a lot of times those suggestions from the knowledge of the past can help with the with the current and future stuff going on.
We're interested in all kinds of operating systems, Linux, BSD, free open source stuff, so forth.
You've met continuously since incorporated in July of 1992 and all our meetings are free and open to the public.
There's no individual.
Hey, the agenda for the meeting. This particular meeting is from 6 to 6 30. It's time for testing and chat, microphone, sound and screen sharing.
The basic topic and questions usually run from 6 30 to 7 and then we get to the to the middle where we do internet introductions, announcements, call for help.
Hopefully by the 7 15 we can get to the main topic after the meeting. Further discretion is possible on our mailing list.
Recorded video chat slide work or sent to archives usually within the next few days. Just saw the base topic.
It's often focused on personal computing. Off on a beginner level, fundamental introductory instructive short, simple, small.
We're trying to keep them short and simple. Kiss, keep it simple and small. We are now at the middle.
Okay, now and then just keep going with the page here to show people what's going on later on.
We're gonna have a main topic. It's often focused on enterprise computing. Or more significant technology detail.
The port, profound, set of. Afterwards, after the presentation, general destruction. On other topics can happen.
We don't turn off the meeting until people are done.
Is we have a couple of loosely affiliated special interest groups, the St. Louis group that's Was it 8 days from today?
It's next Thursday and. And we also have the first.
Monday the month, Slack meeting, St. Luceri computer club and then the new Linux group is always almost always on the fourth Tuesday of the month.
We have a calendar. And our, we go and go to that, see if I can get this magic thing to work, control, hold.
. So old
Yeah.
Slack is the first Friday.
Control click, it says. Okay. Okay.
Not, not, not for strides for Thursday.
Okay
Let's see if I can do this.
You are correct.
Wrong button. Where's button button? Who's got the button?
Blackm.
My machine. I didn't want to do this because, A lot of things going on.
Never mind. Let me get back out of this. Go back to where I was. Anyway.
I can share the calendar if you want.
Yeah, please why don't you So I'll stop my share. You open the calendar, appreciate it.
Okay, let's close that terminal. Let's go. That's not the full calendar.
And this is in the way again.
Tavish. Dot org slash calendar should get you there
Or you can drop down the resource button.
Hey, let's do the resources because I can't type. Go on.
There we go. And our sponsored meetings are shown with red highlights. And that's the layout of meeting and.
Next. Let's see.
October fast!
I don't know whether the area is posted that on a meeting or not. Anyway. Woohoo!
That includes beer, right?
Yes. We got the first.
We're in Broadway and
Lebron wasn't?
We got the first cookies coming up Friday. Or internet cookies on Mosaic, Netscape, 0 point 9.
Wow. That's whatever.
Yes.
Yeah.
Oh wow, October was a big day for programming languages. We got the first C plus plus reference guide and then Fortran was released the very next day One right after the other in that order.
A different year. You're great. Different year, different year.
Yeah.
Check on the
Linux group and see if we've posted that.
Just looks like the standard blurb.
Yeah. Oh.
I don't want to do that.
2,004, Next year, it'll be, twentieth anniversary.
Okay.
And we've got the new Linux users group on the 20 fourth.
It's usually 5 days after the Saint Louis finishes group, but not always depends on how the calendar breaks out.
At month. But it's almost always of course. Tuesday of the month.
Wow.
And Dennis Richie days on the same day as our steering committee.
Okay.
Everybody's welcome to come to the steering committee meeting because, outside influence is always greatly appreciated.
Okay. Will it be a costume party?
I don't know.
And then on the second of next month is the St. Louis Area Computer Club. St.
Louis Linux area computing club.
Enough. Let me go back to sharing, please.
You have control?
I doubt that.
Well, Gary can't stop you this time.
That's true. But remember, our sponsored events are highlighted in red anyhow. Members can ask questions and sometimes provide answers on our mailing list and we have a Very limited traffic on our announcements.
It used to be a weekly. Email but haven't found anybody volunteer to edit that so that's usually just the instructions for each of the meetings goes out.
Discuss is it.
Oh, Gary did put in the channel chat. Scheduled for Thursday night the the topic transport label lay or security by Michael I think I said some of those words correctly.
Okay. Whatever. And that's our mailing list and
Afterwards, as I said, presentation and archives are usually available next few days. And that on our salute main site there's a lower bottom of the screen shows the archives page also.
Any questions about this? This is As we say, this is the glue middle.
And next up is our main topic. Any further questions?
In that case, I will stop sharing my screen. And in a DD.
Yeah.
He is pointing at the chat. So we still are looking for a talker or a talk for next week.
But that talk on TLS is scheduled for November, the 60.
Oh. Oh, I get confused with the dates and the calendars. All those numbers, you know that.
All those each calendar has a bunch of numbers and I get them all mixed up.
And sometimes they swap where the numbers go.
Yeah. Bert.
I'll go ahead and introduce. Carl Perry. He's gonna be our main speaker tonight.
And please I'll turn it over to you at this point and if you'd like to talk about yourself could buy biosomery I appreciate it
Sure. So here I've got a, I have slides. So hi. I'm, I'm Carl.
I am here to talk to you about risk 5 and. Speculative execution attacks, which are not necessarily related, but we'll, we'll get to that.
I am a, individual member of the risk 5 organization and I've been a advocate for alternative architectures for an extremely long time before I was doing a lot of stuff how how I got under risk 5 is that I was doing a lot of things with.
Brastery pies and a lot of stuff running on. Arm and various other platforms. I'm also really big into restoring older computer systems so My winter project to this year and the only reason it's a winter project is because it consumes so much.
Freakin power is I recently picked up a couple SGI ONIX 2 systems so I'm looking forward to getting those repaired and up and running and doing some scan line chasing with them.
Once the temperatures comes out here a little bit. I'm in the, the greater Austin, Texas area.
So it's going to be a while before the temperatures go down. We're, having our first false fall, but it's gonna probably be a hundred by the end of the week again so hooray.
I'm down in San Antonio and enjoying the rain.
Fair enough. I'm glad you're getting some.
Yeah, just a little bit.
So if you want to, reach out to me, there's my email address.
I maintain a presence on Mastodon. I am not on Twitter, but most other things you can find me as just either links and go from there.
The probably the first, the most important thing to talk about once we get started is, that it's called risk 5.
A lot of people think it's risk V, but it's actually risk 5. Although the risk V part is a bit of a joke.
Which we will cover here in a moment. And yes, this is the risk architecture that's going to change everything.
But the joke that I like to tell everybody is don't call it a comeback. We've been here the whole time.
I hate to break it to you, but pretty much every processor that you've used in the last 20 plus years has been a risk processor whether whether you know it or not.
So what is risk 5? This is the fifth iteration of the risk architecture pulling from all the previous implementations going back to the eighties.
It's free and open source. You can actually go get all the information about the instruction set architecture.
And several reference implementations under permissive open source licenses directly from GitHub from the risk 5 international site.
There's also a bunch of other folks who make other implementations available. S. Open hardware group and they have several releases as well.
There's, there's a bunch of things available. It's already shipping and you're probably already using it.
There's a tremendous amount of risk risk 5. Microcontrollers in a lot of modern cell phones.
Especially if you have a Samsung phone, there tend to be a reasonable number of them in in Samsung phones as well.
There are 32 64 and yes, even 128 bit architectures. So, we're, kind of looking forward to the future.
The old tag line used to be the instruction set architecture for the next 50 years. And a lot of us really believe that.
I will post a link to these slides afterwards, but there is indeed a single sheet of paper that you can get your hands on that has the entire base instruction set for all the different versions of Risk 5, the 32 the 64 and the 128 bit available for for, reference implementation.
There are extensions to the risk live. So this is like I said, this is just the the base architecture, but there are extensions to the instruction set that can be added.
I am keep an eye on chat. So I, we will definitely talk about. Risk 5 in the news a little bit later on.
And yes, there are risk 5 microcontrollers in Samsung, Xano's socks.
The main processors are not necessarily risk 5, but Samsung does use Risk 5 processors for their memory controllers, their power management ICs.
The camera interface a lot of stuff around the sensor system those are using embedded risk 5 microcontrollers is not necessarily the application processors that are risk 5 though.
So the comment I made earlier, don't call to come back. We've been here the whole time.
If you know your history. How risk came to be was there was this tiny little not very influential company in the world called the Digital Equipment Corporation.
And they had spun up a research center out on the west coast of the United States. And they were looking to try and make.
The successor to the PDP 11 processor. And as part of that, there was a bunch of research happening at Stanford and a bunch of research happening at Lawrence Livermore and various other University California organizations into different ways of doing it.
And the idea was that Those processors were CISC. They were complex instruction set processors. And they were basically unmanageable like even even at that point as simple as the processors were for the PDP 11 they were becoming unmanageable and so the idea was to try and make something better.
So in this case, risk means 2 things. Risk 5 is an instruction set architecture. That uses the reduced instruction set computing model as opposed to the complex instruction set computing model.
You can have CISC processors that are implemented using risk. Processors internally. In fact, this is how most modern processors are implemented.
If you go look at ARM, ARM was originally a risk system. But these days if you go look at the modern arm instruction set one of the things everybody got very excited about with ARM 8 dot 4 was the the advent of the new JavaScript null or 0 instruction.
That's obviously not risk. It's very specifically tailored towards JavaScript. And as time goes on, pretty much everything kind of becomes sis processors.
And even all the modern Intel stuff are CISC processors. But if you are looking at how those processors are implemented.
If you go look at modern AMD or Intel or even ARM processors, they are a risk core.
The micro architecture is what Intel tends to call it, what AMD tends to call it. Those actual processing cores are risk.
What the CISC part is, is that we take these complex instructions. And the fundamental philosophy change here is Sisk believes that the hardware people are smarter than the software people.
So they give you a ridiculous number of instructions to basically do whatever you want. And then when you take a CISC instruction, that goes through a decode block in the processor, which is huge.
It takes up a massive amount of space on the actual dye. That takes that cis construction and decomposes it into a Optimize set of risk instructions that will drop into your multi stage risk processor pipeline.
So hopefully that is appropriately confused everyone. And if you are confused. Do not hesitate to ask questions.
Sean asked a question. I heard that, risk 5 like arm need special driver for each salt.
Is this true is more like x 86 64 so funny story. Even x 86 64 needs special drivers for each implementation.
Newer versions of Intel's processors, specifically everything Twelfth Lake and higher, or twelfth generation and higher, are using a model very similar to what Arm was implementing.
15 years ago called Big. Little. Where there's, Intel doesn't call it that.
They basically call it efficiency course and performance cores. They're not the same. In. Applications compiled for the performance core can't necessarily run on the efficiency core because they run different instruction sets.
So even with the modern stuff. There are those incompatibilities and if you remember with the initial rollout of the twelfth Gen Intel processors, there were a lot of interesting follow-ons.
One of the big one was no lawyers could get certified in the California bar n using new computers because their anti cheating system wouldn't operate on twelfth gen processors they had to use older notebooks.
Those sorts of things happened. There was also a big problem where a lot of software would initially crash especially on Windows 10 because the Windows 10 scheduler would schedule you to one of the efficiency cores, those were incapable of running, say, AVX 2 instructions and your application would crash.
So it took a lot of changes in order to make those things function as we move forward. So this is not a a risk thing or an arm thing or an x.
86 thing. It's just a modern computer thing and sadly it's it's only getting worse.
So there's things that we're working on doing that. I got ahead of myself with the slides.
I apologize. So the 2 schools of thought are SISC is we provide all the software and the software developer needs and risk is that we make the basic building blocks of instructions and then we leverage the computers.
Compilers and other software to combine them for you. Sisk was very complex to implement, as I was saying before.
So let me show you. This is an annotated dye shot of a Motorola, 68030.
And what you'll notice is there's this giant section here called the control section and that is basically doing the decoding of what the instructions are and like this die, like this is a second generation, 32 bit microprocessor from Motorola.
This is the dev board for it. So this is a 74 logic TTL implementation of that entire thing like it's huge.
It's massive and it takes a lot of effort to continue adding instructions to it as time goes on.
So in a contrast, this is what a risk 5 heart looks like. A heart is the nomenclature that's used in the Risk 5 world, what you would normally call a core in everything else.
Why we changed it? I don't know, but we did. There is an instruction decode phase.
But those decoders tend to be significantly smaller than the coders that you will see in other blocks.
And I'll have an example of that here in a moment. But this is basically it. Like this is a very small pipeline.
This is a single, stage pipeline to get everything through. But this is very simple compared to say.
What's running on a Zen 2 core so this giant block up here is taking the this decode section that the top middle This is what's taking those sis constructions and decoding them into what.
The the ALU, the load store, the data cache, the branch prediction, the scheduler, like all of that stuff is to basically break it down so that the bottom half of this diagram, the floating point SIMD stuff.
The ALU, the load and store and the data cache like those are all. Implementation of reduced instructions that computing it is proprietary to AMD.
But it exposes a complex instruction set of x 86 64 for application compatibility.
So who makes risk 5? And the answer to that is everyone. Because there are, because everything is available for free under a permissive open source license is all BSD licensed.
There are a lot of great big companies, sci-fi, Andy's Qualcomm, Microchip, Western Digital, Nvidia, T head.
There's some newer places like Tens Torrent. Google, all of the new, Google tensor CPUs that they're putting in their new processors.
Those are all risk 5 based. The application cores, again, those are still arm, for their phones.
But the actual AI accelerator stuff they're doing, that's all risk 5. There's also some or other smaller organizations and academic institutions that are doing this as well.
The open hardware group like I was talking about before, which is actually a partnership between excuse me, fails aerospace and silicon laboratories here in the United States where they're basically both working in the open.
To make system viral log verified. Implementations of various risk 5 cores completely open source that they can share between them and with other organizations and then they just put their their proprietary stuff in the periphery around it, which is kind of cool.
ETH Zurich has made a lot of great contributions to the Risk 5 community. Some of that stuff has actually gone back into the open hardware group.
But they have things like the Palpino and various other platforms. At 1 point they made a. The 1,000 core Linux, excuse me, a thousand core risk processor running Linux.
Just to show that they could. It was one of the largest dies ever created. It was basically an entire wafer squared off.
It's kind of impressive to see. Enjoy, enjoy digital as a group out of France. I believe there is actually a company behind it.
But it's a lot more community driven. And what they're doing is they provide this technology called Lightex.
That allows you to define the processors in a Simpler programming model. So instead of having to do it in VHDL or VERL log or system analog or anything like that.
You can basically define it in Python, and that will compile it down to various. Software implementations for use on, FPGAs or field progressable, Gateway systems.
For doing rapid development and trying out new things without having to spend the time of waiting for it to get manufactured at a foundry and then ship back.
So there's a lot of cool stuff going on. I will take a moment to pause for questions because that's kind of like my risk 5 overview.
Hit me with your best shots. That's what I'm here for. And I apologize if I talk too fast.
Go for it.
Alright, I'll start. So, you mentioned, that the Andy and Intel at their core, they have reduced instruction set.
Yes.
As well, but they've added a bunch of stuff onto it over time. And then you also mentioned that risk has extensions.
Yes.
And I've heard I've heard about these like it like I've heard that it can't even do like basic arithmetic or something without like some extensions.
Yeah.
I don't know. I'm not very knowledgeable about this, but what would the same thing that happened to Intel and the also happen at risk 5?
So yes and no. Like I said, part of it is to try and it's a philosophical difference.
So Intel is trying to make an instruction for every possible case like I said that that JavaScript instruction was a big deal because it dramatically improved the speed of JavaScript interpreters on ARM systems.
That instruction has existed in the x 86 world for about 10 years at this point but it was a relatively new addition into the arms space but kind of the primary difference is that philosophical one of we don't necessarily want to sit there and handhold and make an instruction for every possible situation.
It's more we want to make building blocks that smarter compilers can take advantage of.
So instead of you writing x 86 assembly code. And then that being decompiled down to a proprietary risk implementation side of the processor, we're saying.
Right your code in C. Let the compilers do the thing that they're good at of break that down into what the processor is going to understand.
We have the same thing in the risk 5 world that we do in the x. 86 world so most modern processors have very long pipelines.
And what a pipeline allows you to do is. You can use different parts of the processor for different instructions at the same time.
We'll get into this much more here in a second when it comes to speculative execution. But the idea is that you, you can be processing multiple Parts or multiple instructions at the same time as long as you're doing it with different parts of the CPU.
So you can have one in the decode section and then the instruction before that is in an ALU and the instruction before that like all the way down the pipe and the wider your pipeline is the more instructions you can put in instead of having a small set of engineers figure out what's the best way to fill that pipeline.
You have the compiler do it instead. That's kind of the philosophical difference.
Now you are right that with there are extensions to risk 5 and we're putting things in. The base instruction set to your point does indeed include math.
It does not include all of the map and some of that stuff is part of the the base instructions.
So there's a base integer set which will let you do arithmetic. Basically addition and subtraction of integers.
But if you want floating point, that's an extension. If you want to be able to do.
Atomic memory options that is a different extension as well so we kind of build these like necessary building blocks and then we tap them on.
A lot of the big extensions that are being proposed right now. Are ones that are getting, we recently ratified the vector extension, which is the other half of the joke around risk 5.
That how this came to be was a group at Stanford. Was trying to build a new generation of vector processors and they needed a general purpose microcontroller to manage all of that.
They tried to license stuff from ARM, they tried to lend us and stuff from, from Intel.
They tried to license them from AMD. Nobody would give them reasonable pricing. At the time they were doing this all the rights for the risk to risk 2 plus risk 3 the risk for stuff that got designed but never got implemented all the rights for that had reverted back to the region.
Of the University of California and they went why don't we just put this together and then we can build the vector extensions later.
So last year, the vector extensions got a proved. And this is going to be a big deal because if we, let me take a couple slides back here.
If we go back to looking at this Zen core you see this giant SIMD section SIMD stands for single instruction, multiple data.
Simd is a way of trying to bolt. Vector computing into a system that doesn't understand it So the idea of vector is being able to work with multiple pieces of data at the same time in a a building block sort of way.
So instead of saying, hey, one like SIMD has a lot of weird instructions of like, okay, great.
Here all these SIMD enabled registers. There's this one instruction that will take like.
5 variables that are in very specific SIMD registers, add them together and put the output in another SIMD register.
In the vector extension, we say, okay, great. Tell me, where you're starting for the register, which register to end in add all of them together and which register you want it to put into.
And it happens. We can do that and you can like shift around which registers you want to do and things like that as opposed to having to implement a new instruction for every combination of registers that you want to do mathematics on.
This is also part of the reason why a lot of the current AI stuff is using risk 5 is because at the end of the day everything that's artificial into artificial intelligence or more accurately in machine learning is piles of linear algebra and matrix multiplication.
And the vector stuff doesn't excellent job at making the matrix multiplication stuff much much faster. So that's, there are things that are coming along.
Another one of the big extensions is an entire suite of extensions that's that that starts with the letter Z.
And these are all various bitwise operators. Not necessarily something that you're going to be finding particularly useful for desktop computing, but in the microcontroller space and in the networking space being able to twiddle bits very efficiently.
Extremely useful thing to do. So it's that kind of stuff that's being added to the to the processor to the instructions that architecture over time.
Is it going to be like Cisco where there's infrastructure for everything? No, that's like the philosophical difference So whenever there, but because we are open.
There are things that are happening of like. Different manufacturers will implement their own custom instructions to do very specific things.
A number of years ago I went to a meet up here in Austin with NXP.
And they had done an implementation of risk 5. And they put their own custom instructions in it for computing ethernet check sums.
Order to be able to get network switches to work significantly faster. They're not going to submit that as an official.
Extension to risk 5 they don't need to they basically only use it inside of their application specific processors but that's one of the things that you can do with the risk 5 which up until a couple of years ago you couldn't do with any other processor.
So many companies were doing that that arm put in a thing where you can wedge in 4 or 5 instructions, but you certainly can't do that with x.
86 because that's all completely controlled by the duopoly of Intel and A. Does that answer your question or did I just ramble too much?
Yeah, no, no, that was good. I like that. And, so, if you have like, so like, let's say, you know, Samsung, like that.
And, so, so, if you have like, so like, let's say, you know, Samsung makes a RISK 5 processor and they choose like what's a risk 5 processor and they choose like what extensions they want and then somebody else makes another risk 5 processor and they choose like what extensions they want and then somebody else makes another RISK 5 processor and then somebody else makes another RISK 5 processor and they choose a different
set of extensions they want. And then somebody else makes another RISK 5 processor and they choose a different set of extensions, right?
Well, that means that these need 2 different drivers, right? You can't write. Or can you write one driver that works on both or is it 2 separate drivers because they have different combinations of these extensions.
So that's there. You great question that comes to the whole discussion of, fragmentation.
Inside of the ecosystem, which ironically is something that we already have in the other ecosystems as well.
Arm already has fragmentation and Intel's x. 86 already has fragmentation as well.
How we're dealing with that inside of risk 5 is that we have a concept of platforms and profiles.
So we. Ship once a Soon, twice a year, we ship a new profile. And the profile says.
In order for you to call something as Risk 5 compatible, this is the minimum set of
Extensions that need to be implemented in your implementation. And then there's applications of if you're going to use a RISK 5 processor for . S.
A, which is basically operating system alpha, which is essentially Linux, Windows, any sort of free BSD, any sort of general purpose operating system.
These, this is the profile that you need to use as to what extensions we, we expect. And these are the extensions that you absolutely have to implement in order for that to function.
So we're dealing with it from that way. So that you can still do things of like you compile something on a Samsung risk 5 processor it will also work on an Intel risk 5 processor it will also work on a sci-fi risk drive processor.
You may not take advantage of. Custom. Extensions that are implemented by each vendor. So like you can build stuff.
For an Intel processor that's going to have extension that are going to take advantage of extensions that are only in those Intel processors but yet won't be guaranteed to work on other processors.
The idea is to basically define the lowest common denominator and then if you decide to use things beyond that, it's going to limit what you can run on, but for the most part it will be interoperable.
Does that make sense?
Cool.
Yup, that really does. So, but that's, but you said you released that twice a year.
So that means that each one of these platforms has a year number. So, so does that mean that like maybe something compiled in 2016 won't might not work in something on a process.
So does that mean that like maybe something compiled in 2016 won't might not work in something on a processor from like, 20
We actually be worried about things the other way around. So if you compile something in 2016 the idea of the profile is that We expect 2 things to be forward compatible with the profile.
We don't necessarily expect them to be. Backwards compatible with the profile. So if you build something on something, if you build some software that is targeted at the 2,023 profile on a processor that's made in 2027.
We expect that to work as part of forward compatibility. But if you compile something on a 2,000, and 27 platform.
But if you compile something on a 2,027 platform it may not function on something that only implements something on a 2027 platform it may not function on something that only implements 2023
Yeah, that makes sense. That sounds a lot better than what I said. So that's good.
Okay.
That's good way to do it. I have another question, but I'm gonna let anybody else jump in so I don't wanna hog the whole meeting.
So thank you for answering my questions.
Not a problem. Gary asked about what about the new chips, the Apple M one and M 2.
So the Apple silicon devices are a mix of risk 5 and arm, but same thing just like we were talking about before.
Our CISC processors that implement a risk. Micro architecture and so It's not risk 5 based.
But the application processors, the things that you are using for actually running your applications, those are risk computers.
Down here.
Okay.
There are risk 5 components inside of those SOCs. Again, typically in power management. Things like that.
Steve, sounds like you have a question.
Go for it.
Yes.
I have a question on Tony. You mentioned AI, so my, and my understanding is that, Nowadays you need, and video with run AI or it's more efficient or something.
It depends.
So where does the kuda course fit into the hierarchy here?
So, Applic or a implementation of a very application specific processor. That Nvidia uses for both their graphics pipeline.
But it also turns out the way they built it makes it extremely easy to use for Very repetitive data intensive tasks.
So the pixel shaders and the. The shade, the shader, the shade computers, shading computers.
Are what basically what make up coup de course. And they're very good at taking large numbers of math and assuming large numbers of values and doing Simple arithmetic operations on them and storing those outputs very quickly.
They're essentially doing vector processing. They're just very specific purpose built to that. The problem with the coup de chorus is that the only company that you can buy them from is Nvidia.
It's a proprietary architecture and they don't license it to anyone. Which is great for Jensen and if you're in a video stockholder it's great for you too because holy smoke so they making money.
But the issue becomes because you're beholden to one company, they can do things and be like, you know, behold our new H.
100 data center processors, I will start the bidding for this processor at $85,000 and I wish I was kidding.
That's what they start at and it is a bidding process. They only make so many a year and anybody who wants them has to get in touch with Nvidia and basically offer more over retail than everybody else in order to get their hands on them.
So the idea with risk 5 and machine learning or other computational learning models is to try and get away from that proprietary instruction set and move towards something that's a little more general purpose.
There's a bunch of companies that are working on stuff like this right now. Tense touring is a big one. I forget the name of it, but John Carmack started a company.
Raja Kadori, who used to be the head of Rad on graphics group and then left to go make the Intel Z architecture at Intel for their new processors.
He's now left and is doing an AI startup same thing. They're making risk 5 processors for doing AI.
So I think there's gonna be a convergence of that in the near future. There's a couple working groups that are working on an instruction set extension to do things around AI.
But everybody that I've talked to works in that space have all been very excited about Risk 5 because they're like, oh.
You guys can like the stuff that you've already built. Does 90% of what we need. The primary things that are different are we're working with different data types.
So in traditional. General purpose computing you're using things like I, for 71 floating point.
In ML, they're using B floats, which are binary floating points or they're using various other implementations of floating point for performance optimizations reasons.
CUDA does that. But we can implement those in risk 5 as well. And so people have been doing that.
And so there's some work coming down the pipe to implement those sorts of additional data structures. As alternatives to just standard I triple E 4 71 floating point inside of processors as essentially AI accelerators.
I hate using the term AI because there's nothing artificial or intelligent about anything that has to do with AI.
So that's why attendees refer to it as machine learning. Or machine processing. But that was a big stumbling point for all of these companies is that they would go and try and work with Intel.
They tried to work with AMD or they try to work with ARM and Those specifications don't allow them to implement these different data types.
And so that's why they're kind of all jumping on board with risk fives. Is to do that sort of stuff.
So it's gonna be some interesting stuff. The risk 5 North American summit is the first week of November.
I am excited to be going. There's going to be a lot of big announcements. So I anticipate we'll be hearing a lot more about that.
And we can, I can talk about more, of that afterwards. I run the Austin Linux.
Risk 5 group. We're on meetup. Calm. We're also in community.
Dot com. We run all of our events virtually. You're all welcome to come show up second Tuesday of the month is when we do those meetings.
And I already stated that next month's meeting is going to be there's like 4 of us from the group that are going to the risk 5 summer we're going to get together we're going to compare notes and we're basically just going to do a dump of everything that we learned at the summit next month.
So if you would like to learn more, I definitely encourage you to come jump in on that and ask questions.
Anybody else I can ask questions for. I know you had another question, Tony. I'm happy to give it a shot.
Well, so risk 5 is going to be doing the AI. There are, it's not doing yet, but it's going to be doing the AI.
And is it gonna be how much close to the Nvidia? Quality is our performance are you gonna get to.
I mean, that's that like everybody's implementation is going to be a little bit different. So like.
And video is currently building their current stuff, the H 100. If memory serves, those are being fabricated unlike.
5 nanometer TSMC. I think I think it's on TSMC 5 and I don't remember exactly which fabrication process it is.
I know Ten's Torrent is working on stuff that's also running on I anticipate that it will be.
Just as fast, if not faster, in certain workloads. So it's just going to be a matter of like what silicon is commercially available and how much it's going to cost.
But the advantage of doing it with risk 5 is that you have a little bit more of a open playing field.
More people can come in. You can choose from different manufacturers. I know T head is doing stuff in the space as well.
I know open AI just talked about that they want to make their own chips because they're tired of on depending on Nvidia and giving them all way too much money.
So like I think the performance will be there depending on how much you want to spend is really what it boils down to.
Yeah.
I have a question about. About, right? So So is it possible to run things that are, compiled for, in, in risk 5 and, and maybe this doesn't make any sense, but I just think that like, If we could say like anything that can run in WAS and can run over 5, I really think that really like opens the door, right?
For like a whole lot of stuff.
So that's already happening. There are already WASM run times available for risk 5. There's been a tremendous amount of effort making sure that Nodejs and V 8 are optimized to operate inside of Frisk 5.
There's been ongoing work to do that. Part of the problem is that like, Ideally, I would like to see it go the other way around.
Like I would love for WASM to instead be an implementation of risk 5 instead of trying to implement.
Everything on top of WASM because the WASOM runtime. Is never going to be performant unless you throw massive amounts of computing power on it because At the end of the day, JavaScript is just not performant.
So like ideals like from my perspective, I would like to see it go the other way, but you can do that.
We do have that now. There are people who are running full WASM stacks on Risk 5, microprocessors or risk 5 microcontrollers to do various things.
That already exists. Performance varies depending on which feature sets you're using of the WASM assembly and also which
Which processors you're using and which version of Nodejs are running.
That's interesting. So. So if I compile, so does that mean? Cause you talked earlier about like compiling it like, you know.
And then it working on other risk processors. So does that mean that if I'm on x 86 and I Compile something to WAS and I can run it on RISK 5.
Yes.
Oh, cool. And is that the only cross compilation or is there a more normal cross compilation that can happen too?
No, I mean, so the all the major compilers that you're familiar with, your claims, your GCCs, they all support risk 5 targets at this point of various shapes and sizes and so you can do a standard cross compile from there as well.
Any application that you can run on, say Linux on x 86 relatively easy to cross. Compile to Risk 5.
I actually have a risk 5 machine sitting on the other side of the room that's running full-blown arch Linux with a desktop.
With an AMD radian card in it using all the open source drivers and like everything works you can run doom you can run a quake I'll leave ray office functions like It is not the snappiest thing on the face of the earth because of a lot of those Missing performance benefits that happen from us being in the last 30 years of an Intel monopoly and everything being x 86
optimized. One of the things that's happening is as community we're going through and we're trying to put a lot of those optimizations in for.
Risk 5 on a lot of the lower level libraries. So things like storage access your file systems If you go look in the Linux kernel, you'll find that there's actually a fair amount of assembly inside of Linux kernel that's x.
86 x 86 specific to provide performance optimizations. We're trying to build those same sorts of things for both.
Some communities are doing it for arm, other communities are doing it for risk 5. Some communities are doing it for long soon.
And so the idea is to trying to get to like performance compare, performance parity between those platforms. Capability exists.
It's just a matter of going back to where we were in the late nineties when we had the hardware wars of, you know, SGI was making MIPS HP was making PA risk deck was making alpha, son was making ultra spark people would write software on all the different ones and I'll support them between them but as the Intel homogeny came into place a lot of that went by the base
of the wayside excuse me and we just focused on x 86 so now it's like getting back to where we were and like relearning those those things so that we can target stuff for x.
86 risk 5 and arm not necessarily in that order.
The risk group. Yes, the risk group is. Every second Tuesday of the month if you want to put it in the calendar.
You can go to meet up.com. We post them there and also you can go to community.
Dot com.org and there is a they're posted there as well. A community that rescribed.
Dot org is where we actually host them virtually. There's a whole platform there for doing it. We don't record the meetings, but I do post the slides into a discord after the meeting is ended.
Okay, any other risk 5 specific questions before I jump into speculative execution and I will try and make this relatively brief because We only have an hour before I have to go run away to ironically a risk-five meeting.
Okay, let me let me hop in here so Special of execution. Let me give you some context around this.
You may have heard of. Spectative execution. You may, you may not have. This is not a risk 5 specific thing.
This is a. Modern computing related thing. If you have heard of, there's been a lot of things around this recently.
The most famous ones were Specter and meltdown, meltdown specifically for Intel CPUs and some Samsung CPUs.
As soon as Qualcomm CPUs and meltdown for basically a specter for basically everything else.
And how those function is by doing new tricks that we're performing in order to make computers faster.
I had a lot of questions when I was preparing this meeting, previously of like, you know, when you switch to risk 5, like what does that mean for viruses for firewalls and perspective of execution attacks?
And so let's kind of cover that a little bit. So if we go look at.
How we get to the point of speculative execution. There are 2 fundamental ways of running a microprocessor.
Traditionally, We did a thing called in order execution. It's traditional, it's slow, it doesn't really scale, but it's very secure because the process does exactly what you want it to.
So like an instruction hops in here, it goes into that first block. It passes through that green barrier, goes to next block, pass through the green barrier, goes the next block and so on and so forth.
And then once all of that is done, it's been written back. That's what that last block is, then the next instruction can come in.
We've decided that that has some scalability problems because it does like you can only go so fast with that and so now we come to pipelines and out of order execution.
So now you can take that same. Group of systems and that block that green block in between instead of it just being a logical connection now becomes cross bar that can connect to different stacks of the same piece of information at the same time.
So if you remember back to the early 2,000, Intel created this awesome new technology called hyper threading where suddenly you can run 2 processes at the same time but only have a single core.
That's really what out of order execution is doing. But the issue with out of order execution is that in order to make this function, you have to do weird things.
As you're processing instruction one. You're eventually gonna come to a instruction one is eventually How you're going through your code, you're going to come to a decision point.
An if statement, a for loop, something like that. And in order for you to continue processing past that, Inflection point, you have to make a decision.
And this is where the speculative execution attacks come in because what happens is in out of order processing you compute both answers of that output and because you're dealing with a processor there can only be 2 answers.
It's either yes or no. So as you're coming in. You get to a point where there's a decision and now you start executing 2 instructions, one for if the decision is true and one for if the decision is false and you keep walking them all of the way through.
This is where we get into the spec of execution attacks. Cause what can happen at this point is One of them is correct and the other one is incorrect.
But both of them are executing at the same time. In a perfect world. Once we get the answer to what the decision should have been.
The incorrect. Statement would stop being executed. All of the memory that it touched would be marked as dirty and we'd move on with life.
That's complicated and hard so nobody did it. Instead what winds up happening is we continue to execute on both code paths.
The idea being that If you pick the wrong code path, it doesn't really matter because since we're not going to continue processing down that path, eventually the number of instructions that you will need to process comes to an end and then everything just kind of lightly goes away.
But what was discovered is you can put deliberate code into your applications. That go, okay. If false.
Look for passwords in the memory. Copy them out and put them somewhere else so that the previous correct code path Well then pick up those passwords later and report them back.
Now you're sitting here going, well that's crazy talk. Like who would write applications that would go and grab passwords randomly and just run stuff on code.
And this jumps directly back to the first meeting we had tonight, ads. All of those are running JavaScript and it is extremely cost-effective.
To write vulnerable applications inside of JavaScript. And since everybody tends to be running the same web browser and because everybody is using the built-in password managers in those web browsers.
It's very easy to go find passwords or find forms that have the password field. There's an add on the login screen.
We pull the password out, we put it somewhere else, another part of the JavaScript in the the same ad will take that and report it back to a bad actor and voila your password fishing through ads on the web.
So yet another reason to run Python or at least an ad blocker. This is like I said, this is not a risk 5 specific things.
This is not an x 86 specific thing. This is not an arms specific thing. This is a Fundamental trade off that we as an industry decided was beneficial to get added performance.
For the consequence of less security as you are moving forward. So if the system predicts. The correct if the system actually predicts the correct path everything's fast like that's what this is saying so like we come to a decision there's 2 options true or false.
The system predicts the correct path. It goes faster because we've already done all the work ahead of time.
We're good to go. If it was false and that's what we predicted, it goes faster.
If it was true, but we predicted false, then it's slower. We got to go back.
We got to come pick predict the truth. We got to go compute all the true stuff again and go forward.
But if it was false and we actually meant it to be true, you could actually put some malicious code in there that looks for your passwords and pulls it out.
It's a very like I'm being very broad and non-specific around this because the details very wildly from processor.
Implementation to processor implementation. There was a recent thing in the last couple of months called Zen bleed that only affix only affects very specific revisions.
Of AMDs microprocessors that is almost as bad as the stuff that was happening on Intel's processors, but like that's what speculative execution is.
It's not necessarily something you could put a firewall in for. The best way to do it is to not run untrusted code on your system, but unfortunately we live in a world where everybody has to run JavaScript for any portion of our website to function and so you are always running untrusted code on your browser.
And that that leads to why we have a lot of these password leaks it's not all doom and gloom.
There is some new technology coming down the pipe to deal with this when Spectre and meltdown were initially released meltdown specifically.
There was a large organization, a couple large organizations got together. ARM portions of the EU, Google, a couple other big companies and they created this thing called AMT, which is advanced memory tagging.
What this does is what I alluded to earlier where When you get to a point where you've made a decision of that branch that we were doing the other prediction work for was wrong.
Every time you make a branch, you would create a new tag. And all of the memory that is being used by that new branch would have a tag associated with it.
In the event that you realize that a branch prediction was incorrect. You would then invalidate that memory tag.
So anytime the system attempts to go and access the the memory that has an invalid tag. The memory controller would deny your access, thus preventing you from being able to access anything.
Also, you wouldn't be able to access stuff on other tags. It's a very clean solution.
It's also slow and very expensive to implement. There's work being done to try and make that better.
There's been a lot of work being done by people who are way smarter than me on how to make these things better on modern processors.
So it is getting better, but this is just. Dealing with the trade offs of our desire for things to go faster and faster and faster rather than trying to do things correctly and securely all the time.
So brief overview on speculative execution. Happy to take any questions for folks. You have on that and while you are since somebody asked where is the the link to the the meeting let me go.
Pull that up here give me 1 s and I will get it for you
But in the meantime, happy to answer questions.
Yes, I've heard of Specter and Meltdown, but this is the first time I'm hearing.
In the context of JavaScript, being able to exploit it or tricker it.
Yeah.
And, you know, this is gonna show my ignorance here, I'm sure, but I, you know, there's a lot of layers between my web browser and the CPU.
Correct.
And I'm just It just seems like there's a big gap there and I'm wondering would somebody writing this malware have to be like very, very smart in order to basically penetrate all those layers and exploit a system from like a web advertisement.
So that's the that's the that's the sad and scary part is that the operating system and everything running the JavaScript does all of the heavy lifting for you in order to take advantage of that exploit.
The only thing you have to do is create a Well, If statement inside of your application. That is there, but will be predicted as false when it is actually true or vice versa.
It's predicted one way, but it's always going to be the other way. Both code packs will execute and then you can in your if statement be like, okay, cool, let's walk through the DOM.
Let's find the appropriate place inside of the web page where we see the password field or go make a connection to my one password application from my trusted browser extension and start pulling credentials out.
I'm not saying that you can pull credentials out of one password that way but just as an example and then put all that information somewhere in memory where the good path can then go pick up that information and execute it because both things are happening at the same time.
And the system is going to forget about that incorrect path. It's going to focus all of its attention on.
What's happening on the good path, not necessarily what happened on the incorrect path that it thought stopped processing a while ago.
Okay, so here's the so here's the follow-up question then so I know like on Linux or it's my understanding that on Linux you can choose.
Whether to apply the specter and melt on patches or not. And what I've what I've kind of heard.
Yes.
You know, just kind of other people's take on this and I you know I don't know anything but They've said basically, you know, on their VPS or something, they do it, but on their laptop or desktop, they typically don't, is what I've heard like some people say online.
So what do, what do you think about that opinion?
Yeah. So I run the Spectrum Melt on patches on everything. The trick becomes, on, Linux, that's very easy to do on Windows.
It's not. You don't get to choose which. Mitigations Microsoft implements in their operating system.
Same thing with Apple, same thing with, Android. But even then, assuming that you do implement all of them, so a lot of how those patches work.
It, it should be noted that. Those patches are not a fix to the spectrum meltdown thing.
It is a fundamental flaw in the architecture of out-of-order operations. So it's not something you can just throw a patch on and make it go away other than turning off the out of order operations capabilities of a system.
And in some cases you can do that. Like you can turn off hyper-threading on Intel processors and in fact all the big cloud providers have since done so they've turned off hyper threading on all of their machines that have that capability in order to reduce the area where this can be affected.
Those spectra and meltdown mitigation patches, which are also the same patches that are being used for the, the Zen Falls stuff, which is the newer stuff that affects the Zen to processors, or the Zen.
2 based course. Those are simply mitigations, so they do not guarantee. That there will not be speculative execution occurring.
It tries to minimize. The damage. Mostly how it winds up doing that is when it detects it's in a situation where a speculative execution could occur, it flushes the entire L one and L 2 cache.
Of the processor. In validates all of it. So that information can't be left in the cash for another part of the code to come pick it up because at no point in any of these do any of them get to a point where they can like start access or the, improperly predicted branches can go start like accessing main memory.
But they can almost always access however much memory is in cash and with newer processors having hundreds of megabytes of cash there's a good chance that the things that you want to look for are actually in cash.
So a lot of it is to just flush the cash with zeros or all ones. At regular intervals or specific code junctures to ensure that if a speculative execution occurs it won't be able to find useful information.
But this has a hugely negative impact on performance, which is why a lot of those patches are not included in Windows.
But because they will significantly slow down day-to-day operations of things like the start menu drawing and I wish I was kidding.
Good. So that means that Windows like all other malware, Windows will be the primary target and us Linux users will be way down in the food chain.
Well, I mean, so there is stuff that's happening, but like every single proof of concept execution, every single proof of concept that I've seen for all of these mitigations have been in JavaScript.
Like that's been the terrifying part. It's like it will function on Windows. It will function on Linux.
It will function on Mac OS. It will function on Android. Because it's easier to write to that and target things that are happening inside your web browser because let's be honest.
These days, what is every application? It's a web browser. So being able to target that stuff inside of a shared processing environment like that is kind of a big deal.
Some browsers have been doing a lot of work to try and like cut down on that. So like you can't necessarily access memory outside of your tab.
Firefox did a lot of work with this with a JavaScript standboxing. Google has picked up on some of it for security research purposes or for security purposes like this.
Safari has also done some work on this as well, but like there's a lot of work that needs to be done to kind of like secure that environment so that we know what code is running there and it's not as easy as it is for like traditionally with software like you go and you have a trusted source of software, you can see what's going on.
The whole point of JavaScript is that every single part of JavaScript is obfuscated for performance reasons.
So you can't you can't do the thing that we used to do in the mid nineties of like view source on a web page, find the JavaScript, open it up, read it, see what it's doing.
Everything goes through a minifier and an obfuscator now to reduce it to be as small as possible because we're sucking out literally megabytes of JavaScript on every web page.
In order to make things happen. So it's kind of a chicken in the egg scenario. Like we've gotten to this point because we've gotten so used to running untrusted code on every single thing that we do.
And so now it's a question of how do we best go around to fix that? And that is like, you know, getting out of.
The web 2 point oh mindset pretending that web 3.0 never happened and going to something better in terms of networking computing. How are we going to do that?
I don't know. But even then that doesn't solve the problem of outdoor order operations inside the processor.
It just reduces the attack surface.
Yeah, but I don't have the fuzziest idea of what that other thing would be, right?
Cause even like even when I wanna like just install like development tools, right? Yeah, it's open source, like just install like development tools, right? Like, yeah, it's open source.
I might look at the code, but even looking through that, I might look at the code, but even looking through that with any real degree is like, yeah, it's open source.
I might look at the code, but even looking through that with any real degree is like very time consuming and I barely do it.
Oh, totally.
And so thinking about doing that for every website I visit, I mean it's just impossible like out of the question, right?
So
Oh, completely agree. So like. This is this is a fundamental part of the problem like You shouldn't have to.
If you go and download an open source piece of software like, let's say you need an integrated development environment.
Okay, you go like download Emacs or something. That's fine. Are you gonna sit there and go dig through every single piece of code and see what's happening inside of Emacs to make sure that it's not sealing your passwords?
That's it.
Of course not. The difference, the difference between, oh go ahead.
Huh.
I was gonna say that's a pretty funny concept. I've used that editor forever for an IDE and everything else and there's so much I started to look through it one time and I just kind of went no I'm not going to do that
Yeah, right, right, so but the thing is like, okay, so The reason I chose Emacs is because it's also it's somewhat dense but at the same time When people go to download it, integrated development environment these days, what do they typically tend to gravitate towards?
They don't tend to gravitate towards a max. They tend to gravitate towards visual studio code.
What is Visual Studio code a web browser? What happens in that web browser? It shows you ads and those ads are coming down with code.
You don't have control over it. That's the problem. That's the thing that we need to fix is Everybody is injecting ads in everything.
Because that's how you monetize it these days. You know, heck, the new version of Calculator in Windows 11 has ads in it.
Because they were showing it as a demonstration of look you can use the new Windows Foundation framework and it has this built-in thing to get ads from Microsoft.
It's like, There's not content. Filtering happening at the ad level to make sure that there isn't malicious code in it, which is problem.
But I don't necessarily see that getting fixed. It's more of We need to get out of a mindset of everything is perpetually connected to the internet and running untrusted code unbeknownst to the user.
That's really the issue is the unbeknownst to the user part. There's always going to be exploits and code.
There's always going to be. Malicious actors trying to do terrible things. I forget, there was a big one recently where somebody went and, Manage to infiltrate one of the big Python repositories and replaced a couple semi popular packages with ones that would literally like run cryptocurrency miners or whatever this happens a lot inside of NPM.
Actually, like those are the places, those sorts of things are going to happen. But you're absolutely right.
We could actually go through and audit every single piece of source code we wanted to on Linux for the applications that were running.
But like my mother isn't like she doesn't care she's she I have a hard enough time getting my mother to not sign up for trials of Microsoft Office every time Windows doesn't update.
So like it's it's dealing with the dark patterns and going through those sorts of things to try and get Computing back to a place where computing becomes safer.
It doesn't help us that right now, as Cory Doctorow so brilliantly put it in his speech at Devcon this year.
The only type of computer that we've made is one that makes your shareholders sad. The the flaws are in the silicon.
And like we need to come to a consensus of how we're going to deal with that before we can deal with the crapification of everything on top of the silicon.
The fact that the silicon allows this to happen is kind of the primary problem.
Yeah, but you're not gonna get anybody to do anything about that, cause that's how people make money.
Yeah, so it's like it's coming up with a better way of building. Systems and kind of tearing down some of this Everything is free and you are the product ecosystem.
I'm not saying it's an easy thing to do and I'm not saying that something that can happen overnight, but I do think it's something that Those of us who have the.
The knowledge of these things should be advocating more for rather than everything being built on a web browser.
Made by an ad tech company, which is what we have right now.
Yeah!
Right. I've got a A question. About web browsers. Now, I go to a couple of sites that I have to run Chrome.
Yeah, I'm aware.
It won't run on anything else. You know, bank like that. Anyway, I've also got a couple of ad blockers on Chrome that I generally don't use because they're a big pain in the rear.
Yep. And also Google has been making it harder and harder for Ed blockers to function in Chrome.
Yeah, now for last couple of years I've been using a thing called Grave. It's a Park of Chrome.
Yep, I'm familiar with it.
Yes.
And they took a lot of that garbage out of there. For their own personal reasons, I guess.
Yeah.
But I love I like to watch podcasts and you know. All kinds of stuff on, YouTube.
And I've been running this for quite a bit of time and yeah, there's a few ads floating around.
You see him and you ignore them. They're not enough there to you care about. And every once in a while, I've got Chrome fired up, I go look at some site that I like to watch.
Yeah.
Something like that. And oh my god, the ads. You know, and they like. It's just like watching TV, you know, your show stops for 5 min while you watch somebody's ad.
Yeah, you get you get 3 min of television in 5 min of ads. Yes, I'm familiar.
I watch motor sports.
Okay. AM radio is probably the worst. There you have 5 min of commercial and 1 min of Whatever it was you wanted to listen to.
Yep.
But what are these guys doing because Even when I run ad blockers on Chrome. Doesn't touch what this browser does.
What is doing that everybody else does not?
So part of yeah so part of the problem with the ad block tech in a lot of the problem with the Ad Block tech in a lot of the Chromium based browsers.
Like I had been using Brave for a while, but then I started doing some more digging into the people who are running brave, the business model of the company and I was like, oh, I don't really want to be associated with this because They too are a, well they're a cryptocurrency and ad tech company.
And while they are making changes to how the Chromium browser functions. Google is probably always going to be one step ahead of them.
Probably.
I've since moved to you like you probably saw like the presentation that I gave. Like I made it in Google slides and I've been using Vivaldi for my browser since then.
Is it perfect? No. I use it for basically Google things. Like I use Firefox as my everyday browser and I'm very happy with it.
But to your point, like I can't use the Google Cloud Console in Firefox.
It literally does not function. So I wind up using of Vivaldi or something like that.
And I just Limit the area that I have to use that browser for very specific applications.
You, you, you, you, you, you, Chromium.
Anything that I need to do Chrome in, I have a very small number of things open, that only work in Chrome or in this case, like this, this machine that I'm talking to you on is like, I primarily use it for video conferencing.
Alright.
So like, you'll know that you probably noticed that like there were several tabs up like there was one for the the risk 5 meeting that I'm going to and half an hour and a couple of the rods and ends and those are because like this is this is the thing that I primarily use for my calendar and for screen sharing from various applications.
But like my primary browser, the thing that I do everything in is Firefox. And then if I can't do something in Firefox, I'll go open up a tab in a Chromium based browser.
My preference has been Vivaldi of recent. Do the thing I need to do, close the browser, close that browser tab, move on with life, continue doing as much work as possible in Firefox.
Like that's how I've kind of dealt with it and I have some really nice functionality in Firefox between Privacy badger and Adguard.
I've been really happy with my experience in in Firefox for getting a lot of that stuff done.
Vivaldi also has some really good stuff in it like it brought back the strict ad blocking protection, the strict anti tracking protection.
And a lot of this a lot of the features that are built into Firefox now they've brought that into Chrome.
I tend to have those turned. To like the medium setting and set it to the strict setting because if they're on the strict setting Again, most applications won't work.
But that's just kinda how I've been dealing with it. It's annoying.
Absolutely. Like it's incredibly annoying. You know, going back to my poor parents, I just tell them to run Chrome.
Like it sucks, but Half the time it's what they have to use to use half of the sites they use the joke that I made at DevOps days Austin 4 days ago is just becoming more prophetic as time goes on, which is, you know, Chrome is the new IE 6 proved me wrong.
9 times out of 10 people will test off in Chrome and I'll never touch it in any other browser.
And they're like, good enough and ship it. And frequently I will run into sites where I go to do something and it's like, you know, click on this button.
You can't even see the button in Firefox but it renders just fine in Chrome.
Yeah.
Exactly. Exactly.
Yeah.
Yeah, it's it's frustrating but like you know this is this is kind of the world we live in.
I think I don't know if there is a good way to fix it. I wish there was the thing that I tell people is like if your technology if you're technologically adept I recommend using Firefox and just be aware that you're gonna run into those situations.
But you can customize Firefox to have the ad blocking features that you want. And then when you run those into situations.
Another browser to go do stuff. I don't recommend using Chrome, just because it's, it's Yeah, it's Chrome.
I used to recommend people doing, if you're on Windows doing stuff in Edge if you needed a Chrome very browser for something, but I don't even do that anymore because Ed spends all of its time trying to shove bang and co-pilot AI down your throat on everything and I'm just like oh god which is why I've moved to Vivaldi.
We had a presentation on browsers sometime, somebody helped me with this in the last year, 18 months.
And the amount of stuff that. Edge sniffs off your computer and up. Cool, mackerel!
Oh yeah, it's bad. Yeah, yeah, edge is pretty awful. And.
Here now and watch my. My current.
Router that I attached. I live out in the country, so. My router that provides my local area network in my house.
Yeah.
Connects to a cell system happens to be AT and T anyway. But this router has a built in.
You log in and it shows you all kinds of stats, what's going on, how much upload, download, blah, blah, blah.
Yeah.
But it's on the router. And that sometimes looks very different than if I run. Stats on.
Oh, totally. Yeah.
You know, the computer that I'm staring at. First is very different. Of course it also picks up all the rest of the junk in the house that uses Wi-Fi that's out there.
Yeah.
And, about that. Well, I could shut it all off, but I don't really want it all shut off, you know.
But.
Yeah, it's it's because everybody is
Not everybody, but it's because businesses have chosen that the the ad focus model for the internet is the way to go.
And that's starting to backfire. Like we're seeing a lot of that starting to backfire.
Oh really? Where?
Well, I mean, so look at what happened to Facebook the first time they announced that their user base hadn't grown.
Really?
As much as they had predicted. Towards the end of the pandemic like their stock value lost 30% in a single day like Yes.
I could care less about Mark Zuckerberg, you know.
But like, so all of these companies are based on unlimited growth and selling as many ads as possible.
And Facebook and Google are really hurting right now because there's been a lot of push back against that.
And here in the United States, it's kind of rough because we don't have a good set of.
Privacy laws to protect for that sort of thing, but in the EU, both of those companies are getting their pants handed to them.
Because of GDPR and the the strong privacy laws that the EU has. I anticipate that those things will eventually come to the United States.
I mean, hack. California just passed their first version of, you know, basically the right to be forgotten law that's part of GDPR.
And that's awesome. Those things are going to spread as time goes on inside of the United States and things are going to change.
But the other part of it is like we're all accustomed to a lot of this stuff being free.
And we gotta figure out how to fix that without breaking everything. And, you know, this was a large portion of a large portion of like what the Hollywood strikes have been about.
When Netflix started The whole idea was Here is all the content with no ads, just pay us $10 a month.
And then they decided that No, it's not good enough. We need to start creating content and we need to start competing with the studios and we need to start having an ad based here because we're not bringing in enough money and oh we don't have unlimited growth either and like they had a disaster in the middle of the pandemic because they had a month where their numbers fell down significantly and their stock price
plummeted. Because of it. And so now they're trying to go back to an ad based model.
And in fact, that's kind of what the writers guild wanted? I'm not blaming the writers, Guild for any of this, but like, you know, that's the model that has worked for them in terms of residuals.
And I definitely believe that those people should get paid the residuals that they're due. The problem has been That Flicks was taking all of that money and dumping it into creating more content, or they weren't taking that money and pumping it into creating more content, which is what everybody thought they were doing.
They were taking it and dumping it into stock buybacks and paying their executives. And that model has broken.
So the answer has been things like Pluto and FreeV and things like that which are having all of the content but having it be ad based and everybody says oh it's it's free I like my parents try to sell me on freebie and Pluto all the time.
They're like, there's all these great programs that you love on it and it's free and I was like yeah and there's ads every 8 min.
I'm like so and I was like that's why I pay $9 is so that I don't get the ad so like if there was an option to do something where you can get it for a reasonable value. I will do that.
Like that's why I pay for you to premium. So I don't get the ads on YouTube. It's $9 a month.
It's great. But
Try running you, on, Brave.
Oh, it's rough. Yeah, I know. Okay.
That'll get posted at $9 back. $9 is not gonna kill anybody obviously but
Right, but the but the issue became like part of what we ran into is that you know the Netflix model was successful and so everybody decided to copy the next flicks model and so suddenly we had cable again and like We're trying to come out of the, I should be able to get all these things for free on the internet being ad supported.
We need to come up with a way of being able to support this. This infrastructure and these services that people want to be able to provide.
But also have it being done in a way where Your private data is not the thing that is being bought and sold for your access to Okay, the phone dimensional functions of the internet like.
Let's just happen.
Being able to use email or watch videos, things like that.
Yeah, but I'm pessimistic though because there's been a lot of attempts to find a different model.
Sure.
Then ads and selling data. But none of them have really made a foothold or even come close to.
You know, toppling the current, you know, the current way that we do it with ads and telling data.
Yeah.
And like even brave, you talked about brave being a crypto company, right? Well, that's what they originally were trying to do is trying to come up with a new way to fund the web aside from the selling everybody's data and serving ads.
Yeah.
And it's There I mean their way flopped right and all the ways that we've tried so far flopped and I think a lot of really smart people have have put time and effort into this and nobody's really came up with a better solution.
So there's a
So At this point, I'm kind of pessimistic on the whole thing on whether it'll get better anytime soon.
There's a couple things that I've seen that are giving me hope. Like one of them is mastered on.
So what makes it not work is when you've got a small number of organizations with the largest amount of content.
Google YouTube, Office. 3 65 Facebook. You know, these are all great examples of small organizations, large organizations that hold a large amount of the content, but it's like it's one organization that does it as opposed to a group of individuals.
So on Mastodon, you know, I'm on a Medium sized instance?
I think there are several 1,000 people on the instance that I'm on. I'm on an instance called Kind Dot Social.
A guy here in Texas runs it. I don't know him personally. A bunch of people on the instance do, I throw 5 bucks a month at him to like keep the server running and he's happy for it because like all of his costs are covered.
Is it enough for him to quit his day job and be the administrator of conduct social full-time? No, but he doesn't he doesn't care about it for that standpoint.
He does keep it running. And like the bills are paid, which is great. And there's no ads on mastodon like other than ads that users create like I feel crummy sometimes because I will occasionally post promotion for risk 5 events and things like that and like Is that an ad?
Like. Like that's a that's a very kind of gray question like I am a user who's doing it.
It's not an automated thing. Am I using a template that comes from risk 5?
I am, but like am I making substantial changes to it, which is to say I'm just taking the graphic out of it and putting in my own text.
Absolutely. So like, you know, it's, It's weird. I think the movement of indie web and small web and things like that are probably going to start picking up more momentum as time goes on.
And as you are running smaller services on the internet instead of running, you know, Facebook, you run your own blog.
It's very easy to run your own blog for free or cheap. You know, my My blog is hosted at Dreamhost because I used to work there.
If I wasn't a former employee and had my thing, had my entire service compensated because of that, it would be costing me like.
$30 a year? Oh no, like That's pretty easy for most people to. Come up with and make happen and not have to break the bank over it and then there's you know are there gonna be ways of being able to do monetization in certain platforms probably Ironically?
Hiccup is kind of leading the way in this because while TikTok is selling ads, they are also taking a portion of that revenue and giving it back to the creators.
Why can't you do that? At a smaller scale? Well, other than selling ads might be hard.
You, you could. Or you could do a thing of like, okay, here's a platform.
You pay content to get in the platform and then everybody gets a cut of the profits. See float plane see some of the other big nebula and float plan are kind of like the 2 big ones for that where a bunch of YouTube creators have gone and kind of created their own platform because now they don't have to worry the ads, the metrics, all of that fun stuff.
You pay a minimal fee, you get access to all this content, you gotta go from there. Does it suck that it's not free?
Yes! And that's something that we need to get over. Does that mean that everybody should be paying $30 for everything that they want to do a month online?
It's a matter of trying to find the right balance and come up with a better way of doing it.
We had a lot of discussions. As part of the greater internet community around micro currencies around the turn of the century.
And all of them kind of flopped because like They started to pick up Steam and then Facebook made their own and you could only use the Facebook one on Facebook and that's where all the games were and so that just kind of killed the whole thing.
But like that model could work. It's just a matter of getting enough people to do it. I think the change is there because so many people are pissed off about What Facebook and Google are doing with their personal information.
The information that they're selling, the information that's happening, the the the information that's being sold and the information that's being leaked.
Is almost worse than the information that's being sold and it's all coming from basically 4 companies.
And so there's a lot of pushback against that. The tools are there. We just have to build something and then make it Easy enough for Our parents and grandparents to be able to use it and still be able to communicate with each other.
And this is one of the other things that like goes back to the small web and the federated universe and activity pub and stuff like that of like opening APIs so that systems can communicate with each other.
Again, another thing the EU is pushing for and the United States doesn't have any idea on is like you can go to a different platform, but you can still tweet at your friends from not Twitter.
Is like the vision that the EU wants for the future. And that's great. Like that's what it used to be like.
Before we had all of these siloed things, so it's trying to make standardized protocols and do things.
I think it's gonna happen. I think it's gonna be slow and it's gonna be painful and it's gonna there's gonna be a lot of locking on these platforms but Smart people.
Who have a lot of interest in making this work. Your Cory Doctorows and various others, all of the EFF, a good chunk of the ACLU, like these are smart technologically capable people who are going, we can do this.
And I believe them. It's just going to take time and it's going to take concerted effort.
And I think the internet will be a better place for it. The trick is you're going against United States venture capitalism and that's going to be really hard.
Yeah
Yeah, I agree. I think and you know some You know, I'm just. So I put a really strict ad block around my network and I was expecting my wife to come and complain.
That's something that she used wasn't working and she didn't for like months. She didn't say anything.
Yeah.
And I'm like, how have you, has everything been working okay? And she's like, yeah.
And I'm like, Do you see ads when you go to websites and she said I don't know.
I don't really notice and I'm like, well, what websites do you go to?
And she's like, well, I don't really go to websites. I just use apps, you know, and, and it's like, and I, maybe she's the only one this this way like it's maybe it's an anecdotal of one or maybe she's not.
Maybe it's just more and more people are just going on apps on their phone and just don't even open their web browser hardly at all.
Unless they, you know, click a link in an app or something.
Yeah, we, I mean, we already have that information and like that's happening right now. Like.
There was a news article recently that like, a TikTok made a deal with the Wikimedia Foundation so that when you search for something on TikTok snippets from Wikipedia will show up at the top of the search results.
For that information because an entire generation of internet users like TikTok is the internet. So like if they want to go find out like When did Caesar invade Rome?
That's how much I know my history. But like, you know, when did when did the Napoleon invade Italy?
They go to TikTok to find that out. Like they literally type it into the TikTok Square box and they expect somebody to give them an explainer and is it correct?
We don't know and so the idea was to like put Wikipedia up there so you can get some information like That's already happening.
The web is kind of dying because apps are taking it over. The other part of the issue is like we were talking about before of you know I had a lot of my friends who were having difficulty with so my house mates were having difficulty when I implemented the the pie hole here because Things stopped working correctly.
Except for one user and that user was My roommate who has an iPhone. Because on the iPhone if it couldn't figure out how to get to something over the network over Wi-Fi, it would just happily do it over cellular instead.
But the Android phones would pull this, would try to do something over the Wi-Fi and they'd get stuck.
And sometimes they would, you know, just get stuck or sometimes it would just turn off the Wi-Fi and switch back to cellular.
So that might be happening as well and you just don't know it. And you can't control the DNS on cellular because that's that's a whole other ball game so yeah, like.
I agree with you. It's apps. But like how do we How do we get to some place where that is better and I don't know yet.
Like it's difficult to compete. Especially on something like the iPhone platform because it costs so much money.
To create and maintain an app on that platform for the developers. Which is also why everything has ads in it because You can publish something for free on Android, but you cannot publish something for free on the app store like you have to one you have to buy a Mac and 2 you have to pay all the developer fees in order to even get access to the infrastructure.
It's kind of messy.
How much does that cost? I've never really thought about it.
So one like that to start with, you have to have a Mac, like full stop. You, you cannot do iOS.
Development for anything other than a Mac. And then 2, it is a minimum of a hundred $50 per year per application that you want to publish on the app store.
Wow.
And like that doesn't seem like a lot and for some people it's not but like I said it's per application so like if you want to make 3 video games that's $450 and so you need a way to recoup that.
And you have to pay for it upfront, of course. It's not like something you pay for over time.
It's a hundred 50 bucks upfront. There are discounts, but on top of that, like, okay, so you put in the ad system also, if you're If you build something that takes money on either app platform, be Android or iOS, Apple or Google takes 30% of whatever you charge.
So if you're charging $5, they take a buck of it.
Hello.
Yeah.
Yeah, so recently I did this exercise where I was like, okay, I'm gonna go whitelist all the websites that I actually like going to and try to, you know, support them in my ad blocker.
But then I was thinking about, I'm like, I don't really like, I don't go to any blog sites anymore, you know, I used to be one of these people to have like an RSS reader and I would like follow certain blogs and read a lot of the stuff they post but now it's like well at the time Reddit wasn't bad yet and so I just went
to Reddit and like you know, I would just go to whatever is linked on there that I found interesting, but I had It's not something where I'm like, I'm gonna go to the verge and read what the verge has and I just don't do that anymore.
Yeah.
All of my news is, like social, like filtered through a social filter kind of thing where other people share it.
And then the other way I go to sites is like by search, right? I do Google search and then I end up on some page.
Yeah.
So it's not like I can say like, oh, these are my top 10 websites that I love to go to and I'm gonna you know, make sure that I see their ads, you know, it's just that's not how I use the web anymore and I wonder how many people are similar, you know?
A lot of people are like that and like I do a little bit of the same thing. There are still some sites that I try to visit like daily.
One of them is like Veronics, get a lot of great Linux info and stuff like that from them.
But I also pay for a subscription of Veronics because it's $50 a year and you know whatever that helps them out keeps keeps Michael going like I'm happy to support him in doing that.
A lot of the content that I consume online, I tend to sponsor them through Patreon.
So like, you know, I have 3D printers. So like I I throw a couple bucks at I do not remember the gentleman's name here in Austin who maintains Marlin.
So like he gets 10 bucks a month for me through Patreon and like that's kind of flipped the entire content creation model on its head.
Like sitting here right next to me is a tablet that's playing. A live stream of a group of hilarious Canadians that I follow that are doing a Sabathon right now and like I watch their stuff almost daily and so I give them 10 bucks a month on Patreon.
It keeps the lights on and they continue making all their stuff out of free. Yeah, I still get ads through whatever platform I'm watching it on, be it YouTube or Twitch.
But like I don't I don't have to deal with a lot of the other like integrated ads if you gotta go watch some other stuff.
So it's There's other ways it's just a matter of getting a little more creative.
The other thing that I would say is like, you know, everybody's like, you know, oh, well, ads are always been there, but.
The other part is how ads work on the internet. Are completely broken versus the rest of the ad industry.
And the rest of the ad industry, you pay for impressions. On the internet when it started you paid for impressions.
But then it very quickly turned into, well, we have all this data now. We won't click through.
And now it's more than click through. It's click through and how long do you stay on the site?
Which is why there's so many ads on every site. If it went to the same model that the rest of publishing uses, which is by impression, It would be significantly more sustainable.
Like, you know, paying for a billboard on a major freeway. Costs a lot of money because you're going to get hundreds of thousands of people looking at it over the time that you're there, where as opposed to paying for a billboard on a small side street isn't going to get as much views.
But the the the advertising industry decided that stupid we it would be like billboards being charged by how many people call the 800 number on the billboard.
Like, of course it doesn't work, but that's how advertising has gotten as bad as it is on the internet is because they they broke the model for how advertising should function because they got greedy.
It's always about people getting greedy. So maybe something will come up better. There's been alternative ad networks.
Could all of partners used to run this thing called the deck that was great same thing based on impressions they worked with big bloggers.
They would only sell X number of spots per month. The ads would rotate out and basically you were guaranteed how many people were going to view them folks love them it was too much of a pain in the ass they shut it down But most of those innovative ad companies have been bought by Doubleclick who have been bought by Google or and then double-click bought Google, sort of kind of.
So it's hard. I would love to stay and discuss. But I have another meeting that I need to go to.
Thank you. All this has been great. If you have any questions, feel free to pull up the v, send me an email.
Best of me on LinkedIn contact me through meetup I will be around.
I'm happy to answer more questions. But otherwise I'm gonna take off. Have a great evening, everyone.
Good job, Karl. Thanks a lot.
Before you go.
Yeah!
I've really enjoyed this.
Before you go, if you want to send your notes to editor@sloop.org, we will post it along with the video of our session here in our archives.
Sure, will do. I will, I will, post those, editor at slug.
Org. I will get that sent off here in a few minutes and you can have access to the slides.
No problem.
Cool. Thank you.
Alright, have a great night everyone.
Take care.
Okay, 10 min warning. Normally it would shut if we were to still at the library or someplace like that we would shut down because we had to be out of building but this meeting does not have to end at 90'clock.
But keep going, folks. This is fun.
Yeah.
What? Yeah, I've enjoyed this tonight.
And since Gary can't say anything, it's been remarkably quiet.
I can't, anything.
Okay.
You got laryngitis, Gary?
No, I think it's hardware problem.
Oh.
Oh, that sounds bad.
You know, Lee since I bought this camera you recommended I think I paid a whole 10 or $11 for it.
All of these meetings have worked absolutely perfectly.
Yeah.
There's a little internet camera and I use the microphone, I guess it's got a microphone built in.
And that thing just. You know, it's not complicated, it's not fancy, but.
It works.
What I like is got the little button on it or light. It's red when it's off green when it's on.
So you got a confirmation when it's on.
Yeah. Yeah, let's see if I hit the stop video. Yeah, the green light goes out.
And my picture just appears.
Well, I did try about.
Did you really?
14 or 15 of them before I settled on is one. So. There was some selection there.
Yeah.
About half of my send back a few others I kept for Spears.
The only problem is I have no idea where I get another one.
Is Amazon not have it anymore?
Well, try to find it. I'll come to think of it.
I don't know. I think I still got the box laid over here behind me.
It is still there. February 2021
Okay.
Oh, you're looking in your Amazon purchases?
Yeah, but it's, it's not there. I hit by it again. Let's see.
Yeah, not currently unavailable.
Currently unavailable. Yeah, that's a shame.
No.
So I'm disappearing next week to Durham, North Carolina.
Thank you.
Go on vacation or you moving permanently or?
Vacation to a tech conference for The Django Python framework.
Good.
Oh, okay.
Trying to think if there's anything you guys interested that we're gonna be talking about those.
Do the stairs.
Oh no.
I've heard of a Sequel alchemy and I don't know anything about it other than it's probably like an or something but just that name in school.
I know it's not Django, but it's related, I think, to Django.
Yeah, it's a Yeah, it's a Python. Or, instead of SQL alchemy is strictly, I believe.
Database, data storage, that kind of stuff, whereas Django is more website slash.
Application focused. That has a very nice or I'm attached to it.
And even the flask and the fast API is also related to the frameworks.
Flask is more of a peerly website. I don't know if it had, or how much of the database it drags along.
Probably can install the Python database. Packages and moved it in and now I'm just I use this one.
Good morning, going to North Carolina to. For a week to talk to people on how I can abuse it more even more often.
Yeah, I work for, 100 others.
Thanks, the theory I might get in. Fights with somebody over. Other stupid things, but you know.
And
Yeah, I work for a Warner Brothers as a we are our automation engineer.
Oh yeah, I pair my jangle website with celery which allows me to from pure Python code.
In the background to do that. Stuff. Let me done. Actually named it the Kraken.
Cause I think I once or twice I've killed a server.
Did you say you were an automation engineer? Is that what I heard?
Yeah, I'm a in for automation engineer. I work for a one over this discovery. Location is, there, but currently remote.
I'm currently located in. Fish and access.
Yeah, cool. What kind of tech do you guys use to do your, automation?
So JavaScript for a in for automation, V, operational manager. That's, we gonna use for a monitoring.
And, we, along with. JavaScript and partial.
Hmm.
We do the infra, like that. Snapshots and sometimes we deploy through telephones.
And, managing playbooks to answer both.
So.
And you're, you're writing JavaScript code to do all that?
Okay.
I'm not all of them like we have a separate tool called. Where it is orchestrator that is where we can use the JavaScript.
And apart from that and we use some of the Linux missions patching or something like that.
We use for answerable playbooks. The Windows service will manage through Powershell.
Well, here's the funny thing that Ansible Tower product that they produce. I believe the AWS, which is the free version.
Yeah. Yeah, LMS is the free version for the open source. Yeah.
That's Strango.
Oh.
That is a product built on top of Django. So that, that, that very nice.
Interface for the API.
That's all Django RUSS framework.
At least last time I checked.
Alright, I'm angry. I'm gonna go to. Talk to you guys next week if I'm not.
Otherwise entertained.
You mean you might have more fun somewhere else?
Isn't that the point of vacation?
Well, yeah, kind of.
Let me know if you wanted me to ask anybody's questions about that stuff. Especially if there was a mailman that we were trying to deploy.
Into Kubernetes.
Thank you. I think you're trying to do that.
Well, that'd be fun.
That's one of my tasks this next 2 weeks is. Figuring out how to deploy Djingo efficiently into Kubernetes.
And have it all play nice.
Use helm. That's my advice.
Use what?
It's more of what do I put into the setting so I can find the database server.
Oh, okay.
How do I set up the database server in such a way that it's fall redundant in Djingo doesn't care.
Sounds like fun.
Managing dozens of secrets that May or may not be changing. Stupid things like that.
Later.
Yes, I.
Well, Stan, you think we ought to cut the recording?
Yeah, I think so.
Our folks, this has been the Wednesday October eleventh general slug meeting. The tutorial was Pihole from James Conroy and the main presentation was risks 5 by Carl or forgot his last name.
Harry.
Very