OpenSSF Education SIG, 27 Oct 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Education SIG – Expand Content Section 2 (October 27, 2022)

Description

Meeting minutes: https://docs.google.com/document/d/1Lt8uGpiMFfgws8VF36xtTMaJAeHufha-7Dqz1tjrPGY/edit#heading=h.naeeah7jeanr

A

Oh official background time.

B

I see I still have my awesome OS background. Let me swap it with something else: none hey.

A

I always like the Gundam Wing and the bet.

B

uh Fizzy, no, we don't hear ah he's already dropped out perfect.

B

um Let me at least start by sharing my screen.

A

Don't forget notes Glenn.

B

Yeah I was on it.

B

So we have this, we have the link to our awesome notes.

B

Let's see, let me make a copy of the new agenda. Put it.

B

B

Page break there we go.

B

B

ah I saw Christine also joined us, so let me already enabler so welcome everybody. Thank you for being here.

B

um Please uh uh go also to our meeting notes and agenda notes to mark your presence as well um and Market black for some I already did because I see them for others, I, don't ah yeah all right, perfect um yeah! Do we have any new friends I, don't think so. It's uh probably the same uh Usual Suspects as always right, yeah, all right.

B

um Somebody helping to scribe of it that would be great I will also try to do it and based on the stream too. What are the agenda items that we actually want to discuss because I do have uh definitely a couple um I, don't know what uh the others of the group have as additional agenda items.

A

No I think that's it. I think we might be having a short meeting. Maybe all.

B

Right, um one of the things that I actually wanted to discuss in terms of materials uh with this group is that for now um when we have like, for example, the labs and the environments that we created- and this also ties a bit into the current 2.1- go existing content and improving and expanding the content and training.

B

uh Currently we are covering and who already have like the Java, node.js Andy Python, and what we have is actually um the explanation of vulnerabilities uh and we also have the exploits how to do actually the exploits for it. Currently. What we do not have yet- and this is actually a question that I wanted to ask here- are also the correct implementations for that specific functionality or vulnerability.

B

um In the past, what we do and what we decided was actually not to include also, you know the fixes so take. For example, cross-site request, forgery python. So here we have the average space the explanation of what is the vulnerability. What is the issue give any more background, then we have a chapter of exploitation. So what is actually wrong and working on a hacker do and Achieve with this stuff, um but I feel we might also want actually to include like the secure implementations. As as what should a developer do in the past.

B

We did it because, of course, there are thousand ways to actually you know achieve it and implement it, and but looking at where we want to go to and making the old learning experience a bit more smoother and quicker um yeah.

B

We might want to add this uh why we didn't in the past, because uh you know I really have the the philosophy and the mindset to become good at something you need to have pain, suffering, crying and and really learning, and that's awesome, but maybe here as we are really trying to also uh speed it a bit up and and help people, uh you know progress quicker.

B

We might actually want to make the pain a bit less uh for them to also, for example, provide here an example right of of what the correct fix should have been or could have been for different type of labs that we offer um so any thoughts about that from you guys. What.

C

B

D

So if I understand correctly, it's not directly part of the lab, it's part of the documentation like the knowledge graph and perhaps from the lab. You can access it. But if you want to go to the lab, you will cry and if you want to stop crying, you can go to the docs to finance.

B

Yeah exactly yes, yeah, because it might be that I! Don't know! You tried a couple of approaches. You render code, ql and and I. Don't know the dynamic security testing from zap it still flexes as vulnerable okay. What now right.

A

I would I would say that this would like it's difficult because, like for there's, some of them, that we don't have implementations in multiple languages. So this reality is that we would have to like guide people like point it out like how would you go about like fixing the lab like? This is how we would go about fixing the lab, so I think that we could do that. I think the idea is great.

A

I, I and I think the documentation can be written on how you would go about fixing it, but as far as in the lab environment, I feel like this would have to come after our like after we decide how we're gonna add the guidance to the labs a little better.

B

Yeah indeed, um but do you want, uh maybe that's also a good question, then? Is it really that we should make Gardens or do we give like correct code example, guidance.

A

Well, I know that a very big goal for kind of a lot of the work that's happening in the labs is making it so that you don't like have to open two browsers. Essentially, where you have the write-up on one side and.

C

E

A

On the other, you know and I know that that that's very impractical and that's like bad user uh UI, ux, whatever like so I, know that that's something that okiki's trying to present some ideas on what potentially could happen and how we could organize this so that you have it like side by side um and that's what I'm saying. I think that this is what we were talking about like if you did want to have guidance like if you did want to have like the UI, where you're pointing out and you're.

A

Like click this button, you need to be in control of that UI. So I think that it's a good idea. I just think that and I think it should be done, but I think a it has to be guided because we don't have implementations in every single language yet and even if we did even if we did I, think the big question would be like how much more. Are you really gaining from some of these basic examples?

A

If we like leave you to do it versus the guidance, because it's really hard to have like one or the other and I think also it's worth thinking about what people want or what people would prefer, because I think that different people want different things.

C

A

Like I know, a lot shall we say more seasoned developers kind of like here give me what I need to do and let me experiment I know, that's the ideology, but I know that that's not the ideology for like new Learners and things of that nature. So I think that. There's also that to think about.

B

Yeah, we could also say, depending on I, don't know the the profile and the uh what stream one is actually doing. We could say we only present like a part of uh the edible, the content material. If you say hey, my profile is I'm an advanced person yeah then you maybe only get like this first part right or right, because the medium one then type of person you get a post and a second part or.

A

Actually, this this actually brings up an interesting dilemma that we've been having if I can pivot for one second Glenn, because we have avishay on the call which.

E

A

You are right, abishay, we are building and we're trying to fit everything in a graph database, but then there's the question. So a graph database has nodes right and basically, what we're we're our graph database is cataloging different pieces of knowledge. However, the question that I would like to open up for this group that relates to this is okay, so before the lab, could we pull up like uh Glenn like an entry of a or wstg like like 4.1.1 like the just the basic one, because basically a node is a single knowledge object.

A

So, for example, you would have like an entry from wsdg um I I I could send an example if you'd like, um but basically how are we gonna split? That up is the question because it is a standard, it is an entry. It is a thing. You know it is a concept. It is a core concept like any of those any like four anything, that's like chapter or section, four yeah, but you see exactly like that, so you have like summary: you have how it works.

A

So would all of this be a single thing, or would we want to split this up where, like you can interact with different sections of knowledge? You see my point.

A

Because this can be saved as like a single data object so where you basically just have you know like the the ID and just the the name, and this and that's it, you know- or we could split this up where each entry will have, for example, a summary or a description and then maybe, like you know, a demonstration piece or so I. Don't know I'm just talking on my rear, but you got my point ideally ideally I. Imagine that we would want to break them down, but then it's then it's a question of okay.

A

What's going to be the format.

B

Yeah also, and ideally because you know, for what we decided to to move forward- is actually to look at the testing guide for the offensive and for the defensive part, we look at the ASCS, so there we have like a structured sort of data set, which we can make note so for the the graph.

B

um But the question is: how are all the other materials structured right? How do we indeed break those down again because we can make an approach for this one, but it feels then that we need to have a sort of different approach for all the different type of materials that we are going to and before we continue Christine. You have your hand up sorry.

E

Oh yeah um I was I, was gonna comment on uh the earlier question that you have or your suggestions so yeah.

C

E

I understand it correctly, so you uh you are currently showing mainly like the path that uh or just like, showing what could go wrong, but you're, trying to look for how to get guidance or potentially give guidance of what they should do right. I.

C

E

C

E

I was wondering, if have you ever had a chance to actually interview or folks who are actually consuming the content and see what they might wish, like. Maybe interviewing different types of folks, maybe like the folks who are trying who are new to security and just get a sense of what they are looking for. Have you had the chance to do that in the past.

B

um That's a good question. So actually uh you know because currently you know um I work at a company where we are using this platform already for like uh more than three years, we have uh like I, don't know like three four hundred people actually trained. You know in a secure development using these labs and the feedback that we dare get it's a bit like.

B

Indeed, Randall was saying the more senior people they like to play around and figure it out themselves yeah, um but we do see that indeed for the more Juniors yeah they're struggling and then you know, sometimes we see that they would go to a stack Overflow or whatever copy a piece of snippet there and then try to embed that to see if it solves the issue and yeah. So it is a bit both right then yeah.

A

Another thing I want to point out. Another thing that we've or I've kind of observed is that you really have like multiple levels or different types of security training, depending on like what generation you were taught. So that's another big thing for us because, like the new people that are just coming in they're being told a lot of crazy stuff to not call it something else of like oh security, doesn't involve any coding, you don't have. You could be allergic to coding and be in the security business.

A

That's a hundred percent fine and we're talking like top universities that are telling this to students and I'm, not saying that. Maybe there is a version now of security where you don't have to code or you be like not knowing how code works is okay but, like still you know what I mean because, like I'll be honest, I do I, have had a lot of Engagement with brand new graduates and they're allergic to command line.

E

A

Yeah, like you, have no idea Christine like they are very resilient, like you're gonna. Make me use this. This is still a thing. You don't have a GUI. What's wrong with you. It's like bro you're in the computer business.

E

Yeah it is, it is very hard doing like I remember one time we had to work on a UI framework and trying to see if we could, because originally the educational material was very much high level, and there were a lot of assumptions that you would already come in knowing and they ended up pivoting to try to address the really the beginner and try to explain a lot of the Core Concepts and there was like collabs and how to do it and how to do it right, but because they addressed the beginner, it almost seems like even the people who are seasoned could typically get something out of it, and so you were able to hopefully cover everything.

E

But the beginner was pretty important because at that time that's who they wanted to Target uh initially. So it could be an idea to try to see if you can do something.

A

And to add context, I think that's the direction. We need to move it because in reality for like seasoned people like so I, don't know if you know this, but SKF has its own operating system called hack, OS. So for seasoned people you could just like give them hack, OS and be like go figure it out and for seasoned people. That's fine for older people, that's fine, but for somebody new, that's like what do you want me to do like there's, no Arrow or flashing button.

B

Yes, it's like oh I need to do the same thing. I'm actually hired for, but I, don't really have the Practical experience to know what I'm doing yeah.

A

It's like it's like Christine I, don't know if you know the I'm sure you know about Kali Linux and how a lot of people think that everyone that works in this business uses Cali and it's like. No, that's a learning tool that just is meant for you to look. Learn it's not like. You really are going to have this operating system with a bunch of exploits installed and using that on a daily basis, that'd be terrible.

A

There's just a lot, they said, there's just a different level of expectation in different generations and I think that that's something we also have to be aware of too, because there's also different learning styles, you know, there's the people that need the Hands-On. You know there's other people that learn better with lecture. You know which we don't even have at all in SKF.

A

So that's that's another thing, so you know there's different, there's. Definitely in our observation, different expectations from different users.

B

F

Sorry I just want to see if you guys can hear me, okay can.

C

F

Hear me yeah, we can hear you. Yes, thank you. Sorry, I'm having I've been having audio issues and yeah I was just wanting to go off the back of that right. It's like in all honesty, it's cheaper! If we just approach the common denominator in all cases right um in terms of like forced.

E

In terms of an MVP.

F

And then start developing more advanced use cases for more advanced and selective users and user full Journeys. In that respect, and by targeting you know the common denominator that nobody no security, regardless of how well you are in coding, and then it allows us to actually create a more holistic structure, God put it out to the end user and it would help create a more holistic experience for them to learn through as well. But I was just want to also say it's like a lot of this.

F

My opinion comes down to how we disseminate the information that we have presently from there. We have a better idea of how we're going to transport that information outwards to the end user and how we can then dress that up. Like Randall said you know, there's already some exploration by okay here into how this can be done and bringing it into the one user experience instead of making it multiple would definitely help them. That's in that respect as well foreign.

A

I think that is a worthwhile addition to what we're doing is to add the the solutions. I just think that delivery has to be thought about, but I think delivery has to be thought about overall, so um I'm sure that we might be able to continue this discussion once we have our delivery stream a little bit more solidified, because right now we are limited by what we have.

C

B

D

Definitely does the SKF lab platform today supports like a staged lab, or maybe that's what we have so you can move from stage and fixed to Stage fixed by a click of a button. For instance,.

B

Sort of sort of- maybe it's good also, you know, um let me do a quick and then we also have it also in the videos for people who are not uh will be able to be present, uh but the idea is uh the following, so you have SKF, you can create an account or log in with the default user.

B

um So what we currently have you know the security knowledge framework is a bit more than only Labs. Actually, it's also for security requirements gathering at the checklist from the asvs, for example. So that's the other thing what we can do when you have these vulnerabilities, yeah and uh examples, you can also correlate them to security requirements and the security requirement is also telling you a bit like hey. What should you do, but again it's a very yeah, um not a detailed, step-by-step level right, but anyhow. So what we have currently is the labs.

B

The lab section is more about offensive security, uh where you can really train and practice both the vulnerabilities and do them in a real application without doing anything harmful. So, basically, you can spin up one of the the labs and you have it over here then, where you can actually do your hacking whatnot.

B

um So this is a local file inclusion. You have a menu, for example, that you can go and say, like okay, cool all the labs. The idea is that it's very minimal only one function, that's learnable because then also later on, when you want to fix stuff, you actually know where to look and not learn the whole platform. This is built in like, for example, python, the flask API or in Jaffa the spring boot. You want to make it as easy as possible.

B

So here you see a full path through a tour file and of course, when there's a bad security, you can just actually put in anything. You want and read files locally from the server, so that is the lab environment. Normally you're able to play with this, and do it yourself and figure it out. But again, if you have issues you can click right up which language do you want to see it Python and then here you have actually uh yeah the right.

B

The one I just showed you, and so this is really for um I, say it's uh offensive. Where we created this stuff, then we have the other one. That is the hack operating system, so we have it for python Java. We also have one for node.js, because those are the three languages that we currently have and support, um and here indeed, is more the idea that you have like a a full environment, heck OS yeah. Maybe it's a wrong word, but it's basically everything included uh in this yeah operating system in a browser right.

B

So here you have indeed uh terminal access. You can also say like hey.

B

um Let me think you can also say: uh I have a text editor like Sublime of Visual Studio code, and here you can also access all the the folders actually right, all the labs, for example. So we can go again to the local found inclusion, this one we just did open, and now you can also hack it and start it here, locally, yeah or you say like no I already hacked it. I want to actually fix it.

B

So then you're focusing on these four lines of code, because that's where the the issue is and actually make sure that, when you're going to call this dangerous thing, this uh open function that actually the attacker cannot select random files anymore, but only the ones that are. You know Allowed by the application.

B

um You know the other thing why we have this environment because of course, you can just spin off your own Firefox, where you can access the lab. The other thing why it is well I would say more interesting, because we can also have like command line tooling or other type of tooling like zap, so we can also give them zap to run locally in this box against the local application that they fixed and started.

B

You can run code ql over it, for example, how to do the static analysis um and again this should also help them in yeah verifying the fix they do, but yeah if they're really stuck or as you also know, the tools are sometimes lacking context. Lacking rules, so maybe the fix they did is actually not really good. But these automated tools, actually yeah, cannot really find it right. So there you also might want to have like a pro proper code, snippet or guidance like hey.

B

This is what you should have done to actually make it secure right, um yeah.

C

B

That's a bit uh I had the operating system. Here and again you can just install it at least that's the idea, so you have a port. You can also run this, and so we can go to the uh what is it python, Labs LFE? We also have a starter script by the way for people who are not really familiar with.

B

You know how to install dependencies or started or whatever, um oh and I, see I made it didn't save it there we go so now it's running locally on this box right so now I can go here. I can type localhost logo post.

B

And now the app is also running here. This is by the way, the uh the old styling just that you're not confusing, uh but again the similar application um and the cool thing is, you can now start also fixing it and directly see what you actually are doing right and then, ideally, if you have fixed it correctly, you can say hey: let's do an automated Zep scan on it and see if I actually solved it correctly.

B

So, as you see here, yeah, you have a lot of freedom to play to well use the same type of tools and environment that you normally would also do as a as a developer or as a hacker want to know more about also fixing and securing stuff. And, as you can see here, it's now actively scanning and doing a check on the vulnerable application.

B

um Yeah and ideally here in the alerts, you should get a thought reversal there, because this lab is actually about a local file. Inclusion and, as you can see here, uh the dynamic application security testing tool was able to also um I said. Do the local found solution vulnerability and find it that it's vulnerable right.

B

Because here we have the a to say, positive power again, that's being uh here, we can look at requests. So what is actually issue? They change file name to HSA password a and the response is actually this yeah.

B

So that is indeed uh the bit more yeah I say it's. uh Thank you, the more in-depth uh lab environment, the operating system that we currently have, and it is true that in here, yeah you're a bit more on your own right, there's, not a lot of guidance, so that is also what Randall will say and fizzy I guess.

C

Yeah, that's correct yeah. We.

B

Should indeed make it the more of a workflow type of approach here that also like beginners know actually, where to go, what to do and what are the options.

A

Well, we're not far like oh geeky and I made the observation that, if you really think about it to do most of the lobs, you do need three planes. You need a code editor, you need the actual like output and you need the write-up. Basically.

F

B

Yeah, because another thing that, for example, here is not yet uh I would say that visible, but um the other thing, of course Zep is like an HP interceptor and for some of the vulnerabilities are like header injections or whatever yeah. You also need to be able to intercept uh HTTP traffic, so all the traffic that we are actually doing here in our browser. We actually also need them to Tunnel it up to your.

F

B

Yeah and then say at localhost and then uh I don't know port 8080. So all the communication that we're not doing, we can intercept and we can then also see in Zac to then intercept, uh modify and forward it right to uh to the back-end server. To then do the injections, Etc yep, yeah.

C

B

Is of course, I have one tool, then we have a codeql, we have Sam grab, we have dependency Checker. We have all type of open source security tools that we would want to also uh make available here in this box, um then, on the infrastructure security, because that's also part of the the scope there, you will need to use like different type of tools like uh I, don't know Hydra, for example, for some brute, forcing and stuff like that, nmob, um so yeah.

B

That's why we actually chose to to yeah have a more freedom, a free environment like this, because then it was easy to give all those different uh accesses to all those tools to be able to assess security and also verify if you, if you did it correctly, foreign.

A

People how to use John the Ripper.

B

Yeah, that's also one of the things right.

A

I, don't think I, don't think it works anymore Glenn. So now.

B

You will be amazed that stuff still works. You.

F

Know most of that go.

B

For like uh oshiel hash cats, because you can actually use your GPU to uh brute force, uh with some high number rates, uh a different password, wow and yeah.

C

Did you hear about.

A

Like the the list of like 96 million, most common passwords that got released close to me, yeah.

B

Yeah yeah, you have the list of the 10 million top 10 million most popular passwords, so you know we'll do normally we do uh with like in that we're digesting a bit with oclash.

B

You can easily uh give it that list uh and basically say: okay for every different hash, algorithm convert those into hash hashes, and then you basically have a rainbow table for that top 10 million right.

C

A

See Glenn well, we were actually messing about yesterday with the graph was you see, like you, could add labels to anything or like messing around with the idea of adding a core label to stuff so like so, we could distinguish what is like core content, so you can make a query like I want to know what core content is, and then we kind of got into this idea that if we actually break content down, you could actually label it accordingly and you could actually make like Journeys that way.

F

Map out the journeys and be able to map out where our content fits together and then not only that also means that applying the content becomes a lot easier as well. We can make that workflow a lot easier so when it comes to creating and designing new labs, that would be. You know, part of the overhaul of the the workflow.

A

Correct foreign.

A

We would have to figure out is how they would basically end up looking like in the graph in order for us to come up with a stable budget of like what like, for example, it would cost to index a lot of these things. That's that's kind of what we're hoping to get we're hoping to get done. What we currently have by Friday so I think the intention. As far as us is once we have what we currently have mapped out.

A

It's just a question of what would all of this added to what we have looked like, and it would be a lot easier for for us to be of more assistance in terms of okay. So, from a budget perspective, what are these additions? Gonna look like.

B

Yeah, because you know what I would also recommend that we will do uh date. For example, we have already um data sets that is going in there right, for example, the wsdg, the ASG, the security fundamentals from David um I would also just you know, because we have here also lost webinar and uh podcasts I'll also just grab some random blogs, yeah about security and and podcasts and and YouTube videos and see you know how that would be.

C

A

If you like it, if you like to grab those over the next couple of days and have them ready for Saturday that'd, be excellent.

C

B

It can be just anything, it doesn't have to be correct. It's just to support the uh you know the um what.

A

I was gonna, do right now.

C

A

Was gonna do right now, Glenn with Anthony and Anthony, who correct me if I'm wrong is over the course of the day and tomorrow we're gonna try to just map out what we have of the W STG, how that maps to the asvs and how both of those map to the labs that we have.

C

A

Because, theoretically, the association out of all of those already exists.

B

Yeah indeed- and um we already created like an overview of the testing guide, which type of labs do we have for different languages and the one for asvs. We are going to also wrap that up and.

C

B

um So yeah then at least we know where we have coverage and at least a good thing about when we do it for and have coverage, for example, from the testing guide, point of view and asvs, then I'm sure that a lot of the personas that stream one has identified. We actually can reuse a lot of that artifacts and materials which we would uh you know need to do the bare minimum actually to actually make that course for that or that learning path. For that specific persona uh easier to implement right.

A

Correct now coming back to David's course. This is what I was talking about at the beginning. Okay, so how are we going to split that up? Is it just split up in sections or how do we want to go about that? Because, like yeah yeah there's a there's gonna be overlap there eventually, I. Imagine there's going to be overlap between courses.

A

So that's one thing that I have I'm trying to figure out is like how would we split up David's course into like Concepts chapters sections, because the more granular we can be with the inner information, the easier it is to enrich with things like glossary terms, and you know podcasts and videos and all sorts of jazz, so yeah? That's that's the big question that I have is if, if there's a big course or like I, don't want to call it a big course, but essentially David's course is kind of the singular object.

A

How would you split that up, like yeah.

B

A

Would be the most optimal.

B

Yeah, so it's not optimal, but you know he has uh different categories right, so what I did I actually for now, because, as you know, this is only part of it- the labs actually, where we try to glue the whole courses and everything together is in the training section right and here basically you can say: hey Advanced Training start and you get all the content from David and, as you can see the introductory requirements, okay, what we decided to how to split it up uh now, I, don't know where I put my here so requirements, for example.

B

So here we have the requirements with every topic and requirements: I have privacy risk management. We we chopped that up uh into this yeah section. So that is how we did it. I, don't want to say it's optimal, um but yeah, I I think that's also going to be a bit of the challenge um when we.

A

I don't know if there is an optimal way of doing it. I just think that, consistent whatever we end up doing I think that consistency is key and I. That's why I do agree with you that I think that the librarian of all of this should be within SKF operations, because essentially it's really more than optimal. It's really a matter of consistency. I would argue exactly.

B

Yeah and yeah I mean now, for example, with uh David wheeler scores. I. Did it really uh uh manually, um not ideally uh but yeah? We wanted to have an MVP actually right, um but yeah. We should.

A

Have anyone have thoughts? Does anyone here have thoughts like fuzzy or Christine? Do you guys have thoughts about what my like? The breakdown of this Maybe.

E

um Not right now for me, I still have to kind of get more familiar, but okay.

C

F

Problem main is just working giving and you know what what and all of the knowledge graph is. That um and I've said this to your handle on private. Is that the better? We can disseminate the information that we have into small.

F

Ontologies, you know small into taxonomical groups. um We can better relate this information from the likes of David wheeler from different partners that can grow in time. um Blake we've spoken about. You know it's like that part of the workflow we we could really leverage off the graph, um the graph, the graph frame, I'm, sorry The, graft database.

F

um The knowledge graph is what I'm trying to say right. So yeah, it's like here.

A

F

Split it I would honestly the word. The one thing I would say is like split this up. You know just take a chop, and you know a knife here and just chop it into bits that we could then rep. You know we don't need to duplicate information twice now as well.

F

We got also trying to consider, as like information here in David's course has been duplicated and information that has been replicated in SKF then only through the knowledge graph would be able to see that and then we could be able to bring you know, because then what you have is to competing.

F

You know ontologies with each other, so what you would need to do then right is either simplify into one or Mika assault, a relationship between the two.

A

Yeah, we would have to establish the relationship between the two yeah which, like, for example, David Wheeler's course is oriented towards developers, so that would be like. So there would be different ways of filtering it right through the graph, because some things will be oriented towards developers and some stuff will be oriented towards. You know: Network people and I.T people and.

F

Just different points, you give a cool you know uh reading in terms of like complexity in terms of code right and in that way we could filter out between, like the locals no code stuff and the more deeper complex stuff. You know again through the power of labels and the in the knowledge graph.

A

Agreed I like that.

B

Yeah and just to give you an idea as well, so this is the original file right. So it's one big file. It's basically a book.

F

Does it end with Glenn.

B

You wouldn't say, but uh yeah.

C

B

Really went be a ball from Beyond to uh to write this, and you know that's why we also have it right. It's it's very good material, it's very good right because it really goes into depth. Yeah.

C

A

Great, but now Glenn, you see what I mean also about the the taxonomies of actually adding things. It's it's like. It's a lot easier to add things in a graph database, but still you have to think about how you're adding stuff, because in order for the data to work like the taxonomies need to work with whatever data that you're, adding, if not you're, basically just adding another node in the middle of nowhere.

C

A

But he is right now and to answer your question: fuzzy I, don't think our intent is to necessarily draft a bunch of information. I think that our intent is to try to cattle catalog tag and organize, what's already out there and try to do it in such a way where a reader could basically get the whole scope.

A

So he can understand in essence, kind of multiple documents at once in a way, I'm, not saying that this will let you, like you know, Superman read three things at once, but it should give you Insight on how, like everything works together, because.

E

A

To some degree does actually work together and say the same thing. Yes,.

F

And yeah and it'll allow us to build and map out these the labs you know so it's like referring back to what we were talking about. I was trying to do with the holistic learning. Experience is like through the power of the knowledge graph is like we could devise, Better, Learning experiences and Journeys for our users, correct.

F

You know it's like the more we uncover and play with it. The more we realize how Pinnacle that the knowledge graph becomes a backbone of this endeavor.

A

C

A

I would say Glenn for next time we will try to bring kind of a sample of uh what the graph database is looking like, and what the graph database will look like um with stream three or stream twos and stream ones. Proposal of the editions I know that there's podcasts videos, webinars uh blog posts, um I'll I'll, go through it and I'll and I'll and I'll kind of bring that next time and distribute that through the education sync. So that way, we could finalize our estimates and resources based off of that.

B

uh One remark: I thought: I saw in The Matrix of stream, one that there was also a mentioning of Ruby.

A

um Yes, there is actually okay all.

C

B

So we also need to edit this one.

A

And then I I need to, and we need to ask you next in the next meeting uh about that uh about. If the spreadsheet is ready to go, if it's ready to go, we can do 2.2. There was an action item to make a request for out or other educational material um yeah exactly so um that that can be done if the spreadsheet's ready to go.

E

I think, after the meeting they had last week, I believe there was something sent in the mailing list that the spreadsheet was ready to go. But we can confirm.

A

Okay, I didn't get that I might not be on that mailing list, maybe but laughs.

B

Right just going over the uh the items that we have.

B

All right um anything else, we should discuss right now.

A

B

For example, the uh blocks podcasts.

B

A

Correct because we would have to figure out like what labels and properties go to each one before we can really talk about, adding it real and then yeah like making making these things is not difficult like making them for the. What should we call it?

A

It's not difficult from the point of view of like having something to do, but it is difficult from like uh you know what I'm.

B

Saying yep yeah it needs to be all tied together, yeah.

C

B

Then I would say: Let's uh leave it, as is here for now we will get working on uh this week, so we have something to present next week as well in the global sea yeah, and so it's a bit more clear uh and how it will look like and how we also can consume uh and then link and reference and use all that uh artifacts right. Those notes that we're creating them yep yep, agreed.

A

E

A

Having a meeting on the on for stream one or did they cancel, or is it still supposed to be happening.

B

I think it was after this one. Yes, just after this one at that well three o'clock morning time, so in eight minutes there will be stream. One yay.

A

I'll probably see most of you, there.

B

Yeah I need to pick up the kids, but uh Randall Let's, uh you know meet. uh You know in a couple of hours in the evening. For me.

C

B

All right well again, thank you very much everybody and talk to you all soon.

F

Take care of the peace.

A

Thanks Anthony thanks again, thanks for seeing bye.

C