Hey guys, you've probably wondered how do you deal with all your restaurant staff throughout this whole coronavirus crisis? If you have make sure you guys keep watching. Hey guys A lot of you are trying to figure out how do you deal with your restaurant staff through this whole coronavirus crisis? You don't know how long your restaurant is going to be shut down until you don't know how long this whole quarantine Process is going to take place and every single day you're bleeding out of your pocket So you're trying to figure out what is one of your major expenses your labor And that's what we're going to be covering today So then that way I'm going to give you the four different options in order for you to be able to understand through all the noise How are we going to be able to deal with your biggest expense your labor in order for you to live another day to fight for another day? If you haven't already done so make sure you subscribe along the journey because I'm going to be sharing a lot more of these Content with you. So make sure you subscribe now without further ado. Let's dive right in So before we talk about any of the steps the four steps First of all, we need to make sure we assess our business health And what I mean by that is understand how much cash flow you have done the bank Understand how much you need to account for paying rents and other utilities and understand how much cash is left in order For you to run your runway this dictates how healthy your business is and what course of action You can decide to make so now that you understand the business health of yours You understand the numbers you understand how long you can survive without having any revenues to come in then you can consider One of these four options number one is to pay all your staff leave with pay a lot of big companies are doing that all these Chains are doing that mainly because they have assessed their business health and they understand that throughout the quarantine process They much rather keep the morale of their staff They understand that this creates a great culture within their company if they can afford to do so now not a lot of big Not a lot of companies for that matter can afford to do that But if you have enough cash flow, it's something that I would highly recommend you to do because hiring a new staff and Training them requires you to pay money for training and everything But if you guys can go through this crisis together, you're gonna have some loyal People that you can retain and these are the people that would fight and put their necks out there for you in the future A second way to deal with your restaurant staff is leave without pay What I mean by that is after assessing your business health Understanding the fact that you may not have enough cash flow to sustain your business While paying all your staff full-time pay without any work then unfortunately you need to start talking to your staff Understand they would understand the position that you're in that you're bleeding left right and center that you need to pay for rent You're forgoing all the revenue that's coming in and all these crazy things that are happening at this moment Your staff would understand you don't want to lay them off But you want to keep them on board and if you have that consensus if you have that chat with your staff Then it is okay to have them leave on holidays without pay The third way to deal with restaurant staff throughout this whole crazy Crisis is staggered shifting and what I mean by that is if you're still operating your business in wherever you are Or if you're operating business as a delivery only option It is okay to talk to your staff and explain to them about the situation once again They very much well understand the situation that you're in that you have all these crazy expenses And that you losing money left right and center So they're okay with just working the minimal shifts and to actually work out the staggered shift With their other partners and other peers and this one that way we can all get through this whole crisis together The fourth and final way to deal with your restaurant staff throughout this whole coronavirus This whole crisis is to fire them now. I'm not telling you to fire them in a very bad manner I understand that a lot of you are suffering through a lot of guilt internal guilt because you know that they have Families they need to feed you know for a fact that they're living to pay check pay pay check to pay check And you feel super guilty and you don't know how to fire them But then yet you assess your business health and you just don't have the money to pay them When there's no work Now I'm giving you the permission in order for you to fire them because a lot of you understand that Businesses business business decisions needs to be made and the sooner that you can make this decision The sooner that you can live another day to fight another day So then that way when times change you can go back and actually take care of the people that you love Take care of the people that you fire take care and rehire them get them to join this whole family again a lot of people are Afraid to fire people afraid to take this action because they feel guilty today I'm giving you the permission to do so Businesses business live to fight another day So there you go the four ways to deal with your restaurant staff throughout this whole pandemic whole quarantine period number one is leave with pay Of course, we all want to be able to do to do that be a responsible owner and to build them around build that culture This comes at a huge expense huge capital and deep pockets if you have that I Highly encourage you to do so because all these people they live paycheck to paycheck and their families to feed Second step to deal with your restaurant staff is to have them leave without pay leave without pay is the second resort because at the end of the Day, you don't want them to leave but at the end they just don't have that cash flow in order for you to sustain them So getting them had to have a month of vacation and paid is also something that you can work out with them The third way is staggered shifting staggered shifting so then that way you can still give them Some shifts in order for you to maintain your operation if you're dealing with delivery as an option or if you're in a place that has That your operation can still sustain fourth way The final way to deal with your restaurant staff throughout this whole crisis is to fire them I'm not telling you to fire them out of spite or be cold-hearted, but Business decision needs to be made and unfortunately you need to be able to protect yourself And I'm giving you permission to do so do not have to feel guilty because you have done assessing everything Live to find another day so that that way you can repay the people that are on your team These are the four ways that you can deal with your restaurant staff throughout the whole crisis I really wish and hope that I can give you a better alternative But unfortunately these are the four ways if you guys want to learn more about how Is that one thing that you can do in order for you to survive throughout this pandemic? Check out this video right here where I talk about the number one way to survive this pandemic Nonetheless, I really hope you enjoyed this video Make sure you subscribe along the journey because I'm gonna share much more of these crazy content these good content with you Otherwise smash the like button. I'll see you guys in the next video


It's a pleasure that Modiji visited us today and he named the centres. I've been involved in studying the landing sites. So daily, day in and day out, we used to see where to land, how the location looks. We used to only identify with numbers, latlons, but today he has given name to where we landed, so it's very a happy moment for all of us.


It's pretty pathetic, honestly, how these low-lives work together with each other. Honor among thieves. As much as I don't like making these videos about the negative things happening to me, what am I supposed to do? I hire three lawyers. They all work against me.  You know, what these secret society degenerates have done to me is irreparable. My mother, double kidney transplant, stroke, patient has lost 20 pounds over the past month because this has induced some type of paranoia for her. And I'm sure most of you know the details about how my business partner stole money from me, but YouTube was kind enough to take down the video of him in lieu of a privacy complaint. You know, Mr. Starwitz, I would say I don't enjoy having to deal with this, but one of my viewers was kind enough to make a website in your memory. On adamstarwitz.com, they have the privilege of seeing your Instagram, your LinkedIn profile, a brief summary of what you did, and those two videos you want to take and download so badly. Maybe you should join the rat in Costa Rica. I'm sure he has plenty of teenage boys to go around speaking of which his website has been up for a few years now. It's kind of crazy what these people can do, and then their control over everything allows them to just sweep it under the rug. You know what strange is I looked at his LinkedIn profile a few weeks ago. It said he was currently employed with the little beat table. After I posted that video on him, he changed it to not currently employed. And that means one of two things. He was fired from the job after someone saw the video and contacted them, or he removed it as his current employer so that no one would do that. Either way, I have a feeling Mr. Starwitz isn't going to have a job after this if he did have one. As much as I'm a very forgiving person, the way these secret society scumbags act is beyond forgiveness. Someone who agrees to open a business with me to split profit 50-50, grow something together, instead takes advantage of me, my followers, to pad his own bank account, deceives me the entire time. If it was up to me, this guy would work in a dungeon of a kitchen for the rest of his life to pay off his legal fees. And to be honest, the way things are going, that's what it looks like. As I said, I hired two lawyers. They both screwed me over. They didn't file any motions in court for me. They just let default judgments go against me. They didn't listen to anything I say, and then they withdrew from the case. So it's pretty sad how I have money stolen from me. I'm the victim, and then the courts, the judges, the arbitration people, they all screw me every step of the way. So it's very clear what's going on here, and these people are selfish, and they want all the power to themselves. And things like this that rarely happen because no one is really in a position like me are true examples of what they do to people.


In this module, in fact, we will derive some principle. We have derived them from different disciplines. We started with, in the beginning of the course, we started with sociolinguistics. Then we came to anthropology, then to sociology. And after all these points of views taken from these different disciplines, we have derived principles to have a general understanding of what is gender and what is its relationship with language. The first principle is that gender is learned. It is something learned directly or indirectly. And this learning process is continuous. Second principle is that gender is sometimes taught. We are explicitly or directly told that behave like a boy, behave like a good girl. And this happens through formal ways, through education, through curriculum. We call it collaborative principle of gender. We are taught which behavior, which dress, way of talking is suitable for a boy or for a doll. Gender is not developed in isolation. We are now trying to understand how is it collaborative. Gender is not developed in isolation. Rather, through interactions, what we have called social markets and what we have called community of practices, what we have called peer cultures and different disciplines which we have discussed. And through interactions, we are exposed to new social orders. We learn gender norms mostly indirectly and unconsciously because gender development takes place in interactions. This is a collaborative environment. This is how gender development becomes collaborative. So during these interactions indirectly, we internalize what gender is. So it is learned indirectly and unconscious most of the time. It is gender responses of others that teach us this is good for men. This is good for women. These activities and these roles are good for boys and these are good for females. So when we interact with people, their responses to our behavior, to our talk, to our hairstyles, to our habits their response would teach us indirectly how we should behave. We are separately grouped into sports teams. We are separately seated. See how responses are given during interactions. Sometimes this is taught indirectly when we are separated into separate teams in sports. We are separately seated in transport. We are separate in shopping days. Here, you know, in Lahore, we have, for example, impodium. There is a day just for families and females. No male can enter without family. So we learn what to do where and how as men and women through this collaborative interaction. And this happens indirectly. It means that gender is not sex. Sex is part of gender. It is what men and women do. There are two levels of gender. There are two parts of this category of gender. One part is biological and natural. That is our sex. We can't change it. And the other part is cultural and social. This is what develops through interactions. And therefore, here we are saying that gender is not our sex. It is, in this context of talk, it is what men do and what women do. It is our performance. So gender is sometimes defined as performance or performativity. And you know, performance is social action. So here gender means social action, social activities. And we already have talked about it with reference to Weigarski, if you remember. He says that our identity, our gender is defined by our activities. Now the fourth principle of gender is that the development is that gender is asymmetrical. Now you may be looking at clearly that all these principles somehow are linked with some discipline that we have talked about. Asymmetry in some roles, males are more important. And in others, female are more important. In some roles, men are more powerful. In others, women are more powerful. For example, as husband and father, men are more prominent, more powerful, authoritative. And as wives and mothers, female are superior. Now see, all these four principles working together make up what we call gender. Here is a task for you, so that you relate these things with something practical. You have studied four principles of gender. Can you think of any other principle? Keeping in view Pakistani culture. Because these principles are derived by Western authors from their point of view. So we have a separate culture, separate norms and conventions and ideology. Do you think there can be a fifth principle, sixth principle of gender development? So that would be your understanding of what do we mean by principles of gender development.


So I'm hoping this is going to be a discussion. Welcome to, I'm hoping to talk with folks here about the current state of X509 and certificate storage, root certificate authority lists, secret key material, all of the stuff that we have to deal with for transport layer security, secure sockets layer and even other things like open VPN. And I'm hoping that we can have a discussion about the current state of what's going on in Debian, mainly because I think it's pretty confusing right now. And I think it's confusing for packages to know what the right thing to do is. I think it's confusing for systems administrators to know where they should be putting stuff, where they should look for things. And I think it's confusing for users because they don't know what to expect when they're using these services. Most users probably have seen scary warning popups and probably most users have never had any idea what any of that meant. And I'm wondering if there's a way that we can try to sort of rationalize or normalize things to the point where we have a chance of maybe educating some of the people who are using it to the point where they understand some of what's going on. If that doesn't sound very hopeful, it's because I'm not terribly hopeful. I think X509 is a mess. But anyway, I'm hoping to hear suggestions from people, questions from people. And I've got some ideas and suggestions of my own that I'm happy to share, but I'd like to understand what makes sense to other folks, both as packages, as administrators and as users in terms of what we should be considering. So I think we don't have a talkmeister for the talk today. But I think we have microphones here. I can keep an eye on the clock. I don't know if anybody would be willing to look on IRC. Well, thanks, Tom, and relay questions that people are commenting. Probably we'll be on hashdebconf-talkroom1 on the OFTC network if anyone is following along. So yeah, the microphone's up here. If you want to say something, why don't you come up and grab the mic since we don't have anybody to run it right now. But I can sort of pose the problem if people are, I mean, I can pose lots of problems. And I've put it up in this Gabby document, which is on gabby.debian.org under the debconf-12 bof directory X509. And I've just put up a list of open questions that I suspect almost everyone has run into at one point or another that don't really have clear answers in Debian, in our policy, in our packaging policy, in the way we expect administrators to use systems. So yeah, so for example, if you're packaging a service, and the service needs X509 key material or certificates in order to run, or it receives connections, or it makes connections, and it needs to verify those connections. So there's this whole set of questions, right? Where do we put the secret key material? Probably right now, it's at the SSL private, which I can argue about, which has its own issues. But other tools store their secret key material in other places. Do we wanna be sharing secret key material across services? There are some configuration simplicity. You wanna come down to the front? You got your hand up, right? So Daniel is saying, I'm asking you to come up front just so that you can be recorded, but he, well yeah, thanks, Tom. Sorry, I was just gonna encourage you to bring up the example that I gave yesterday rather than running down for the mic. So I have a couple of packages now to do exactly that. So in voice over IP, you've got external communications, both client and server, TLS, and all the applications can benefit from using the same certificates. So that's something that we do need to think about, and it's not just for those applications, the same certificate could be used for email as well if people wanted to secure SMTP. And then you've got a number of different packages that provide, say, the SMTP function or the SIP proxy function. You've got repro, you've got Camilo, you've got asterisk, all doing SIP. So any one of them could wanna use the certificate and the key for SIP. And then obviously you've got the question of mapping your big bundle of root certificates to each application, which one should each of them support. Right, so actually, if you don't mind, I'm curious if you say there's an advantage to the different servers using the same certificate. Can you just be clear about what you think that, what you see that advantage as? Yeah, the administrative effort for obtaining the certificate, the cost of obtaining the certificate, the effort of keeping the key material secure. Obviously if every package keeps key material in different locations, it's a lot harder to keep track of the keys, to back them up to make sure that they're all a suitable length. None of them are 1024 bits or something silly. So having them all in one place, having them shared, for me I feel that's a sensible thing. Yeah, so I would agree that all of those, that reducing the administrative burden is the goal. I think that we may find some pushback from different security folks or different package authors saying, wait a second, that's supposed to be the secret key for my server, and if your server is insecure, and you leak the secret key material because your server's insecure, I don't want you sharing a secret key with a server that I'm trying to maintain. So I think we should think about, I agree with reducing the administrative burden. I'm not sure that sharing the keys across services is gonna, I think that might, we might have difficulty pushing that part through. I don't wanna enforce that. I'm not suggesting that should be mandatory. But certainly it should be an option for those people who feel that it's worth, or that they are willing to accept one risk instead of another. Right. So I think we should give people that choice and make it convenient. The other question then is if you do want to, if we do have this concern about any one application leaking the key, then should we have more security around the keys at the platform level? Should we offer more services to do signing at the OS level or some other abstraction so that no individual SIP server or Java server or mail server can lose a key? Right. Yeah, so that's an interesting question too. I think that touches some on some of the work that Stefan, I wanna say graph I think has been doing within GNOME for the P11 kit. So this is something that tends to be used for client side certificates. So it's a certificate management interface that uses PKCS11 and he's trying to encourage different parts of GNOME and other tools to pull from P11 kit for secret key material. And so if we could have our servers do the same thing then potentially P11 kit could talk to some demonized agent that keeps the key material secret. So that's another possibility as a way of sort of structuring the workflow. So we brought up the secret key material, we brought up how to manage the certificates, the fact that some services might wanna have the same certificate as others, same key material as others, some administrators might not. There's a question about the list of trusted root authorities for any service or package that's gonna be verifying the other end of a TLS communication. We may wanna have some system-wide defaults for that. We currently have an attempt, roughly at a system-wide default for that, which is Etsy SSL certs, which confusingly is not just certificates used. It's actually a list of root certificate, root authorities. In fact, it's a sim-linked set of certificates of root authorities that are trusted to identify a TLS peer by some of the tools in Debian, and then other tools don't use that. So we have this sort of duplication. It's configurable by the admin, which is nice. It's in a sort of funny place, which is a bit confusing, I think, for some packages and some users and some admins. And then the fact that it's not universal is also confusing. So for example, you can go and you can say, de-package reconfigure CA certificates, and you can say, I no longer want to trust Diginotar, for example, and it will remove it from the set of certificates in Etsy SSL certs, but then your other tools will continue to use them. And so it provides us with a set of configuring for one thing, but maybe not for another. Another issue for servers is this list of intermediate CA certificates. So if you have a certificate that's signed by a CA that's been signed by a CA, that's been signed by the root authority, then the transport layer security standards as when you offer your TLS handshake, you have to set out not just your own certificate, your end entity certificate, but the certificates of each intermediate CA up to, but not including the root authority. And different packages have different ways of requiring that. Some say you've got this certificate, you put all those certificates in one file, other ones have different configuration options that say, this is your end entity certificate, here are your intermediate certificates. I don't know how much of that we can normalize because some of that is upstream differences, but it seems like if we can get more and more services to use the same kind of configs, the easier that's gonna be for administrators. I mean, I know that right now if you configure a box that has Apache and I think it's courier IMAP and postfix, the three of them actually all have three different mechanisms for configuring these things. And if you plan on reusing a certificate and a secret key across those set of services that all use TLS, you have to actually duplicate data around in order to make it work. On that field, on that topic, it's really important to have the same key material for postfix, courier, all the code and web because you might want to buy one certificate and not three. Right. And then your host name will match anyway, so. Right, because you have a host name match and this goes back to what Daniel was arguing for as the reduced administrative burden. Even if there was no financial cost to each certificate, there certainly is a labor cost to getting the certificates and making sure that they're not expired and so forth. And so getting a single certificate in that context makes some level of sense. Right, so I see people are adding good stuff here about certificate revocation lists, OCSP, and I would say actually that there's a general question from that that goes into just a general blacklist. You'll note that most browsers today, the mechanism that they're using when they discover that there's been a compromise has not been to use CRLs or OCSP but to actually push out a whole new version of the browser with the known compromise certificate included in an embedded blacklist. That doesn't really scale very well unless the only tool that you use is your browser and I think we can all agree that we don't want that. So again, I'm not sure how we achieved this but it would be nice to have some kind of a system-wide blacklist that would work for all implementations of whatever kind of transport security or anything that uses X509 in general, any sort of certificate validation. I'm also curious if people have suggestions for how to make the certificate signing request and creation process less painful and I've got a list here on the GABI document of packages that are affected. There's probably many, many more packages and then I had one set of arguments which is about just the names of these directories which I think are bad but I don't know and I don't know if obviously renaming doesn't solve the problems that we've talked about but maybe there's a possibility that we could, if we can come up with a consensus about how things maybe should be structured that the act of renaming gives an opportunity for packages to say, okay, I wanna come in line with a proposal, I'm gonna start looking at the renamed sections and the renamed sections might have slightly different semantics than the old sections did. We might have to make some decisions about that but if we do a rename it offers an opportunity to say, okay, these packages are now using the renamed thing, here's one standard and we can try to sort of converge towards that. I don't know if that's useful, people might disagree and so I'm hoping what we can get out of this maybe are some ideas about what is best practices that maybe evolve over time but at least give sort of a baseline. This session was triggered for me by a bug in the Dovcott package where Dovcott was actually storing its own server certificate in Etsy SSL certs so as a result it was effectively acting as a certificate authority for all of the other packages in Debian that used it and it makes sense, you have a certificate that you're using for an ex-opinion certificate, you've got a directory named Etsy SSL certs, you might wanna put it there. So again, it's like package or confusion that causes admin confusion as well. Yeah, there's a proposal for Etsy SSL public here which looks like a good idea to me. So actually can you run the mic up? Looks like Daniel has another. I mean that example raises the question of what other mechanisms we should have in place like for security audit of packages, security audit of a Debian system. Should we have a convenient cron job that checks all the certificates each day? Should people be forced to be warned when new certificates are installed into the root store or should they have an option to enable such warnings? Should we have the cron job that I mentioned that could do other scanning as well like to detect one, oh, two, four bit certificates, to detect certificates that are expiring. So providing all these things in a convenient way is if we want TLS to be widespread. I think the reality is we have to help people a little bit. I mean some of us understand all of this quite well but not everyone does, so. So it seems to me like that might be something that would be useful to put in a package like CA certificates that manages these directories. It seems like it could also install a cron job that would alert, send mail to root or something like that in the event that there's a change. So I mean that says as a baseline of alerting the system administrator that something has changed that you might want to be aware of. I don't know if you have other suggestions for where some kind of monitoring script like that might live. I use Tiger myself. Sorry? Tiger, the Tiger package. Okay. And that's a general system monitoring health check, right? It actually is a security auditor. That's its primary purpose. Right, so. I mean there are two things that stand out for me and one would be to look for the certificate files and the other would be to look at all the open sockets and to actually connect to them and if they're an SSL socket to do some analysis on the certificate on a routine basis. I mean that's maybe a bit much for some cron job that's installed by default but having such a tool easily available might be useful. Yeah, I think that would like, so this is, we're talking about a, something that you could run by hand. Sorry, I'm not sure this is in the right directory here, right section here. Do other people have suggestions for, these seem like good things that we could have for an administrator to get a sense of if something is going wrong but without having a set of sort of clear and simple policies about what we expect a system to look like, I think it might be difficult to create these kind of tools and I'm wondering, I don't know how we can get a consensus within Debian. Certainly a unanimity is probably going to be impossible but I'm wondering if there's a way to get some kind of rough consensus within Debian about the right way to do this and then maybe just start filing wish list bugs against packages. One way I thought about was creating something like DB config common but for certificates. Like you could have a standard question saying, do you want to use the host-wide certificates that would be shared among Apache, Postfix, Dovcode, et cetera. And then even if you don't, then it would be in a standard directory specific for that package. That's the idea I had. But I'm not volunteering for implementing it. So that would be a good way to have a mechanism to do that. But then again, it still doesn't answer the question of what is the policy that this mechanism implements. We're talking about trying to have a standard place to put things, trying to have some common expectations of what servers do. We have the SSL cert package already that creates the snake oil cert. Right, we have SSL cert and CA. Are there other packages that do this sort of system-wide-ish operation? Can anyone think of any other ones? The Java one. The Java one, right. I don't remember what that one is called but something like Java-certificates? It's CA-certificates Java or Java may be in front. The other issue with having a single trusted root store that is a single store of trusted root certificate authorities that's system-wide, that's a system-wide default, you can sort of see if you look at the LibNSS API where you can interrogate LibNSS and say, give me a set of trusted certificate authorities and it'll give you the certificate authorities and it'll include, as it gives them to you, this one is trusted for web browsing, this one is trusted for web browsing and email, this one's just trusted for email, this one's trusted for code signing. Can you use the mic? I already added it at the clients section. Sorry, this one here, line 28. Yes. So, right, so he's saying that OpenSSL has headers that you can attach to X509 certificates that indicate your local policy about what this is trusted for. So that is, this is a root certificate that is good for web access. And I looked at the, I tried to look at those headers a couple of months ago and tried to compare them with the NSS trust flags. And I think there was kind of an impedance mismatch. I don't remember the exact details, but it seemed to me like there were flags that OpenSSL could set on a, and I might be wrong about this, but it seemed to me like there were, you could say, oh, I trust this to be a web server, to verify web servers, but not web clients, for example. And NSS just has a flag that says, I trust this to deal with the web. So you could conceivably configure these settings within OpenSSL headers and then try to translate them into NSS and not be able to because there's this impedance mismatch about what are the legitimate zones of trust. And I don't know how to resolve that unless we just throw away all but one transport layer security library, which doesn't seem like a good idea either. Yeah, I feel like I don't mean to shoot that down. I think that's a useful mechanism, but I'm not, and I also know that GNU TLS, for example, can't read those headers. And it's possible that, I don't think NSS can read those headers, so we would need to provide some kind of translation for that. Do folks think that it's legitimate to file bugs against packages that don't default to using the centralized list of authorities? I mean, so do we all, I mean, is there a consensus in the room here that Iceweasel is buggy because it uses libnssckbi for built-in authorities? Okay, there's nodding around the room. Are you looking online? Is there anyone online who's disagreeing? So why is this not, why has this bug not been, I mean, I think there is actually a bug, but I think it's like a wishlist bug right now. And nobody has gone through and sort of tried to push the elevation or offer patches. I haven't tried to offer patches. If there's a general consensus among the people who are interested enough at DEBCOMP to come talk about this, that that's the right thing to do, we need to make that a little bit clearer. I mean, I know that I have had the sense that, oh, maybe other people have these disagreements, maybe there's some other ways to do it, so I haven't gone in and tried to do that myself either. I'm also pretty terrible about actually getting things done these days. But I think it's worth noting that there's a general sense in the room that we want to see this stuff happen in a more centralized way that the administrator can configure dynamically. So maybe that is something that can be the start of sort of a rough consensus and we can build something like this out. So just a suggestion to make a list of objectives. So we would say our objectives are to make it easy for the administrator to configure his system, like a central point of control, maybe to say we make it easier for the packager, the maintainer to include things like CSR if required. And then we could have a third objective, maybe just to raise the level of security overall for systems running Debian. Does anyone else want to suggest like an objective like that? And then all the other things can be linked to those themes? How do we want to praise it for what we want the packager? I'm just trying to make a note here so that we actually have... To make it easier for the packager to rely on a CSR mechanism that he doesn't have to do it himself. So he can tap into something in the same way as the DB config mechanism, that type of... Perhaps that's certificate creation, management, notification of expiry. Just a comment from IRC. There was a question about going for just NSS only and CS Thomas, who was at Debian Confluster, James Innan says that other distros tried and failed, in particular Fedora tried to standardize on NSS. And that didn't work. Right, so I mean that was kind of an audacious plan by Fedora to rip out the other transport layer security libraries and just settle on NSS. I kind of think it's in opposition with the Debian way of doing things. In that our policy tends to say, here's how we expect packages to behave. And if you wanna use some other crazy package, as long as it behaves in the right way, we're happy to welcome the sort of diversity of implementations into Debian. I agree it would be nice to have a single implementation that we could focus our auditing on, but I think it would be a shame to discourage other people from actually working on alternative implementations that might also be useful. The following question was, do you know how Fedora failed with that? And I'm not involved enough with Fedora to know what the verdict is there. Or it's news to me to hear from IRC that it's been an official failure. I know that there was a lot of work on a to-do list to try to make it happen. And I don't know how much of that was done or how much of it succeeded. Do other folks have suggestions for objectives that? So right now I'm thinking that what we might do is set up a page on wiki.debian.org that tries to document best practices as a starter here. And I think maybe starting it with a list of objectives like Daniel mentioned would be good. And then having a couple of sort of basic points. And then if we can get some sort of agreement from people that these are the best practices for dealing with this in your packages. This is what the administrator can expect. Then we can maybe try to push some of that into a policy-ish document. I don't expect this to be a short-term process, but this is how I'm thinking it could, we could start something like this. I don't know if people have other suggestions or preferred outcomes. And presumably the result would be some bugs that are filed and hopefully fixed within Debian. Does this seem like a reasonable workflow? I've got one thumbs up and no thumbs down. Does anyone have any other objectives that they think are worth doing? We've got making it easier for an administrator to configure his or her system with a single easily auditable point of control. Let's see, for X509 certificates with a single easily auditable point of control, make it easy for a packager to rely on certificate creation, management, expiry, et cetera, so that each package doesn't need to re-implement these functions. Other objectives. We were talking here about packages and administrators. We have users who are neither administrators nor packages that are supposed to be one of our main priorities. It seems like having something specifically about what users should expect. Would it make sense to, if you got a central point of control of certificates for the systems, would it make sense for it to behave as a root authority upon demand so that programs where it's not integrated, you could just point to your own machine and... So your thought was, and I think this is a, sorry, I think this is a tool smithing suggestion, a permachine root authority that could be enabled by default? I think that's an interesting proposal. Yeah, I think we need to look through, I mean, that makes sense in the context of a single machine, but most of these are networked services that deal with more than one machine. So at that point, it seems like what you really want is you want one authority that's gonna be for your entire domain, in which case you can't just build one per machine. And to make that work, you can actually, so actually right now, for the CA certificates packages, for those packages that respect those locations, you can actually just drop a certificate authorities certificate into, I think it's user local share CA certificates, and then rerun certificates that update dash CA dash certificates, and it'll automatically be brought in. So there is a nice way to do that, but it doesn't auto create the certificate authority for you. I'm not sure, because our sort of scope of configuration and administration is a single machine, I don't know how well it makes sense to automatically create the root authority. But I think it's an interesting idea. Does, can someone try to formulate an objective that would address regular users, not admins or packages? Cause I'd like to make sure anything we come up with would help them to make it easy for a user to, I mean the main problems for users are getting connection failures that they don't understand, right? And they're also have problems with connecting to services that require them to have a certificate that they don't have. The two main problems we've had is You can put the mic closer to your mouth. How do we distribute our own CA root certificates and then we're also deploying client side certificates and that's a nightmare now, depending on what browser they use. Some mechanism in making that simpler would. Yeah, I'm having a really hard time hearing you, I'm sorry. The client side certificates is really the big problem because there's so much variation across the browsers. Right, so making it easier for them to use client side certificates across tools and then the flip side is to make it easy for, or make it easy for a user to connect to public services predictably with different tools. Cistamas points out in the IRC that browsers often bundle their own list of trusted CA's that come with the software and so I don't know if you would ask applications or packages of those applications to unwind any upstream root CA's that come with their thing. Yeah, so I think it's worth pointing out what the current status is. So we can look at Iceweasel as a particular point, right? Iceweasel relies on libnss and libnss itself hooks into libnssckbi.so, which is a library that is, it's a set of certificates, root certificates that are built in and the version of libnss that we ship ships an actually modified version of libnssckbi and it's modified in order to include software in the public interest certificate authority. So we're not averse to having packages modify the list of embedded certificates. Like we're already actually doing that. There's been no problem with doing that. We've been doing it for quite a while now. I think we might also add in the CA cert certificate authority. I don't remember what the current status is. But that doesn't mean that the libnssckbi that we ship is actually using centralized configuration. They're just, it's modified but it's not modified to use the central configuration. So I think the argument of we don't want to ask people to strip stuff out or modify what upstream gives them, I think we do. We do that already and I think that's okay. And the only problem is that we're not doing it enough in order to provide an integrated experience across the distribution. And then the comment is the downside with doing this if we succeed is that now we're taking responsibility for altering the root CA's for all these applications. We're already doing that though. I mean, that's sort of my point. We are taking responsibility for doing that. We're taking responsibility for even distributing the applications. So we're taking responsibility for a lot more of the user's experience than just the list of trusted root stores. We're taking responsibility for making sure that they get a package that's not buggy, that doesn't have security holes. Debian is about taking responsibility. And I think we need to, so yeah, we are. And I think we need to keep doing that. Em Shuler says that Chrome looks under home directory.pkinssdb for user added certs. So I don't know, NSS has user added certs too? You can just add your own certs? Yes, and actually Iceweasel will also allow user added certs, but in a different directory. So there's not a shared experience there. And I think Chrome or Chromium is trying to work with a single .pki directory, which again makes sense for tools like Chrome that use NSS, but again the structure and format of that NSS per user certificate database is not directly usable by implementations that use OpenSSL or by implementations that use GNU TLS or any of the several other transport layer security implementations that we actually have tucked away in various corners of Debian. So being able to say, hey, here's how we're gonna store stuff, here's where to look at it. Providing those hooks would be really useful. Unfortunately, I don't have a clear answer for how we get there. So we've got about five minutes left. If folks have other questions or suggestions, if there's any projects that we should be aware of or try to put in here, any idea about what we should choose is the name in wiki.debian.org? I'm thinking it's something like X509 best practices. So I'll go ahead and make that page if nobody poaches it before I get there. Something like this. Any other questions? I don't feel like we need to fill out the 45 minute slot if nobody has any. I was hoping that we'd have someone say, oh yeah, here's how we do it. But I don't have that either. So I think we can go ahead and, so in addition to or as part of X509 best practices, how can we make monkey sphere first class citizen? So I mean one of the reasons, right, so Tom's sort of calling me out on what my hidden agendas are here. One of my reasons for trying to normalize this is to try to get people to say, hey, this is how we want to manage secret key material. This is how we want to manage certificates. And if we have a reasonable way to manage these certificates, I would be happy if we could also start moving towards managing other kinds of certificates there. Because not every certificate is an X509 certificate. We have open PGP certificates. We have raw public keys. We have open SSH certificates. And it would be good to try to think of these I think in an integrated fashion. Right now the fact that X509 itself on its own is such a mess, makes it difficult to try to pull these pieces together. So yeah, the reason I would like to see this happen is because I want us to start thinking about certification as a distribution wide responsibility. That we need to look at all the packages that we ship and make sure that they provide a coherent experience, one that has a minimal overhead for maintenance, for administrators and for users. And so if we can sort of try to integrate that across the packages that we ship and agree in general that that's a valid goal, then that'll make it more straightforward to start allowing other certificate models besides our current fealty to the certificate authority cartel. And we're moving in that direction by doing things like shipping SPI's cert as well. So anyone who uses Debian can get into Debian administered machines without us having to ask another authority for it, for certificates. But I think we can do, I think we continue to do better beyond X509 too. So yeah. So yeah, I think that's it. Thank you all for coming and for sharing ideas and concerns and problems. I'm sorry that this doesn't have a particular answer for how it's all gonna work. But I think the fact that we're all here and we all have a rough consensus that we do want that is that we do want some kind of coherent management is worth. A comment from the IRC from No Shadow. Suggestion, it would be nice to have a recorded way where certificates are, what format they're in, the private keys, intermediate certs, what permissions they need, and then have tools to check for things that are running out, I assume that means expiring, or the data you get from a certificate authority automatically there. So I think that there was a comment earlier I think Kurt made about automation. Right, so monitoring review of sensitive directories and then also managing, making it easier for the packager and the administrator to manage certificate creation, expiry and all of that. So yeah, I agree, I think that those should be part of the best practices documentation that we work on. So all right, thank you all. And I think next up we have, let me see here, what do we have next? Thanks DKG, so sorry. Next up we have DEBCONT 14 in your city here at noon and we have future plans for DAC in Roberto Terran at noon. Thanks.


Good morning lab students. It is Tuesday April 14th. I have gotten work graded that you've submitted for Lab 9 and a few people who had gotten some of the older labs done. So you should be able to see those grades in your grade book. I'm still working on Lab 10. It's proving to be just a little bit tricky to change things around to make sure that what I'm providing to you will be enough considering some of the technical challenges some of you guys have been having. So I'm going to continue to work on that today just to make sure that the lab is set up as straightforward as possible for you, and I will let you know when that's ready to be done. For any of you who might still be behind schedule on getting some of the old labs done, work on those labs and get those turned in. At the end of the semester, I have to grade you based on the work that you have completed. So be looking out for when Lab 10 gets posted. In the meantime, if you have older stuff you haven't gotten done, get those done as soon as possible. Have a good day.


This is an introductory text to a collection of papers from the CTE 2018, the sixth workshop on cloud technologies in education, which was held in Krivy Rih, Ukraine, on the December 21, 2018. It consists of short introduction and some observations about the event and its future. This article was authored by Arnold E. Kiv, Vladimir Insoloviev and Sergey Osamerikov.


Hey everybody, this is Sam one of the producers of conversations with Tyler today We're releasing two bonus episodes to go along with episode 193 featuring Steven Jennings These two episodes show fascinating elements of the daily life the culture and the politics of Nairobi and Kenya as a whole In this episode part one You'll hear from Harriet Marathi a young woman working in Tatu City a 5,000-acre mixed-use development just north of Nairobi After this episode make sure to check out part two to hear from the perspective of an elder Gatai Gatenji who also works in Tatu City for a contrasting perspective of the rapidly developing country of Kenya Now on to the show Conversations with Tyler is produced by the Mercatus Center at George Mason University Bridging the gap between academic ideas and real-world problems learn more at Mercatus.org for a full transcript of every conversation enhanced with helpful links visit conversationswithtyler.com Hello everyone and welcome back to conversations with Tyler I am sitting here right outside of Nairobi, Kenya in Tatu City, and I will be speaking with Harriet Marathi She's a 22 year old hostess and waitress She works at a restaurant roast by Carnivore located in Tatu City She's worked there for a year and a half, and she has strong interests in the hospitality sector She studied supply chain management at the Kiambu Institute of Science and Technology in Kiambu County She loves reading books watching movies and also traveling She comes from Uranyaga County her village is called Karumandi. It's near Mount Kenya I am told the area has spectacular views especially in the morning It can be cold, but it's ideal for cash crops such as coffee and tea She is a kikuyu speaking the Bantu language, and that is one of 42 tribes in Kenya Harriet, welcome. Thank you so much What for you makes Nairobi such an interesting city? Why is it the place you chose to live? And Nairobi just has so much to offer in terms of opportunities career-wise Also, it's a very nice place to be in Nairobi And the part of Nairobi you live in why did you choose that part of the city? At least I chose because one it was close to the school where I was and Now it's close to the place where I work. So it's convenient for me to move around And languages you speak Bantu, right? That was your family language? Yes, it is English obviously, and you speak Kiswahili Sure any other languages Not for now. No, what else would you like to know? Maybe a bit of Italian Italian. Yes. Have you ever been to Italy? No, but I do have a friend who just moved in there like last year If you dream of going to Italy, what do you think you will see or do? I Will say it's the views for me and I also know it has a variety of job opportunities around that place Also, the pay can be quite good more than it is here Do you eat Italian food in Nairobi ever? Not really. It's very good. See if you can get some. I like pasta very much We do have pasta though And the artworks in Italy, they're very beautiful very interesting to see sure You say you you like to read books. What are some of your favorite books or kinds of books? I Will say fantasy history Adventure Yeah, what would be something you would read in fantasy? Let's see Dean Kuhns will be my writer to go all the way Yeah, his books actually he covers almost every range that I actually mentioned Yes, and for history. What do you like to read about about Kenya or about Italy other countries? History is quite interesting Because actually to specialize in Kenya we have different tribes and they all have different histories Which can be actually fascinating something that you didn't grow up with or did experience on your way growing up How do you think about what makes key you tribe different or special? I will say it's special because Kikuyu in general is a Bantu language, but it's divided in different mode of languages Because we can actually speak Kikuyu, but different versions of it maybe from the intonations To the way you communicate yet a different way to different words to mean the same thing But say the culture or the personalities are they different for Kikuyu? Not really. Not really saying there's other people in Kenya. Yes. What are you most proud about when it comes to Nairobi? I'm proud about The growth I have seen Nairobi grow since I lean off How old were you when you left your village? I Would say I was 10 so that was 12 years ago. That's a long time. Yeah, and what made you decide to leave? I won the reason why I left my place was I was offered a sponsorship in a school around Kittangela Yeah, so I left for school and Given that you have to choose high schools around your area. I chose around Nairobi And that is how I found my way in Nairobi and that's because you're ambitious and smart Yeah, and did your parents come with you where you came here at age 10 alone? No, I my parents were left back in Kirinaga, but I used to live with my aunts and uncle and they took care of you Yes, they did And how many brothers and sisters do you have? I only have one brother way, too And he's still back in the village or he came here or no, he's still back in the village And what does he do? I still in school. He's 13 years old 13. So younger brother. Yes When you see families in Nairobi a lot, they only have two children You're part of a family of two children. Do you think that's the future of Kenya? Yeah because the economy is quite hard as it is and Having more children is the one that is leading to all these three children a lot of people in Not good businesses like theft and stuff And if you think of your future you think you want two children or something different or maybe no children I'm okay with two. Yeah. Yeah. Yeah, I understand What do you watch on YouTube? I? Do watch podcasts. Yeah podcasts story time. Which podcasts? This guy's Kenya podcast or American know these huge guys in America like Joe Rogan and Tim Ferriss So yeah Like those ones, but I can't recall the names But what do you find interesting about it? Like what do you listen for or what topics? They evolving technology that is coming along you could say the AI you can see the People who are privileged to own like they have money. They help a lot of people They just create a random way of reaching out to people who actually need their help So you're interested in tech. What social media do you use? Social media. We do have a tick tock. Yes, we do have Instagram. We do have our YouTube What's up as well, but which do you like? What's your favorite tick tock all the way because it's more fun? Yeah, do you make tick-tock videos? I do I actually do and How can you tell us how to get to them? Sure. What's your site address? It's Hazel Hazel. Yeah, Hazel Jones Hazel Jones. Yes on tick-tock and what are your videos about? Mostly, it's about how I spend my days and my work at roasts Yeah, about how I go about my days and you do these in English not Bantu or both Both depends sometimes it's dancing Yeah, it makes it interesting when you have a little bit of everything. So you'll dance and then you'll talk. Yes And your friends watch the videos many strangers watch they do they actually do When you listen to music, what do you listen to? For me in music, it's about the message conveyed in the music. I'm more of an old soul the Westlife kind of vibe Yeah, so you listen to rhythm and blues Yes, I do Beyonce of course. He's your favorite or my all-time your all-time favorite. Yes The Lemonade album by her is one of my favorites. Oh, that is an amazing one and there's a new one I forget the title, but I think that's quite good It's a 1970 sound for a lot of it a lot taken from disco and earlier musics Okay, I'll be sure to check that out And in Kenyan music, what do you listen to? I Used to listen to a bit of bongo, you know bongo, of course Yes, we do that. We also do that right now Mmm Ganga tone a bit. It's the clubbing vibe Do you listen to Nigerian music? Yeah, they are Afro bits. That's very popular now also in America really absolutely a lot of big Nigerian stars now in the US On YouTube most of all, that is interesting. Yeah. Yeah, and you go out to clubs at night Sometimes I do yes, and that's to hear music or to meet people or how do you think about it? Just for fun Mostly it's more about having fun Just letting loose a bit from the normal schedule and work and everything Also, it's a nice way to hang out with friends Like y'all can catch up and talk about what has been going on because we all on different parts right now Could you tell us a little about the restaurant where you work? Sure, the restaurant is roast by carnivore Right now. I'm the Waitest roc hostess, but hostess is my main thing. I just help out a bit in service interacting with people Because it's a hostess in overall I manage and make sure that all the guests visiting the restaurant They are served quite right. They have everything they need Yeah, and just checking up on them every once in a while So you have to oversee the other staff and make sure they're working well Yeah, what's the main mistake? Sometimes they make Will didn't call it a mistake, but when we are a bit overwhelmed You have like five six tables you're handling and they all want your attention So you can't be there all at once so somebody has to step in to help out and that's you. Yeah What kind of food do they serve? Mostly it's about meats. We are all five different types of meats Do you serve game like ostrich or just like beef chicken goat? Right now we're doing the beef chicken goat, but I know main restaurant in carnivore They offer all that the world even the croc dials His goat your favorite meat No, I'll go with beef beef. Yeah goat is more like traditional meat Right. Yeah for a ritual ceremony Older people prefer goat Yeah, I think they do Because depending on the turn up I see at work on a daily basis many people prefer to go for the goats that age Do you like Indian food? I Hate the spicy parts too spicy. Yeah, maybe you don't like it so much Yeah You like Oogali, of course I do that's the main like your staple food for breakfast or I Wouldn't say that I will say I'm more into rice But I do love Oogali because where I'm from rice is like readily available Because we're just around the Muayah region and that is where you get the best rice the Pichori rice That's a little unusual for Kenya, right? There's more wheat here than rice overall True, but the region where I come from is more rice. Yeah, great Have you ever had like Jollifrice from Nigeria or Ghana? No, that's a good dish It's hard to make but I make it very well in Nigeria. Okay. Yeah And the job you have why did you take that job? Okay, I took the job because one I'm passionate about the hospitality industry I love that the way you go to a place that is not your own and you meet different people And you get to get a treatment that Will make you remember the place and want to go back there over and over again Also in restaurants, that is where you find people mostly want to unwind About their days. So the people can be quite talkative and it's amazing You get to interact with different people from different places How ambitious are you? I want a scale of 110. I will say an eight point five So you want to own your own restaurant someday? Of course, that would be a dream come true And what kind of restaurant would it be? I want to go for A high-end restaurants Yeah And it would be Kenyan food. Yes or something else Food from your village a lot of rice or what's your dream? I will have a mix much of everything more like giving the people what they want Because from where I'm at I can be able to see what it is that people love what they like I can visualize on that You think you're a good people person like very friendly Cooperative. Yeah, I can say that about myself a good boss Yes Are you good at getting mad at them and firing them if you need to fire them? Oh, not the firing part that one. I leave it to the big bosses But if it's your restaurant, you are the big boss Yeah, I would say I love giving people chances before I am done completely done Why do you think the cost of living has become so much harder in Nairobi in the last few years? The government What do they do wrong? Everything I just have a million questions I would like to ask them because The management controls everything the government governs everything so They are the ones who are calling the shots and right now what they're doing They're pressing on people so much So you don't think they're running the country that well? Yeah And do you think it's a question of voting for some other party or you think of deep structural changes are needed? Boss a little bit of both we could use both because right now we need Complete change around the government We need to switch things up a bit so we can run smoothly like we used to a while back If people try to start a small business Do you think it's very hard? They need to get a lot of permits spend a lot of money get licenses Or is it easy? So if you went to start your restaurant, how hard would that be? It would be a bit hard. I will say I actually try to start selling clothes a while back sometime last year but one And it was a bit hectic One reaching out to people second before finding a spot and the permits as you said So you find the kanjo people as they call them. They are quite distracting for the people who are Trying to start up their businesses And your clothing sales was it from a physical store or online? A physical I used to do physical and also what's up is to help me a lot by then Reach out to my friends reach out to people from school You talk a lot on whatsapp Yes, I do. Yeah. Yeah, so you're very extroverted Uh, yeah, I can be extroverted and introvert because I'd rather be indoors all day than go out And how fun Why would you rather be indoors all day? What's your thought there? I enjoy my company and um your own company Yeah, and the movies it's the storyline for me when I start a movie and I love the storyline I just want to go with it till the very end What kind of movies do you like? A little bit of everything It's the storyline for me if it's drama if it's horror if it's a thriller if it's fantasy But is it like bollywood movie nollywood movie canyon movie us movie Hollywood nollywood us all of those yes, and you have like a favorite movie of some kind Right now what I've been following up on is power Power political power or you mean just people who are strong It's the storyline for me because the power started when I was quite a bit young And I have seen the people who are acting grow till date and they're still doing it So I've seen them growing that industry and the storyline is Quite captivating you mean electrical power You know just political power. Yeah So you like movies about political power Yes Do you think power corrupts people? Oh, it sure does Because when you really want the power you have to go through extreme stuff And the people who come out of that process they care too much about power maybe Yeah You have mobile smartphone, right? Yes, I do. How much time do you spend on it? Given that I work for like 10 hours in a day. I would say I spend like four five hours maximum And you think that's the right amount too little too much Ah, it's too little sometimes because when I'm tired from work sometimes I don't even look at my phone I just want to get to bed and sleep But it makes you happy when you do it It does And what kind of phone do you have? I have a techno spark 80 And that's the android system or what? Yes, it is and where is it made? China Yeah Yeah You see a big chinese influence in Nairobi Yeah, I can say that How do you think that's going? For me, I don't think I have much to say about it I'm just happy everybody is trying to find their way because When they come and they make things a bit cheaper for us that is where that is exactly what we need And they help create jobs, right? Yes by investing. Have you ever been to America? No, I haven't What's your main impression of it from what you see? You can tell the truth. I won't be offended I think it's a nice place but I will say the Blending in or do I say fitting in Before you actually do familiarize yourself with everything that goes on around that could be quite a challenge Do you think we're crazy? Sometimes when you all go out on the black people Yeah Do you think we don't respect our parents enough? No, I wouldn't say that because it's all about the upbringing Yeah, and it happens in every place different countries Yeah, and the race problems in America. What do you think they come from? Technology have some technology Because your technology is more advanced It is way more advanced than it is in other places And you think that increases racism in some ways Not really But the platforms they The fact that nobody knows who's talking to who It makes people have the courage to speak out what they want and not everything that they do speak out is good And then they become worse maybe over time because they're saying too much true Including You know messaging services or online. Yeah Do you think the world will fix that problem or what do you expect? The world can fix it, but it all starts with an individual because once you want to change it And you influence the people you're hanging out with or the people you have around It goes like that and maybe with time we might see some changes Are you an optimist about Kenya? Yes, I am Do you think you'll live here your whole life or you'll try to go to italy or somewhere else? I would remain traveling, but Kenya is the place I would like to be Like for living Kenya is the place to be, but I would like to visit other places. You like the climate here Everything about Kenya is amazing the people the food. I especially the food But not the Indian food not the Indian food And in the food Have you seen that change in your lifetime? For the food. Yes So you've been in Nairobi 12 years. How is it changing? It is changing quite a lot because With time The people are forgetting about the indigenous foods that we used to get at home right now around Nairobi given that it's more Residential place you don't find a lot of places where people want to grow this stuff And the thought of getting them from the villages and transporting them to where you are can be quite hectic because Some may spoil on the way Their budget may be just not pocket friendly So yeah, people are more reliable on the junk food parts around Nairobi than it is around the village areas Do people here think about the british much? This was once a british colony Is that an important issue or you've all forgotten? History taught us a lot about what happened in the past But with time we have seen the changes and by now people have adjusted to the day-to-day living Do you think being a british colony was good for kanya or bad for kanya? Not so good It isn't in between because we all had something to learn Like the christianity mode came along that time And yeah And yeah At least to go to learn something from them, but they treated people here very badly. Yes Yes, they did Do you go to church? I do christian Yes Which branch? I'm a catholic What makes catholic appealing to you? The unity there's no much diversity as it is in the protestants because Whatever is being taught in the american church is whatever is being taught in the Village church we have the same bibles the same readings scriptures for every sunday It's programmed that so long as in the catholic you're getting the same information Do you think fewer kenyans are going to church than before? Yes, I will say that And that concerns you or you think it's okay? It does concern me because I'm also affected because I work six days in a week and sunday is one of the busiest days You can never get enough day on sunday So personally for me, I will say it has affected kenyans a lot work wise Yeah, if you marry someone you want your husband to be religious catholic Or it doesn't matter so much It doesn't matter so much Just to fees a good person. Yeah There's this cult in the south of kenya paul mckenzie. I read about this in the newspapers How do you understand that what what's your sense of what happened there? Uh, that's a tricky and interesting topic at the same time But I really don't get what teaching it is that these people are getting to the extent that they can go and undergo the Fasting session and their leader is not undergoing the same thing You know, that is something that is controversial so It is weird I'm not in support of it. Yeah, we've had things like that happen in america, of course What do you think of women's rights in kenya? Are they strong enough? Yes, they are How could women be treated better? Nothing, I will say that is not being done right now So you think it's really pretty good. Yeah, it is because in terms of leadership We're given equal rights in terms of speaking our minds out. It's allowed I think it's quite okay. We just need to walk your way up to the top And then for women you think have the same chances as men Yes, they do Yes Are you worried about any of kenya's neighbors? So there's samalia, ethiopia a lot of fighting Does this concern you or it feels very distant? I wouldn't say it's distant because every kenyan is a human And I believe so long as no one is trying to attack the other one and we're all trying to live in peace Everything is going to work out quite fine Because it's all about the peace and the humanity and the friendship between the countries That's a very catholic view, right? Yeah, it is And kenya takes in a lot of refugees. How do you think that is going? I'm not sure how that is going to be going in the next few weeks or months because with the gmu cutouts I don't know how that is going to work out How's it working out with uganda as a neighbor? I don't know how they handle it. I haven't read much about it But if they're doing okay, I think that's good But do you worry that kenya is better run than most or all of its neighbors and that you will receive a lot of problems through your borders? No You just think kenya will be safe. It's strong enough No But I wouldn't say the management in kenya is quite as good as our neighbors around Also, we're all working our way here to try to improve lives around What would you do to improve the schools here? the schools Curriculum What would you change? I'll take it back to the 844 system And what is that system? Right now what they're doing is called the cbc They have a variety of things. They're teaching in schools Some that were not even teachable before they're even teaching pe in schools nowadays And that's good. You think or no It is okay. But right now what people need is To go on with what they used to do You mean stricter more math more reading and writing Yeah Just to make sure everyone can read and write very well Yes, I will say that How good do you think your school was? Okay, I have been in different schools in primary and secondary. I was in one but Schools were how do I say it? It all depends on the schools because we have the public sector and the private sectors And the two can never much cannot much or even come close Which is better It is not better, but it is okay But of the the private the public which of those two kinds of school gives you the better education The private of course private. Yeah How is it you ended up curious from your family from a teacher you were born that way? For me, I just wanted to see more than just what was around me And coming to Nairobi was the best thing If you were to travel somewhere else but in Africa, where would you want to go the most? In Africa we'll go with Uganda Yes, why Uganda? It's just the thing about Uganda and there's Way of living there. It's not as expensive Yeah, the people seem very friendly when I meet them other places. Uh-huh. Yes, you have that impression Yeah, people can be friendly, but it all depends on the approach And if you think of visiting somewhere in Asia, where do you think of going? In Asia That's a funny one That's a tricky one. I'll have to research on that When COVID came here, how bad was that for you? You were you couldn't go outside You couldn't meet with friends or how was it or maybe not so different. How would you describe it? It was quite hard And it actually delayed my school year. I had to extend time in school Comparing to what I would have And it was tough. It was tough times Do you think the country is over that? Not really not really. Yeah, so people are still depressed or upset or frustrated Yeah, people are now trying to find their way back because COVID really affected a bunch of people Many people became jobless Relating with one another became an issue Because of the social distancing Yeah, and you stayed here or you went back to your your home place Actually did both I went back to my place, but I also came back to Nairobi. Yeah In your village, do you see large animals very often? Yes, so you see lions elephants giraffes We do have elephants. We do have hyenas Not all the animals are there, but we do have some of them And you've seen them so many times you're not excited or you're still excited when you see them It's exciting because you know, you know, he used to sing them on a daily basis And it's always fascinating to see animals Are any of them dangerous for you? Yes, they are You know, our place is near Mount Kenya, like I said and sometimes they run away from the forests and they're coming to pupils Shambles to eat so it can be a bit scary And which one is the most scary? The elephants all the way Because they're so big and strong and they might just step on you and they are fast These things can chase you so fast. Yeah. Are the hippos scary? Yes, they are They are scary, but you don't get to see so many of those around Kirinaga. There's just a lot more elephants. Yeah How do you think your village is doing in terms of its economy or people getting richer happier? Or do you think it's stuck? It's stuck I have been there like a couple of times and I can't say I have seen as many changes as I would expect to see in that span of years Why do you think it's stuck? The curious people leave Yes, that is one And the people are a bit closed-minded about Opening up their minds to things They make it more superstitious than it should be So they don't have so much Christianity. They have older beliefs Yes, I will say that like what would be something they might believe in Let me say like in case you're having disputes Or let's see one when you see an owl they say that somebody's gonna die or something Right. Yeah, and they believe it. Yeah. Yeah, and sometimes it actually happens. We had lean off And how much of your village is Christian? Everybody So they blend Christian and earlier beliefs together. Yeah How are women's rights in your village? Do you think? The people have not opened up their mind as they should like I said So for the women around that place, it's more of like a home-based thing Not many of them go out to look for jobs or even Want to do much about studies They just know they should stick around at home to help their husbands and all And raise children So not so much opportunity. Yeah But Nairobi is much better. You think? Yes, it is. Yeah. Yeah And you think you'll always live in or near Nairobi Always could be a tough time, but but mostly. Yeah And what do you see you've taught to city you work there, right? Yes And you're optimistic Yes, I am very much so you see a lot of progress jobs coming people visiting. Yeah Like see I got a chance to meet you. Yes Maybe your restaurant will be in tattoo city sometime. Yeah, maybe hopefully Will you encourage your brother to move here? Yes, I will And you think he might? Yeah, he's very much interested Did you or he ever think of moving to Mombasa or some smaller city or you just think it has to be Nairobi because it's the best the biggest You know, it's all about giving a place a chance because Coming to cambo for me. I mostly came because of school around the cambo institutes And me moving to tattoo city was closer to school and still closer to where I work What is Campbell Institute? I it's a long cambo road It's a college And they what is it they teach? Mostly it's I will say more of the physical kind of stuff like They have business courses like how to build things Yes, we also have the hospitality in the the hospitality there. They do teach hospitality Yeah, so it's and you studied hospitality No, I haven't you want to or you think you know enough already I will remind you because it is something that I'm passionate about But what I did in school was the procurement the supply chain management What did you learn from that? There's a lot and there's procurement in almost everything be it hospitals be it companies be it the hotels be it schools Procurement is everywhere and it's fascinating how people do that Do you think you need a degree In hospitality to advance further or you think you can advance just with experience Now school is important the school beat is important because the papers will also help a great deal But it's all about it all narrows down to what you learn on the ground because Mostly what is in the books is not what normally happens in the places of work. It's very different Do you think you'll go back to school or it's too much a waste of time? I will go back to school but first I want to learn more learn more on the job. Yeah What kinds of things do you want to learn? You know interacting with people sure takes a lot of courage and humility Because not everybody is quite friendly Some people just come like I said they want to unwind their days and sometimes they're not that good Because they can be harsher times So that part world is something that I would really like to Impound on The humility part because it's it's a bit tricky. I will say that What questions might you have for me? How do you like it in Kenya so far? Well, this is only my second day So far I like it very much the green Vistas are very beautiful. This part of Kenya is quite peaceful I've had very good food It's been good to see Steven again But most of it I haven't seen So I'm going on safari in a bit. My wife is coming tomorrow And she will join me here I want to come back sometime and see the coast see the north So this time I will only see around here and then safari Okay And for the people are very friendly here and it's it feels easy to me Okay, that is great. And for food, what is one thing that you would like to try? Maybe the meat I once visited Tanzania And I very much liked the ugali Now, I don't know if it's the same here But I go to these meals and westerners. They feed me everything but ugali So I hope I can get some more ugali I'm sure you can pass by a roast and you you'll be sure to get some.  I like very spicy. We have the spicy part too. Yeah, so I will do that On safari, I'm not sure what they serve me, but I think I haven't no choice Yeah, but sure since you're in Tato city, you might pass by roasts. We'll give you the ugali. Okay, great Okay, and if you think about America, what is it you wonder about America? About America is The way of living their education How they know so much at a very young age They're also quite friendly Americans they're pretty direct fairly open I think Yeah Final question. What is the next thing that you want to learn? What is the next thing I want to learn? You know right now the way the country is evolving I believe it's all about gaining a skill. You need to have a skill because employment The deductions are getting worse and you'll rather be self-employed than it is being an employee so For the skills, I would like to learn more about technology. I don't want to be left behind I want to learn more. Do you use chat gpt by the way? Oh, yes, I do And what do you do with it? I have another few more questions that Um, I learned about chat gpt through a youtube channel And also I have colleagues who are so much impressed by it And I just like the way it makes work easier for everybody But it also poses as a threat because once you're getting the ai to do all that stuff for you You might not need the employees as you do But you talk with it does it write poems for you? Do you ask it questions? Yeah, all of those when I have burning questions when I want to know something Because when you're in the night shift, I will say I'm not much of a newspaper person or news So Chat gpt is my way to go just more fun. Yeah chat gpt and tiktok Harriet marathi. Thank you very much. You're welcome. Thank you too for having me. It's a pleasure Thanks for listening to conversations with Tyler You can subscribe to the show on apple podcasts spotify or your favorite podcast app If you like this podcast, please consider giving us a rating and leaving a review This helps other listeners find the show on twitter. I'm at tyler cowan and the show is at cowan convos Until next time, please keep listening and learning