Hi, welcome to the All Things LGBTQ Interview Show where we interview LGBTQ guests who are making important contributions to our communities. All Things LGBTQ is taped at Orca Media in Montpelier, Vermont, which we recognize as being unceded Indigenous land. Thanks for joining us and enjoy the show. Hi, everybody. I'd like to introduce Sarah Lipton, Director of the Montpelier Senior Activity Center here in Montpelier. And we're glad to have you, Sarah. How are you today? Thanks so much for having me, Linda. I'm really happy to be with you. I'm good. I'm just very much running around like a chicken right now. Yeah, and I know you're understaffed, so that doesn't help either. Yeah, well, that's why, basically. Yeah. So tell us a little bit about yourself. Are you from Vermont? And how did you end up at the Senior Center? Yeah, thanks for asking. I am not from Vermont originally. I actually grew up in Maine, but I've been here in Vermont for about 12 years. I think it is now. It will lose track of time a little bit. I have many different stripes and hats. I came out as a queer person in the 90s, which was a terrible thing to do. And then traveled the world for a little while and went to Naropa University, which is a Buddhist university. Spent about 20 years pursuing the Shambhala Buddhist path and teaching leaders all over the world how to really show up and be who you are and connect to your vision so that you can actually land it and move forward. I had a business called The Presence Point, which I was doing that work through. I launched a nonprofit called Genuine and actually created a podcast, which is out there. You can listen to it anywhere. It's Genuine the podcast. Genuine comma the podcast, but it's out there, which I co-hosted with a dear friend of mine and we interviewed people all over the world and some famous people too, which was fun, really about what sparks and inspires them. And I have two small girls and seven and five and during the pandemic had to stay home with them. And so my businesses kind of went to nothing. And I had to then figure out what to do and wound up coming back to work, but not the way I imagined. I wound up actually running the Feast Program here at the Senior Center and I fell in love with it. And then when the former director decided she needed to move on, I thought, well, I have all this leadership background training other people. I could probably just step in and do this. And so I've been doing that for the last year. I've been the director and I love it. It's total chaos when I have not enough staff, which has kind of been all year. But I get to bring all of my creative energies into this place and connect across the whole community. I just had an hour-long meeting with someone from the Helicopter Library about all the things that we're going to do together. And I've loved connecting with you, Linda, and the Rainbow and Relic group because I'm so excited we're going to be able to offer more LGBTQ programming with our poetry readings and, you know, some maybe open mic and comedy nights and things like that, which can be really fun. And I think it's just really important to be able to create a space here that's inclusive and welcoming to any older adult that wants to come in. And older adult is a very wide definition. You know, our membership is 50 and up. And we offer a wide array of things. And I'm really excited to let people know that we're here and we're open and we're doing stuff. We're about to launch 40 classes this fall. I know I was going to ask you about that, but we'll get to that, like how many classes and all, but has it been hard to get back and just swing after the pandemic? I mean, Yes, very much so. I kind of just thought everything down for two years, so. Very hard. I think the hardest thing, the biggest impact I would say is that we had to stop doing our congregate meals, which were where many people up to 100 people on Tuesdays and Fridays would come in and eat together and not being able to do that because of the pandemic and not being safe for people to be unmasked in the same space and all that. I think has been the hardest thing for many of our older, older, older adult members. I know that they miss it. They're telling me a lot right now about that. And I'm listening and I'm trying to figure out how we can open fully back in a safe way. And I don't really have the answer yet, but I'm working on it. And I think one of the things that's really, really been key for me in my role and my time this past year is listening, is meeting the diverse array of members that we have, and as much as I can, or as much as people are willing to come out and meet me to find out what people want. I can create for creating sake or I can create what you actually want.  And it must have to be, especially for older, older adults, the idea of COVID is a very dangerous thing. And so you have to try to juggle all that, the needs of the community and how to do that in a way that's going to benefit everybody. It's hard because I think it's a place to be. It's very difficult. And I think, you know, as we all saw, one of the most harmful aspects besides the actual medical aspects of COVID was the isolation. It was the lack of social engagement. And that is one of the hardest things to recreate while we do still have to wear masks. And we do have to still be aware of, you know, COVID is totally still out there. I mean, I know three people right now that are out with COVID. You know, it's not here. It's still here. And we're open and trying to figure it out. And so I think, you know, as with most things in life, one of the hardest things is patience, trying to figure it out. I mean, we've been working really hard to create a really robust environment of activity to create that sense of thriving for our aging and older adults. And, and yet it's still hard to get people to come engage with things if you don't feel safe. And that's just a, that's a puzzle. So are you still going to continue doing both like maybe some activities in person that people can come to and then do things as well? Absolutely. Absolutely. So we had to shift away from our congregate meals. We shifted over to the curb side meals so folks can come and pick up a meal on Tuesdays and Fridays at the curb. You're welcome to bring your meal inside and eat together. We are going to try to figure out the congregate meals again. And then in terms of our activities, we still have a lot of drop in groups where folks can come and play Scrabble or I was going to say Parcheasy. I don't think that's one of them. I think it's Scrabble or Parcheasy. Yep. We've got a number of other games. And then I guess I want to play Parcheasy. Mahjong. Yeah, Mahjong. Thank you. And then we have some musical groups that play together and our walks with Joan on Monday mornings and we of course have the Trance group as a walk-in drop-in group. And then we are going to be having quite a number of new classes coming in this fall. We've got an English country dance class that's going to be starting up. We have a couple of really interesting brain classes, a class on neurodiversity and the aging brain that'll be in person here. Another class about games, actually about how games and puzzles work with the aging brain and how you can kind of enjoy sort of massaging your brain through playing games, basically. And then we've got trash tramps. Yep. We've got the trash tramps. We've got feels like a thousand different yoga classes. Mostly those are still online. But we do have some hybrid classes. We have a space upstairs that is our hybrid room. So we have classes where the instructor and a few participants can be together in the room and on the screen, the rest of the participants are there. So we do have a hybrid setup and I'm investigating being able to create a second hybrid space. So out of the 40 plus classes we have this fall, I think about 16 are going to be in person. That's nice. Yeah. I know from people I've talked to and myself who said it's been very difficult. And people are very anxious to get back even though we have to navigate how to do that. But I think especially for seniors and people who are living in the country just might have been one of the only ways they had to connect with other people. So it's really important to get back to that. Absolutely. So you have yoga and then we're going to have an LGBTQ poetry reading in October. And so it sounds like you're really getting back to... Oh, in the farm stand. Oh, the farm stand. Yes. So back in May, the parks department in coordination with us decided to create a farm stand right out front of our building here every Wednesday from one to three, selling for a dollar a piece the beautiful fresh produce that's coming from the feast farm, which the parks department runs to grow food for our own feast senior meals program. There's a surplus of food and so we're able to sell very low cost to folks. And we have, because we received a grant really nice grant from AARP for this kind of community place making activity, we've been creating events at the farm stand as well. So we have an incredible array of different things happening every Wednesday from, you know, yesterday we had the community jam that was performing and a presentation by everybody wins, which is a really cool organization that matches older adults with kids for a reading program. We've had some... And the music at the farm stand was great yesterday. Yeah, you probably could hear it upstairs. Well, we have two musicians, two different musical groups coming next week, so we're going to enjoy again. And then you have the events in the park in the back, right? Like, is that... Yes, there's the Berry Street potluck. So we've been working with the Capital Area neighborhoods and the Center for Arts and Learning right next door. The three of us have been collaborating sort of a meeting tonight to plan the next event in, I guess that will be in September. And looking at what all we can do to bring more vibrancy and engagement just here on Berry Street, you know, amongst our neighbors. We've already seen just we've had two events and we've already seen how much life there is here. You know, Berry Street is a very dense neighborhood and sometimes it feels a little hard to kind of break into the community here because it's so dense. And so we're just trying to create some continuous events to bring people out and to connect. And we've been having these potlucks with really interesting engaging activities at them. There was a speed networking event last time and there's some other fun things that we're planning. And maybe next year we'll do a festival. It's kind of our dream. Well, I know you were part of the Pride Festival. Yes. And you've been here with art and different organizations. That was really good. And you put a flag up. Yes. I myself climbed out the window in that pride flag. I had to get city council approval and I got it. Good. Good. And I didn't know. Yeah. And it's really important, especially in the winter here, to have places that people can go and gather and hang out and do all those activities. And you've been great really. I've noticed a huge change. I've noticed that there's much more going on, much more interaction with people and really, you know, making everybody feel really, really welcome. And I think that is an amazing quality that you have. And I really appreciated. It's, it's really nice to have someone that's really involved and really, really wants to do things for the community. I appreciate it. Thank you in that. Well, I want to thank you so much for coming on and the community really appreciates you. And we'll see you soon, I'm sure. And is there anything else you would like to tell people before we sign off? I think just to let you know really that the door's open. You don't have to be over 50 to come in here. We've got lots going on. You know, our classes are open. Basically, most of them are open. You can be a teenager and come take a class here. Our classes are super affordable. We have an incredible amount of amazing instructors. And whether it's an online class or an in-person class, you're going to make community connection here. And I think that that's, there's a vibrancy to that that I think is so important in our community, especially as we're coming out of this pandemic era. And so I just really want to encourage folks to just come by, check us out. We've got so much going on and we're really, we're here for you. And when are dues due? When do people sign? It's only once a year. July, I think, isn't it? Yeah, it's July. Yeah. It's only $25 to be a member. So, you know, not a big deal. membership in though, because you know, it really helps to keep the programs going and pay people and do all the other stuff that the center wants to do. So we have a monthly newsletter. You can sign up to receive that. We have our weekly e-letters. Get on our email list. We're on social media. If you want to find us, we're there on Instagram and Facebook. So if people want to reach you and I'll put this on, make sure that it's on the line. But I could put up the telephone number, but do you have a Facebook or web page? Email. Oh yeah, we have our website, which is Montpelier-VT.org. It's the Montpelier City website. Montpelier-VT.org. And then I think it's like backslash Montpelier-VT.org or something like that. And that's your web page. And will that list also like what classes and what's going on there? Okay, good. So we'll make sure we put that up on the screen. Okay, great. Thank you, Sarah, so much. Thank you, Linda. My best to be coming in. Yeah, take care. So several years ago, first by executive action and then by legislative action, we created an office of racial equity. And we hire or Vermont hired a single individual to carry on a momentous task. Well, since that time, Vermont has seemed to wake up to the fact that maybe that person could use some help. So there has been an effort to expand and to clarify the expectations of the office of racial equity. And joining me today is one of those people who have been brought in to carry on this work. Please welcome Jay Green to all things LGBTQ. Hello. Welcome again.  And I don't need to ask you about your pronouns because I see they are prominently displayed. Yes, indeed. I went on Etsy and got a custom made pronoun necklace that is very large so that it's readable from far away. Very good. So why don't we start with a little bit about you. What is it that brought you to Vermont? Yeah, I grew up in Rochester, New York and moved around the country and eventually ended up at UC Berkeley in California doing my Master of Public Health degree. And when I started at UC Berkeley, my family moved, my parents relocated from where they were in Minneapolis to Lebanon, New Hampshire. And my dad was working at Dartmouth-Hitchcock Medical Center in an administrative capacity.  So it was sort of unexpected to say the least to have it come back like a decade later, a decade and a half later. And as her time on this earth was sort of dwindling, I realized that it was really important for me to move back to the East Coast and be with her for as much as I could. And I was fortunate to do a summer internship in the summer of 2016 with the New Hampshire Bureau of Infectious Disease Control. And then I relocated to the Upper Valley permanently in spring of 2017 and was able to stay with my mom and spend time with her until she passed away in January of 2018. So I was living with my folks up until January of 2018 when I relocated to River Rejunction and got my own place to live. And I feel very fortunate that I landed in a really a really great spot for me. I transferred from the University of California Berkeley School of Public Health to the University of Vermont's distance learning program, which would turn out to be fortuitous in a couple of years. It was great to be in the distance learning program ahead of 2020. And yeah, so things sort of all worked out in a really positive way for me when I relocated from California to Vermont. And it was obviously difficult with my mom's passing, but I think about her a lot in my job. And I think about am I making my mom proud with my life choices quite a bit? And I think it's safe to say that she would be proud of me for doing what I'm doing with the Office of Racial Equity. She was very strong. I mean, she brought me and my younger siblings to anti-Iraq and Afghanistan more protests when we were like five or six years old to start building up a conscious object or file for us. So we wouldn't get drafted. So yeah, she was a really strong believer in the values of social equity and pacifism. And yeah, so that's the very long answer to highlight to Vermont is a combination of family circumstances and just sort of luck, I guess. So how did you happen to stumble across the position at the Office of Racial Equity? And what about the position was attractive to you? And I think you've alluded to some of the underlying family beliefs that might have played a little role. Definitely. Yeah. So I graduated from the University of Vermont Master of Public Health program in October of 2021. And I spent a few months looking for work, applied to lots of different positions. And one day I was on the vermont.gov careers website. And I noticed that this position had popped up with the Office of Racial Equity. And I was like, Office of Racial Equity, I've never heard of, I've never heard of the Vermont Office of Racial Equity before. This is interesting. So I looked through it and it seemed like a really great match between my interests and skill sets and what they were looking for in a policy and research analyst. As I kind of did my Master of Public Health training and education, it seemed to me more and more, the more and more I've learned about the conditions that create disparities in health, the more and more it felt like, what are we doing if we're not attacking those problems at the root? And a lot of the times the root cause is systemic racism or laws or policies and procedures that have been put in place at the government level that actually keep systemic racism in play. So it made sense to me to transition from public health focus to a broader, more systemic, like government-wide focus. And that's what's really cool about the Office of Racial Equity is that we're able to interface with every branch of state government and that's all within the purview of the Office of Racial Equity. So that's very cool. And I get to use fancy words like purview in my job, which is fun. So let's talk a little bit about what is unique and distinct about the Office of Racial Equity and then how the mission or the work of racial equity extends out and involves you with the work of other state agencies, commissions, departments, because as people have heard me carry on ad nauseam, I get concerned at times that we create silos, a sort of separate but equal. And we don't allow the true intersectionality of our issues to really manifest. Absolutely. Yeah. And I love that you brought up intersectionality because that was certainly something that brought me to the Office of Racial Equity was sort of understanding myself as a transgender person and starting to lose my cisgender privilege when I started transitioning in 2019 made me extremely aware of the impacts that these kind of instances of discrimination or harassment have on people because I was like pretty happily sailing my way through the world as a white woman for 27 years. And that was like fine. And I just didn't have to think about how my whiteness or cisgender status really offered me any kind of privilege because that's the thing about privilege is that it's really invisible. You don't see what you're just getting as a default. So once I started transitioning and getting this gendered and experiencing job related harassment because I was using they them pronouns, it was like, okay, this is how it feels to experience discrimination. And this is a deep unsettling problem. And I'm white. I don't have to deal with racial microaggressions. I don't have to deal with you know, any comments related to my my language, you know, because English is my first language. So this, it was a really important motivating factor for me for joining the Office of Racial Equity was like, this, where I can, I can turn off my racial equity work as soon as I turn off my work laptop, you know, I don't have to walk out and live my life in in public as a person of color and experience those racially motivated instances of discrimination. So if I can contribute my energy towards the work of racial equity, that's a positive thing for for the world. So I feel like I'm still answering your previous question a little bit, but I wanted to put that out there because I think it's a really it's a really important message. So and also it's why I'm on all things LGBTQ. I wouldn't be here if I wasn't somewhere in that alphabet soup. So I'd say I'd represent mostly the T in LGBTQ plus and so to speak a little bit more about the Office of Racial Equity, the Office of Racial Equity was just my supervisor executive director of racial equity Susana Davis for about two and a half years. And then he the second report of the racial equity task force made a request to the legislature that they add more staff position than more funding for the office. So I was hired in February of 2022. And my co-worker Shalini Suria Narina was hired just a month before me at the end of January of 2022. And of course, I'm getting notifications there. And so now we're a three-person office and the sort of mission statement or goal of our office is to work towards dismantling those instances where systemic racism pops up in our state government. And it's I mean, it's a very big task. And it is it can definitely feel overwhelming at times.  So yeah, that's that's kind of where we're at. We're we're going after the elephant of racial equity one one bite at a time with the three of us in the office. And now we've added a we have an intern with us temporarily for the summer and we will soon be hiring for a new office that was created within the Office of Racial Equity, which is the Division of Racial Justice Statistics that was created by each 546 or I believe that was Act 142. Don't don't call me on that. I think it was Act 142 last legislative session. So that's very exciting as well. And I was going to say to give people an idea.  And I'm not really sure that people appreciate the task that the Office of Racial Equity has been handed. So I'm wondering if you could share some of the specific projects and initiatives that you're currently working on so that people can get a sense of and we expect for people to do this. Absolutely. Yeah. So so I'm my official title is Racial Equity Policy and Research Analyst. And my my corporate Shalini's title is Education and Outreach Specialist Associate, excuse me, Education and Outreach Associate. And so the little blurb that you can read on our website reads that the office works with local, state, federal and nonprofit partners to advance equity in all areas of life and for months. So all areas of life, what does that mean? So for example, the notification that I just received on my computer was an invitation to work with the Department of Health with a project called Stretch, which is organized through the CDC Foundation. And I know that Shalini and my supervisor, executive director, Susana Davis will be working on that this afternoon. I am chatting with you. So I believe that they are collaborating with the Department of Health on trying to reform the grant making system in Vermont to make it a more equitable funding method and more equitable funding distribution method. Let's see. My role specifically as policy and research analyst, I do a lot with the legislature, giving testimony on bills when the legislature is in session and doing outreach to members of the legislature to talk through what are sort of the policies and what are the places that racial inequity shows up in our legal system and in the laws and regulations and policies of the state of Vermont and where can they be changed to make things more equitable. Shalini has a ton of projects that she's been working on. She does all kinds of educational trainings and talks to different boards and commissions around the state about how to focus on equity in their work and how to bring an equity lens, as we like to say, to all of their different projects. Let's see. We're working on a language access plan for the state. We want to make sure that everyone who lives in Vermont has the ability to access the same government services and programs as someone who speaks English as their first language and that includes people who are from other countries and they speak, you know, Pashto or Dari if you're from Afghanistan or Karendi or Swahili if you're from Central Africa. And, you know, that's a pretty big project to say the least to figure out how do we convince everyone in the state to get on board with this idea that, um, yes, all government services should be available to everyone who lives here, which seems really simple when you say it like that, but that's kind of the way that a lot of this works where you say something like everyone in the state should have the same level of access to government services and programs and then you get into sort of the implementation of it and it gets really complicated, really fast. From what you've been listing for the initiatives and projects you're working on, a lot of it would seem to rely upon getting comprehensive and accurate data collection so that you can truly, so you can give a true analysis of who is able to and who is not able to access services. Our Vermont agencies, and I'm using the term agency in a broad context meaning not just the state of Vermont governmental infrastructure, but, you know, the nonprofits and the service providing networks, are they willing to engage with you or with the Office of Racial Equity? Are they providing you with data and are we capturing what we need for data so that you can make policy recommendations? That's a very big question. Yes, that's why I asked you. Exactly. I'd say that there's definitely different levels of ability to capture data accurately depending on who you're talking about and it's one of the topics that we're actively working towards reforming is making data a lot more inclusive. For example, the Office of Racial Equity is a participant on the Health Equity Advisory Commission, which is, Susanna is the current chair of the Health Equity Advisory Commission and I've been going to meetings since I started in this position and one of the things that the Health Equity Advisory Commission is doing is making writing a report that will include recommendations towards defining categories other than white and non-white for data collection around race and ethnicity in Vermont. And that's kind of where we're at with a lot of data collection in the state of Vermont around race and ethnicity is that people get separated into white or not white and that framework is super problematic because it frames things around whiteness.  How are people of color supposed to feel represented by that data when they're not even identified past while you're not white? That's a really concerning pattern in the state of Vermont that we're trying to advocate that it gets changed that we have. So the Health Equity Advisory Commission is going to be making recommendations to the legislature that we set out some better categories for people so that they can hopefully see themselves reflected in the data of better and then we can use that data to better understand what the situation is in Vermont for people. So for example there was a really great paper that was recently published by some researchers from Stanford where they looked at health disparities among parent pairs in California and they went through and changed their birth certificate form so that you could identify yourself as the parent giving birth or the parent not giving birth instead of mother and father and that left the door open for mother. Mother pairs to to be counted in the California birth certificate records and what they found was that actually parents where the parents where it was parents who were identified as two mothers had worse health outcomes related to pregnancy and giving birth than mother father parents did and they wouldn't have been able to find that health disparity out if they hadn't asked you know if they hadn't changed the birth certificate so that your child could be you know accurately reflect your family structure not being cisheteronormative. So and they also now are able to measure the birth outcomes for trans men who give birth and the birth outcomes for non-binary people who are the birth giving parent like it was a really great paper because it really showed how a very small change to the record keeping system in California actually opened up this huge wealth of knowledge to be able to find health disparities where previously they weren't even able to measure them so it would be really great to see a similar process take place here in Vermont but especially with health data and I know that we've talked about this before when it comes to electronic health records and health systems it can be very challenging to get the companies that make those software platforms to add a third option for gender for example besides male and female which are ones for sex and not gender by the way so it's you know it's um it's uh it's a lot it's a lot to to think about and it's a lot to uh it's a big elephant to eat so in our remaining time you know and again I'm going to go back to the concern that I have personally about creating silos what is it that Vermont's LGBTQ plus two s plus communities could be doing to become more actively involved and supportive of the work of the office of racial equity yeah um so I think that one of the one of the first well I'll say this one of the things I love about Vermont is that even though people aren't always as aware of the you know preferred language around certain social topics or um maybe they hadn't heard of you know whatever before I found that people are very willing to listen and very willing to learn and I think that's awesome because that's really where all of this change starts from is a place of learning and so I think that for our white LGBTQIA plus viewers a really great place to start is just educating yourself on sort of the history of the United States and where all of these systemic racism where all this comes from where is the origin it's a lot of stuff that we're just not taught in our school system um I recently finished reading The New Jim Crow by Michelle Alexander there's a fantastic book about the criminal justice system and how the war on drugs has really contributed to a lot of racial inequities that we see today um the uh Office of Racial Equity has a reading list on our website and we also the Vermont League of Cities and Towns recently released an equity toolkit that includes an excellent reading list with a ton of video resources and podcasts to listen to I know I personally get tired of reading sometimes and do a lot of listening to audio books while I'm cooking or cleaning up so definitely recommend checking out the Vermont League of Cities and Towns podcast list to learn more so yeah just really think through um you know doing that learning doing that work and try and lean on other white people when you're encountering the emotional challenges that come with it because it is I can speak from personal experience it can be really horrifying and exhausting to learn about the impacts of systemic racism and um you know talk with your therapists talk with your your white friends don't put that the people of color in the state already know about it from personal experience you don't need to put that on them um so you know do some learning um talk with your white friends talk with your therapist talk with with uh you know uh other white people about it don't burden your your friends of color with uh your racial equity learning just yet um because you know it's for a lot of white people and I include myself in this category there's been a lot of like oh oh kind of moments and um that the fact that it's taking me until age 31 to have those like learning aha moments is a reflection of my white privilege and it's fine to experience that and it's fine to feel grief and and sadness about it but it's not fine to put that emotional labor on your friends and and people of color who already experience that in their personal day-to-day life so that's why I was gonna say so with that I need to say thank you and it sounds like we both give our peers of privilege permission to feel uncomfortable oh yeah with their privilege and to be willing to challenge it and I already am planning on inviting you back to talk about what comes out of the racial justice piece and the direction that might be moving in so with that thank you for spending this time with us absolutely thank you for having me and um yeah uh thanks you'll be thanks so much and you'll be back I'll be back thank you for joining us and until next time remember resist


So we can start. All right, let's start. I'm very happy to introduce Michael Scherer, who is coming from Red Hat's open source and standards group, to give us a talk about, well, it was supposed to be a modern architecture. Now it seems to be a secure infrastructure. So, Mika, go ahead. Mika, I did the proposal in the evening, and I didn't have time to change it, so sorry about that. So if you wanted to see something about modern infrastructure, sorry, you can always leave. So as I said, I'm working at Red Hat, like a lot of people in the conference, so it would not be a big surprise. I'm a system administrator in the open source and standard team. We are the team distributing the t-shirt in the corner if you want to get more information or just t-shirt. And basically, we are helping various open source projects upstream directly for stuff like community management, project management, helping to organize events. Or in my case, making sure that the infrastructure is one working, two working in a secure way. And the problem I see is that we have a lot of upstream projects with a lot of developers taking care of everything. And well, to me, developers and system administrator are two different professions for one good reason, is that developers are not always a good system administrator. And system administrator are most of the time not good developers. So when you ask a developer to make a system in job, it usually does not end well. And for that, I'm going to speak about a short story which started with some project from Red Hat. I will not give the name, but this is a distributed file system. Hey, it's not like I'm giving the name. You have two of them. But two of them have the same problem. And it started back to September. I was tasked to modernize the infrastructure and see what was happening. So first thing you do, you start with doing an inventory. So it was quite easy. There was some stuff on Workspace. I just looked at what kind of virtual machine and everything. And then I started to look to other stuff. And it's like REL5, REL6, not up to date, but nothing serious. Some of them having no SSL for login. That's something I fix. And I start to look around how they are running. They are hosting as VM on some system somewhere in Canada. And I start to connect around. Because when you have an access, you just start to see if there is other access. If you can boons and this kind of stuff. And I discovered that this is basically three VM running on a Xen host. For whatever reason, I had access to the Xen host for one of the hosts. So perfect. And so one of them was called shell.example.com, example replaced by the name of the project I will not give. And I said, OK, it's not something we are using. I will take care later. I just write in the inventory there is this VM and that's it. And I was curious. I decided to start TCP DOM to see if there was traffic. And it turned out that I start to see pop3 in clear text. And I said, oh, there is someone that forgot a mail forwarder, and it's using clear text. It's quite bad. Maybe I should tell to them that they should do something. So I tried to connect to that server. I have no access. What do I do? I start to look with the VRSH, the Libre console. And surprise, I get a root shell. Someone was connected and forgot a root shell. Fine. And then I start to see what is running. And that's where things start to be bad, because there is a script called bf for bruteforce.php. And it was running, well, as you can see, 2,000 of them. And when I start to look where it was, no, it was definitely not something legit at all. So that's where I say, OK, there is a problem. Someone managed to get root on that server. It's OK. I can shut it down. It's not a server we are using for development.  And I investigate. Investigate, in the case of a security compromising, it's taking the whole disk and running with tools like guestfish and everything. And it will not be a whole story without getting worse and worse. So I start to see that the home directory is shared with the network file system, which means that, basically, anybody who had a root access could just inject SSH key to connect to the other server. Quite bad. I start to look that. I start to find that, well, some people forget their SC2 credentials in their home where some attacker could do something. I start to see that people started to forget their SSH key, which is quite bad. And, well, they were unencrypted, which is bad. But the worst part is that some of the key were the key to access to other server as root. So that's where we started to contact internal security to make a full investigation and an investigation. Basically, it was three weeks of work where I had to stop everything I had to do with meeting. And it went really up to the management chain. So it's something that we really want to avoid, so that I do not like meeting. But between meeting, I was doing work. And between work and meeting, I was sleeping. And the problem is we found more. Like, we didn't have more issue, but we did see that for the fall last year, basically around four people were connected from China, from Romania, from Argentina, and started to see a pattern, like all the country finished by A. But we were lucky it was just a script kitty. And then the question is, how did they got in? I mean, I would love to say that, oh, they were using the old A, using hypervisor bypass, and disabling SLI nukes, and a crypto bug door, and everything. And nope. It turned out that they were bridge forcing the password for 15 minutes. And I suspect that the password was likely secret, not like secret. It was not shared, like secret like this, because we had the Kickstarter file served over HTTP. So someone could just download and say, the password is this, as a comment, and yeah, quite bad. But hopefully, it was not sophisticated attacker. He uses his own IP somewhere in Romania. And he also uses work IP, some data center in Bucharest, and even worked on Romanian hacker form, you know. And he was using a PHP script for that. So it was quite easy to find where was the person. So we just decided to disable it, or did the whole infrastructure, and yeah. So the question is, how did we get there? And it turned out that when we acquired that company, for some reason, people left the company. Some people got moved to other department, and everybody was thinking that someone else was in charge of the server. And it turned out no one was in charge. So that's no one to blame. So, but my point is not to explain how it can go bad or everything. I finished, yeah. So yeah, the point is not to blame people because everybody is busy and everybody try to do his best.  It's not because you need to master how to play Quake and this kind of stuff. It's because you really need, well, to know how to do. But as I cannot multiply myself, or at least not in a way that do not take 20 years, I want to make sure that people know at least the good, the small stuff, not all the crazy security stuff of using two-factor authentication and VPN over VPN over VPN, and this kind of stuff that you see in movie with a gray, black screen and a green later. So what can you do to block this kind of small attacks? We are not dealing with NSA or this kind of stuff. I mean, I no longer have a problem with the government because they could just get the IP address and enter without trouble. So what are the easy steps for part-time system admin? So by part-time system admin, I mean, all the developers that had the bad idea of installing something and said, oh, it will be okay. It will update itself. Nope. So when I discussed with the internal security at Fredat, they said that if I need to do something and only one thing is to disable SSHFoodPassword. So I just want to make sure that if any of you there do that, please disable the SSHFoodPassword. You can use SSH key and everything. It's more secure. There is no risk of boot forcing. It works quite well. But why did you do not let your SSH key all around? But I mean, that's basics. If you want to be more secure, well, you can use disable the same for user password.  So maybe do not do that. Something that people tend to do is to use a different port, which is nice except that we discovered that each time you make an NTP request over IPv6, there is a search engine called Shodan that will scan you back. So suddenly, your perfectly working security measure is listed in a search engine for all kinds of stuff. So people can just search for SSH server. So let's say that it's completely useless.  And some universities are blocking all kinds of wear port. It happened to me last week. And yeah, when you cannot connect to your server to do your job during your Confluence, it can be bad. Especially when the same university is also blocking VPN and all kinds of stuff like this. So just use standard port. I think it's good enough. Something that people also told me to do is IP limitation, which is fine when you do not move. And it's fine when you have a fixed IP. And when I'm traveling too much, I want to get help for other people who might be from some country where there is one single IPv4 for the country, for example, like Mongolia, or get one IPv4 for one million people, like most of the country at the moment. And there is fail to burn, which I do not like because the probability of shooting my foot is non-zero. And I mean, if people try to connect to the Fedora, people's Fedora server from here is blocked. If there is suddenly someone managing to just do a port scan, everybody will be blocked. So not good. So just for SSH, which is really the basics. That's all the kind of stuff you can do, but just do the first, it will already be great because all the compromises I had to do deal since two years with this kind of stuff. Sometimes it was just me, like forgetting that there is a test-to-test user, well, okay, my fault. If you want to do more, and if you want to help the security team and me, something that you can do, and which is not hard to do when you have the resource, but you know, we are all about cloud and this kind of stuff, so it's easy to get VM. It's doing central login. So central login is something which we have, like since forever, or more than 10 years, which is equally the same. And you just say, okay, if someone connect and get access to that machine, we still have a copy of everything because the attacker we had was not sophisticated, but he still managed to break havoc on the server. So we had to use some tools to get back the file he erased to see where he connected from. So it was not that bad, but not that smart because we could get stuff. With that, it's not supposed to be able to connect to the remote server. And that's it, you do not need to, you can keep them for years and years. Ideally, if you want to do stuff properly, you need to use TLS, which is supported since a long time. But the problem is doing certificate is hard, like really annoying. Each time I need to do that, I Google for the answer on the same exact page and I'm too lazy to make a bookmark. And so we have a product inside Red Hat called Doc Tag, which is a ship with a free IPA. And yeah, I was planned to doing one hour of saying, oh, free IPA is great, but I only have 40 minutes. But it's like one single command to install. Like you run the command, you say, I want this password, this password, and it deploy everything. Probably did you use a CentOS 7 or CentOS 6 or even, well, let's be corporate. And one command for each server to enroll them. It's like, add the server to the LDAP and that's it. And for that, you get LDAP. You get Kerberos. You get certificate with automated renewal. And it's all working directly. So how does it help us? Yeah, first before helping us, you need to make sure that you get a copy because it will start to be critical. So the same, getting a replica is two command. One command on the first server, one command on the second server. And now we have two server. Well, how does it help us? So first, it brings a consistent policy. Like people have the same password everywhere. And since they have the same password, they have only one password to remember, not 20 different passwords, and they all become tests on passwords or this kind of stuff. It helps to close account. We did add a few people from that company we acquired that left, but they still had open account. And that's problematic because if someone starts to connect from a random IP, no one is gonna see that. If they need to change their password, no one is gonna change the password and everything. It helps to manage the pseudo access on Twally because again, there is basically five different ways to distribute pseudo policy. And the project was using one way for each server. So I had to do the audit for the first way, for the second, for the third, et cetera, et cetera. It's quite fine because I did learn a lot of stuff. But at the same time, it's bad because you do not know where to look for access. While with this, you can just click and remove everything. So there is a web interface because not all developers or part-time C-Sanmin are okay with a complicated man page and this kind of stuff. With a web interface, you can directly see everything. And it kind of provide you some kind of inventory. So you can see all the server you have, you can see what are their name and everything. Which then bring me to the second part, which is configuration management. So I do not know if people were in the talk this morning about the new stuff like configuration management is dead. Well, I think it's not dead, but I have no one to troll in the room. So just pretend that you see that. I tend to recommend to use something like salt and uncivil and mostly uncivil because they are really easy to start. And you need to make sure that if you are not a full-time automation engineer, you do not need to do everything. Like you can just deploy SSH config and that's it. That will be sufficient. You can do the rest by hand or this kind of stuff, but you can just do that. Make sure that people cannot connect on wood. I mean, I did the full presentation to make sure that people remember that. So please remember that. Ideally, you should make sure that SLI NUX should be on. Not because it make a Dan Walsh whip, but because it's good for security. The problem is people disable it because they do not understand. So for that, there is two things. First, you can use a standard pass. It's nice that you want to get your website in the slash home slash website, slash my website, slash dot com, whatever. But if you place it in slash var vvv, SLI NUX will do everything for you. And the second thing is you can trick SLI NUX with Boolean. You can decide that, okay, this part is too complicated rather than disable everything. I can just change the policy or I can disable part of the policy and that prevents some exploitation. During the problem with the file system, the distributed file system that shall not be named, we did see that the attacker could have access to the download server. And the good part is that there was no SSH key leak because the download table were not signed. So we had no way to verify, we had some way to verify the download server but not so much. So now I'm setting something which is called Tripwire or ADD and it just checks a directory and make a checksum of everything. And you keep that, you put it on another server and it alert you if something is changed. Like if suddenly someone changed the table, you said, hmm, there is something going on. It's not complicated, it's like just a cron job and a SCP and it can prevent some problem because we had in the past, for example, I think 10 years ago for ERC, we did see TARBOL, for example, for Juniper and all kind of stuff and this is an easy step to prevent that. On the side of the code, well, I would recommend to make mandatory code review because if someone managed to push a commit on Git and there is no code review or anything, it's bad. Someone could get access to your laptop, push and nobody will remember anything. So if you force people to make a GRIT artist kind of stuff which is part of the good process, you also improve the security, you make me happy. Ideally, if you can send a mail on commit because suddenly if you see that when you are on holiday, someone is committing a backdoor.c file, maybe it will be suspicious. And obviously, you need to use SSL, even if it's something that do not count, like, oh, we do not need to have a SSL for our Jenkins server because it's just some password. Yeah, no, when the password can be used to connect to the server, nope. So SSL is dead use, it's annoying, but we have let's encrypt. So it's now in beta, it's now in a well seven and in Fedora. You basically have no reason to not use it. It's easy to integrate. It's just one cron job and one apache of snippet that I will be able to, that I wanted to show, but nobody can, nobody will reach it on a paper or anything. And it take care of everything. It automatically update the certificate. And speaking about automated update, something that you should really do is to make sure that you update all the package. And for that you need to make sure that you are using package. If you start to use a self-installed WordPress or this kind of stuff, it's a recipe for disaster because it works, but no one is updating it. And suddenly someone starts to get SQL injection, get on access to the server and you are not using SLNX and you are not updating the kernel. And suddenly you are root and I spent three weeks starting to investigate everything and it do not make me happy. And sorry, I was faster than planned. So if you have any question or if you want to debate about all kind of controversial stuff with me, I will be quite okay. And if not, I'm also okay for 20 minutes of uploads if you want. And if you want to contact me later, it's quite easy. You either send my email or my IRC. And if you try to get me on Twitter, Facebook or LinkedIn, it will not be me. So any question? Yep. I'll just throw it away. Okay. So the question is, what do you think about SSH figure print? Because there is sometimes man in the middle and if I have a solution for centralized fingerprint management. I think that free IPA is doing that, getting the SSH fingerprint from everything. I'm not sure if it publish that directly on DNS, but you can publish the fingerprint of your server in the DNS and ask to SSH to verify. So someone has to make a man in the middle between the server and a man in the middle with your DNS that can be secure with DNS stack. So in practice, I think it do not happen. I mean, I never seen anyone speaking to me about SSH man in the middle in the wild. I mean, we know that technically it could happen, but it's more like when the government is trying to get you. And I don't say it do not happen, but I said that for now I'm trying to fix when the Romanian script kiddies are trying to get me. Rather than the top hacker of whatever government is going to go attack the project that shall not be named. Now the issue with fingerprint with man in the middle is that it will only work if you enter your password. If you are doing public and private key cryptography by using SSH key, I do not think I'm not a cryptography specialist. There is a few of them are likely around, but not me. So if someone wants to answer, feel free. But I think that you will not reveal anything by connecting there and trying to send your... You are not sending your private key, you are doing some crypto operation and if someone pretend to be the server, they will not be able to get anything from your laptop. Unless there is some timing attack or this kind of stuff which are much more complicated for my knowledge in cryptography. So it should be okay even with SSH key. You will see that there is something going wrong. And if you get the prompt, try to connect another admin, say, yeah, did something did change or is it normal or try to connect from another server to see if it's the same.  So that's not really an attack, but that's how it can happen. So yeah, I hope that it answered the question. If not, I can just pretend to say it did because I have the mic and you don't. Thanks. Yep. Yes, I did a non-cable playbook for that and it's working quite well. The biggest problem with the let's sign crypt is that you need to, for HTTP because I didn't play with other stuff, is that you need to serve some secret... Oh, so yeah, I do have experience. So for people watching the stream, the question is about running a let's sign crypt in a container and I forgot the rest. Basically, it's not my fault. The question was too long. So yeah, the problem, so your problem is that it's not what you have a container that is running let's sign crypt and you are redirecting when there is a dot acme, well-known, whatever for let's sign crypt. So basically it's a reverse proxy that is running in a container between your server and this. So that's not something I've done. I'm surprised to see it's not working because that's the exact architecture I wanted to use because I did add a lot of other tips and stuff to say but it was more complicated. I was really aiming for the easy stuff. Yeah, I think we should talk afterwards because for me it's working but it's directly deployed on one single server and yeah, I cannot see why it will not work. I mean, what I do is that I get a redirection from HTTP to HTTPS except for that specific, for that specific well-known URL. So maybe if you are doing in a different way that will be different but I would really need to see what you are doing to help you but we can do that after, except that after I have a lightning tool so that will more be like tomorrow or if you are going to Bruno downtown I will be there somewhere to try to spend my check-found. Yes? So the question is, how do I deploy free APA with Ansible? No, what kind of configure? Yeah. So that's a question mostly about Ansible. Basically, how do you do a good design for getting access to the server? I personally have one server which is a specific, secure server with a root key that can connect to the server and when I cannot, well, okay, I'm lazy, I can connect directly as root to the server but the goal is to not do that later like when I will be less lazy in maybe 20 years but in a needy world you will not get access, you will have access only from a specific SSH key with all kind of protection like limiting by IP because it will be on a server that do not move and that server is running Ansible and connect to all the server and the way I done is that when I push by Git, it trigger some kind of script that connect to a specific user that deployed Ansible and everything and that deploy also with Chrome. Another way to do that will be to use Ansible Poll where you are not connecting a goal, it's a server that downloads a playbook and run it. The only problem with that is when you start to have a password that you want to distribute because you do not want that to be easy to download by anybody so you need to set up some kind of a GPG stuff or using something like Vault or the free IPA feature for distribute the password which is working well but you still have some kind of bootstrap problem but we'll let that as an exercise for the reader. Yeah, exactly like what the Fedora infrastructure is doing. No, yep, another question. So the question is I mentioned Salt and Ansible on the slide and is it some kind of, is it example or is it a case where I can combine two and the answer is yes for both of them. I'm using Salt for that specific project but I prefer Ansible, I'm doing some work upstream on Ansible like fixing all the kind of crappy bugs that I find or sometimes that I do add myself and but you can also use Ansible over Salt which is quite a nice trick but I will not speak about it because I'm doing a lightning talk on that topic later. So no, it was mostly just an example for what I use. I use Ansible, I use Salt, it could be Puppet, it could be Safe Engine. It's just that Salt is quite easy to get started and it covers a lot of stuff and Ansible is easy to get started while Puppet is getting more complicated to install, Safe Engine is not even packaged and this kind of stuff. So I recommend for people who are really new to system administration to start by that because it's simple and if you want to get something complicated, sure, we can find something without documentation and this kind of stuff if that's what you want but maybe you want to do your job and Ansible it is. So no other question, we still have 10 minutes so you can ask me anything. I can speak about Python developer or about French policy, about dance, about nothing, whatever you want. Yes? So what do I think about changing the SSH port? I think it's, well, on one end it works because you avoid most of the scanner. On the other hand, well, sometimes you get blocked. There was one slide on that and I know a few places where I go to work like university or library where you cannot connect on anything where you cannot connect on any port or not at all port and you can connect on port 22 because there is a sysadmin and I know that people want to do SSH. Sometimes you just can't. So I prefer to avoid doing that but a lot of people like. So it depends, you can try and if you see that you are blocked, well, then you change it back. For example, inside Red Hat, we do have something which you have one specific box in the data centers that do cache and when you try to connect on SSH port 21, it try to see that it's not FTP and it do not work. So we have a Garrett server which is listening on the port 22 and we had the SSH listening on port 21 and suddenly it was not working anymore and people were not able to connect and they say to me, yeah, there was a problem. I said, nope, it's working for me because I'm working for home. There is no one doing man in the middle but from the office, it was the case and we discussed with network team and said, oh, you are using the FTP port for something which is not FTP and the DPI stuff is detecting that and blocking that so change the port and it was okay because in this case, we did detect quite fast but if you discover that at the wrong moment and you cannot connect to the server, it can be quite bad. Like when everything is broken and you cannot fix it, it's something you want to avoid. Yes. It's not about, so the question is I mentioned fail to ban and that I do not like it. It's not, there is better replacement but I do not use it so I cannot tell the name. It's just a concept that I do not like that someone could just connect from the same IP as me and just block me on my own server. Now it's efficient. I know that Fedora was using it. The problem is that Fedora was using it but they were also getting a lot of false positives like someone in some country, let's say Belgium share an IP with someone who has a botnet and they cannot connect so they go see the admin, the admin sees that the IP is blocked, unblock the IP and this kind of stuff and it's consuming time that this admin prefer to spend discussing on IRC or posting on a slash dot or this kind of stuff. Which is bad. Yep. So did I try to use spark knocking for firewall and everything? No, I think it's fine and it's quite fun but I do not want to use some complicated stuff that require me to connect as root or something like this each time I want to connect and the more TCP port I need to connect the more I risk them to be blocked. It's fun. Well, it's nice. It's something that all security geeks try but I think that in practice it do not improve that much security because the problem was that the password was weak. So I need to fix the problem at the root cause which is get a good password or do not use a password. All right, yep. Question? Nope. Yeah. Yep. So for backups, you need to, it depends basically on, you need to make sure what you want to backup how much time you can, basically how much resource you can spend on that because if you have unlimited storage then okay, make a snapshot of your virtual machine every hour and store that on your petabyte of storage. It's fine. Most of the time you do not have that so you need to be smart. Like is it okay if I have only one week of backup for the log? Do I need to make sure sometimes backup are not the solution? More it's about making sure that the data is replicated in several place which is fine unless someone remove something but it really depends. You need to look at what you need to do. You need to make sure that it's replicated in different system. If you can get something that has a net up as a nice system where you can remove a file and it's not really removed, it just disappear from the file system but you can still get it. So if someone make an error like you want to remove a world directory you forgot a space who erase everything. It's quite easy just to get it back and it's a self service again. This admin do not like to be disturbed so if it can be self service for the developer it's perfect. And sometimes you also need to make sure that you can restore backup because it's nice to make backup but if you discover that you cannot restore anything like oh I downloaded my whole database but I forgot that everything is encrypted and I didn't save the encryption key while you are tested. So you need to make sure that you can restore. You need to make sure that this is documented because obviously when you are doing the test it's okay, you can take your time. When everything is broken, the production is broken and people are just asking every five minutes on is it working, is it working, is it working? You tend to be stressed quite a lot so test the backup, automate them as much as possible and make sure that the backup are secure because you want to protect the data but at the same time the data will also be in the backup. So not everybody needs to have access to that. You need to make sure that you are using redundant hardware and everything and make sure that if something is broken on the backup side it should be treated as a production issue because maybe your hard drive which is broken on the backup right now is the same brand of hard drive that will be broken tomorrow on your production server so make sure that you get everything fixed right away and yeah but that's basically the standard stuff that you can get from the literature and everything so I don't have anything special. Yep. So am I using a network vulnerability scanner now most of the time? Clearly I should do that but the problem is that there is a first lot of false positives and I was focused on the security rather than finding some stuff. The problem I have at my job is that I get some servers that I didn't install and I need to clean them and reinstall them so a network vulnerability scanner would be able to show me that indeed there is a problem with the firewall or this kind of stuff but I'm not there yet. Once everything will be secured yeah it will be good to get another team to do some kind of penetration testing and everything and we do have a team inside whether doing that and from time to time I fantasize about having free time and being able to organize an event like this but I do not have free time but if you want to do that just send me an email then send me, send to me, I'm gonna scan everything. I might be hungry or not depending on my mood but you can do that and report me any kind of error you find. So yeah. But I do not trust that much these kind of tools because sometimes they can be quite destructive and that's not something I want to do on the production server. Most of them are sitting but then they try to find some crappy stuff like oh my god, you have the SSH banner so we know it's running SSH. Okay, yeah, thanks. But that's not a vulnerability. So yep. So the first question is I have like all this admin well all people too much email and specially by logs. No, I do not check logs because I do not have time in an ideal world I should have something but it's more to check when something goes wrong which is bad because I did see a presentation from one of the NSA manager who said that well what they fear is that someone looking at logs because they see that someone thing fishy is going on most of the time this admin do not do that and I do not do that because I do not care. It's not that I do not care. I don't know what to look for. I do have a monitoring and everything to warn me if suddenly a selenium is disappeared most of the time it's me who removed it but it's this kind of stuff but that's something I should do. Yeah, but I don't. And the second question is do I use a snort or? Ideas? No. Again because snort most of the time first you say yeah great I'm gonna see if someone is trying some complicated attack on my whole infrastructure and then after one week you just see that everybody is pinging your server and doing all kind of end map from let's say China because they have a lot of IP address and you say okay ignore, ignore, ignore and you never have anything. It's mostly like something that make security geeks quite happy but in practice it's a full time job just to check that. And yeah, most of the time you do not have that. You do not have the time. Again if you are part ICs admin it's not your full time job so I would not recommend to do that. The other problem with this kind of tool is that snort for example require to run as root or have a privilege to be able to inspect the package and you do not want to have something that get a random binary package from the internet to run as root because parsing and all kind of stuff is where most of the problem are and so that's where, I think I finish. So I will finish that question later and thanks for coming and see you later outside. So many questions after talking. That's a good question. Oh, nice. Yeah. I want to catch up with you. Could you please give me your slides? Oh yeah. So I didn't know that you were there. I was there at first time as well but I was at the stand and I was running around there. I heard you were there at first. Okay. Yeah, I need to sit down with you sometimes. I understand some stuff. Okay. Okay. Pardon? Yes, sir. I'm here. I'm here. I'm here. I'm here. I have to go about that. Seems it works. I'm here. I'm here. I'm here. I'm here. I'm here. I'm here. I'm here. I'm here. I'm here. I'm here. I'm here. I'm here. I'm here. If only the speakers will make it. I'm here. Where's the speaker? Thank you, I'll buy it for you. Thank you. Sir, why are you trying to take the minute to please me? Keep my speakers away from here or They might notice it. Okay. I was supposed to go. Hi! Hi, sir. We're here for the first twoullионals. My tickets order is four. I think Jan started it first. Yeah. So I'm here. Okay. In fact, I was presented to all of them, and when I came back, it was like I was back in Hunza, from those beds. This is a soloist. Yes, it's a soloist. Yes, it's a soloist. And here is Shalu. Great. How is this going to work? Yeah, I mean, there is like order, so like the first speaker is him.  Or is there a dedicated machine? Or you can, yeah, I mean like if you want... Mine is a Google Doc. Yeah.


Hey, welcome back everyone to SuperCloud 4. Here in our Palo Alto studios, I'm Trevor DeValante. We got two great guests and one of the focuses we have here is founders, how to start companies. We have two experienced founders, Piyu Sharma, who's the investor and entrepreneur. Formerly sold his company to Tenable, just recently left there. It's kind of freelancing out in the open here. Sure he's got some grand plans, doing a lot of research we've had him on before and Vikram Yoshi, CETO and founder and president of Compute AI. Guys, both keep alumni's. This topic here is important to me because being an entrepreneur, Dave and I have seen the waves that you guys have, your legends experience but also you're out in the arena. And the cloud was great. You put your credit card down, you can start a company, the SaaS revolution was born. AI is different. We're seeing stories of, give me two engineers and a product person and one go to market, the rest is faster. Is it faster? What do I use? How do I build the tech? What's available? Let's demystify this. As founders, welcome to this panel. Pius, we'll start with you. As you look at the opportunities clearly like the web, every vertical is open for business. What's your perspective? Thank you for having me here, John, first. Thank you, Dave. I think this is one of the most revolutionary times we have seen in at least in my lifetime. After the internet revolution, we are seeing a significant, significant changes happening on how the cloud have been used, especially now the AI LLM, it's a buzzword today. It's become super easy to build a company. And as long as you understand what the problem you're solving, there are sufficient amount of technology that is available and then you can use now technology to build more technology. Like the AI LLM today is run from cloud for cloud, essentially changing the game of the startups. And you've been an investor, so you know the playbook. You put some C capital in, you get some VC. Dynamics are changing. Big time. What's your perspective on the funding? How do you get funding? I think the market needs have significantly changed in the last few months and years. The investors always look at the white spaces, the bigger spaces like AI or LLM are similar to that. The usage of the whole AI ecosystem is going to be very significant. So the money wise, I personally feel there's a plenty of money available. You just need to have a problem that is important and urgent and that's about it. That's the key. You still have to solve problems, right? And so you're in the world today. So what's the process that you use as a founder to go about trying to understand them? I mean, a lot of times we just fall back on what we know, but then you have to step back. I mean, you're in the world of data. How do you go about figuring out what problem to solve next? That's a great question, Dave. I think we are playing much like what you said at a very important time in the evolution of data processing, computing, AI, ML. And we are playing at a very important juncture here at a conference of two kinds of forces that I work. So I just want to set the tone for a little bit of the background and then we can discuss the opportunity and what it takes to be an entrepreneur and raise capital in this seemingly tough market. So it's the confluence of two major things happening here. One is you have massive amounts of data processing going on and then there is the AI, ML forces, whether it's gen AI, LLMs or other kinds of AI, ML. And there are many opportunities here and I know the market has been saturated with conversations on gen AI and LLMs, but there's a much larger, there's a vast amount of opportunity in the AI, ML space outside of that too. From an entrepreneurial perspective, understanding what the problem space is, understanding real pain points, how do you identify those? The architectural tenets of entrepreneurship haven't changed. It comes down to team. You've talked about that. People have talked about that. The example information as an entrepreneur, you think you focus on the team, great teams build great products and of course you must have a market and it's not very easy to see the path in terms of how big is the market? Can I tap into it? Is it greenfields? Is it brownfields? What the option it is? And that's where they cannot... Did you raise money for your startup or did you fund it with your own cash initially? Did you raise some, and how did you capitalize that startup? So the urgency that I felt, I did, I did. The first thing I did was, I put my own money in. So I put my own cash in. I went ahead and got a million dollar line of credit on top of it to make sure that whatever the market conditions, we have the ability to continue to focus on the idea and just go after it with custom. Because once you believe, once you've come it, you do not hesitate. And I think that's one of the first principles of entrepreneurship. You have to have skin in the game. It's just between you and me. It's me and me. It's not even how investors look at you. And then the next thing was, there were other investors who were interested, including people who invested in me before. That's how computer... We talked about this. We had coffee prior to coming on the program before with some of our friends. And we talked about opportunity recognition in that you don't really need a lot of capital to go get going. That's right. Even the seed game has changed. You can either fund it yourself because it's like the cloud days. You put your credit card down and you put it in the cloud. A little bit higher scale with AI, higher velocity. What's the power dynamic on the funding piece these days? I know you may do a lot of mentoring of other entrepreneurs as well. What's the current state-of-the-art mindset and execution playbook for three feet in the cloud at dusk? Get some momentum. How do I get that next check? Yeah. And I think, John, you made a very good point that it's all about driving a value and innovation. I think when you deal with the new technology or the new hype cycle of a brand new technology like AI, LLM, there are investors, there are sufficient number of challenges that they are up there to be solved by somebody by you or somebody else, right? I think the funding is a secondary aspect of a problem that you're trying to solve. So if you really start with the right problem, most fundamental, I keep on saying that is the problem important and also urgent is where you actually start. As an entrepreneur, when I look at anything to invest, if I am angel investing in a startup, I always look at that the problem, that how important it is. Is this going to be for 10 customers facing the same problem every day or is it going to be a thousand customers they see this problem once in a month? And the urgency. The urgency. Sorry to interrupt. I would have scored the important and urgent is where you need to start. From the investment standpoint, just to wrap it up on the investment part, the investment, whether you bring it your own money, whether you bring it investors money, you always consider it's your own money because that's the conviction that the founder needs to bring in. Once you have that conviction, money will follow, the customers will follow and everything will start falling in place. Let's talk a little bit about markets. You guys both compete in very large markets. You're in the data world, you're in the security world. That's right. The data world is dominated by the big three cloud players and then you get snowflake and Databricks which seemingly reached escape velocity. So the market's enormous and there's some big beast. Softly worded, yeah. That's the way of the land there. And in security, highly fragmented, really nobody has a double digit share, maybe Microsoft does, but generally speaking, it's very, very fragmented. So completely different, but both huge. So how did you go about thinking about the problem that you wanted to solve?  Was it because AI was a potential disruptor or you saw that the existing guard was not capable of doing what your vision sort of led you to? Yeah, I think just the framing of the question itself is very powerful and understanding who the big players are. They are the cloud players, they are the big behemoths, there's snowflake and there's Databricks. As an entrepreneur, I'm always looking to create value. And I don't view disruption in technology as being something that you decide upon. If something is gonna change the game, let the customers vote on it. So how did I make the decision out there? You're playing in a very rich data landscape where it's a trillion dollar market or whatever the numbers are. It's a massive, massive market and no one denies the fact that there is plenty of opportunity.  And in my case, I was thinking in terms of incremental but significant value where you leverage the great work done by the snowflakes of the world, by the Databricks of the world as you're standing upon the shoulders of giants and creating value which really means finding those pain points, real pain points like Piyush said that are urgent and you wanna be able to solve them. And what we heard through all the conversations and having been in the data space and knowing that I'm not gonna come in here and build another compute engine. You don't wanna be the 10th search engine and not do something like Google. So at the back of your mind, you know that if the problem is large enough, personally it's not exciting to me as an entrepreneur. So you always have that push and pull out there. Is this large enough? And how am I gonna insert myself? And is there gonna be credibility? You come out there from the left field and you say, okay, here's the Databricks. Here's a snowflake. Data management is done. What's the next thing? What's the pain? And how do you go out and create value where anyone who buys your product probably already has one or both of these solutions. And you still wanna go out there and make it. That's clearly the case in your world. The security is exactly like that. And honestly, on the security side, right now there's so much noise around certain things because everybody wants to do everything. But nobody focuses on the main thing which is the prevention against the beaches. And every new technology brings an opportunity in the cyber security, right? AI came in. I mean, AI ML has been there for a long time. The large language model, the performance and the efficacy improves in the last few months like when the transfer market actually came in. So, I wanna ask you on that. One of the things Dave and I were just talking about before you guys came on was that CrowdStrike event and all these events we go to, the Cube, everyone has the same line. When we get your reaction to it. We've been doing AI for years. Exactly. Okay, so, okay, they have- I have a story there too. All right, you said the 10th search engine- We just bought a company that's doing AI. And your point about the 10th search engine is Google was a nuanced point. That's like, they came in late the game and became dominant. They had a different approach. What is the disruption vector that startups can take? If you fresh start starting a company, you've got LLMs with the foundation models. What about genera of AI makes it a disruptive enabler? And how do you change a game and flip the script? Is it the data? Is it the app? Is it an AI wrapper? What does AI native mean? Because I look at all the old guard stuff and say, okay, CrowdStrike might have been there and done that. They're doing it. Some say they're the best at it. But is it really going to be the next wave? What's your guy's perspective of this disruptive opportunity for the startups flip script? Yeah, great question, John. Actually, you put it very well that everybody says that we have AI. We've already been doing AI for 20 years. The challenge is the whole, why this disruption happening now? Because of the consumerization of the AI. AI has been, AI and ML has been a very niche, very specialized platform in the last few years. But the whole launch of open AI, HRGPT has consumerized AI in the hands of actual and you very well stated, right? The whole, so AI has become commodity, large-angle foundation model. There are like 10 of those foundation model available. And even it to the extent that there are the models which are region specific. Like there was one company got funded in Europe who solves only the Europe specific, the Europe specific problems around foundation model. So the whole commodityization, which is where everybody gets a hand on something or other application that uses AI or being secured by AI, I think that's the change we're talking about. It always starts in consumer though. Even in data, it started with the Google file system right in the search, right? Yeah, absolutely. And an example of that is, I had someone who worked with me in the AML space, was the lead engineer, is the lead engineer. Remember one of these applications in Gmail as you type it completes the sentences on you? That's a massive generated AI LLM model using millions of whatever TPUs out there at Google. And it's been around for a long time, but it's that commercialization and the commoditization. It's like search and chat GPT are now starting to compete. And I think that gives it wings. So I want to get back to the consumerization point because LLMs and we just showed our power law chart on our intro segment that the size of the models are changing. You've got smaller models. The flip is script. I'm here with the word proprietary and walled gardens a lot. And open AI is called the proprietary model. Actually it's more open. And other models in the long tail are proprietary intellectual property. So data is now the IP, okay? So you look at that. So people are putting a walled garden around it but yet it interacts with other data. So the question is, how do you look at the data aspect of it from the perspective of security? Does security mean securing against breaches or just knowing that something's truthful? What if synthetic data gets in there? How do you know what's real and what's not real if the consumerization is here? And to your point, my daughter was texting me and a new app she's using to write her emails for her. She's just graduated college. So they're already using apps that are coming out, AI wrap wrap. What's the next generation? What is that security posture? Is it about truth? Is it about breaches, all the above? Yeah, so I'll take this, I'll take a 10 second attempt to explain that what is an impact of this LLM on cybersecurity? And this is just my definition. There's no standard on this. There are four dimensions in which that AI LLM has been impacting cybersecurity now. One is your cyber offense, which is where a lot of AI will be used to breach the system, creating DDoS attacks or a lot of threats, vectors will generate come out of the AI LLM. There's a foundation model that was created in the dark web which just creates the malware. So you can imagine now, more and more data is translating to that. Number two, is a cyber defense. So a lot of AI usage is starting to happen to prevent breaches. Very contradictory, right? There's one is to use attack, one is to prevent. And then there is a social responsible aspect of the AI that whether by AI because it's generative, needs to be socially responsible, et cetera. And the last is the four dimension is preventing attacks on AI itself. So if every company of the planet is going to use an AI infrastructure, you need controls that will prevent breaches on AI. To the last point which John mentioned, the data. Data is so critical because data has become the threat vector in the industry for the first time. It's not the user, it's not the infrastructure, it's the data. So you use data to exfiltrate the data. You create prompts so that you can exfiltrate the private and PII information. So that's why it's a very transient time but it's a very significant change the way the security solution happened. And by the way, everything you just said is reality happening now and the old standards were siloed data warehouses, old data modeling, old compliance. So governance compliance all have to adjust rapidly. And some companies are conservative, they don't know what to do. Yet it's changing so fast. So the question is what side of the street will you be landing on? The good side or the side that goes away? Now I think you have to lean on both side because we're unfortunately or fortunately remain in hybrid mode for a long period of time like private public data center. And I'm seeing AI as a complete trajectory as cloud. Initially there was challenges in adoption. There were risk chasm which companies sort of companies were built around solving the adoption problem. The same thing happening in AI also. Yo, as Vikram said, it all comes down to value. And the promise of AI is it's gonna drive productivity up. I think in your world that the SOC analyst experience is changing dramatically and then with so much more we can do with data. What do you guys think about the sort of timing of when we're actually gonna see, maybe it's happening already, but it's still not meaningful on numbers. That we're actually gonna see AI have the impact that is promised. I feel that where we are in the industry with data management, these were massive problems creating systems of records, right? You can call them silos or not, does not matter. But solving those problems, the kinds of problems that say snowflake has solved, I think that's been a massive step that we need to leverage and catapult ourselves to the next level. What happens beyond that? And there is another point of inflection here. And again, you need to bring an EIML into the picture. It's important. I do have a separate comment on the synthetic versus the real part of the data. And that has to do with with what's happening with cloud data warehouses, with lake houses, data formats. The moment you take a data warehouse or you take a table and you flatten it and turn that into say a parquet file, at that point you unshackled compute from the confines of say a database or a data warehouse. At that point, it's may the best compute engine win. And there are many out there, but the ability to integrate compute. For users. Well, yeah, democratization. Right, you don't have to use the cloud vendors compute necessarily, right? That's locked in. Even though they're separate, we've talked about. And compute for all, right? Compute is the oxygen for data processing, right? I mean, we don't pay for the air we breathe and we're being productive, we're being entrepreneurs, we're creating incredible value and hoping to change the world. So to have to pay for oxygen, I don't think you want to make compute abundant. And we now have arrived upon the opportunity here where between parquet and formats such as iceberg or delta or hoodie doesn't matter. It's data and metadata. You can now have some very powerful compute platforms which are far simpler because I, you know, maybe this may not be that relevant, but at least I'll sort the seed here for maybe a future conversation. What's important here is, and especially coming here with my roots and databases having had something to do with Exadata. When I look at a database, you look at databases as having to do ETL is done. Then you take the data and you push that into rows, columns, tuples, whatever, into tables, right? Things with schemas. There's DDL and DML, there's transactions. And then you have DQL, which is your query. With parquet and iceberg or delta, which are very powerful standards. So what you've done is you've taken DDL and DML out of the equation. You've taken transaction processing out of the picture. You've taken snapshots, checkpoints, everything out of the picture. And now you're left with a pure read-only compute engine with the power of being able to do transaction processing. We are able to do point-in-time rollbacks, you know, all of those features of databases. So I think we have arrived upon a new feature. If I may just connect the dots and the DML side effect. Well, we gotta wrap up, but I wanna put a pin in that, we'll follow up. The computer's oxygen, I love that line. We have one quick question to end, the segment for you guys.  With what opportunity recognition techniques should the younger generation watching this or anyone in the enterprise trying to figure out how to be less conservative, more aggressive, without failing or getting over their skis as they say. What advice would you give from an opportunity recognition? What's real? What's a company not a feature? What would you guys say to that question? I, if I would start, I would give only one advice. Talk to customers. Talk to the real users of the AI infrastructure. That is how you will define how things need to be built. Talk to them, talk as much as you can. And I would add to that, supplement that and say, talk to investors too, because they have talked to many, many founders. They've gone through 40 pitches or more and so forth through that a week. And what they possess is that information which you can rapidly access. I'd rather, I'd benefit from the intuition of maybe five bright minds than 10,000 rational thinkers. And I think between talking to real customers and talking to smart, strategic investors, you have it covered. It's a great point. And remember the dot-com bubble, not that it did burst, but it ended up happening. Everything that they did invested, it did happen. The spray-and-pray approach was the best. Spread the seeds out on the soil, let them grow. Just the amounts might differ. Absolutely. Thank you for coming on. I wish we had more time. Great panel. Great to see you guys. As always, expert contribution here on SuperCloud 4. Generative AI, generating tons of opportunities for entrepreneurs and innovators to change the game. The script will flip. This next generation is here and growing with the next interview from Brian Harris, CTO of SAS, a company that's been around for a long time, still private, does billions of dollars. His approach and his vision how to take conservative approach, but yet aggressive with AIs up next. We'll be right back. Thank you.


what's up everyone take down here welcome back to another video today i'm going to be sharing with you some vehicles that were once discontinued that should be brought back let's get right into this so we are seeing it more and more in today's market that vehicles are making returns and the main reason for this is for car manufacturers like ford chevy and dodge they are discontinuing passenger cars so they are bringing back a lot of the former discontinued vehicles like their suvs and trucks the main reason they're bringing back these vehicles is because it is cheaper for them to market the vehicles from the past because people already know the names rather than come up with a new name for new vehicles and trying to market that so for this video i have a small list of vehicles that should be brought back let's just get started here up first is the hummer the hummer was first originally a military vehicle but due to arnold swartz nigger loving the vehicle while he was on a movie set he really wanted a hummer the manufacturer decided to make arnold swartz nigger a civilian version of the hummer but due to the success and the popularity of arnold swartz nigger at the time the public also started to demand civilian versions of this vehicle the manufacturer started to make the hummer h1 model which was a very large suv off-road vehicle if you had a hummer at the time it meant you have the status of having a lot of money gm ended up purchasing the rights to the hummer brand and ended up making the h2 model which was slightly smaller than the original h1 however it 100 resembled the hummer it looked just like the original did just more as a civilian version of it gm ended up making the h3 model which was slightly smaller than any of the other hummers from the past and it still slightly resembled the hummer except it was very small and very much more of a regular suv vehicle back in 2009 gm went bankrupt and in 2010 they decided to discontinue the hummer not only were people not purchasing the hummer due to the company going bankrupt but also due to the price of gas going skyrocket i feel like if they are ever going to bring back the hummer they're going to have to make a fuel economy version something that is not a gas guzzler like the original hummers were it is rumored right now that in 2022 the hummer is going to make a return under the gmc brand so it's going to be more like a gmc hummer and it's going to be more of a truck style vehicle it is also rumored right now that it's going to be an electric vehicle which i feel like with more and more car manufacturers going electric these days i feel like it is going to take off and it's going to be competition with people like tesla however i just don't know how i feel of having a hummer that is electric in 2022 i just don't know how i feel about it i feel like they if they're going to make an electric version they should also make a gas version but something that is not a gas guzzler and i think that would be very successful if they were to go that route the next vehicle is a chevy chevelle the chevelle was originally discontinued in 1977 and i just don't see why they discontinued this vehicle it is one of the iconic muscle cars from the 70s and they just never introduced it once again we've seen chevy do this before with the poniac firebird after the poniac brand was discontinued they basically took that year's camaro and put the firebird's emblems on it and changed some of the body panels to resemble the firebird a little bit more i feel like if they're going to bring back the chevy chevelle in any way even if it's only as a tribute vehicle a sub model for that year i feel like they're just going to take a chevy camaro and they're going to put the chevelle emblem on it and possibly take a couple of the body panels and make them look a little bit more like the chevy chevelle was so it's a little bit more resembling of it i honestly feel if they are going to do this as a tribute they are still going to make the money from it and people are absolutely going to love this vehicle if they were to do so next is going to be a dodge magnum station wagon which i was a huge fan of back in the day now it discontinued in 2008 but because car manufacturers are discontinuing passenger vehicles nowadays i feel like to bring back a station wagon might be the next best thing because a lot of people are purchasing suvs because of all the space inside the vehicle and a station wagon is going to have more room for passengers and more space in it so i feel like it would be a little bit more successful than passenger cars are i honestly hope they bring back the dodge magnum because it didn't look too bad but if they're going to make a new version of it i think it would look amazing on the road next is going to be the chevy el camino which was discontinued in 1987 just like it says for the chevy chevelle i feel like if chev were to bring back the el camino it would be more like either a tribute or it would be its own sub model of the camero i honestly feel like the el camino would be brought back before the chevelle just due to the popularity of trucks nowadays a lot of people consider the el camino a crossover between a car and a truck i have always considered it more of a car but because people are not purchasing cars anymore they're going for more trucks and suvs i feel like the el camino because it is a crossover between a car and a truck people are absolutely going to i feel like they could simply have the front end look like a camero and have the back end resemble an el camino just have it more like a truck bed and more like a current model vehicle i think that would look absolutely gorgeous and a people would absolutely purchase this if chevy were to do so the last vehicle on this list is going to be a cadillac el dorado which was discontinued in 2002 once again due to car manufacturers like chevy ford and dodge discontinuing passenger vehicles the luxury market for passenger vehicles is going to start to take off because cadillac lincoln and other luxury car manufacturers are not going to be discontinuing their manufacturers for cars they're going to be continuing these passenger vehicles so i feel like a slight edge that cadillac would have to make these passenger vehicles and to start selling a lot more of them would be to return not only the el dorado but other cadillacs that were once discontinued from the past back up into their passenger car lineup i think people would absolutely love them to do this so these are some of the cars that were discontinued from car manufacturers that i would honestly like to see brought back i was going to include the chevy trailblazer but it is already going to be coming back and making a return in 2021 chevy already confirmed this so i didn't want to include it in this vehicle because they're already making a comeback but because more and more manufacturers are discontinuing passenger vehicles i feel like since more suv and trucks that were once discontinued are going to be making returns once again because we have seen the ford ranger the ford bronco and the chevy blazer make returns and the trailblazer is confirmed so i feel like they're going to continue on this pattern right now of bringing back vehicles from the past then comment down below what discontinued vehicles you would like to see make a return and i'm going to leave this video here please take care peace