Good. All right, am I good to start? Hi, everyone. So it's such an enthusiastic crowd. How's everyone doing?  You're participating. So today I'm here to talk to you about kind of modern security practices and codifying security. So my name is Seth. I'm a developer advocate at Google Cloud. You might recognize me from the Hashi Group community or the Chef community where I worked previously. And to start today, there's some slides in the beginning. And then most of it's live demo, so that's exciting. But first, I want to talk about traditional security. So this is how I describe traditional security. It's a padlock around a keyboard. And let's think about this in terms of an application architecture. So if we look back maybe 10 or 15 years ago, our applications tended to be structured something like this. You had some load balancer that would do the network ingress. That would hit some firewall. Those might have been the same thing. And then you would hit your secure domain. The application was likely monolithic. So you didn't have microservices. All communication happened with inside the application. And your database and your application lived on the same network. They might have been connected by the same physical, like serial cable connecting these two machines. The load balancer and the firewall were likely hardware appliances, like an F5. And all of this was controlled by one or two people who had a lot of skills in the industry. So the important part to note here is that once we're inside the secure zone, everything was trusted. When we moved to a modern architecture of an application, applications have gotten increasingly more complex. This is due to new programming languages, new requirements, proliferations of things like microservices so we can break apart different things so that different teams can work on different things and accelerate application delivery. But that introduced some complexity. So now we have cloud adoption, where we have some things running on a public cloud, some things running on a private cloud, some things running in both at the same time, and they need to talk to each other. So our modern architectures tend to look something like this.  So not only are we eating some performance, but we're now subject to any vulnerabilities that exist in that language.  We no longer have a firewall. Instead, we have firewall rules. Again, that's like TLS, we're encrypting the connection, we're encrypting the data over that connection, but we need to encrypt our data at rest as well, so in transit and at rest. At the same time, we need to understand the trade-offs of encrypting that data. There are certain data that should be encrypted, and there's certain data that can live in plain text.  And this is where there is no one answer. If I'm a company like MailChimp, where my core business is sending email, email addresses are very important. If I get hacked and I see that there's been a data leak, that's basically the end of my business. On the flip side, if my primary business is cat memes, and I run the top site for cat memes, and I collect email addresses so I can send out a newsletter, if I'm attacked, it's bad. I shouldn't have done that. I should have followed better security practices, but it's not the end of my business. And at the same time, if I encrypt all of my email addresses and my database, I lose the ability to do analytics. I can't search for all email addresses that end in, say, at gmail.com anymore, because they're all encrypted. So I have to make a business decision of should I encrypt this data or should I not encrypt the data? So encryption everywhere isn't the answer. Instead, having a cognitive conversation about whether we should encrypt data everywhere is the answer. And making a business decision and analyzing that risk of whether we should encrypt or not encrypt and what the business trade-offs are for that. The second pillar are these dynamic, time-based, revocable credentials. So in a traditional application development, you might have an app that has to talk to a database. And the way you generally get the credential is you email your DVA team or you file a ticket. They manually provision an account for you. They give it back to you. You put it in the config file for the application. And all of your applications share that same credential, seemingly for the end of time. If you're in a large enterprise, you might rotate them every six months. If you're a startup, you keep them there until you get acquired. This is a challenge. The longer a credential lives, the more likely it will be hacked. So instead of trying to do this whole no one's ever going to infiltrate our systems, we're going to have the best security parameters, we can instead invert the conversation and say, you know what?  We should do better. But our credentials only live for an hour. So at most, an attacker would have to penetrate these three levels, then get in a credential, and use it within an hour. And we can revoke it early. And this is why time-based credentials are very important. I'll say this on the encryption side. And I'll say it here again. Unified APIs and codified best practices. This is arguably the most important concept. And what I'm going to show you in a bit with Vault, which is an open source tool, is we need a central source for secrets. Many organizations out there are writing code in five different programming languages with hundreds of engineers, all with different levels of expertise. We can't expect every Ruby developer, every Java developer, every Go developer, every C developer to reinvent encryption. Instead, we should treat encryption the same way we treat things like databases. They're just a service that is offered. So just like a database is a service that is offered to store data and retrieve data and search data, we should think of security as the same way. There needs to be a service that does security force. So things like encryption as a service, password generation, entropy generation. I shouldn't have to write that in my own language. It would be great if I could just make an API call over, say, SSL with a JSON payload and say, hey, give me 150 bits of random entropy. And I don't want to have to write that in five languages. I would love to just make an API call. And that's kind of the direction that I think security should be going. It's security as a service. If I want to encrypt something, I don't want to have to pick a cypher suite. I don't want to have to know if it should be asymmetric encryption. I just want to have this blob of text. And I want someone else to encrypt it for me with the latest and greatest standards and give me back the encrypted text. And I don't want to have to think about it. I don't want to have to know all of the vulnerabilities that exist. And again, this is the direction I think the security industry is going. And to do that, we need a consistent experience. So it doesn't matter what language you're writing in.  It doesn't matter if you're an enterprise or a startup. It doesn't matter if you're running on Kubernetes or Mesa's or bare metal. We need a consistent experience. And that's really what Vault tries to be. So Vault is an open source tool written in Go. It runs as a service. And it's designed to be the central repository and central egress and ingress for all credentials within a system. So I'm going to demo it while continuing to talk about it. I have this live demo slide. So I couldn't get my way out of it. So let me just show you how this works. So Vault operates in a client server architecture. Can everyone see this? You're also loud. There we go. All right. So Vault operates in a client server architecture. What I've done here is I'm going to start a Vault server.  So I'm starting a Vault server. That's exciting. It's running as a service in the background. I'm going to go ahead and open a new tab over here. So I have Vault running. It's running as a service. If I was in production, it would run in high availability mode. But for locally, I just have one instance. And I just make requests against Vault. It acts just like a database where it has data. But we'll see in a little bit that it's a little bit more than that. So just to prove to you that I have a Vault server up and running, there's a Vault server. I just queried for it's status. Vault is conceptually similar to a website. You have to log in to Vault or authenticate to Vault. There's a number of ways you can authenticate. You can authenticate via a username and password. You can authenticate via GitHub token. You can authenticate via LDAP, service accounts, et cetera. The easiest way to think about it is when you log into a website, you put in a username and a password. The username and password is validated against a backend database. And then you get a session token or a session ID. And that's stored in a cookie in your browser. In Vault, the concept of a session ID is called a Vault token. So I'm just going to log into Vault here. And I'm now authenticated to Vault. And I've logged in as the Root account, which is a really bad practice. But this is a demo, so I'm doing it anyway. And this is just going to showcase, it gives me super permissions in the system. So the first component of Vault. And the easiest one to think about with encryption is this what we call the static key value store. The easiest way to think about this is encrypted Redis or encrypted Memcache. I'm going to give Vault some plain text data. Vault is going to encrypt that data in transit with TLS and at rest with AES256 bit encryption. And it's going to store it. When I want it back, I ask Vault for the data back. Vault decrypts it and gives me back the plain text data. So it's going to behave similar to Redis or Memcache, but it's encrypted in transit and at rest. So I do that by writing to anything under secret. So I'm going to create a secret named Wi-Fi. Wow, I can't type. And I'm going to say that the password is, what is the Wi-Fi password? I'm not typing that out. The password is bananas. So I've created this credential. And I can read that credential back out. And I get that my password is bananas. And I can create any number of these secrets. So I might have the bathroom door code. And it might be 1234. And I can actually list these now. And I can see I have two credentials, the bathroom credential and the Wi-Fi credential. And this is nothing special. This is just I gave Vault some data. It encrypted it. It stored it. I want it back. I get it back. That whole process is authenticated, though. So I'm cheating a little bit here. I'm the root account, which is like pseudo in Linux. So I can do anything on the system. But everything involved is actually policy-based. And if you don't have permission, you can't do it. So I could create a policy which lets me read the Wi-Fi password, but not the bathroom code. So work all you want. No breaks for you. Someone got that joke. So this is basic CRUD operation. So the last thing you can do, obviously, is to delete things. So I'll go ahead and delete the bathroom code. And I've now deleted that credential. So basic CRUD operations on a K-value store. It doesn't feel encrypted. How many people feel extra secure using this over something like Redis? Yeah, it doesn't actually feel secure. And I want to talk about that for a second. So the reason for this is that the security industry has kind of preconditioned us to believe that security has to be hard. And part of this is vendors trying to sell their appliances. And part of this is just security was hard for a very long time. Vault is open source. It's been audited, I think, six times now by three different groups, including the NCC group, which is like a leading auditing firm in the security compliance area. It's FIPS 140-2 compliant. It can be PCI compliant if you follow the correct steps for implementation. So it checks all of the boxes, all of the multi-letter acronyms that you're used to with security and compliance, yet we don't feel secure. And that's part of the industry's thing and part of the thing I'm setting out to change is that security doesn't have to be hard. This is a tool that is validated. It is used by government agencies in the world. So it passes all the checks. But this isn't where Vault is cool. I could build this backed by something like Redus or Memcached in an afternoon. So this is just one feature of Vault. Another feature of Vault in where it really shines this notion of dynamic credentials. So here, when we're using the key value store, I give Vault data, Vault encrypts it, and stores it. But what if I have a really large data set? Maybe I have a database with 100 million users in it. And I want to encrypt their passwords or their social security or credit card numbers. I don't want to store that in Vault. That's a lot of data. And Vault isn't a database. It shouldn't be used for replication and sharding. That's a database's responsibility. But I still want to encrypt the data. So what we can use, we can use what's called the transit backup. So instead of Vault encrypting and storing the data, Vault will encrypt and return the data to me. And then it's my responsibility to persist that in my application. So I'll go ahead and show you how that works. Everything in Vault is like a file system. So I'm going to go ahead and enable the transit backend, as we call it. And then I'm going to create an encryption key. So I'm going to go ahead and run this. Set up transit. And now I have this transit backend. And I have an encryption key named MyApp. So what I can do is I can encrypt transit encrypt MyApp. I can encrypt some plain text data. And that data has to be base64 encoded, which I'll explain in a second. And I will say FossAsia. So I've encrypted this. What happened was I sent some plain text data to Vault. Vault encrypted it using a Cypher Suite and returned me this encrypted text. This is also available via the API. Actually, everything I do via the CLI is available via the API. The CLI is just a very thin wrapper around the API. So you could do this at Ruby, or Python, or Java, or with Curl, if you would like. I take this Cypher text, this whole block of text, including the Vault v1. And I store that in my database. When I want the plain text back, I take this entire Cypher text, and I give it back to Vault. But I use the decrypt endpoint slash MyApp. And I give it the Cypher text. And Vault gives me back the plain text. And this is base64 encoded. So if we echo this code, we'll get FossAsia. So the reason that we use base64 encoding is that there's actually no requirement that the data that you're persisting to Vault is representable Zasky characters. PDF, Word document. All of those are things that I should be able to encrypt. But under the hood, this is a JSON payload over HTTP over TLS. And in order to safely transmit those binary bits, I need a transport mechanism. And base64 is one of the most common. So if you are encrypting large blobs of data, base64 encode them, they get sent along with the payload. They come back as a binary safe string, so you can store them in a database and then retrieve them later. So this is a great way to provide encryption as a service. And what's nice is there's a number of different features of this. So it's not just an encryption key. It's actually an encryption key rig. So I can maintain multiple versions. I can upgrade and downgrade my encryption keys to make sure that I'm always using the latest data, and my data is always encrypted with a fresh key. I have third-party processes that can re-encrypt data. I can have my front-end servers with the permission to encrypt data, but not decrypt it. And I can have my back-end servers the ability to decrypt data, but not encrypt it. This will let me have a front-end application that could accept credit card applications. It would encrypt the social security number or the credit card number, put it in the database, but it could never decrypt it. So even if an attacker gained access to my front-end server that had root access on my front-end server, that server is not authorized to decrypt data. So they couldn't actually decrypt it because they have to also compromise vault in that scenario. So it's a multifaceted attack. Similarly, my back-end servers can only decrypt data. If an attacker is able to compromise that service, they can get their credit card numbers, but they can't persist any bad data or any fraudulent data into my system because they can't perform the encryption operation. So this is kind of leading into what involved we call dynamic credentials. Dynamic credentials are things that are created on the fly. So one of the easiest ways to think about dynamic credentials is in terms of databases. Right now, in order to create a database password, you have to run some SQL commands or click and agree. You get back a username and password. You put it in a text file and you share it across all your applications. There's a number of problems with this. Namely, you have one shared credential. So if it's hacked, you have to incur downtime to rotate those credentials. You don't have Providence, which is a one-to-one mapping of an application to its credentials. And it's not good for auditing and logging. You can't do this dissection or diagnosis of a problem. So what we can do in Vault, oops, I ran that before I actually showed you what it was, is Vault can actually connect to a database like Postgres or MySQL or HANA or Oracle. And it can actually dynamically create these credentials. So I'm running a local host here because I did want to rely on the internet. But last night at the meetup, I demoed using this on Cloud SQL, so third-party database service. What I do is I give Vault a root or a privileged credentials to my database, and I give it a series of SQL commands to run to create a user. So here I say create role with login password valid until. And these curly brace things get filled in by Vault. So what will happen is when I make an API request to Vault, Vault will establish a connection to Postgres. It will run this SQL, filling in the things between the curly braces, and give me back a user. So what we've done and what Vault does is it actually provides an HTTP API for programmatically generating SQL users. And this works with Microsoft SQL, Oracle, a lot of mainstream databases out there. You can run any SQL statement. So if you have a stored procedure or if you want to grant privileges on a number of different things, it's just an SQL statement. So I already set that up. And you'll notice here that I've created a role. A role named read-only is like a sim link. So when I want credentials, I ask Vault, hey, give me the credentials that correspond to the SQL statement. And the way I do that is by referencing the role. So I would run something like Vault read. Actually, before I do that, let me prove something to you. So this is my local SQL instance. You can see there's one user in there. That's me. I'm the root user. Now what I'm going to do is I'm going to read from database creds read-only. This is going to generate credentials. So when I hit Enter, Vault actually establishes a connection to my local Postgres cluster, generates a username and password, and it shows it in between those curly braces, executes that SQL, and returns the result to me. So here you'll see we got a username and a password back. This is a real Postgres username and a real Postgres password. And every time I run this command, I'll get a new username and password. So you can see here that they're different. This is useful because all my app has to do is, at boot time, make a request to Vault. If it's authorized and authenticated to do that, it will get back its own unique credential. So that one application has a unique credential to talk to my database. You'll notice that the database credential has a lease duration of 768 hours. It's about a day. Sorry, about a month. It's a long day. It's a day I'm hard on. It's a day on Jupyter. It's not a day on Jupyter. That's about 30 days. So what will happen is after 30 days, this credential will get revoked automatically. So we don't have to worry about rotation and stuff, because we can tell our auditors and our compliance teams, hey, no credential lives longer than 30 days. I could set that to as little as five minutes, if I really wanted to. And then no credential would live longer than five minutes.  I'll list the users, and you'll see we have two users in here now. So we programmatically, and again, under the hood, this is just an API call. We now have an HTTP API that can generate database users. This is incredibly powerful. And those users have a limited time that they live. They can live for a configurable amount of time anywhere from one second all the way up to five or 10 years. But we're able to time scope these. We can revoke them in advance as well. So right now, I just showed you all my username and password to my database. That probably wasn't a good idea. So what I'm going to do is I'm just going to go ahead and run Vault revoke. And I'm going to revoke all of the database credentials. And just like that, when I go in here, they're all gone. So that's what we call a break-class procedure, which is, oh no, I've been hacked. I need to stop depleting. I'm going to incur downtime, but that's better than losing customer data. I'm going to delete all of my credentials, and I'm going to start from scratch and re-diagnose this problem so that we can find the vulnerability or the infiltration habit. That's how easy it is to revoke these credentials. And you can do it on a subset. You can do it on a full set. You can revoke everything in vaults. Now, that requires a lot of privilege. Not every user can do that. Again, I'm the root user, so I have kind of exponential privilege in the system. But if you do that, you must do any tracing. If you do this, you don't lose tracing because the username and the lease ID are available in an audit log, which is stored separately. Typically, you put that into something like Splunker, some third-party system. So you can still correlate with the logs. How many people here run their own certificate authority? No? You don't like to self-deprecate? So one of the cool features about Vault with these dynamic secrets, and one of the challenges with microservices, especially a lot of them, is you either need some kind of service mesh with something like Istio and Envoy to manage mutual authentication and authorization in the cluster, or you have to manage your own PKI infrastructure. And Vault actually makes that second one easier. So for customers that can't adopt tools like that or aren't ready to make the step to a service mesh, your own internal PKI infrastructure is very helpful. So here what I'm doing is I'm generating a root certificate. I could give Vault my own certificate if I wanted. And then I'm generating a role called my website, where I can actually generate TLS certificates on the fly. So if you're not familiar with PKI infrastructure, don't worry about the curl distribution points and stuff. All you need to know is this is really hard and often involves lots of stack overflow, copying and pasting, and then eventually someone figures it out and puts it in a text file. So what I'm going to do here is I will configure this, so set up PKI. And now what I can do is I can just generate a certificate on the fly. So what I did here is I asked Vault to issue me a certificate for example.com. And that was authorized and authenticated. So I got back the certificate. I get back the public CA chain and the private certificate as well. So there's the issuing CA. And here's my private key. And again, all of this is happening via an API. So there are tools out there that actually do this entirely in memory. So web servers that query Vault for their TLS certificate and only store it in memory. So even if the system is compromised, someone would have to trigger a core dump to get the private key out of these web servers. And again, this is an API under the hood. So you can automate this in any language you'd like. Again, every time I run this command, I'll get a new certificate. And I can revoke the certificates early. So this certificate I think is valid for 30 days. But if all of a sudden I detect an intrusion, I don't trust my application anymore, I can revoke it early, and it can no longer talk within my systems because I'm using mutual TLS, for example. This next one's kind of fun, but it has a real use case. So how many people know what TOTP is? So TOTP is the generic algorithm for one-time passwords or passphrases, multi-factor authentication. Those six or eight-digit codes you get with Google Authenticator or AFI, it's a spec. Vault can actually act as a TOTP per flyer and a TOTP reader. So what's a good use case for this? Remember, everything in Vault is authenticated and logged. And the challenge with multi-factor authentication on something like a AWS root account is that it belongs to a phone or a device. So if you run an operations team, how do you get multiple people access to that MFA code? Do you pass around an RSA secure ID token to people who are on call? Vault is actually a really good solution for that. So you actually store the generation in Vault and then you authorize and authenticate that. And you can write Vault policies against third-party systems. So you can actually say people can only generate the TOTP code if they're on call and link that into something like pager-duty. This means that even if you're in the operations group, you can't actually log into the AWS root account unless you're currently ENOC. So I'll go ahead and show you this. I just have a sample one here. And now what I can do is I can read TOTP code demo and I get back my six-digit code. So you're used to scanning those barcodes. Those barcodes actually correspond to a URL. And you can do that here. After about 30 seconds, this code will rotate and I'll get a new code. So this is the same as like Google Authenticator or Authy or OnePassword doing the cycling. But it's authenticated and audited. If I don't have permission to read this TOTP code, I get permission to die. Vault can also act as a TOTP provider. So if you have an application and you want to add two-factor authentication to your application, you can either implement the entire TOTP spec yourself and hope you get it right, including recovery codes and backups and falling over to SMS. Or you can use something like TOTP as a service. This goes back to kind of Vault's core mantra of security shouldn't be this hard. We're going to give it to you as an API and do the best practices for you. So instead of acting as the thing that generates codes, Vault can actually act as the thing that validates codes, which is a TOTP provider. So I'll show you how that works. Set up TOTP provider. So here I'm generating, I use the generate equals true keyword, but it's the same, what we call a back end or the same generator.  This is kind of fun. This first block of text is a barcode. This is a base 64 encoded image of a barcode that you could have your user scan with their mobile application. The second one is the actual OTP off URL, which is encoded in this barcode. So I will attempt to remember the command to do this. So I'm going to copy this to my clipboard. I think it's base 64 dash dash to code, that long string of things, and we'll save that as pure G5. All right, and then we'll open this guy. And it popped up on the other screen, but I promise it's real. Oh, I'm full screen, dang it. There you go. So you can scan this with your app and it'll generate codes, and then you can submit those codes to Vault and Vault will validate them. So again, it's not hard if you follow the TOT spectrum to build this yourself. But the idea is, and Vault's kind of mantra is, if we want teams to do security, and we want teams to do security, well, we have to make it easy. And there's nothing easier than an API that does the best practices for you. So the last thing I want to show you about Vault is it's pluggable nature. So in addition to all of the built-in things, there might be something in Vault that I need to customize. I might run some custom fork of MySQL that doesn't integrate, or I might have some crazy engine that I want to integrate with myself. And I can do that with plugins. And Vault has this really verbose plugin interface with a way to trust cryptographically secure plugins. So I'm going to go ahead and install a plugin here that I wrote. What this plugin does is it allows me to generate random passwords or passphrases. This is really useful if you've ever used something like one password or last pass, where you can generate logins for websites. But I want something that's cryptographically secure, truly random, and I might want to be able to use the Diceware algorithm so that I can generate dictionary or human-readable things. And I want to do things like include symbols or include letters and numbers. This isn't something that's included with Vault. By default, this is the third-party plugin, but I just imported it. So let's say I want a password. I can ask Vault to generate me a password. Gen, in this case, actually maps to a plugin, which I just installed. So Vault generated me a password. I think it's 64 characters in length. It includes letters, numbers, and symbols. This is great.  And it would work great. But there are websites out there that suck, right? How many people have ever put a password in, and it's like, no, you can't be more than 12 characters, and all the letters must be five. It happens. And for those cases, you can customize that. So I might want to say the length is 36 characters, because that's an arbitrary limit that someone imposed. And there can be up to 10 digits, but we can't do symbols. So this will give me a 36-character string, which is compliant with the specification. And just like the other credentials we saw, every time I run this command, I'll get a new password. This is cool. Again, this isn't something that's bundled with Vault. This is something that I built in an afternoon to show as a demo. But I also use it for generating passwords. It also generates passphrases. So you might have seen these before. This is part of an algorithm called Diceware. Short and trench monogamy expert polygraph ramble. So this will generate six random words and put them together. This is actually the horse staple battery, something, the XKCD, right? It's actually cryptographically more secure than the other passwords I showed you. But this is way easier to type, especially when it's like Netflix on your Apple TV, and you're scrolling to try to type in all these weird characters. Again, just like the other one, we can customize the number of words. So I can say words equals three. Now I've got three words, and I can customize the separator that exists between them. This one's actually just really fun to play with. Sometimes you get some really weird things. Like the treadmill greedy snooze sandstorm showman pregnant. I like to make up stories about them. If you are into crypto, though, totally unrelated to this talk, I would encourage you to look up the Diceware algorithm. It's really cool, dictionary-based attack. The problem is the computers are really bad at random number generation. So what the Diceware algorithm does is you roll a die, so you generate a number between zero or between one and six. And you do that five or six times. And then that corresponds, like you truncate those digits together, like one, three, four, two, six. That corresponds to the 12,476th entry in a dictionary, which becomes one of those words.  That's that. I'm going to go back to my last two slides. So if you're curious about any of this, but you're like, I need a place to do this, Google Cloud is giving you $3,000 in this check on a slide that you should take a picture of. 10-10, so you should take a picture of this slide. So if you work for a startup that's qualified, you can visit this URL down here or just email a cloud startup to google.com. $3,000 in cloud credit. You can play with Vault all you want, as well as a ton of other features of Google Cloud. There's no reason you shouldn't do it. I will wait for more pictures to be taken. You can also just write down this thing. That's the important part. But this is a pretty slide, so you should take a picture of it. All right, cool. That's all I have for you. Thank you very much. Again, my name is Seth. You can follow me on Twitter. And I'll be here the rest of the conference. Any questions still before Seth? All right, do you want to try or do you want to try? Do you know of anybody using Vault for managing SSH secrets? Yes, so there's a number of what we call secrets engines, which I didn't discuss. There's about 12 of them. SSH is one of them. So Vault can actually act as the thing that sits in the middle. So you install a Vault agent or a Vault helper on the system, and whenever you try to authenticate, your authentication actually goes to Vault. Vault generates a dynamic credential, dynamic SSH key, and locks you in. It's also possible to do that via trusted CA certificates, where you have open SSH trust Vault CA, and then Vault will sign that CA chain. I have a chart that shows how that works. There are a number of people doing it. My problem with that is that if you're truly trying to do security well, no one should access a system after it's online, especially via SSH. So if there's a reason that an operator needs to touch a system like that, that's, in my opinion, a fault of logging, monitoring. We should be able to egress that data through third party systems. There's no reason an operator should have to touch that system. If, in fact, that does happen, though, that system should immediately be taken offline. So if I'm an operator and I need to debug an issue, and I do use something like Vault SSH to access that system, that system should be removed from production immediately upon debugging so that it wasn't tainted, because we can no longer trust it. Just a simple question about the concept you shared around using Vault to issue passwords to the application to connect to the database, and short-lived username and passwords. How do you handle that expiry and rotation of that? Yeah, so the question is, if I have these dynamic credentials, what happens when they expire? That's application dependent, and there's a few strategies. So if you're building a cloud-native application, it likely responds to some type of signal to reload, right? SIG hub or a graceful restart or a hot reloaded configuration. In those situations, you can use what we call sidecar applications that end console and console template that will present the credentials that Vault has as environment variables or a file on disk. And when those credentials change or are about to change, you signal the application to reload as configuration. In the case of a non-cloud-native application, like a Java app that takes four years to boot, typically it's hard. Typically what we see in those scenarios is we adopt Vault for the green-filled applications that can be cloud-native and can adapt to these highly elastic environments. And then for the Java app, we just create a credential that's valid for a year. We still do it in Vault so we can revoke it early. But it's still a manual process until someone can update that application or we can deprecate it. Thanks. I previously used these UB keys. Does Vault have any native support or plug-in support for UB keys? So kind of. So I used to work in HashiCorp. There was, I was in play number four in HashiCorp. So I was there quite a while. Yes and no. So the open source version of Vault does not have support for things like HSMs, which is a derivative of what you're talking about, like a UB key. That's part of the enterprise play. So customers that want hardware-generated entropy can actually connect Vault to an HSM, which could be a UB key or it could be some kind of appliance that generates entropy. And that's a paid product. So it's not available in the open source, but it is a feature that exists. OK. Yeah, we're good. Cool. So that's it. Thanks very much. Thank you. So great. I think we've covered a lot here. Quick announcement that we're going to have a group photo, this year's group photo, today at 12.15. And so if I can just ask everybody to go down to level one and to the exhibition area. So we're just rounding up outside there on the exhibition area. OK, thanks a lot. Thanks.


Today, we have Chris Paul from Hercules Silver, and your investor talk today was fantastic. David Morgan, all of us were sitting on the edge of our seat because we're interested in what you're up to. How about you give the investor intel audience a bit of those high points? Yeah, sounds good, Tracy. It certainly has been a while, as in since we last talked. I think it might have been early in the summer before we really got going with the exploration, and yeah, I can tell you there's been a tremendous amount of things that have happened at the Hercules since we last spoke. So, I mean, obviously 2022 was a pretty crappy market for the juniors and for everyone. So, you know what, we said we're just going to put our heads down. We've got lots of money in the bank and we're just going to do good exploration. You know, as we've always kind of discussed, we've always felt that there's a big system present at the Hercules. And so we got out there and, you know, we did the work, we did the soils, we did the chip sampling, we did the geophysics, we did the mapping and, you know, we put that all out to the market and I think we've really proved that there is a huge system here. So, you know, we've got those drill results pending now. We're expecting those any day now. And, you know, we're going to have our phase two drilling out pretty soon. Our phase two drill plan announced pretty soon. So, you know, lots of lots of good stuff to count. OK, so you were discussing the mineralization results that just came out in the last week. Do you want to talk about some of those highlights? Yeah, absolutely. So we kind of started with that, you know, started the summer, started the season, you know, we did the soil sampling, you know, we kind of expanded the land package. We did a bunch of regional work and it turns out that that historical resource, which is, you know, which is a really great starting point, but it only represents maybe 3% of the total mineralized footprint that we're sitting on. And so, you know, as great as these soil samples are, we wanted to get out there. We wanted to get some actual rock in the bag.  So, you know, when you're dealing with an area where there's very little low crop exposure, so all the old timers, you know, they couldn't find this stuff because it wasn't sticking out of the ground. But we've got these modern tools and we basically use those modern tools like the LiDAR. We could map out where all these little hidden outcrops were and we went to each one and we sampled them and the results came back. We put that out last week and they were tremendous. I mean, we've got, you know, copper in our copper target, grading up to 21%.  It's consistent. It's over, you know, three and a half kilometers of strike length. And, you know, we're seeing all these little high-grade mineralized shoots all through it. So, you know, obviously really pleased with the results. And it's my understanding you're going to be at PDAC this year. You've got a booth. We will be at PDAC this year and we will have a booth. Obviously, we're a new company. So, you know, if we've just got all the new materials on order, I'm going to be there, you know, going to have a few people alongside there with me. It's going to be fun. It's going to be exciting. And I think maybe you and I are going to do an interview as well. Well, not only are you and I going to do an interview, but of course, we're going to have Chris Thompson there who loves, absolutely loves silver. And I don't know if we should add this into our discussion, but I hear you drop antimony as well in the list. We do. We do. Yeah, it's there's a few critical elements kicking around. Not that silver itself isn't probably the most critical element, at least in my biased opinion. You know, if you think of all the solar panels that everyone wants to build and the most critical component of the solar panel, of course, you get the copper and you've got everything else. So I think, you know, we're in a good jurisdiction place that wants critical metals and, you know, maybe maybe I might even bring some of these high grade samples with antimony and copper and silver to the show. Maybe that's a good idea. Show off some of these rocks. Well, individuals that are attending PDAC love samples. So I would encourage you to do that. Chris, thank you so much for joining us today. And please join us more often. We're delighted to see you. Absolutely, Tracy. We need to do this more often for sure. Thanks again.


It's Diddy came back today with another spark video huge house everybody to name watch subscribe me just made a scribe But give me a thumbs up and do not skip those ads and it's June 26th. It's time. I'll get to this bag Yes, yes one today, baby. I almost fell in somebody's breezeway I Almost fell somebody breezeway. I was dropping stuff today was a crazy day We came and got it done and we got done early So you guys want to make sure you do to the full video also if you want about something much All you can do is email me at rosehouseofusiajima.com and let me know what you're trying to do my flow sick like the flu I hope you guys enjoy the video make sure you smash the subscribe one make sure you give me a thumbs up and do not skip those ads They're about to see us get to this bag. Let's go What my tour is 4.8 miles for 25 59 wait stop until we shine or number two is all What my tour is 4.6 miles for 25 77. Thank God for our blesses. Let's go So this is Sherry, I'll probably put Sherry in the back and I'll put the other one okay Doing this morning y'all been busy Alright, this is my first order, so hopefully see it goes well. Hope you guys will be seeing me a lot today Now I'll be done fast. Are you guys have a good one? We are here to jump up order number one it's time to get it done this breeze is feeling so good, baby Today today is a nice day outside.  That's what I'm talking about. Just like when I move you just like that This one says we need to bring it and put it in the breeze away So I'm gonna put this one in the joint in the breeze way We'll keep on going in this breeze to get this cheese Go push it in Jump like it's hot right here I remember I couldn't do this house before they had a dog So I'm gonna Drop that right there Just in case you wanna come on here and get busy I'm gonna move on and switch Told y'all they had a dog Steve Don't get me doggie doggie Oh steps out We failed Order number two y'all know we about to do about to get busy I hope you guys are with me about to move kind of shitty Look comment below and let me know if you almost feel it delivering anything before Almost bust my stuff at these people house I already got a doggy door right here I gotta be careful They might try to take me up top They might try to run up there and take me up top and bite your leg Stuff like it's hot They got not that much They got some pizza, some ice cream They about to eat good food They got some zebra cakes Stuff like it's hot Comment below and let me know what your favorite did Ms. Debbie Kate hit them photos Order three and four I remember when we was po All the way One more two orders 4.7 miles for 22.53 We about to get that cheese Order number four is all the way One more two orders 7.1 miles for 26.93 We ain't stopping until we achieve the goal Cause we on the road and my pockets on the floor Let's go Nicole the big y'all put that in the trunk I know it's a whole bunch of eggs and stuff in there right There's a lot of yeah There's a lot of chill So Nicole So y'all could put Nicole in the trunk And I'll put Joe in the back seat No take the No, no, no, no, no, no Take these out put the eggs in here Cause I don't want it to be too heavy I'm gonna carry these I can carry more of them at a time Than the milk Just took them out I thought it was a lot of eggs ain't it Yeah, you just sit it off to the side That's all right I appreciate it That was so much stuff I need a sticker Which one was it All right appreciate it you guys have a good one Order number one it's time to get it done Guess what guys this is the same place we went to Where they left all that stuff out there Hopefully somebody comes to the door So we can scroll they got a whole bunch of eggs They got a whole bunch of stuff Eggs, milk, chocolate milk I had to park in the middle of the alley Right here Hello I'm here with your Walmart order Look at all these eggs look at all this stuff baby It's time for us to get busy Honestly I'm glad it's kind of going to a business Versus going to A house because it would have been way harder I got to take these few in first Because usually where I sit I would think I'm going to go back out here and get this It's a bag I got to put the Bag in To get these bags on the stand They were trying to put A whole bunch of milks and drinks In this bag I was like no no no Let me stop right there I got to be watching these Walmart workers because they had just put things anywhere I just think that you should put things that make sense Where they should go I don't know That's just me So I'm going to grab these two Up here If I can get it Then I'm going to grab these three These two milks And orange just Okay I don't know about that We're going to get these bags on the stand Drop it like it's hot Drop it like it's hot I'm going to get these eggs I'm upside down now guys Keep on doing that Put these eggs right here Bop I'm just being clumsy they almost fell What's going on?  I like living here It seems It's your second home, huh? Hopefully they can give you some free rent Right here And that one should pop up on yours this time Yeah, they've been popping up this morning Okay So I got a check item Third check We got to check three things I'm supposed to pick anything in particular Come on Then they move the thing around so you can't scan it, right? Two Ah, you have a good day This is not clever Okay It never lines up right, huh? Try again Oh, really? Yup That's what it said We have to try again or no Thank you very much Susan Have it been super busy over here for you guys? What's that? Has it been super busy over here? Oh, not yet It's starting to get a little loud We are here baby, look at this house Look how big it is This joint look like a castle And it got the pool in the back Beautiful The yard is huge baby This joint is very, very nice It's levels to life baby They are in there Shoo Whoo This joint doesn't care Great baby In the driveway, look how high it is It's very nice here I'm going to paint this porch red You know that's my favorite color Then they got to wrap it around the porch I'm going to move this kind of shit You know what I'm going to do This order was actually pretty decent I'm not going to lie I can't complain about it at all Luckily we didn't have to go back to get their watermelons Because they didn't add a substitute So this is what it is baby Drop it inside Those are two glass ones So I got to go through it carefully I've already been dropping stuff all day today Step back Put it in the photo Let's Both of these is going to an apartment baby Beat the way it go Keep on doing our thing We got to get this changed and let's go We are here to drop off order number one It's time to get it done baby This says text them so they know we're here And then they're going to come to the patio We're going to hand it to them to the patio Save us a lot of tricks Game over no flip Oh there you are It's going great how's it going for you It was a beautiful day Now it's going to get warm again It didn't take long It's going to get the same Yeah Hey doggie Alrighty thank you so I appreciate it Really? It's going to be in the 90s? Oh my god I think it was like two days ago I looked down at the thing It said it was 99 degrees That's the thing That's that And then we need a signature Thank you very much So you enjoy you have a good one Just like that we are here to drop off order number two baby It's time to get busy I hope you guys are with me this is on the first floor So it shouldn't be that bad We got to go to one on one baby So when the thing open we can get it We can get busy I don't know which one is one on one So we're going to join again Give it in here at the first floor There you go They got a pocket Get it down baby How you doing? Have you want me to talk a brand new door on your cat? No that would be great if you could right here I would love it I don't want the cat so I would have to take the cat down Down in the kitchen Stay in there That's for you Thank you so much for doing that You're welcome How you doing this morning? Running around like a chicken with my head cut off I know sometimes it happens you wake up and you say Oh my god you just had a lot of stuff to do Yeah exactly Hey kitty kitties those are beautiful cats Thank you This is everything You have a great day you too And just like that it is the end of the video I hope you guys enjoyed the content Today we made two ten forty five It's a great time to be alive So as a winner we can have you got an end baby Also if you want to buy some merch Or you got dudes email me at www.rohsaucevnz.com And let me know what you're trying to do Guess what time we got done today Comment below and let me know I'm gonna tell you right now We got done at eleven oh seven Eleven oh seven Eleven oh seven I hope you guys enjoyed the video Make sure you like it tomorrow if it's going back down where you're playing around Twenty two is bad season We gonna keep on giving them the reason They ain't grating I'll see you guys tomorrow because guess what We skating I'll see you guys on the next one We going floor you already know the DDK And I'm on my way


And he said, you know, this off season, I had to contemplate a lot of things, whether it was retirement, a different team. And now he's here, he said, first day was actually a little bit awkward, he said. But you know, when I'm here, I'm 100% I'm all the way back.  That's nice to hear out of Aaron, the I love practicing, it never gets talked about.


Ports of Call! On blue horizons far at the world's end, strange fascinating lands back in us, bid us revel in their exotic splendors. Come with us as we head for Ports of Call. Cruising along the west coast of Great Ritten, where gusty winds from the North Atlantic roughen the sea, we enter Bristol Channel and steam up the broad Severn River toward Cardiff, largest port of the ancient and storied land of Wales. Smoothly we approach our birth in the great busy harbor, built by the Marquis of Butte, to handle the enormous shipments of coal from the Welsh mines. Have you all been caught ready, please? Have you all been caught ready, please? Got your camera, Catherine? Yes, indeed. Think I'm going to miss photographing a druid if I see one? A druid? What do you mean, Kate? Don't tell me you don't know Wales is where the druids held their mystic ceremonies? Why, they were the ones who invented the significance of the mistletoe. Good for them! And I've heard that not far from Cardiff is an ancient druid ceremonial ground with great stones. Nobody knows how old. There might be druid spirits there. Well, you took in hunt druid spooks, if you like, but I'm all to see the room in ruins before we take the train to Carnarvon. Oh, wait, Larry! We're coming! Carnarvon is now only a village clustering about Carnarvon Castle, whose grim exterior gives no hint of the ruined walls and courtyards within. But Carnarvon is the heart of the picturesque and glorious history of early Wales. The nearby mountains of Snowden have seen the battle flags and banners of every noble house in early England, tossing in the pale Welsh sunlight, flapping in the blustering winds from the coast. Wales, home of the earliest Celtic people, old before Roman galleys landed their conquering legions, old when King Arthur's knights set out to seek the Holy Grail. It is the year 1284. In this hostile land, Edward I of England has built Carnarvon Castle, and with his wife Eleanor has lived for three years in the midst of battle with the fiercely fighting barons of Wales. Scorning England's rule, they defy the king. But at last, they are defeated. In the Queen's chamber, Eleanor is pleading with her husband. Now that you have defeated the baron, let us return to England.  Oh, hear me out, Edward. Already because of this miserable land, we have lost our eldest son. Now that God has sent us another to take his place, let us go back to London before he sickens and dies. It couldn't have been the air of Wales that caused Henry's death. You've seen for yourself the people who live here are like men of iron. They are barbarians. They do not mind the cruel winds of this sea coast. I know if we had been in London, Henry would not have died.  Because I must make sure these Welsh barons understand that they must swear allegiance to England. But I will promise you this. If all goes well at this audience today, as I believe it will, we will go back to England. Llewelyn understands his power is broken. Many of the barons are glad to make an end of the fighting. I wish the time would come when I might not be pleased. As long as there are lands to be divided, men will fight. You may enter. Your Majesty, the barons are gathered in the Great Hall. Good. When the audience is over, you will let me know. Yes, at once. You will remember what I told you, Martin, and carry it out exactly. Yes, Your Majesty. You may open the door. His Majesty the King. Well, my lords and gentlemen, so you have come to sue for peace. We have come to discuss terms, not to sue for peace. The terms are mine, Llewelyn. And since you have been the one to rouse the barons against England, you shall surrender all the eastern portion of your lands in the marches, and all your holdings near Carnarvon save only the castle in which you live. In addition, every year at midsummer, you shall journey to London. And presenting yourself to the sovereign at the tower shall swear allegiance to the crown. I'll not be so humanly. Your doing is no good with your rage, Llewelyn. Let me speak. Speak, then, Baron Roberts, and remember, I am muster here. I will remind Your Majesty that the Welsh barons have been doing battle with the English since 1062, and many times have been victorious. Now, for the present, we are forced to yield. But if Your Majesty does not make concessions to us, you will never know peace in Wales. Our sons will furnish another army of men, and their sons as long as one is left alive. I am willing to hear what concessions you ask. We demand that Wales be kept separate from England. We agree that to ensure peace, there must be one feudal lord set over us. But he must be Welsh. This is your sole demand? At this moment of defeat, Your Majesty knows we cannot ask for more. Then you pledge your word that if I agree to this condition, there will be peace between England and Wales? We pledge our word. It is well. And because my spies have brought me word of disagreement among you, I have already chosen for you a feudal lord. We will not submit to an Englishman. You need not fear. Not only was this lord born in Wales, but he cannot speak so much as one word of English. Who is he? A moment, my lords. Martin, bring him in. Yes, born not only in Wales, but in this very castle. Did I not say he could not speak a word of English? Barons of Wales. Dear Lord, my son Edward. Here and now I dub him Prince of Wales. And so was created the title, which since that day is born by the eldest son of the English sovereign. But the proud Welsh nobles did not long remain at peace with England. The lords of the marches, those border estates between England and Wales, resented English domination. Again and again fierce fighting broke out. Edward died. His son, the first Prince of Wales, became Edward II. In the year 1324, the Welsh are defeated. Their leader, Roger Mortimer, Earl of March, is taken prisoner, ordered to the tower of London under sentence of death. It is night. Within the cold, grim walls of the tower, the young Earl paces the floor of his dungeon. Oh, Talbot. Oh, your grace. You ought to be hanged in the morning. Oh, that's not news. The warrant was read to me an hour ago, while you were at your supper. Don't look so downcast. You must have seen many men in this predicament. There are not many men like your grace. It grieves me to the heart. Nonsense. We all have to face it sooner or later.   Surely there was something I could do for your grace. You mean that? Yes, but I... Will you spend the evening with me? Gladly, your grace. Spend it. Here. Take these three gold pieces. Send for the finest wine in London. You and I will drink together. What better way could a man spend his last night on earth? Oh, your grace, the priest... I am enough for the priests in the morning. They often bring the wine. Yes, your grace. Close the door and be gone. There's not too much time, you know. On's blood, what are you staring at? The Queen Isabel herself is coming down this corridor. Your majesty. I have come to see the Earl of Mount. Admit me to his self. Yes, your majesty. You may lock the door. I warn you, you will be a reporter to the King if you listen to my conversation with his grace. Oh, your majesty, I will not listen. Oh, Roger, my love. Isabel, it was madness to come here tonight. Do not reproach me, Roger. There is so little time. Say you love me. You know I've loved you since the moment you and his majesty crossed my threshold on your first visit to Wales. But you would never have told me so if I had not thrown myself at your head. I tried to remember you as a wife of the King. But my love was greater than my honor. To mention honor in the same breath with Edward is to defile the word. Oh, I can no longer endure him. I am going back to France. But you are the queen of England. What an empty word. I am miserable here. My only son is thought to hate me. My darling. Besides, when you die, Roger, I have nothing to live for. Oh, Roger. My love, I'm not going to die. I'm going to cheat that gallows tomorrow. Roger, then you knew... I only knew I would not endure death on the gallows of the command of an English king. I have planned to escape tonight. Oh, Roger. Oh, I am so glad. I came here tonight to bring you a drug. I hoping you would take it rather than suffer hanging. No, Isabelle. Splendid. Now I shall not fail. But how would you plan to escape? I sent my jailer out for wine. And I meant to stupefy him with drink. At the end of the corridor is another jailer whom I bribed to exchange clothes with me. And let me bind them as if I had taken him by surprise and stolen his keys. Roger, it is dangerous. I have nothing to lose but my life. And that's a forfeit to the crown tomorrow. Give me the drug. I'll put enough of it in the wine so Talbot will sleep soundly. Where is it? I have it here. Three tablets. Oh, I could not bear to think of the noose about your neck. Now you did not. Quick, give me the tablets.  One tablet in the wine and the trick is done. But you must go now, my darling. But we will meet again. The king was Satan himself who could not keep us apart. I have it. I too will make my way to France. Oh, yes. I will go to my father's house outside of Pallieu. Come to me there. I swear I'll come to you the moment I set foot upon the soil of France. Elizabeth, all these two months have been endless. You know, I have been tortured by the fear that you might have been captured. I had no way to let you know. I feared to write from England. Now that's ended and we're together again. We shall be as happy as the day is long. No, Roger. No. What is it? I was mad to think I could escape being queen of England simply by crossing the Channel to France. My poor darling. What has happened? My father refuses to shelter me longer. He thinks it might provoke a war with England. So I must go. I have nowhere to go. Besides... What? Oh, there is still more. I've forgotten how wicked the tongues of men and women could be. Everywhere we have heard about my love for you and of yours for me, Roger. I am scorned by women who once formed at my feet. My darling, if my love brings you nothing but suffering, we must part. If you return to England now, we will silence their gossiping tongues. Oh, no. Return to the cruelty of life with Edward. I could not. I have a friend in Flanders. The baron Griffith of Denby. He has a price on his head. Oh, yes, I remember him. Yes, that's it. He and his wife will gladly make you welcome. His wife may disapprove of me too. Disapprove? Not Negan. Besides, once she sees you, she'll love you as much as I do. Call your maid and pack your clothes. Call for Flanders! In Flanders, with the Earl and Countess of Denby, Roger Mortimer and Isabel live three years of idyllic romance. Then one day, Roger returns from the hunt to find Isabel eagerly awaiting him. Roger, I have a letter from my son. Is that all courier from Paris on the road? Yes. The letter went first to my father's house there. My son begs me to return to England. Does he say why? No. Perhaps he feared the letter might be opened in red. Perhaps his father's harshness has become unbearable. Oh, Roger, how I shall miss you. You're going then? It is the first time my son has ever asked anything of me. But you could never face Edward's court. Come with me to Wales. But you will be killed! No, no. I didn't tell you the courier brought Denby and me despatches from Wales. Peace has been signed. We are free to go back home. Roger, then we need not say goodbye. How could you think I'd let you go alone? Come to Wigmore Castle with me, you and the boy. There you can be alone with him, away from his father. How understanding you are. Roger, perhaps we shall never be so happy again. These three years have been like heaven. If Flanders seems like heaven, think how happy we'll be in Wales. Flanders, England or Wales, I love you with all my heart. And I, you, my darling. Well, Lord, what is it? Your grace, a great part of your horseman is at the gate. How many men? I should say a hundred, your grace. It must be the boy in the zest court. Oh, yes, it must be. Station minutes alms at the Fort Cullis. Admit the prince at once. Yes, your grace. Oh, I wonder what he will be like. My son. His Majesty the King. Edward. Yes, it is Edward, the Prince of Wales. No, no longer Prince of Wales, but Edward III, as well you know. What? Edward, my son, your father is dead? My father was killed, and Roger Mortimer is his murderer. No, no, he has not been in Wales for three years. He has been in Flanders, I swear. He was in Flanders when your letter came. My father badly write that letter hoping it would bring you, and with you, Roger Mortimer. But no sooner did he set foot on English soil than his hired assassins killed the king. Captain of the guard. Edward, what are you going to do? I will send Mortimer back to the tower, and this time he shall not escape. Oh, yes. Your Highness, I mean your Majesty, it is true I had no cause to honor Edward II, but I swear I did not take his life. Edward, my son, you cannot send the Earl of Mouth to his death for this crime. I am the king, and I mean to have his life if only my father could have lived to see this day. No, my son, no. Take him away. Swiftly the years sweep over the forested mountains and turbulent rivers of Wales. In the reign of Henry VII, how little Wales is at last forced to bow to England, and peace comes to the troubled land. Industries develop, great coal mines and slate quarries, honeycomb the earth, but the fiery wealth shall quick to resent what they consider tyranny. Late in the 19th century, the wrongs of the poor find an advocate in the brilliant and hot-headed young solicitor David Lloyd George. Farmers, shopkeepers, workmen find him eager to fight for them in the courts. One evening in the year 1888. Come in. Oh, come in, Margaret. What brings you here so late? I was obliged to wait until I'd finished my work. Is it too late to ask your advice, Mr. George? Not at all. Sit down. Now what is it? It's about my father. Oh, I know him. He works in the quarries, doesn't he? He did. He died yesterday. Oh, I'm sorry. What do you want me to do? You see, he wanted to be buried by the side of my sister in the Church of England graveyard. Of course. But he wasn't a member, and so they refused to allow it. What? They say if he's buried there at all, it will have to be over in the far corner among the suicides. Hey, that's an outrage. Oh, is there anything you can do, Mr. George? Oh, of course there is. Don't submit to this decision. You have the legal right to bury your father besides your sister. If you're refused, but they locked the churchyard gates. Oh, then we'll break them down. Scandalized, the church authority sued the girl. Lloyd George Defensor loses the case, appeals to the Lord Chief Justice of England. I find the county court judge was wrong. And that Mr. David Lloyd George was right on the point of law in connection with which he was overruled. The body of Mr. Snowden will remain the Church of England graveyard. The Church of England Like a flame, the name of Lloyd George blazes over Wales. Curiously, he challenges outworn customs and laws. Political fixtures go down to defeat before his trenchant tongue. Then in 1890, he stands for Parliament. Instantly, his enemies set up on him, try to turn the people against him. Break of his meeting, sneer at him as a demagogue. The ballots are counted. Lloyd George wins his seat by 18 votes. Save it, Lloyd George! Ten crowded years. His wealth splurged quick to Kenville. Lloyd George smashes at obstacles to his cherished dream, the improvement of the lives of the poor. 1899, England declares war against the boars of South Africa. In the House of Commons, Lloyd George is finishing a fiery speech. I outrage that the thought that a great people like the British nation should attempt to crush a tiny pastoral race. I urge you not to commit our country to this deed of violence against the struggling people. No! But such was his hold on the hearts of the Welsh people, that even in the heat of the war frenzy that swept Great Britain, Lloyd George was returned to Parliament. 1906. Extra! Extra! 1908. Extra! Extra! Extra! Extra! 1909. Before the crowded House of Commons, David Lloyd George presents his first budget. Proposes increased income taxes. New royalties. Unemployment insurance. Old age pension. I cannot help believing that we have advanced a step toward that good time when poverty and human degradation will be as remote from the people of this country as the wolves which once infested its forests. No! Oh, no, worse of times. You can't possibly understand the feelings of a gentleman who never went away shop star. The House of Commons passes the budget bill. But Lloyd George sees it killed by the House of Lords. That night in the Prime Minister's study at 10 Downing Street, he sits with Mr. Asquith. We can't expect the Lords to sign their own death warrant. Lloyd George? No, I agree. And yet it has to be legal. I can see you have a plan. I have. And this is it. The price in the history of England, the Prime Minister, has called upon the sovereign to create enough new peers to pass certain legislation. Good Lord, we should need something like 500. I know we should. Are you willing to go to the King? Perfectly willing. Splendid. And I'll drop a hint that will reach the ear of the House of Lords. Asquith consults Edward VII, nominates his army of new peers. The budget bill is again presented. Grudgingly, it is passed. The ancient power of the House of Lords is broken by the Chancellor from Wales. Once again, war. December 1914, Lloyd George speaks to the other members of the cabinet. Do you realize that for five months our army has been fighting a retreat? Do you know they are being overwhelmed by the war? Do you know they are being overwhelmed by gunfire, infinitely superior to ours? We need more shells. I say we are making shells. We need a million times as many. I know Lloyd George is right. I suggest the formation of the Ministry of Munitions, which he will head. Lloyd George takes up his post as Minister of Munitions, organizes manufacturers, trains new workmen, enlists hundreds of thousands of women, organizes departments of labor, enrolls iron and steel experts. The shells and munitions pour out in an enormous stream. June 1916, Lord Kitchener, Minister of War is killed. Lloyd George is appointed to the office. December 4th, 1916, Asquith designs. Lloyd George becomes Prime Minister of England. In his first statement to the cabinet, he says, There are too many men in command of the Allies. We shall never win this war until we place our armies under unified command. Time after time, the military command refuses Lloyd George's suggestion. October 24th, 1917, Lloyd George calls on the Allied commanders in France, just as disastrous news reaches them. Austrians and Germans under Bonsulot have defeated Italy for the loss of 300,000 men and 2,000 guns. If we had had a unified command, this would not have happened. Even yet, it may save the day. Send an army of English and French through the Montenegro tunnel to northern Italy. The commanders agree. General Puma with his army arrived just in time to save Italy from being captured by the Germans. Two months go by. Russia collapses. Two million German soldiers are transferred to the western front. Nothing but unified command can save us now. May 1918, the Allies finally accept Lloyd George's demand for unity. Place General Fosch in Supreme Command. The war is won. And the Welsh Prime Minister who began life as a village boy in a cottage of a shoemaker becomes one of the Council of Four to determine the future of the world. Once more, our steamer awaits us at the bustling docks of Cardiff, whose clean treeline streets and modern buildings belie the turbulent days of old. But the terror of Norman Castle still frowns over the city. And the harsh wind seems burdened with the echoes of the battle songs of the ancient Bards. The stirring choruses of the Welsh esthetically. Music born at age-old conflict, yet today attuned in loyalty to the mother empire of which Wales is an integral part. We're homeward bound once more from another journey to Port Subcalled. We invite you to join us again next week at this time as we journey to another of the world's fascinating Port Subcalled.


Live from Vancouver, Canada, it's the Cube at OpenStack Summit Vancouver 2015. Brought to you by headline sponsors EMC and jointly by Red Hat and Cisco with additional sponsorship by Brocade and HP. And now your hosts, John Furrier and Stu Miniman. Okay, welcome back everyone. We are live here in Vancouver, British Columbia for Silicon Angles theCUBE, our flagship program. We go out to the events and extract the signal noise. We're live at the OpenStack Summit, extracting all the data, sharing that with you. I'm John Furrier with my co-host Stu Miniman and our next guest is Timmy SVP of Infrastructure Business at Red Hat. He runs all development, essentially, one of the head honchos. Welcome back to the Cube, great to see you. Thanks for having me back guys, good to see you too. You get Red Hat Summit coming up in Boston this year, not San Francisco, so on the left coast. A lot of action happening. We're here at OpenStack. What's the development action? I mean, Red Hat's used to great support big customers. OpenStack's developing very, very fast. Absolutely. And it's on a path to maturity, not yet truly mature yet. What's happening? How are you guys viewing the market and the relationships you're building? Well, I think the first thing is we do agree with the point of view that it's maturing rapidly. Even as we're driving a lot of innovation, if you look at the next release of OpenStack, you know, a huge set of technologies focused on the telco space with NFE. So the pace of innovation isn't slowing down, but at the same time, I think we see the core getting more stable and supportable and for companies like us, you know, we understand that the community model is always going to be about innovation. So, you know, no one in the upstream is going to build a production quality product. And so we gear everything that we do to taking the innovation as it comes, the more robust the better, but we're going to put it through our products to see regardless for, you know, making that admission critical, because they're moving for customers. How about the quality of the releases? Are you seeing better quality coming out of the releases? Are you happy with it? What's your take on it?  I was giving the tier one position you have in the market, but I mean, this is emerging, but getting better, what's your take on it? Do you get a good vibe on that? So definitely better. And as you've noticed over the last year, so we've extended our support life. So for any given letter release, we're not providing three years of support. So a customer who takes this into production isn't forced to then, again, every six months update, the minute they can stay on for three years and ultimately we'll continue to extend that. And it's very dependent on both our confidence and the robustness of the core and our ability to make it bulletproof and supported. So we're already at three years and we're intending to extend that as we go forward. So definitely getting there. And I think if you just look at the buzz here, you know, the attendance is great. You know, people's confidence is high and you're hearing lots of stories of production customers now. I mean, there's people on the floors. I mean, the sessions, just for the folks watching, I got just to share with you that you're not here. It's packed.   It's like a builder community. A real transition quickly from the thought leadership in the early days to now, you know, engineers are here building. They want more data. Well, I can just, just from, you know, Red Hat, we're, I think we're hosting 44 sessions. And that's sort of as requested. You know, and they're all technical sessions are all how-to kinds of things. So, you know, the people that are here are clearly on an implementation path, which, you know, even if you think back a year ago to Atlanta, there was still a lot of, you know, is it, is it ready for primetime yet? And I think we're through those. And now it's a question of for what use cases, you know, at what scale, the kinds of, the good questions that people should get. Yeah, primetime, no. Basically. Yeah, exactly. It's primetime just started. Right, exactly. So Tim, you know, obviously Red Hat has a huge presence at the show. I've seen lots of Red Hats being handed out, people walking around with them. One of the things you're highlighting at the show is your partnership with Cisco. Can you talk about, you know, why the partnership with Cisco and how you're helping together to help customers modernize their business? Sure, absolutely. Well, you know, Cisco and Red Hat have had a long-standing partnership in the UCS space. And, you know, a year, year and a half ago or so, we started to recognize that we had a joint and shared vision around the evolution of cloud, being open, being hybrid. And we started on a path to collaborate, you know, in CCS with Fias's organization, as well as other parts.  They work with a lot of customers. Frankly, that, you know, we've served as, you know, data center customers, but I think this has together given us the opportunity to help reshape how, you know, telco and networking infrastructure is playing out, leveraging open source, RELL OSP. So we've got a very multifaceted set of activities and the companies have huge numbers of engineers dedicated to building in all these areas and making RELL OSP with inside in Cisco solutions real. Yeah, one of the key things that was talked about this week in the keynote was, you know, interoperability and portability. Maybe talk a little bit about, you know, how Red Hat and Cisco, the solutions you're doing kind of tie into those.  You know, I think that just the very nature of OpenStack is such that you can build cloud native workloads in a very consistent fashion. Cisco, for example, with their intercloud strategy, you know, is consciously trying to create ways to allow clouds and workloads on those clouds to interoperate both those that they're hosting and those that we're jointly partnered with. So we're happy to be working with them, being an enabler for that. But I think in the end, you know, we're going to see these dense fabrics of hybrid clouds, you know, public and private, and we've geared our whole product strategy both directly and with Cisco to ultimately respond to that. Right, how about going up the stack into the application space? How does OpenShift fit into this discussion? Yeah, so great question. And in fact, we made some announcements this week that we can touch on if you like, that sort of allude to this. But, you know, OpenShift is our Paz platform, but you know, I think that actually does it a bit of a disservice because it's really the culmination of all the things that we're doing to enable people to both modernize traditional applications and have them live in a cloud native environment where OpenShift winds up being the pinnacle of that, where it's highly opinionated, but also highly automated. But all of the things that we build OpenShift out of are embodied in our other platform technology. So as you look at OpenShift version three, it will support Docker as a native container format. Kubernetes for orchestration, it's based on our REL Atomic host, which is our specific container footprint for REL. It's all managed by cloud forms, our cloud management platform.  And now we have OpenStack as a way to scale out your OpenShift environments on-prem. So we've built this really nice fluid environment where the choices you're making aren't Paz versus IS, and whatever development models predominate there. It's what services do you want to be? Highly automated, pre-configured, and then just give me a way to manage, build applications across them and manage across them. I like this vision. I want to expand on that a little bit. Because this gets down to what the language of the customer, no one talks infrastructure service, because it's now a service architecture. So you guys have a unique vision. I want you to share that. I know you guys made an announcement, congratulations on that, but I want you to tie it together, because we are living essentially in a service-oriented architecture. Web services now, all that stuff from 10 years ago, is actually on the main stage in production. So what does the service architecture look like? And what does that mean in the language of the customer? No one really cares about platform as a service or softwares. It's all one big cloud rollout. So I want resources. And in fact, the old timers like us look at, you know, microservices, big architectures say, isn't that so? We've seen this before. We've seen this before. Well, and I think that goes to the point, right? So our view is, there are classes of applications that are either stateful, scale-up, database-centric. And most of those still remain very strategic to those customers, right? They just don't lend themselves architecturally to a scale-out, stateless kind of model. And then there are, of course, what we always talk about in terms of cloud-native apps. Those can be also enabled by VMs or someday soon via pure containers. So our view is, you've got classes of workloads that actually don't need to be stove-piped to an infrastructure. So take containers as an ultimate evolution. You can containerize elements of an existing, traditional app to make maybe captive data available by wrapping it and have that be consumable by your cloud-native stateless app. So our view is, VMs versus containers, that's not the discussion. What do the workloads require, both in terms of architectural approach, what things they're trying to consume, and have those live fluidly in that environment? So it's runtime assembly of resources, not so much this platform, and I've got a general purpose, whatever, locked in. That's what people in the industry put things in boxes. But what you're saying is, customers are thinking like a programmer, and they're thinking, okay, I'm assembling resources, and I have to program it, so I'm really talking to services. So, okay, I get that. But I got to ask you, what the hell does microservices mean? We hear that the cloud found you summoned. Is it a buzzword? Is it specific in meaning? Is it just a service of a service? Is it just, I mean, what is a microservice? It's actually a very simple context, and I'll put it in a specific sort of container dimension. So today you can containerize an app, single app, one container host OS. That's interesting because you do that a lot of times, you can get much greater density. But where it gets really interesting is when you start to build multi-container applications that may or may not live on a single host. So multi-container single host, multi-container multi-host. Well, the value of that is you get the runtime assembly kinds of elements, so you get much greater reuse of components. Serviceability and support, people haven't even thought of. So if I have security vulnerability, and I've got my registry of containers, I know what applications are consuming, what containers, and I build workflows that just update and automate that in a really elegant way rather than trying to find 300 instances of an app that have an SSL bug. You're doing an audit, basically. You're deep in the weeds on going through data. Right, it's all automated. You just build the workflows and all that becomes automated in the container. So you can literally contain threats, meaning the container, but your efficiency isn't off the charts. So what you basically get with microservices is you get these loosely coupled service-based applications where I'm coding a lot less, I'm consuming more of what's existing, and I can also give assurance that I know where those things came from, what's in them. To the customer, what does microservices mean? I hear people talk about it.  What is it? It's an assembly of multiple containers in an app where you're probably inventing a whole lot less and just organizing and orchestrating. Yeah, so Tim, microservices are great. One of the things I've heard from some people is just like everything else, you get a little bit of sprawl. So if people create those services just like we had VM sprawl, we can have some of the microservices sprawl. You can, but I think microservices gives you the opportunity. If you build up a registry of certified containers, you now can pull from those, whereas every VM was constructed specific to the application and workload, so you get much greater reuse and supportability so you can propagate these changes just by automated workflows. Whereas VMs, you had to go fix every one of them. All right, so we don't have much time left. Can you talk a little bit about just kind of the customers that you're showcasing here at the show? What are our customers with the whole place? So the good news, as I mentioned, is we've got now hundreds of paying customers around OpenStack. What's really interesting is if you look at those, about half of those consume OpenStack and our CloudForms Cloud Management. So to us that's a really good sign because in the end, you need to manage the environment and the workloads on OpenStack. So customers are already starting to conclude that. I think an interesting sort of example of a customer that really gets it is FICO. If you look at what they've done, so this notion of Paz and I as sort of fluidly built together and you're just making service selections, that's fundamentally what they do. They happen to use all Red Hat's infrastructure to do that and CloudForms to manage it. But I think we're seeing that pattern more and more and more. The other thing that you'll see here is the customers and partners that we have. We talked about Cisco, but we've got numbers of partners here that maybe in the telco space. People that work with the Nokia's, the Huawei's, the Alcatel Lucent's, and I'll forget your 20 others. But what's exciting is they're all sort of seeing the reality of it's a really heterogeneous hybrid cloud world and they know that it's more than just the stateless workloads.  Well I think, I want to say congratulations. I think your vision's amazing on that. I agree with 100%. I think the service model is right on. This layers and containers are underneath that. They're all out there, but it's not the definition. It's not how customers think. Certainly you can put things in boxes, but like, come on. John, you make a really important point that I think, even at a forum like this, sometimes it gets lost. Depending on which study you believe, the majority of the world's workloads won't be cloud enabled for a while. People are moving there rapidly, but in the end, there's a lot of vendors that talk about just the net new workloads and what lives on the public and private side and refer to that as hybrid. But we see it as much broader than that. How you bring your traditional apps that aren't going to change into that world and leverage what's there and make it all work. And to roll it out in an SLA, I mean, you start with three years, but I know your goals to get 10, but I mean, three years is still good. Considering how new it is. So congratulations. Thank you. I really appreciate you coming on theCUBE, sharing SVP at Red Hat. Breaking it down, I always said, you guys have a good systems background. We're in a systems programming world. Microservices is all happening. Stu, we're breaking it down. More after this short break, we'll be back live here at Opus Tech Summit. I'm John Furrier with Stu Miniman. We'll be right back. Thanks guys.