Hello, yeah, okay. So is this your first call? Do you want to be associated with some company? I'm from Oracle. I'm just looking into this Do you know if Ricardo wants to join today? No, I don't know. I'll go ping him right now see if he's available Since the channels switch to password authentication, maybe we give people a little bit more time Yeah, I think also last time we took them about 10 minutes for everybody to get on board Hello, Chairman Is this your first call on serverless workflow? Yes. Yes. Yeah So I was going to join with the few of my teammates, Jorgen and Olivier. So yeah I would like to edit you from Oracle as well then Just out of curiosity, are you also with Oracle Cloud Infrastructure as K is? Or are you from a different department? Yeah, so we are from Oracle Cloud Infrastructure. Yeah Yeah, and by the way, it's X. It's Sorry, sorry Man, no response from Ricardo yet, but I'll let you know if he says anything Hey, there's K, hi K Okay, it's almost five minutes. So let's start Um community question time. Does anybody have a question? No, then let's get to our first agenda point. We have a new logo After the CNC design team has proposed us with Several options and we had a coloring discussion last meeting two weeks ago We finally come on the Slack channel to this logo. That is our new Project logo. If I understand correctly, we are waiting for the artwork team to come up with the different formats to upload it in the Do they upload it to the landscape or would they deliver it to us? Do you mean? I think we will get a link Where we will get this logo with text without text black and white white only I mean all kinds of different options So then we can pick and choose but where the link is I'm on it I was just told the artwork repo. So where that is. I don't know yet. Sorry I'm new to this as well Okay, and we have a few spec updates Do you mean do you want to say something about the updates to the subflow state spec? Yeah, definitely in the last two weeks. So we've had a couple of Updates the biggest one is the one. I hope we will discuss today And I have a little presentation for it as well. So we can all kind of look into it But these updates they're mentioned there is we updated the subflow state specification document because via community also It wasn't very clear as far as how function in event definitions get propagated to Subflow states again for for people their new subflow state is a state that allows you to Rather than have it allows you to have reusable workflows That can be used in in several other workflows. They saw a particular business solution So a subwork a subflow state allows you to point to one and that gets embedded and gets executed at that point during the workflow execution um, so There was a question. Okay, the subflow state inherit function event definitions So there was an ongoing discussion that in the prs And at the end we decided that no each subflow state has to define its own function and events so services that he wants to invoke And the event study needs to be either consumed or produced during its own execution That was mainly the decision because we are it's a specification base We do not wish to allow run times now that we don't wish to but it is better for run times For us to be very clear and specific what we want And also at the same time each workflow Regardless if it is a subflow or a parent flow should be able to be validated on its own Rather than depending on another workflow's definition. So we decided on that the second one is Kind of goes in line with this Because we now force that each workflow defines its own functions and the definition. There's all definitely Cases where we want to reuse those And so we allow now for functions not only to be referenced in line and events But also to reference an existing json or yaml file Which include Those so basically you can define a json or yaml file which includes your function definitions or your event definitions And you can reference them in in in your function in your workflow and that should be embedded So multiple workflows can reuse them rather than having to to to inline them in every single workflow definition that you have So that that was an update So the third one is the one that we're going to actually talk about today It's just a pr form currently But I that's something that we all really need to decide and I'm just trying to make a case for it today and see what everybody thinks Um, and we'll go we'll we'll talk in detail that now. So I don't want to waste any time now As far as issues goes if you guys have time, please look at those two issues that are linked here They have to do with retries and and one of our community members There make some really good points on what we can do to improve Especially our retry definitions in the in in the current work was Specification So having more people look at it and chime in I think would really be helpful um, especially because right now I am uh rewriting or trying to rewrite the air handling and the time out in the retry sections of the of the specifications And this has to do with that. So any input would would be much appreciated Yeah If I get it, that's all by our contributions by Jürgen. So thanks a lot for All of the issues and the pull requests that came out of it. Yeah Thank you very much for that that nice discussion we had on the prs and and the issues I have two questions on the remaining issues on retries The postmarked documentation. Could this be clarified? So documentation only or would it would we have to restrict the use of the interval versus max attempts or the use of How we specify intervals um I think there's definitely going to be changes to the to the schema as well. So we might need to relabel those issues. Sorry Okay So I'd like spec label on it. I don't know great and Yeah, I think that's for the agenda today. I didn't add any other topics um, so Tim, do you want to do the deep dive right away or should we First conclude ask for any other questions. Yeah, and then jump into the deep dive. Yeah, definitely Whichever way you think is best Okay, um, then Let me ask if there are more questions Okay I would have one about the use of open api, but maybe I can take this offline favor of time Let me do Final whole call. So Michael. Hi. I noticed you joining. Thanks. Yes. I'm here And So, yeah, that's it. Then let's go into our first deep dive About the function definitions Yeah, let's see how I can share my screen. But just while I find uh, oh, I think you have to stop sharing, uh, Manu But just to understand last Our last meeting we said that it would be beneficial for everybody if we if we started taking our time during these meetings and discussing certain parts of the specifications And and honestly, I I'd love for this to be an open discussion Not a monologue and uh, and uh, and this one I think will be a little bit spicy. I must say So I'm hoping that everybody participates in it because introduces a Change to to to what our specification. I think we should kind of look at it and discuss So let me start sharing the screen And Sorry, my presentation is not very pretty, but I started it this morning so last meeting Can you guys see my screen? Yep, okay great. So last meeting we said that the first topic of the discussion In our kind of deep dives where we want to call these sessions is about function definitions So I just wanted to start off by saying what are function definitions in serverless workflow They're used to describe what services Need to be invoked and how to invoke them. They're typically external services They need to be uh invoked during workflow execution as part of the orchestration of of services and everything else that that You're doing and you're defining with our serverless work for markup and again In order to solve business problems everything that we're Doing or the defining has to solve a particular Part of your business problems within your organization or or or the problems you are trying to solve Another thing about function definitions is that they should really provide the runtimes All the information needed in order to invoke this particular external service So that's kind of I want to say that up front So but there is a lot of parts about invoking services There is an authentication callbacks. We have especially at webhooks in a lot of different parts They're part of the actually invoking a service or a function. So we'll get to that as well Um, as far as our specification is concerned since we're not doing an in-house project or a proprietary type of markup We have to be aware about portability So we have to understand that whatever markup we define Or say users have to use if they choose to use the serverless workflow specification Uh portability should be a very sorry about my dog should be very important part of of what we're doing So in order to see where we're kind of taking the or where I we are proposing to take this Function definitions. Let's take a look at how this currently looks with our Our specification and I did this little example here. This is a whole workflow definition in yaml and basically If you look on top after id name inversion You'll see functions which defines the function definition array in serverless workflow Instead of inlining function definitions in state inside of states or steps or or those parts. They're really concerned with execution or logic We actually define them up front. So we have our functions array. Each one has a name parameter Which is a unique identifier of this particular function definition. Uh, this is workflow unique identifier Not unique identifier within the service that we're trying to evoke. This is just Domain specific to the workflow markup itself The second thing uh parameter is called resource. Uh, and this defines the endpoint location Of this particular service that is exposed to the public And then we have a proprietary string based parameter called type Which we initially thought Or currently have thought when we when we did this that it would allow runtime implementations to give further Information about the type of service. We kind of left it open-ended, which is a string currently type So use uh users can give some more information That is again domain specific to them about this particular service So here you will you'll see two functions defined one is the get current time and one is the read wikipedia function definitions and within the states, uh, then Different states have actions for example the operation state callback state And an event states can define actions within actions. We can reference Those functions, which means referencing a function within an action means at this point the actual service should be executed during workflow Execution so we have a function ref and the second parameter down here on line 19 is ref name And at this point we say we reference our function Definition and at this point we want to execute the get current time Function the same thing on starting on line 20. You can see it's the same thing, but we also allow parameters Which are basically json objects currently to to to be passed as the payload of of For the service that needs to be executed So any questions so far this is kind of like what we currently have I have a question. So you've defined some of these parameters that I understand they're getting passed through for example the wikipedia example Why is it that the there isn't a definition of what parameters are available on the read wikipedia function in this particular case? Yeah, and we're actually going to get to that and this is a very good question One problem with and as you will see with other currently used or or popular um Workflow markups out there You don't have that as a workflow developer currently You not only have to know what you want to write as far as your orchestration to solve your orchestration business problem But you in a way have to be an admin as well to understand the api and all of the operations of all the services that you want to invoke Which definitely makes it hard for Modelers all right. So one of the parts of this where I'm going to is kind of like a step-by-step approach to Get to where I kind of want to get at the end All right. Um, I'll wait for it. No, no problem So this is just again, uh, a little bit of iteration of how we currently do things We have a name resource and type parameter function definitions also Similar to states have a metadata definition. This is our free form type of extension object Which uh modelers can use to add non executable um Parameters and information to their workflow models. So yeah metadata is also available for function definitions As far as function ref goes again, we have a ref name which references the name unique name parameter on the of the function definition And as we have seen in the example the parameters, which is a free form json objects where you can add The data that needs to be passed to the particular service that we want to invoke During workflow execution Now let's In order for us to see where we are and how to improve One of the things I think maybe it's a good idea. Let's compare it to other ones Now I picked google cloud workflow not because I pick on google or anything like that It's just a new one and it's kind of new and I just wanted to see. Hey, let's see what they're doing All right, and this is for their documentation instead of states. They have steps and similar To for example aws, which we'll see they have they defined their service execution inside of their steps Where we kind of do it a little bit different and will we define them up front and reference them? and also can reference Files json or yaml Where is the reusability? We talked about this earlier, but basically This is on top. It's kind of like the definition. They have a call parameter where you can Have an enumeration of different types of htp calls to the services that you can make you can have arguments URL methods you can set headers say the body And blah blah blah authentication information is right there as well And then you have things like timeouts and the results as far as being the results of the service the data results how Is it placed within the workflow data? As the state execution continues and underneath is the same example that are showed On the earliest earlier slide using the serverless workflow Specification. This is kind of like what they're yaml their their workflows are only yaml based This is what it looks like basically where we show the json. No, we also show the yaml in this matter So that's kind of what it would look as you can see that's another approach to to It's similar to ours at this point And another of course a very popular workflow language out there is aws And I don't have a full example. I've been rushing to do this But this is how this is the very similar thing that they find a resource which is In this case an arm, but in a way that's a uri at the end you can look at that and they also have A json object type called parameters where you can basically stick anything in there you wish in order To provide all the data all the information for this particular service to execute So looking at these three and of course there are many others that I haven't looked at and I hope you guys can maybe help me with Looking at even different approaches. They're very similar, right? So Let's see about some notes that are made and again, this is just my opinion and you guys can tell me yours and I would love to hear it So some notes about all of this mentioned including ours They try to be neutral, but in a way every single definition that we have seen so far is proprietary In the sense that it allows you to do what it allows you to do. All right Hmm, it's very specific to Container or the cloud platforms you run on for example Just letting you know from the information that I read and if you guys work at google or work with google flow, please correct me But they'll allow for example currently at this stage only htp executions to be made Um aws also has the services that they have the exposed in their system and they allow you to call those So it's very kind of closed box type of approach where we as a specification. We kind of have to look at a much broader State at this time So no matter what we do or no matter what we're trying or these different approaches are trying to do They were never going to fit The requirements Of everybody now we can't do that either. However They're always going to be Changes and updates and improvements needed But they're all based on again the proprietary or the in-house definition of how you invoke a function Now the second notes I put on this slide is specific to our function definitions Uh, I mean what I mean, but we're in the same boat. So we we're also trying to evoke services during or define how services are evoked during Um workflow execution, but we are a specification. So we have to look at this differently Uh, it's a specification. We have to distinguish ourselves We can again do what we're doing and keep what we're doing and refining it and updating as new customers or new consumers So the service workflow markup come in with the requirements But again, it will be some sort of custom based definition, right? Um, and my idea or or the idea that that I think us going forward should probably look at is to rely on other specifications Same thing we our specifications say that we rely for cloud event specification for cloud format Well functions in a way or executing a service is a very similar thing We should really rely on existing specifications Does do things 100 times better than anything that we can specifically create and do for function or service or uh definitions And at the same time we need to focus on portability and the more information such as authentication username passwords headers things like that that we stick in our markup itself are going to Uh limit our port portability in the future across containers And cloud platforms or even if we're just doing this normal local host type of project, you know, that that our specification is also there for So What does this really mean going long term for function definitions? We I think we should start relying on open api specification And why fail for many reasons? Um, but let's kind of look at first where that's taking us So services that we need that's uh workflows, uh need to invoke during their executions Have to provide or have available an open i description and an open api is a is a specification It is a huge widely used Uh, you guys can look at the docs and read everything but their description is basically jason the reamble format Open api covers almost all use cases for invoking restful hdp services including authentication callbacks for webhooks, etc, etc So what they can provide and already do is already there and we don't have to duplicate it We don't have to create a subset of it and keep improving it. It's it's there and it's widely used um, it is very good for runtime implementation of our specification because Our runtimes get all the information they need all the tooling that already exists in multiple different languages Uh that they can read an open api definition and know exactly how to actually make this call Remember also, they're a single call to rest service can actually mean multiple calls can mean getting a jwt The token doing basic authentication or even a lot more Things than that so open api can already describe all this for us Also, another thing is for tooling now. This is where I come to your question that was asked before uh With allowing opi specifications if there is ever tooling for serverless workflow, which I hope there will be outside of just the the visual code plugin that we provide Some visual tooling for example You will be able to get read the reference opi open api specific definition and help the users With the actual services or operations provided by the service they need to execute So it completely offloads that part uh from the workflow modelers Uh, which I think will help a lot Any questions so far? Yeah, sorry, uh, I have connection problems in between but uh open api so I I do like it probably the most for anything that is rest-based because it's Really complete as you said it allows everything um For amazon web service, uh, you've given the example and they are using arn resources It's a ui format to describe their endpoints, but There you don't even get to choose the transport method. So whether that is http Or whether they are using java rmi internally, you don't get to know For the the google example that is a very generic, uh, http kit so first um If we stick with http um would open api to happen to know if We might run into compatibility issues because if you if you want to call something That you could easily call with an http request and you can specify all the authentication bearer and and whatever you need in the request But you don't have an api schema for it You'd have to build it yourself, right? Yeah, and I thought about that a lot actually and the way I see it is an open api or swagger Is it's also called as a lot of tooling already? And they make it very simple to build one if one doesn't exist number one number two I I made sure before I did this and you guys can really really do your research yourself And and I would love to get everybody's feedback Everybody's doing open api now if you look at aws itself They allow you to upload Swagger definitions open api definitions and also allow you to build open api definitions from their existing services Same thing with google cloud Same thing With open shift for example the stuff that i'm kind of working in so i know that I just talked to for example scott nickles about k native would that fit within the two and he said yes You can also define k native services using an open api definition so Do I understand That there might be use cases where users can say hey, I don't want to do this or I cannot do this But that is the trade-off that we're going to have to to deal with this as a specification Um, I I also described in the pr that we still have the metadata section So for users really that simply do not want to use what we the open api as I will show in the next slide What the proposed change to the function definition they can still use metadata to describe how to invoke their service with the exclamation or or or denote that those types of workflow definitions we Cannot as a specification and share that they're portable across Multiple containers or or cloud environments But it's still possible to do using the metadata Okay, so we would default the type to open api I'm guessing the latest version. Yeah, you'll see type is type is completely removed. You'll see Next slide and then if you want to Yeah, yeah, I noticed but Okay, so anything else could use the extension mechanism to describe a different um Invocation method. Yes, definitely, but like we have to still understand that we cannot please everybody no matter what we do But however, the amount of benefits this has for the bigger public has to outweigh If we're going to do this, so this is kind of why the discussion No, I love it. I love it. I really want to make this the the standard or default way for um method and vocation the only thing I don't want to close any doors. Uh, so by removing the type field So I was wondering if we should default it to open api or if we really want to remove it completely We could reintroduce it later if we wanted to definitely definitely So I think this is the last slide Uh, I hope no, there is one more after this, but I did an example now. It's the same example as we saw before But with the proposed function definition where we still need a unique name Again, the name is domain specific to the workflow definition itself as far as referencing it in actions But you see rather than having resource type Uh, and anything you have a single parameter called operation Uh, the operation parameter is is is a string with two parts, uh divided by the little hashtag The first part is a uri. So it doesn't have to be htp It can be class path file path whatever as as far as as as long as it fits the the uri specification To the actual json or yaml file where your service, uh open api service definition, uh, is present The part after the hashtag is the operation id and if you look at the, uh open api specification There's a widely used parameter called operation id Which is again a domain specific parameter, which really ties in well to our domain specific language workflow language itself And this is a unique mapping in the open api definition Uh to a particular endpoint Or operation that your service provides This is very Ugly this the hashtag is uh is the Uri delimiter to specify a fragment. So daytime here would be a fragment But open api uses object references, um Where the hashtag separates, uh, I think The specific paths to the object, right? um in There are several uh We have to identify the uniqueness In open api definition, how do we uniquely define a certain operation of the service that it provides? There is two things you cannot use the path name itself. It's not unique Because it can use variables Um, you can you can you can use name and path maybe But one of the standards that's really across the board right now is to use the operation id which is, uh, A string that has to be unique within the open api a maps one to one To a certain operation of the service And the same the reason and i'm just letting you know we can change this format But take a look at for example of apache camel the latest, uh, not recently They also added open api support and they use the same type of string So I didn't steal it from them but looking at this stuff the the so the approach is something that other Are looking at that's why I think is is is useful But we we really if we find some better approach or idea Let's use that so that's but we need some sort of way to define Okay Here is the yaml or jason which has the open api definition file So the runtime can read it the tooling can read it and see all the different operations that the service provides And then we need the unique identifier Uh, which represents a single operation of that service that we actually want to invoke So that's kind of like that if we use this type of string format or not Or two parameters versus one I am okay with all of that One comment I would make is that I think the query online 22 Shouldn't be required in this case because the action in the search should come from the open api spec right um That's a good question. However, one of the things that I uh, for example day of the week if you look at that The api the open api specification itself does not know or is involved in the actual execution of the workflow itself So what happens on really after the execution of the first function in this case the get current time The results of that function are merged with the State in this case the get today's wikipedia articles operation state And then the second function gets invoked Right, so we have to pass the workflow has to pass this data Which were the results of the first function invocation As the body or the parameter to the second function in for me execution So we still have that to define that however what open api makes it a lot easier now Is that up front during compile time we can say hey The as parameters you pass a query Right parameter, but the open api definition says it should really be called something else Or you're passing in one parameter, but in api open api definition of the service endpoint Uh, you require two parameters for example I mean what I mean is that it's not necessarily a query parameter like it could be a post body It could be a whatever depending on what the api spec says. Yeah, it should be Exactly, that's why I'm saying that query maybe is Not needed there because whatever how whatever form those parameters take should be defined as part of the open api spec Definitely. Yeah, that's a one-to-one mapping that that open api even helps us with to know exactly the structure Of the parameter that we have to pass in um, even They have open api has a schema definition for the object type So even workload developers will exactly know what the structure of the parameters needs to be in order to invoke this service Does that help or no, all right. So do you agree that the query online 22 was not required or do you think it is required? um I think you could just bump action and search up one level. Yeah. Yeah, I think so too. Yeah, that's fine I agree Hey, hi tihou. Can you hear me? Yes All right. Hi guys. I'm sorry. I'm I'm late um, sorry Yeah, uh, regarding these parameters. It is uh, this will fit very well in the pr that issue that I opened regarding we giving Reasonable reason to the two parameters. So, uh, if they are path parameters query parameters Had their parameters or body parameters We we don't know, you know, actually, uh, we we don't need to know now because uh with the open api thing And yeah, I guess query we we won't need that and maybe just uh parameters Maybe I don't know name name me and data and in the data we we fetch from the from the from the Variable name or from the body of the state Yeah, or anything like that because uh, we we have this context information Coming from the open api and one other question that I have it is that Regarding this well, uh, well all that you have there in the operation for implementations, let's say that They might have the the open api JSON file Within the their context like if I'm I'm writing a java implementation for that I can I can have that that the Emo or json file within my class path Or if I'm running I'm ready and go application. I can Have that, you know packet on my binary as well or I can have that I external or have friends like file or anything like that. So this is a valid bit Where uh, or I? Name right so yeah, so it's you can be spite it's tp. I can I can fetch this file for whatever Path file it's just has to follow your eye Specification. Oh, yeah, just just let's try to to I don't know maybe Document that and somehow or Write that on that. Yeah, because maybe people will will ask like oh if I if I can't fetch the The resource my My workflow won't work, you know because I won't I won't have this operation now. So yeah, we can actually have that Yeah, I think in the pr. I define it as a in some of the examples even use file column forward slash forward slash rather an htp just to show that You can really define where it is yourself rather than always has to be available on some public endpoint Oh, that's nice. Yeah, I'm sorry. So last no, no problem. So just last slide ahead I'm sorry it takes so long. So here is the link to the pr. I think it's you know, currently only open pr right now Um, so the changes are name name is again still the unique identifier for the function definition Operation is now the new parameter, which we said has two parts divided by the hashtag the first one being a new r. I um as Ricardo said and the second part being in the operation id and The low I create the the image below I created a little open api definition using the swagger editor um That is not completely correct, but it's just the more most important part there that shows the how the operation id for slash daytime maps to the In actually in our definition of of this string So yeah, and you can see you can see like you can define in open api the response codes Uh, what kind of return message it gets and the parameters and And things like that So yeah, it it does what it does. It does what the specification is intended to do. It does it very well So yeah, so that's all I had if you guys have any questions concerns um If you want to know more about function definitions or anything right now, please pick up I have a question about the Serverless functions like if you go back to the aws step functions example where I think it was showing an arm For a function Okay, in this case, it's sns publish If we instead have an example where the State is making a call to a lambda function Um, how would how would that work? What would you know? What would that look like with with this? um We it would look the same the first one would be this the operation string would be basically the first thing Is again a uri to your open api Jason or yaml definition the second part would be your operation id for example called publish And you would need to either have one available or create yourself uh an open api definition jason or yaml uh with uh path Which can be really this path right here And an operation id of publish so the runtime can map the operation id to to the operate The operation id to the to the one defined in your open api specification so so somebody that's running this in in aws they would need to Upload an open api spec somewhere the points to their lambda function Yeah, but from what i've seen again, this is why i kind of i do feel confident about this more than not And where i want your guys's input because you guys might be experts in certain domains there much better than i ever could be To know but from what i read that even in on aws you can It can create them for you They them being the open api Uh definitions for the services exposed So not in all cases you have to do your your own and upload them somewhere but in a lot of cases in different cloud and and and Providers will do this for you same thing on open shift All the services you can open shift can generate the the open api definitions for you already Gotcha, I think that makes sense for examples like calling sqs or calling some you know large established aws service Yeah, but struggling to figure out how it works with something like my own custom lambda function that i've uploaded Uh, and I want to invoke that I guess um I guess what what it sounds like is In that case, I I'm not sure if i'd be in like using an open api spec for the lambda service and then passing in the parameters That tell it to invoke my function or if I need to provide an open api spec to describe the kind of api that that lambda function forms um Yeah, the funny thing about lambda functions, I as far as I know and I'm not very overly familiar with amazon services is um As far as I know in order to make a restful call to a lambda function That can also expect a result you'd have to I put an api gateway in front where you're sure it's the pass yourself And then you just refer to the arn As the function to be executed and in this Scenario, I'm not even sure if how the lambda can How it would produce the result but Um, it's that's the only way to make it restful and once you have that you for your api gateway in on amazon you could Come up with a swagger definition This example uses sns publish and it's unidirectional. It's really more of a cloud event cloud events, of course not Exactly supported uh in amazon, but it is the transport here is um A message broker So you have to publish to a topic in order to Invoke the function. I think the the lambda here is bound to that topic aion And There you only have a message structure. That's one way. So I don't know if Actually, I assume that Open api cannot define um such apis because it's You really done for for restful apis and those are meant to be htdp htds base risk request response clients of a protocol um, if there is Something other and that's why I mentioned maybe we wanted to retain the type For function invocations. I'm not assuming anybody wants to do old-fashioned coba calls or do some asn1 encoding but If there are other invocation protocols not based on htdp um Then retaining the type field would be at least an option to extend the specification and write some proprietary extension The other thing I have in mind is that since this is uh unidirectional It's not really waiting for a result. We could somehow formulate such an such a message as an event A produced event that is being produced by the workflow. We we have and that's a good thing Manuel you mentioned this we have two ways of invoking functions within the serverless workflow specification one is Via the actual function definition, which is meant more in our case for synchronous htdp calls in this case Uh, we also have the ability to invoke functions in actions via events That is also already there in the specification itself So you can already uh define in a lot of cases right now We have functions that are not exposed via htdp or not exposed at all But they can be triggered via events in different containers for example And in that case we can also describe a trigger event in a result event in actions Uh to invoke those types of services as well um, so those are more if you want more an async type of um scenario where where where um You fire and then you wait you will most likely use anyways event based invocation of your services Or specifically the callback state even if you wanted to But yeah, so function is more of like a synchronous type of invocation scenario in my opinion again so one thing on this, uh From me thinking about from a user experience point of view like in in step functions like this example we're looking at I know it's sns, but like the the goal for when the launch step functions was to orchestrate functions, right? and I think we can look at another example where they'll they have like Ability to trigger functions directly So if if with our specification Um, we need is some sort of a similar way to trigger functions, right? but by asking the function author to also define a yaml spec and Have it available somewhere uploaded somewhere. I think that's going to increase a lot of development cost which might not be What the function author was looking for? Definitely, yeah, and that's this this is the type of discussion I think we definitely I wanted to have with this there is definite tradeoff And we have to say what we want to do is a is a group Uh, there is definitely a little bit of upfront development with this The way I looked at it and you can tell me if I'm wrong is yes, there is but you have to understand that the actual People developing the workflow model Could be completely Or not understand the actual service Um definitions that they want to invoke I know that I want to as a business analyst or as a user creating Solving by particular business problem via orchestration of services I know what type of service I need to invoke, but I do not need to know exactly every single operation Or if if I have to first get a jwt if I have to do basic authentication What is even my username and password up front? Open api is much better suited for that. So yes, you can say your requirement increases development time But at the same time having uh open apis Definition even for your services will allow you to pour them tomorrow to a different cloud provider pour them to a different Container for example So I don't see this as particularly bad thing for yourself doing this work anyways And given the open api tooling, it seriously need takes like minimal time to do that Uh, it's also some discovery and it's already if you already have defined services For example inside the runtime containers such as quarkus spring boot things like that it is basically just one line of Of in most cases one line of Application properties or some sort of properties that you have to set and it will generate the json and yaml for you So open api is very unique in that a lot of tooling already exists for it That will help you not have to spend a lot of a lot of development effort But what it buys us as a specification is Is really the fact that what would you rather have a workflow definition that is not portable? Or a workflow definition that is and I think that's what we need to decide because Using open api allows us as a specification to say we are indeed portable for for service definitions and and then they're in invocations And that's the tradeoff that I want to that I want to make a decision on with you guys if possible Can we think of like, uh, like I don't know from a market perspective like what the 80 20 on this is like as a Work developer and as a function developer Is like 80 of the time I'm going to require these like Open api seems to me like an advanced use case, right? And I don't know if that's true, but it just seems to me like is that something? Do we want to force that upon everybody or can we think of something like the current method as like a quick start? That can solve Most of the use cases for function invocations or do we think that for every use case of function invocation that we Need to ask the function or the workflow developer to write an open api spec as well. Yeah I don't know My take again, sorry if anybody wants to speak up, please do but my take is again, we are working on a specification We're not working on a in-house project. The problem we're going to run into is Tomorrow, let's say somebody wants to use the specification by google ads or Anybody really out there adds a parameter that they specifically need that we Can only add in the next version And then so they cannot use our markup that will go to google same thing Again, somebody is going to have something that we don't and it again is all proprietary and in-house definitions If it's not open api again, the point of my talk here is let's use specification based stuff And we can never replicate for example what opiate api does and if we have use cases where This is really why we use cloud events. We don't really want to create another Event format. So we said let's use the specifications same thing with function definitions the service definitions is Let's use specifications for that because that really allow us to grow a lot more than for example markups that focus on in-house or proprietary definitions for this Great might be worthwhile having a an inline version of the definition To and there might be another use of this type field is to say, okay. Well, yes, you know, ideally you should Have an an existing open api that you can get it from or maybe you can host a copy of that yourself if one's not available Yeah, you might make for a nice, you know compact example if we had an inline format as well that people could use If if you guys are developing a runtime where you simply say no, we don't want to use this Um, you can still use the metadata section of the function definition to really put in there anything you possibly want That is fair game and you can adjust your runtime Which I think we're actually going to do a little bit of that also within within redhead and also and Ricardo tell me if i'm wrong, but We also looking at metadata to inject further information That is specific to our runtime, but just on the specification level itself. We cannot consider those types of Um Workflow definitions portable, right? I mean am I wrong you guys tell me I really like the open api spec and first class support for I guess what I'm worried about is removing the the type field which seems like it requires the use of open api spec um for for all functions where um, I guess I'm worried that there are use cases that There are not where the interaction isn't restful And so an a open api spec being required would be confusing to users of the definition All right, so I think that that's two people. I think manual and also said the same thing So one of the things maybe to to move towards this implementations. Let's put back The type parameter which is again to everybody a string that basically run times can put in their own identification Or further description of of the type of service they want to invoke to make sense for their runtime Would that be right? Yeah, I agree with that with this as well because Let's say that they can't they they wish to invoke a soap service. For instance, how they did that Yeah, then you know, they they might use they they view sdl. They are very old school Um, yeah, I guess that makes sense having the type parameter. Um, and we can even um Assume a default type parameter being an open api definition For instance, I don't know maybe something like that and then if you won't change you just Type your own type parameter and interpret that in a way that you that you can Do your thing but again won't be portable Because we are looking for portability as well. So we can you can port Part your workflow from from one runtime to another and then if you use a proprietary type You won't be able to do that. So that's that could be reinforced In the in this specification as well Regarding http, I think in the generic http method we ran into issues of how to encode the query parameter to a url the Authorization header fields or potentially additional headers to be sent The structure of the body right because the encoding of the body wasn't clear from the function call Um, if there was some write-up Oh, I'm thinking about following the the google example um We could have a type http that would still allow a generic adaptation, right? So I got a um, would you rather switch to open api completely? I use the tooling to generate specs for um function development. So I don't know I know you guys work a little in java If it's probably like back in the wstl times you wouldn't Run the full specification eventually you end up annotating your code And you have all the specification created through tooling. So a similar thing you could do with open api But for somebody who just steps in I agree here it it would be a really a lot of effort Describing the api open api spec first In order to be able to use any workflow engine to make some calls. So Something that just generically calls an http endpoint Makes it still sense to me. I know a lot of people who Still implement services that way because they want to type up something quick um So if we had a type http and Probably with some predefined metadata on the method headers Um body and whatever is still in is is like in the google example um Would you support it to add it to the specification or is that a no go because uh, there is not enough validation in it Hmm, this is hard to To answer, uh, well From from a runtime implementation perspective, I'd say that Doesn't matter if it is come come from an open api or directly from the spec, you know, the code base would be the same Uh But I have mixed the feelings about this because uh, you know on We we can we can have that using the only the open api and then leave Every every every standard of defining how to call an http restful service to the open api And that's it because this is the standard today. Everyone's doing that. There's a lot of tooling like uh, jihosh said To work with swagger for instance, you can you know any java application can you can generate that no quite quite quite quick and for go as well It is basically the same thing um But at the same time and understand that we understand that we can we can have uh, lots of people, you know, seeking for the the the specification just to call simple service and then They do not have the the open api Defined and for that I'd say that they they should use their own metadata And do their stuff in that and you know The runtime just supposed to to support that because we'll be a hell to maintain the specification In order to align with the open api maybe So, uh, like the the issue that I open to classify the parameters when calling our http service Being a rest or not um We we are basically doing the same job that open api is doing So in my opinion, it should be a no-go. I'd say that we should only have the type open api defined by default and this is if you do not Define a type just be will be open api because it is wide use used by everyone in the industry and you know And uh, we can rely on the standards of the open api and this for rest And for rest for you know called this kind of services and for http Uh, I'd say that the the implement you should decide how to if they would support that or not Yeah, I have to still learn a bit more about open api. Thanks. Um I had one question Still because tma you mentioned once or twice that uh authorization is Open api would give us a also give us a specification of how to authenticate with the service um, and I was thinking about some messy proprietary authentication Messages that I've come across and how they would be supported Or if they could be supported generating an open api spec So I got a definition. So, um How How versatile is it to have? Let's say random headers added to the request The the actual headers you can define them all in your open api thing. So again, that would offload that for us as well But again, you can use metadata I think metadata in a way because it's not Really provides execution semantics You can you can add all the headers extra headers you want And again, you have to be kind of cautious is this portable now In 99 of the cases I understand for everybody probably even here portability is not Really a big issue you again you look at more work created by this rather than not But we we have to understand again We're working on a on the specification itself and one of the most important thing that we're trying to distinguish ourselves from From from all the other workflow markups out there Is this portability issue and vendor neutrality and then I think that for us has to be kind of like embedded in And I have a hard time with that as well To kind of look at this from that perspective more and more than anything else Yeah, it I I fully understand that doing this might limit the users actually of what you're doing because Like you guys all said, it might be much faster and easier just to hardcore the htp or l in there But at the same time Then you run into the same problems that we're trying to solve as a specification, right? So so that's that's one thing like why It doesn't prevent all sort of users in the event definitions to To to use the proprietary event formatting right on the on the runtime either But we recommend using the cloud event format as well So so that I think distinguishes us from from from other Workflow markups out there. They're popping up every week. It seems And I think that's a positive, but yeah Um, I'm all I'm really a fan of open api. Yeah, just seven Yeah, and if there is a better about it If there is the the reason we picked it is because like rikardo said it is a standard out there If there is other ones for for for non-htp based, let's use that but One of the things I think that's important for us to be specification based, right? And and let's just pick the best one That I think I brought it up several times The only thing I wasn't sure about if it's Fully covers the features of a generic htp request. So the security information and so on that would also go into the parameters then Yeah, you also you also solved the for example the cases that we we we discussed with argo recently about webhooks It also deals with callbacks as well So there's a lot of use cases that we really don't have to specify On our own and have to work with in order to To make users happy. So in a way creates more works which War work for our users, uh, which might limit the adoption, but the same way I think the inclusion of of of run times and users Uh, especially the people writing the run times. I think this is a huge step up for them I kind of wonder. I know we're a bit going a bit over time now. The um, the example you gave before about the Wikipedia API, you know, you've got to pass this. Um, I think it's open search Action parameter every time the way that we previously described that you'd have to put that inside every Function every indication definition It may make sense to have some kind of a like a mapping on top of the open API to say well I'm not just calling, you know, generic Wikipedia API and you know passing through my parameters, but saying, okay For this function definition I always want to do the search and then you've only got one parameter that people then pass to that function If you're following me, that's a nice sort. Yeah to to have Pre-customized function calls here pre-filled headers In some cases you wouldn't want to have to repeat that everywhere I open up an issue for them. I would love to to to to work with you guys on that as well So I mean, what did you guys think overall because this is our kind of like first deep dive But it's a pretty hard one because we introduced a big change In the next ones the way I think it was intended just to talk about what we have I think uh two things if if you guys don't mind either in chat or this week or in the next two weeks in our In our team chat if you don't mind like writing, what would you like to see discussed next? Um, so let's pick a topic for for our next deep dive Uh, or anything else you want to talk about also the same thing is like if any of you guys would be willing Uh to lead this type of discussion for next time Uh, please step up I it would be really nice if I wasn't always the one talking about this stuff Of course, I can if you guys want me to but if anybody of you would like to take a section of the specification And talk about it to everybody And and and have a discussion that would be great too. So yeah Hey, thanks to you Mia for leading the discussion today. Uh, was Sorry, okay Same thing. This was really useful. Thank you. We should yeah, we should be doing more of these deep dives Yeah, I really enjoy it as well. Uh, I left some mess some comments in the PR about the dysfunction definition where you be opening press so we can Uh, I believe talk in there in the PR itself. Um, because we are in top of the hour I don't know if we have any more time to discuss anything Great. Thank you guys so much for your comments and your time To join and listen to all this and yeah, hope to see you guys again next time Thank you. Cheers. Cheers. Oh, thanks guys. I really enjoyed it. Thanks. Bye. Cheers. Bye


So, my name is JT Klopsic, I am from Bella, Maryland. I am currently a junior on the Men's Track and Field team studying human services with a BS to MS option. So the very first time I came on campus, I fell in love with it. I drove through when I saw the big Mustang Stadium sign straight ahead and I immediately fell in love. I think it was homecoming when I first came here.  And then once I started meeting people, it was pretty much a done deal. Coaches, professors, athletes, students, everyone just sort of accepted and I fell in love with it. So I think something that Stevenson does really well is they provide opportunities in any aspect. What in the classroom, in athletics, in clubs, organizations, I think that any student can really develop into whatever he or she wants to be, which is really cool. After going to the national SAC event, it was very clear, it's an amazing event. And I just saw, based on his actions and his comments to me, how his eyes were wide open on what type of impact and I think that's really important for JT is what type of impact he can make for not just the students on our campus, but the students in our conference. He's in a diversity group also with our conference with other senior administrators like myself. I'm not in it, but there are other AEDs and presidents who are involved in it. And he has a very active role and for JT, it's about making a difference and the difference isn't just consumed to our campus. The difference is how can he make an impact as a larger in a larger group. It's about being the voice of the student athletes, being the figurehead of what the student population wants. And that's something that's really unique about Division III is that student athletes really do have a voice. So something really cool about our faculty here is that they're all here to help us as students. Be it being a recommendation for a job or even helping us with an interview or it could be something as simple as just talking with us about something we have going on. Something that is really cool to me is that our athletic director, Brett Adams, he actually let me use him as a recommendation for jobs, which is cool, because how many athletes can say that their athletic director is the recommender. JT is going to be successful in whatever he does, whether it's academically, pursuing a particular career or path, or if he gets excited about something such as the NCAA convention, you know, whoever is going to hire JT Klopsik is going to have a very analytical and hardworking and passionate person. So I love D3 because it develops people. If you look at some of the other divisions, you might be a number on the roster. In Division III, you're going to be a name with a face. Every one in your department is going to know who you are. They're going to know who you are as a person. And I believe that Division III builds your character, it builds your morals, it prepares you for a job, it helps you in the classroom as well.


Hey, welcome to my channel. Today we're making low-carb chocolate chip cookies. Now I'm using almond flour, which is going to make the cookies nice and soft. If you like soft cookies, then this is the recipe for you. And I'm also going to be using date paste, which are dates that I've made a paste out of, instead of white sugar and even brown sugar, so that the glycemic index stays low and it doesn't spike your blood sugar. So, and I'm also going to be using just a little bit of oat flour. Now, what that's going to do, I know that has more carbs in it, but we're only using a couple of tablespoons in this recipe, and what that does is brings out some really delicious flavor. So, I'm rocking Robin, and I'm going to show you how to make them right after this. Before we get into the recipe, I just want to mention that you might want to click that subscribe button and the notification bell, so you'll be notified every week when my new videos come out. And we're always whipping up something delicious and super healthy. So, we're going to start our recipe by just, I'm going to be putting things in the bowl, and then I'm going to tell you about the ingredients as we go, all right? So, first up, I'm going to be using some butter. We want to get all of our wet ingredients in the bowl. First, I'm going to use a hand mixer, and this is a half a batch. And don't forget, you can get the written recipe down below in the description of this video. Click down there where it says show more. So, you want to soften your butter. I have organic butter here, and I'm going to put that in the bowl along with the coconut oil. Now, the coconut oil has solidified, so it's not a liquid, and that's fine. We're going to beat this up, and I'm going to get it nice and smooth. Now, once the butter and the coconut oil is nicely creamed together and smooth, then we're going to add the date paste. Now, the date paste is something that I like to use. I started using it a lot in a lot of different recipes. So, for example, I put it in my oatmeal to sweeten it up. It's a great sweetener. It's got a lot of vitamins and minerals, and it doesn't spike your blood sugar, so that's why I really like it, and it just tastes good. It lends itself to this recipe super well because it's got a caramel-like flavor, so it just fits right in, and it's beautiful. Once we've got the mixture all combined, then we're going to add our egg, and I'm just going to toss in some vanilla extract. Use the real stuff. Don't use imitation. This is so much better, and we'll mix that up until it's all combined. Now, for our dry ingredients. I'm using almond flour, but I'm using blanched almond flour. I like this one here. This one's from Trader Joe's, and it's nice and fine. It works great. You want to use that as opposed to almond meal, which I think is a little bit more coarse. Then I also have my oat flour, which I talked to you earlier about. Let's see. I'm only using a couple tablespoons, which is about a total, maybe 12 grams of carbohydrates. Not too much, considering this batch will make about 14 cookies. Remember, you can double it, and that's not a problem. Let's start adding those ingredients. By the way, I've got my oven preheating to 350 degrees Fahrenheit, so you want to do that as well. I'm going to toss in the oat flour first, and the salt. We're going to add a little bit of salt to this, and baking soda. We'll pop that in, and I'm going to blend it up. Now, with the almond flour, I'm going to be adding about a third of it at a time, so that it blends in nicely. We'll just toss that in and just start mixing. The last thing is our chips. Now, I'm using Goutard chocolate chips. These are dark chocolate, so they have less sugar in them, and Goutard, in my view, is one of the best to use. I love their chocolate.  Line a baking sheet with parchment paper, that way the cookies won't stick. We're just going to drop these onto the pan in little mounds like this. Now, they don't tend to spread out very much, so you're going to want to help them a little bit. I think otherwise they'll stay nice and tall. If you like them nice and tall, they're going to be, you know, they'll stay that way. So, I like to smash them down just a little bit, and then we'll bake these in a 350 degree oven for about somewhere between 13 and 15 minutes. Cookies were out of the oven at 15 minutes. That seemed to be the perfect time for these, and now I'm going to give one a go. They're cooled off a little bit, nice and soft. Who doesn't love a warm chocolate chip cookie, right? I love the flavor. The flavor is very, very good. That date paste, just that caramelized flavor, just really fits right in. Delicious. And the oat flour gives it just a little more interesting flavor. I think almond flour by itself is a little bit bland, but I think that oat flour just bumps up the flavor quite a bit. Now, I find that the best way to store these are in a, say, a Ziploc type bag in the refrigerator, believe it or not. There's something about that.  Try it out. Let me know what you think.  Compare the two and let me know down in the comments what you think. All right. So that's our video for today. I hope you enjoyed it. I do appreciate it when you take time out of your day to stop in here and watch my video. And, of course, I love it when you leave me comments, so don't forget to do that. And please share the recipe for me. All right. We'll see you next time. Take care.


Hello, Stampers. Welcome to Stampin' Chat with Stampin' Jill. Hi. We're excited. Today, we're Aubrey and Beth. And we are so excited to be with you here on YouTube Live for the first time. We've been doing these live videos, these live streams once a week over on our Facebook page that have recently decided to switch to YouTube. So we have a beautiful quality to share with you. So you'll find us every Tuesday here at 1 p.m. mountain time. Yes. And we call it Stampin' Chat with Stampin' Jill. So we're the Stampin' Jill team. We are.  You'll get a couple of different people of different times. It's fun. We just kind of tag team it and play with something new each week. Yeah. So. So play along with us. Yes. What are we doing today? Today, we are playing with... Oh, I don't even know where I put it. There it is. With the gone fishing... Oops, this way. With the gone fishing stamp set as well as the dyes that coordinate. And Father's Day is coming up in a few weeks. That's the other day. So we thought this would be a good one to show you and get a kickstart on making some cards for the men in our lives. Yeah. And I know not everybody has a father to celebrate, but there are many men in your life. So we like to approach it that way that you can or if you just love masculine cards or fishers or fishers and this stamp set and dyes are just look how cute for a fisherman, whether or a fish or woman really. My favorite are the sentiments though. Yeah, you can use either you can use the ones that say dad or father, but there's also the good things come to those who wait, congrats, happy retirement. So super fun. Super cute. Super cute. Should we start playing? Well, and we love it because our dad is a fisherman. Is a fisherman. Is perfect. So I wanted to show you first before I show you any cards, this cool dye. When I was playing with this set the first time, it comes with this little dye that's like a tackle box, right? Like you can see on this card here, it kind of sections off all the different things. So it looks like a tackle box, which is really fun. Oh, it's like this. Like, yeah. So then when you run it through, you get that, but you also get all of these pieces that fit inside the tackle box, right? But they work for the sentiments in this stamp set. So you get kind of these cute different sized rectangles with rounded edges that punch out perfectly to use with the sentiments. So, so cute.  Right? And like on this card that I made, I used some of that tackle box as a background there behind that. Just a cute little add-on. Yeah. Beth has already played with this set. You should show them some of the ones you've already made. Okay. Especially that other one. I know. So love that one. So this one's kind of simple. I love the fish. These actually these fish are cut right from the designer series paper. So they have kind of that really pretty coloring on them. And I don't think you can really see on, oh, there you go. See on camera. I added some Wink of Stella on the fish in the background because I thought that was really fun. That doesn't make it super masculine, I guess, but that could be for a fish. Oh, it still could be because like rainbow trout. There you go. That's like scales, right? That's what I was thinking. Yes. Okay. And then I did this one that just is simple, but kind of features the designer series paper because it's really fun in that set. So cute. And kind of different little sections. I thought about the tackle box and I that's kind of what did, but little happy retirement. Very cute. A fun one. And then I showed you this one already, but here's a tackle box. This one was super finicky.  I even strung one of the little dies on there. They're so cute. Super cute. I know it took a minute, but I really liked that one. I thought it was fun. Love it. Love it. Oh, and we've got Patty. Hi, Patty. We're excited to be with you. I showed you guys this one before very simple. Just the fly in the corner and then I made kind of like a little lure lure.  So and that one would be fun with the different designer series papers. You could switch out the colors and kind of use all the different ones. It makes them really simple ones. And again, you don't have to use this. So glad you're my dad. You could swap that for any of the sentiments in this set. Yes. And I want to show you today. How I did this water. It was really fun. Let's see if you can see a little bit of the dimension. Let's see how I can do it. Maybe not. I'll just show you. But these are all just different dies that I cut on the designer series paper and shadowed with some of the ink. So I wanted to show you kind of how I did that today. So cute. Hey, and Aubrey, what are you working on? Let's get playing. I'm going to steal this peak. Do you say pecan or pecan? I say pecan. What do you say? I say pecan. Okay. Pecan pie. I wonder what's normal. You do different normally. I usually Beth says things differently. That's true. It's weird because we were raised in the same house. Yes. You guys don't know Aubrey and I are sisters. Yes. And Jill, who is the original stamping Jill is my mother-in-law. So I married her oldest son and I've worked with her for gosh, almost 16 years. Yeah. Because Gary just had his birthday. So 16 years and Aubrey's been with us for like, like 14. Yeah. So we're kind of a big dysfunctional loving family. And we love that you join us. Yes. Oh, there's Pamela and Connie. Hello. Thank you for joining us. So yeah, I'm on this one. I'm doing kind of a collage look. So I stamped. So there's this cute bobble. I know that's called a bobble. I was raised fishing. So I know some of these. This one's fun because it's actually two different stamps. So you have the back piece that has the whole round and then just the little piece that you can add the color with. So I did that. So I love that you call it a bobble because it's a bobber. A bobber. Yeah. At least that's what we always called it. Well, the feminine version is bobble. Okay. Got it. Got it. So get it right guys. Depends. Depends. I get it. Got it. This is a fly lure lure lure lure lure lure from southern Utah, Washington County. And then the fish. I'm just making a cute little collagey background here. What colors did you use on your red? Did you choose puppy? So no, I used calypso coral. Okay. Calypso coral is the color that's in this paper. In the paper. So I just tried to kind of stick with that. Yeah, because it doesn't have like a red necessarily, but yeah, those bobbers are red. So right, that's a good choice. And then I thought I'd make saying stamp it on this pecan pecan. I bet a lot of people say pecan. I know. I want to know what people say. I know you should tell us you guys, whatever you say. Oh, Sheila's with us too. Thank you. Sheila. Hello. I know I actually really favor making masculine cards. I don't know why it's just the colors. I think are kind of my favorite social tones are ones that I love. And so when this set first came out, it was one that I gravitated to. So I made some of these a couple weeks ago when we were just creating when the catalog stuff came out. Yes. Yeah, Beth is the only one in the office actually who's really played with this sweet. So she's kind of the pro here. Well, not the pro. Nope. And I am not sure if I have any more ideas. That's why I'm going to show you a recycled. But I'm going to show you how I did this little technique because it took me a minute to kind of figure it out.  But as you're creating, you just kind of bandage everything together because you have so many different ideas for sure. And then you just say, well, that's just a sample. It's just a sample. We say that often here in our office. Yep. So I just use this little dye. This comes with a set. It kind of has like a water feature or kind of like an embossed water part right there. And then it cuts the top of your paper to make a little bit of a wave. So I've cut these out different. They're different lengths here and I'm going to layer them on top of each other. But I was careful when I was cutting them out not to cut them exactly the same every time on each of the layers. I moved my dye so that I got a little bit of dynamic with the wave. I hope that makes sense. So they're different little bumps all along the way. Oh, hello, Monique from the Netherlands. That is so fun. So Monique, we just got back from Norway a couple weeks ago. I think this week we're starting to feel normal, but the jet lag was real. Yes. We were so our bodies were so out of it. Yes, we could not figure it out for a few days. So good evening. Yes, and it never really gets dark in Norway. Is that wild? Well, it the sun sets around 1130, but it still isn't like it is here. No, it's like always a little bit like light and then it rises at like 434. Yeah, something like that. Yeah. Will you have a linen thread? Yes, I will. Thank you. You're welcome. So I'm just taking misty moonlight ink and lightly dusting with a sponge dauber the tops of each of my little layers of waves. That's what I'm doing now. So cute. I'm just I love this linen thread. The this sweet doesn't come and it doesn't have any ribbon that technically goes with the sweet. So we thought linen thread was a good one. Yeah, when I was creating my other cards, it felt like linen thread. I don't know.  Yeah, easy to use and the colors, all the neutral colors kind of worked well with the browns and the base for these for this set. Typically we gravitate to basic white, but there's a lot of vanilla in this paper, which is kind of nice because it makes it a little softer. I don't know. Just adds a little bit of a homey vibe to it. Yeah, wouldn't you say? Yeah, or like out even outdoory outdoorsy outdoorsy. Yeah. Okay, I have dementia here somewhere. I know we're making a little bit of a mess on me. It's a little bit thick in here, but it's fine. So I've dusted with ink to give it some dynamic to show the different layers here and then I'm going to take my paper and just kind of roll it. I don't want to tear it necessarily, but I want to give it just some body, some texture. I find that's a lot of what masculine cards are about. You do a little less. They're a little simple, but if you can add some texture, it makes them look a little more finished. I agree. Would you say? Yep. Okay. Here's Monique. Okay. So did I. I went for a two week cruise and it gets dark only at the North Pole. It stays in the summer light all 24 hours and Stavanger. That's how we say it, right? We had a night, I think from 23. Oh my gosh. Oh wow. Yeah. I was glad we were on a cruise ship.  Yeah. It was pretty crazy. All right. There's my first card. Good things come to those who wait. So cute up. I love and simple though. Yeah. And that love those colors images are so cute. Cute. Okay. And I have another one that I already had kind of started here. I cut out all of these little bobbers and lures lures lures. It's not lore like a story. I can't say the word like a lure. Holy dad would be so embarrassed. No, he probably says it the same way. I'm going to ask him. Hey, without bias without bias. Yeah, right? Dad, this is very important. How do you say this word this word? And yeah, I'll just show him right and not say it. Right. That helps. You can't. Yeah. Yeah. Yes. How do you say the word that's spelled? Right. L U R E. Okay. So I've layered up my waves here. You can see. Isn't that fun? Do you love it? So let me show you this card again. Here's like the finished kind of version of what I did. And I you I left a little bit of room so that I could add my little bobble. Is that what you called it? Yeah. Bobble is like a diamond. I know that's the seven version I'm telling you. Yeah. Yeah. Bobber. Bobber. Because it's just popping, right? Because good things come to those who wait. This means a fish hasn't pulled on your line yet. Did you know that? Yes. So when it goes under, that's real exciting. Beep, beep. Right. Good job. You know. Okay. So that's kind of that idea. And then I was working on this card a little bit. So I'll keep I'll come back to this. Doing a simple one here. Yeah, I don't know what all. Oh, I'm really excited to do here, but I want to. I love the collagey look of this down set. Yeah. It's really fun that you can add different little accessories to it. Yeah. I want to do a little collagey look on this side here. Something and then I wanted to do happy Father's Day and do this one for my papa for dad is pretty great. He is. But really for fathers or for masculine cards. This is a great set. Yeah. And this that's available in our annual catalog. So it'll be available for us all year until next spring. Yeah. Which will be fun and we can get a lot of you son of it. I love when these sweets have coordinating designer series paper because it makes it really easy to work with. They just coordinate really well go together really well so that it's and it makes it I usually when I sit down to create I just grab the colors that are in the paper and it just the work's kind of done. Yeah. You'll see like when we do these lives we have a bunch of snap pads out every even has like a stack of card stock. I don't think you can see it. But typically we just pull we look in the catalog. I should show you that maybe you don't know when you're working with this week or with designer series paper. There's a little spot here. Let me find the page where it has the designer series papers listed and they have underneath them the colors that coordinate with the paper. So all of the colors found in the paper typically you'll find right here. The only time we found that to not be true is when it's a watercolor piece and sometimes the tones are a little lighter or darker. So we just have to kind of guess along with that. But this is really fun to show you oh I'm going to grab those card stocks. I have those snap pads and those are going to coordinate great with that set and then you can kind of just go crazy. I like that. Well and I love this designer series paper so much. Do you want to tell them about the sale this month? Did you forget about it? Is this one included? This one's included. Yes. Yes. So they stamp it up has a sale going all through June that you there's certain maybe select select designer series paper is 15% off. Yeah almond flung and this is one of them. So if you need some now's the time to get it. There's there's a few to choose from. So you I don't have a list of all of them right now but we are going to through the month we're going to feature some of those designer series papers. So yeah so go on and check those out. If you're going to be ordering this anyway might as well get a little discount and have some great paper on hand and our designer series paper is double-sided which I love and you have a habit. So let me show you will have like one side to be kind of a good pattern. This one you can see our little fish hooks but small and then on the other side is just a plain gray stripe. So there's lots of ways you can use the designer series paper but the colors coordinate really well.  I love that. Yes. Super cute. I don't know where my dimensionals went. Oh, I haven't.  Oh my gosh. Well, this is why you have four in your drawer because you just keep grabbing like I don't know what happened to those. That's so weird. I don't know where my dimensionals are.  So, so weird. Well, it's fine. It's been a long day. It has been a long day. It doesn't feel like it. Right. All right. Well, we'll keep creating. Yes. Typically you guys we post stills of still pictures of the projects that we create and I think we're still going to plan to do that in our Facebook group. Yeah. So you can go and check there after the video is over. Usually we post them that same day after we just finish them up. Yes. So we can post a link to our VIP Facebook group. If you want to go and check out those still pictures of these of these samples that we've created. Yes. Super fun. And that that is a fun that group is a fun way to kind of connect and see what we're doing. Yeah. Kind of first. Yeah. I think that's kind of the first place we post a lot of things. Yeah. You can find us there and we'll get those posted this afternoon and we'll look forward to seeing you next week. Yes. Next Tuesday. Yeah. Or you can join us tomorrow here on YouTube. We post a Watch It Weekly Wednesday video every Wednesday. Yes. So you can join us for that tomorrow as well. Yeah. And please so you don't miss any of these lives or those Watch It Weekly Wednesday videos. Make sure you like and subscribe our channel. Yep. Perfect. And we'll see you next time. Hey, thanks for joining us. Thanks.


Welcome back everyone. Today we're going to be talking about the Observatory by Mozilla, and the Observatory is basically a way to test the security of your website. And it's not doing any type of vulnerability assessment, but more what the client or client side security would be. So is there secure communication basically between your website or your server and whoever is visiting your site? So again, not necessarily security scanning to find vulnerabilities, but just looking for basic security configurations that we can do to make our users a little bit more secure in the way that they actually access the data on our site. So the first I'll talk about their web interface. And if you go to hdpsobservatory.mozilla.org, you can find this just plain website and you can see you can enter a domain here. So I'm going to go ahead and enter our domain for the university. So global.ac, howlem.ac.kr. And then there's just a few options here. Don't include the site in my public results. So I'm going to uncheck that even though this video is public. It's okay. And then force a rescan instead of returning cash results. If it's been a while since you've scanned your website, you might want to force a rescan instead of using cash results. And then don't scan with third party scanners. If you don't want other tools that they're using to be able to access your site. So I'm just going to select don't include my site in public results for now. And then click scan me. And what this is doing is going through and scanning my web server. And all of basically the web server hosted at on my server and checking for all of the different security configurations that a client would normally see. I'm going to run through a couple of these. So first off, I'm getting a B plus and I'll tell you why, why that is most of the sites that I scan with this get get an F and don't have any of these things set. So I'll talk about a few of them in a second. Let's go down to the test scores. And you can see basically what they're checking for. And they even have more information on each type of criteria that they've set. And basically, most of this is setting your web server to have a particular header, some sort of security header. So for example, X content type options header set to no sniff. So then this will basically go through and try to communicate with your clients in a more secure way. So that way, people can't, for example, sniff traffic or read your cookies. So there's cookies option here. All cookies use the secure flag. All session cookies use HTTP only flag. So basically, this just tells your users, the users of your website, what kind of security does this server support and what do we prefer. And most, most websites, again, like I said that I look at don't have any of these headers enabled at all, which means that their cookies are sent non securely, which means anyone could potentially grab those cookies and replay them and pretend to be somebody else cross oriented origin resource sharing or I get knocked off because of the content security policy. For example, we can use this to say what scripts or where do I allow scripts to run from. So right now, because I'm transferring over I'm using this unsafe inline, I have one script legacy script that I can't move over yet. So I have to use this unsafe inline but I'm working on changing that. So constant content security policies basically say my website can run code from this location and not other locations, which means that if somebody's trying to hack my site, if they want to try to inject their code, they also have to be coming from the same locations that I allow makes it much more difficult to do some sort of code injection from from a different source. Okay. Different types of refer policy. So basically, there's a couple different criteria, I won't talk about all of these this I in the side, it gives you all of the information you need about what these are and also how to fix this on your own server if you haven't already. So this website is really good for giving instructions about how to make your your server or your website more secure for your users. So I highly recommend you test your own website and then look at each of these options and talk about them. And then there's the individual tests, raw server headers. So this is actually the results coming back from my server, what my server is sending to Mozilla in this case. And then if we scroll up, you can also see the TLS observatory and then some other ones. So let's look at TLS. And this is basically what types of TLS or HTTPS certificates are supported and I'm using let's encrypt so free and and works works well for me at least. Okay, so this is actually the web interface to be able to scan a website that you're hosting and see what's wrong and what you can potentially fix relatively easily. All of these protections, it took me about 20 minutes to configure everything. And then, yeah, so the website was was much more secure after that basically. Okay, now, what I'm interested in is all of these headers, or all of these configurations are, let's say relatively standard, their best practice more or less now, or at least they should be so we can assess a website or a group of websites really quickly to see how secure they are. So I wanted to do that from a program rather than putting every website that I own into the Observatory by Mozilla web interface, right? And they are very good because they offer a couple different ways that we can actually access the observatory. And one of them is through this command line utility, this is a GitHub Mozilla HTTP observatory CLI. And then see command line utility, they are using Docker. And they have a Docker image that you can download and run directly from that, or the one that I prefer is the Python option. So I'm going to show you today how to install from Python, which they tell you in the instructions. So all we have to do is open up a command line, I'm running in Linux right now. So if you're in Windows, you have pip installed, it should still work. So we want to run pip install HTTP OBS dash CLI. So pip install HTTP OBS dash CLI. And if I hit enter, it's going to tell me I already have everything installed. This one, I didn't have any issues installing directly from a default install of Ubuntu Linux. If you do have issues, it's probably because, you know, package manager is not up to date or something like that. But I've never had any trouble installing from pip for this. And then whenever you want to run the observatory, you can just type HTTP OBS. And then I sometimes do dash CLI. And then this is the tool that we can run. Now, I typed dash dash help. And this gives us the options for the tool. And you can see here, there's the debug option, there's re scan, just like we saw in the web interface, re scan will re scan the website instead of using a cached version verbose, progress indicator and a little bit more information hidden do not list the scan and the recent scan results remember I checked that in the website. And then zero show test results that don't affect the final score. So this is everything, all of the different tests that they can run. Okay. So then let's do an example of this, where we will scan a website. But we will not show it on the web interface. Right. So I want to scan a website, but still be relatively discreet about it, I guess, I can run HTTP OBS dash CLI dash X, because I don't want to show it on the website. And then global dot halem dot easy dot k r. Okay. So now it's going out. And since we just scanned this, it's already been cached. So it should just get back the cached. Yeah, cached from nine hours ago. Okay. And then the score is the same. So score 80 out of 100. And then the modifiers are basically these refer, refer policy and the content security policy. So now I can see the main things that are affecting my score. And then we could use the, what was the option the dash Z option to see more. Let me just go ahead and run that real quick. Now, the, the Python module. So here's everything that's affecting my score, the Python module or the Python version is using an API from Mozilla. So I am actually connecting back to their server. I'm not running this locally. So just be aware that the Mozilla server is scanning your website. So if you have some sort of firewall or intrusion detection system, you will see scanning coming in. So make sure you don't, don't block it if you actually want to be scanned. If you do want to be scanned. Well, yeah, anyway. Right. So this is basically how we can get really quickly a score for a particular website. Now this is useful for a lot of different things. Depending on the country that you're in scanning for this kind of information might be considered suspicious. But I don't think it would be considered illegal in most countries because you are getting public information. You're just connecting to the website and then looking at the headers that they provide to you. You're not downloading any hidden content or looking, you know, brute forcing directories or anything like that. You're just assessing the content that they are sending back to you intentionally. So I wouldn't consider this any type of hacking. Like I said, it's not some type of an aggressive scan. It's literally just a connection and looking how the conversation works basically. So I use, I've used this actually quite a bit. So I thought I would share it today to see or to show you how you can quickly get at least a basic security assessment on a website. If all of these things have been set, that means that at least the web server administrator is thinking about security. If none of them have been set, you might want to ask why, especially depending on what the what the website is. So an interesting tool, just something I find useful. So I hope you enjoyed it. Thank you very much.