we're gonna get started. So if everybody could please take your seats. Great. So as you can see we found a solution thanks to the lovely gentleman who lifted Reagan up which by the way was Reagan's preference because she wanted to make sure that all of you could see us. So that's how we make stuff work. Which we as actors this wasn't how I intended to start this but I'll start it here since it's a good place to start it. Which we as disabled actors are it's a constant negotiation for us and you just saw that in action. So thanks Reagan. So I'm just gonna start by introducing myself and my esteemed colleagues and tell you a little bit about inclusion in the arts the organization that David and I work for. David who you just saw his amazing performance. So my name is Christine Bruno and like I just said I'm an actor and I'm also disability advocate for an organization called inclusion in the arts. We're a non-profit based in New York City. Basically in a nutshell our reason for existence is to promote the full inclusion of actors of color and actors with disabilities in film, theater, television and related industries. So that's what we do. We've been around for 30 years. We originally were founded in 1986 to address problems of racism and exclusion in the industry and our current executive director Sharon Jensen when she came on board in 1989 felt that it was really important to add disability to that diversity conversation. So basically essentially for the entire life of our organization disability has played an integral role in any conversation that we have about diversity. Just quickly a little bit about what David and I do. I started at the organization in 2005 because Sharon felt and rightly so that the disability was while the conversation about race and ethnicity was moving forward by the time I started in 2001, 2005 the conversation about race and ethnicity had moved significantly forward although as we know there's still a lot of work to do. The conversation about disability had not moved forward and she felt like there really needed to be a specific person in place to sort of help usher decision makers into working with artists with disabilities and whatever that entails from casting referrals to consulting about scripts, consulting about accessibility issues, accessible audition spaces, hiring interpreters and just about dispelling the myths and assumptions of what artists with disabilities are capable of in general. So that sort of is the my function and David came out in 2009 and David is the disability and programming associate. So our job together basically is to increase the opportunities for artists with disabilities on our stages on our screens. I'd say about 60% of our job is casting referrals meaning we get calls from casting directors from decision makers looking for talent with disabilities for specific jobs. The other 40% is things like this, our advocacy going out into communities speaking at great conferences like LEED and other TCG and those sort of things just making people more aware. And I think strides have been made as we see, as we can see from the increase in the participation at LEED. Which I think Betty now is at what did we say up to 450? 470. So that's amazing. So our conversation here today like Tiffany said is to speak not necessarily to audience participation but to the artists with disabilities component is getting artists on our stages specifically. And we're so lucky today to have Reagan, Linton, I don't know who those of you were here for Thursday night saw Reagan's amazing performance. And so Reagan is here to speak about her work as an actor and specifically around her work as an actor with Oregon Shakespeare Festival. And this is Julie Simon from Oregon Shakespeare Festival. You're the access coordinator is that your correct title. So we're just gonna have an informal conversation with Julie and Reagan and then I'm gonna open it up to questions. So in doing I had a great conversation with Julie and Reagan about a week and a half ago just about their experience, their specific experiences of working with OSF and how to sort of navigate that landscape of being an artist with a disability in a major theatrical institution that has a long and distinguished history of working with artists and bringing disabled artists into the fold. So we're gonna talk a little bit about that. I'd like to start by, excuse me, my research. I found that OSF has on their website what they call a value statement and they have one, two, three, four, five, seven core principles. And I'm just going to read you the core principles are excellence, inclusion, learning, financial health, heritage, environmental responsibility and company. And they say, these are the values we hold at the Oregon Shakespeare Festival. They're the center of everything we do how we and describe how we work together. While we recognize the need for balance among them, these values guide us in all of our decisions. So I'm just gonna read you their value statement on inclusion so we can frame this conversation with Reagan and Julie today. So as inclusion, they say, we believe the inclusion of a diversity of people, ideas and cultures, enriches both our insights into the work we present on stage and our relationships with each other. So if anyone's ever been to OSF and I'm sure you all know about OSF. In doing my research, I found that they've actually done a significant amount of work around issues of diversity, equity and inclusion in recent years. And these are just some of the things that they've done. Like I just read the value statement, they have an audience development manifesto which they developed in 2010. And am I right about that 2010? Yeah. They have a disability inclusion planning council. They hired a diversity consultant. They created an access coordinator position which Julie holds. But for how long have they had that? I think they've had an access coordinator position for quite a while, but it was part time for a while and it has grown. They've established action committees. They've established access committees for audiences. They have affinity groups. They have the development of the open dialogue series. And what we're going to talk about today is the hiring of deaf and disabled artists on stage and behind the stage in artistic positions. So if you just look at that, if you just go down that list, that's a pretty impressive commitment to issues of diversity and inclusion. And I would like Julie and Reagan to talk a little bit about their experiences working at OSF. And I think the first thing I'd like to know is how did both of you come to work at OSF and start with you, Julie, since you're... Good morning, everybody. I became the access services coordinator in March, though this is my seventh season with OSF. And my first five seasons, I was the lead interpreter for the deaf actor in the company during his rehearsals. But I've also been a patron of OSF for over 30 years. And so that's how I came to know about OSF. As access services coordinator, most of my job is outward-facing. I work with patrons. We provide audio description, open caption, interpreted performances. I also work with patrons who have mobility issues. I work closely with the box office to make sure that patrons are seated where they can enjoy the performances. At OSF, as Christine just mentioned, we have the audience development manifesto. We have open dialogue forums which occur every two weeks on various topics around access, disability, diversity, inclusion for all aspects of the company. We don't necessarily have one person in the company who deals with accessibility for company members. But there are a number of us in the company who do work on that as part of our jobs. I'm interested in... What's the other... You have another component to your job which actually isn't your job as access coordinator. Could you talk a little bit about working... You're working with Howie? Certainly. As I mentioned, the first five seasons I was at OSF, I was the lead interpreter. I do have a perspective from the company side when Howie was offered a contract, the artistic team realized that they needed to hire interpreters. Howie started in 2009 and my first season was 2010. We worked closely with company members, stage management, with the acting company, with the costume department to make sure that his needs were met in terms of communication. Part of the commitment to diversity around hiring deaf artists is providing appropriate services and that means hiring interpreters. For the first couple seasons OSF relied on local interpreters. If any of you have been to Ashland, Oregon, we're in the southern part of the state. It's very rural. We have a very small local deaf community and a very small interpreting community. Howie's first season, they relied on local interpreters who had other jobs and they... I don't know that he actually had full coverage for all of his rehearsals. I was brought down during his second season for a three-month period to cover his rehearsal period as the full-time interpreter and then my team members were local interpreters. Then I moved to Ashland. I was one of the local interpreters and we did need to bring interpreters in from out of the area because those of us who were local had other jobs and we weren't available as much as needed. OSF also used a sign coach, brought in a sign coach the last couple of seasons to work with the other actors in the company on translating their lines and teaching them their lines in sign language. So we needed to provide interpreting services for the sign coach often at the same time that Howie was in rehearsal but they were in different rooms. So we've worked really hard to develop a team of interpreters to make sure that the communication needs of everyone were being met. So it's a process, it takes commitment not just philosophically but also financially and I think that's... we've been very fortunate at OSF that we've been able to cover the communication needs that we needed to cover and OSF has provided that financial support. So because you've been working with Howie now for a number of years, Howie, and I realize I didn't say his last name, we're talking about Act, his name is Howie Seago and he's going into his seventh season, is that correct? Working with OSF? Howie is not currently in the company but he will be back next season and so I think it will be his seventh season next year. Yeah I think seven which is amazing. So what are some of the... quickly I don't want to get to Reagan but what are a couple of the interpreter-based lessons that you learned through that process of figuring out what the best situation would be for Howie to meet his artistic needs? Well one of the things is talking to Howie, talking to him directly to find out what his needs are. One thing that I think it's important to realize is that it's not the deaf actor or the deaf sign coach's job to find the service providers but I think it's important that they be involved in the process and so Howie was very clear about what he wanted when we were looking for interpreters to bring in from out of the area for a three month period. We worked with HR, we sent out a job announcement and I worked with the producer for the company to screen the applications and the applicants and then we forwarded the three finalists to Howie and he had a Skype call with them so he could talk to them directly in sign language and make sure that the skills that they had were going to meet his needs and then he told us who he recommended and so we did it that way so it's very important to make sure that the deaf artist is involved in the process but is not the one who has to go out and find the service providers so that was something and over the course of the time that Howie was in the company for six seasons his needs changed depending on the kind of roles he had the size of the roles what the needs of the production were and so it was important to make sure that the interpreters knew what those changes were and we would have a staff meeting. As the lead interpreter it meant I was also doing the scheduling so I would meet with the interpreters at the top of the rehearsal period and we would have the stage manager from Howie's show come in and talk to us and we would make sure that we were all on the same page in terms of communication access. Howie was responsible for his own actor needs just like the other actors were but we wanted to make sure that communication was clear. Howie was the one who explained to the rest of the company and to his cast members what his communication needs were we just provided the interpretation and I think one of the really nice benefits is that everyone got used to having interpreters in the room so that when we had interpreted performances the actors in the company and the stage managers were used to having signers there which was a really nice benefit and so it wasn't just the benefit of the cast members or the general acting company because at OSF we have usually between 90 and 100 actors in rotating repertory theater every season so it was the whole company but it also was a benefit to our patrons when they came to see interpreted performances. Thank you. Brigitte, how did you come to OSF? How did I come to OSF? In a wheelchair. No, I think it happened so I started out in Denver, Colorado. I was working with a group called Family which hopefully some of you are familiar with. It's a company that works exclusively with actors with all different types of disabilities and so I was performing with them decided to go to graduate school. I went to UC San Diego and there was a bit of a relationship between some of the professors at UC San Diego and OSF so Scott Kaiser the development of the company the develop I don't know what his official title is but he's he's essentially responsible for going out and scouting talent and developing the company and he came down to San Diego and ironically for those of you who saw me the other night saw me in a production of Glassman Hatchery and became interested in me and so it just kind of happened that I became aware of OSF they became aware of me. I was not cast immediately right out of graduate school in 2013 but a year later I auditioned for Joy Dixon the casting director in Los Angeles and was cast. And I'll just mention I was not the first wheelchair user ever to be cast at OSF. There was another actor in the 90s who was cast and I'm from a you said you remember I did I said his name the other day when I totally forget he was a he had been in a production of Midsummer Night's Dream in the 90s. However I was the first repertory company actor hired and the important distinction of that is that I think sometimes for artists with disabilities it can feel like we're we're brought in when it fits you know for a one production here one production there as opposed to saying hey you're a well-rounded artist you have the ability to you know transform and be in different productions. So I was cast in two different productions at OSF last year one was much to do about nothing and one was Taiwanese play. Both roles had not been written for a disability and I will also note that one of the first unique experiences of OSF was that I had been cast as an understudy because most of the repertory actors are cast as understudies for one or two roles. So I was cast to have an understudy in Anthony and Cleopatra which was out on the outdoor Elizabethan stage. They realized after they got there that the role that I was supposed to understudy was supposed to be on both levels of the Elizabethan stage and the second level was not accessible so my understudy was canceled my understudy position. So that was one of the first experiences that OSF had of oh casting somebody with a disability takes a little bit of additional thought in terms of you know what other functions that actor is going to have. I will mention they also had another experience the previous year involving race and understudy and somebody that had been cast and then all of a sudden they realized oh this was potentially not racially appropriate casting for the understudy. So it's not just disability that they've been having that experience with. So yeah but that's a little bit about how I came to OSF. I'll also mention that when I came to OSF generally the environment aside from the Elizabethan was fairly accessible. They did end up renovating an apartment because at OSF actors are housed by the company and they did not have any wheelchair accessible housing so they renovated an apartment which they also felt was a long time coming in general and gave them the opportunity to do that. I gave them the opportunity to do that and there were other various things that they I guess renovated or updated but I think one of the important things also to emphasize is that it did not take a huge additional financial commitment of any kind. The accommodations that it took to bring me into the company were very small and so I just want to emphasize that because I think that's often a misconception that it's going to take a huge financial commitment to bring in artists with disabilities and that's not always the case. So what was I just want to also mention in your bio I read that you were the which I knew anyway you were the first wheelchair user to graduate from UCSD is that correct? Yes I was the first wheelchair user to be brought into that MFA program at UC San Diego. When I was researching I found approximately five people that had gone through some of the top graduate MFA acting programs across the country that had disabilities and so it felt like a pretty big deal you know to to have a wheelchair represented in one of those one of those companies and I'll just mention that since I've been there a couple years after I graduated they they took another actor who has Ruble Palsy they also one of my friends Jason Dorward is a quadriplegic and he's in the graduate the PhD theater program there so I feel like if there's one school I'll just give a shout out that UCSD is starting to create a tradition of bringing actors with disabilities into the program which I'm really proud of. That's great so can you talk a little bit about what the actual experience was like on a sort of on a day-to-day basis sort of navigating the campus sort of the rehearsal process if there were any issues in terms of did you have a someone to go to to like for instance Howie had Julie as his sort of point person because there was there there was already groundwork laid because they had worked with Howie before so by the time you get to the fifth or sixth season there's kind of a protocol in place what was it like for you since I think I don't know for sure because I wasn't able to find this out in my research whether they actually have hired anybody with a mobility disability since I saw Ken Crow 20 years ago at OSF yeah I I'm not I don't I did a lot of asking around when I got there to try to figure out answers to those questions as far as I understood I don't believe there was somebody I think they did a production of Welcome Home Jenny Sutter a few years ago do you know whether that actor had a disability there is so there was a play about a returning veteran I believe who had a disability and I'm not sure whether the actor that was cast actually had a disability I think she did but it wasn't a wheelchair based one anyway I think in general one thing to be aware of is that OSF is on the cutting edge of a lot of inclusive diversity work however I think they would be the first to admit also that in the pantheon of diversity and inclusion disability has has been kind of the last the last one to make it into the mix and they're working on changing that and particularly when it comes to the acting company there there is representation of actors that have disabilities non- visible disabilities but I think Howie has been one of the main individuals who's who started to change the tradition of hey disability is also about you know particularly when you're working in a visual medium or something that is representational in terms of what we what we take in in front of us that visible representation is really important the the visible representation of difference whether that comes through communication whether it comes from new mobility um so that was something that was and I'll also just throw in I think it's also something that I've experienced a lot as an actor with a wheelchair one of my friends who formed family she was one of the founders of family used to say you know it's so funny that like Broadway can get these gigantic multi-million dollar fake elephants on stage and you know but they can't get a wheelchair on stage you know and that's why as you'll see this morning I know there are different philosophies about like when technology breaks down how do we accommodate but one of my big passions is to emphasize that there's always a way as as long as there are other human beings who are creative and we can work as a community there is always a way to get a performer with a disability on a stage um and and so I think it just takes some ingenuity and sometimes some manpower or woman power um but that's why I chose to accommodate this morning the way I did of saying hey just pick me up and put me on the stage because I think that's often at least for my experience being in a wheelchair that's how we do it and I will just mention at OSF one of the one of the environmental challenges is that the dressing rooms in the bowmore theater where I was doing both of my shows last year are downstairs and the stage is up one level so every time I went to the stage I had to take an elevator that is also being shared by the costume crew that is taking costumes up and down um and Bill Roush you know bless his heart I gave him a wheelchair tour at the end of my of my time there because I thought you know it's important that you kind of understand the you know the route that we take as wheelchair users and he was he was very surprised by a lot of it um he visited a couple places on the campus he had never been to because he just didn't have to take that particular wheeling route he also didn't realize that I had to take an elevator every time I wanted to get on stage luckily there was only one show during the season that for which the elevator did not function and at that moment it was it was about two-thirds of the way through the show and I had to get on the stage and so the stage hands picked me up and carried me up the stairs um so anyway I think in general the environment was is not entirely accessible I think the attitude of OSF was very proactive in terms of um coming to me and as we mentioned before there's not a point person for an acting company member or um or a company member you know for instance uh Michael Mag is the head lighting designer at OSF he uses a wheelchair um but there's not a person that is designated specifically to to be that point person for acting company members and deal with their access issues so it was a lot of kind of cobbling together we're like well do you go to the um stage manager for this do you go to the box office for this do you go to the safety manager and that sometimes was challenging of feeling like hey there's an issue I don't know where to address it and one other thing I'll say and then I'll I'll pass along I'm sorry monopolizing but um there wasn't there there is was an access committee when I arrived at OSF that's actually how I met Julie I think the first time which was intended to address issues of um of access at OSF um but I think I I found that sometimes they were addressing issues more dealing with the patronage as opposed to the artist concerns and I think that's something that also OSF has realized um so that's what I'll say Julie I have a quick question for you sort of bouncing off what Reagan just said so so the fact that there is no real point person for members of the acting company with disabilities did did any of that sort of inadvertently fall on you as the access coordinator for patrons and and how do you navigate that and what suggestions would you have for for rectifying that well I've only been the access services coordinator since March so my tenure has been pretty short I think um I think what has happened in the past is that company members would go through their own department so if it was a company member in the costume shop or the production building or the box office they would go through their own supervisor and some it might end up at HR or somewhere else I'm happy to serve as a resource to to company members my job is outward facing and I do focus on patrons but I'm but I do work with other departments in terms of the open dialogue forum that we were talking about earlier I hosted the open dialogue forum two weeks ago uh two two and a half weeks ago it was in conjunction we had four interpreted performances over the weekend and so I asked if I could host the open dialogue series during that week because we had all of our performance interpreters in town so the performance interpreters were there our open caption operators our audio describers and company members from all departments and we were talking about general access issues it wasn't just about patrons it wasn't just about the deaf community or or deaf company members and it was it was really good and several people brought up the issue of who who who do we go to if we are a company member and we have these issues and so that topic of conversation is now on the forefront and we're going to keep that going um one of the things that was mentioned earlier is that OSF has had a diversity consultant for several years a woman named Carmen Morgan and there is a diversity and inclusion planning council of which I am a member I have been on the committee for about three seasons and and most of the talk is not around accessibility issues and there are a couple of us who are who are trying to change that and that was part of the reason I wanted to host the open dialogue series so that we could talk about access issues and what that means for company members what that means for patrons what does that look like not everybody has a visible disability one of the one of the other really nice things that we have at OSF are affinity groups we have four public affinity groups we have several that are private affinity groups and we have a new affinity group this season it's called the neurodiversity affinity group so that people who process information differently company members it's not for patrons it's for company members who may have traumatic brain injury or may have post traumatic stress disorder or might have autism or or asperger's or dyslexia or something can get together and talk about what they need as company members talk about it in a safe space one of the the head of our voice and text department Allison Kerry I'm sorry Rebecca Clark Kerry has been working with actors who have dyslexia or who have other issues when it comes to reading scripts and she's been working with them for a couple of years on what font size works what what font style works what maybe you need a script on a paper color other than white and so we we're working she's working with actors in that realm so there are people within the festival who are working within different departments and for different employee constituents page company members on these issues and and the open dialogue that we had a couple weeks ago brought a lot of people together to talk about this and there were a lot of people there who had never thought about these issues who work in different departments so now they're thinking about it and that's part of what the open dialogue series does and just is I would imagine for for someone like Reagan with a mobility disability there would be discussions with the designers around set any potential set issues is there any sort of negotiation in terms of aesthetic versus practicality yeah so I'll mention a couple a couple different examples first of all for myself as a wheeling performer sometimes costumes are a consideration and the costume department was very very accommodating in talking to me about what I needed and being open to okay here's the design but how do we how do we adapt this so for instance I was wearing a shawl in one of my in one of my performances and a shawl for those of you who have ever wheeled with a shawl or use your arms like it can easily fall off and so they would put like little snaps up at the top similarly I was wearing some some gloves that were like velour and I was thinking well pushing that's going to be really difficult because it just slips and so they put some like grip on my gloves in terms of staging there were a couple of interesting experiences I had one was that for much ado about nothing they were kind of putting it in this outdoor villa and they wanted to use turf on the stage so they actually came to me a few months before I got to OSF and said hey you know we're thinking about putting turf on the stage when you get to OSF can we give you a couple different samples and have you roll on them and tell us what what works for you so when I got to OSF I rolled on the two different samples and I said oh well you know really this this one that's a shorter cut works a little better for me so come to you know first rehearsal on the stage they had chosen the other one the longer cut but I appreciate that at least they consulted me about it but I think that was a really a really great example of like you know they took it into consideration they still decided for design purposes to go with the other one which made it you know so I had to accommodate slightly and I got my workout pushing across the the turf every every show so it was just you know an example of like thinking about it is one step and then putting it into action is the next step I'll also say when I was working on my other play the Taiwanese play we realized that going off the stage on one side there was access to get to the backstage if we went off the other side because of some of the set pieces I was not able to get around to go down to the dressing room and the the director had directed me to come off of the right side of the stage and then it was going to hit intermission and so I was like well I'm going to be sitting on the right side of the stage like for the entirety of an intermission you know essentially like 30 minutes so he ended up crafting this moment during intermission where I would cross the stage theatrically which was really just to get to the other side of the stage so that I could go downstairs and drink some water so you know again ideas of how sometimes it can feel like design and accessibility are in conflict and it's that's really not true it's just a matter of finding where is that middle ground and finding a compromise and a creative way of solving these problems or not problems but solving these conundrums um Tiffany I just want to do a Tiffany and she's talking Tiffany could we do just do it I just want to do a quick time check so we don't because I want to give time for the audience to ask Reagan and Julie questions we are right now at 1115 almost so if we want to go a little over because we didn't start right away okay that's fine do you want to say we have 10 minutes 10 minutes 10 minutes uh for this section or 10 minutes 10 minutes total probably 10 minutes total unless there are key points we want you guys to say what you need to say okay all right so yes of course you can I want to add something about what the aesthetics of the show with a deaf actor on stage there's going to be sign language on stage and if you've got a right-handed signer and the signer is signing so their right hand is facing upstage what they sign or what they fingerspell may not be clear to whoever they're talking to and part of the discussions around and rehearsal uh were around who's the communication for it mostly for the production so what other actor what other character needs to see the sign language who's signing to each other are they looking at each other are they in our Elizabethan stage we do have several levels if you've got two people who are communicating on different levels they have to the person on the upper level has to be close enough to the edge to see the sign language that's being done on the lower level so there were some staging and blocking considerations around having a visual language as part of the production and that's where the director and the actors all of them not just the deaf actor but the hearing actors work together and collaboratively to make sure that this was going to work out they also work together to figure out cues if there was a pause before how he had a line because a lot of actors go off auditory cues and if you've got a deaf actor who can't do that you need some kind of visual cue so they would build in movements the other actors would build in movements that would provide visual cues so that how he could then say his line at the right timing and it could have it sometimes it was just a matter of one actor putting his hand on another actor's shoulder and that movement was enough of a visual cue for how he and it did nobody else nobody in the audience knew that that's what was going on so there are ways where within the rehearsal period everyone involved in the production can work together to make sure that there is inclusion on stage to meet everybody's communication needs so I just want to um because we haven't talked about sort of what the impact is about what we're talking about having disabled actors on stage what is the impact on the audiences what's what's your experience been Reagan specifically let's just use OSF as the example what what kind of feedback did you get from the audience yeah um I'd say the feedback was overwhelmingly positive and overwhelmingly encouraging um you know a lot of the time when I would roll off stage uh OSF outside you have this area called the bricks where people kind of gather and people would often encounter me some of them wouldn't realize that I actually used a wheelchair in real life they thought it was just a character choice but that was like a little shift that I realized is really important to acknowledge that because there's not that tradition of people with disabilities actors with disabilities playing roles people make that assumption that it's a character choice which I think is something good for us to realize oh there's still there's still a lot of um you know ground to be covered there in terms of changing that tradition so that people at least think oh that actor might actually have a disability um overall everybody that I encountered said hey this is something we've been waiting for we want it we're so glad to see OSF is doing it um and so I think if there's if there's a takeaway one takeaway that I'd like to offer from today it's that it's important to think about changing the tradition uh of inclusive you know casting and that doesn't happen just with one show that happens with bringing a Howie back for seven seasons that also happens with not just bringing Howie back you know that happens with bringing in a Reagan it happens with making five percent ten percent of the the company inclusive of people with disabilities you know particularly for OSF when you're dealing with a company of a hundred actors and granted OSF is doing a lot around different types of inclusion and so sometimes there are just you know unique requirements in terms of the material that they're doing um but that's another piece is choosing the material and what are the stories you're putting up there and I think particularly um you know when you're just thinking of what inclusion means it is always important and I know most of us in this room probably know this that you know disability is something that can affect anyone and probably will affect anyone and it is hugely represented in our human population so I think it's something like 15 percent in the United States or 20 almost 20 percent of people in the United States identify as somebody with a disability so if you are putting work on stage that is meant to reflect the actual human population there is no way that you can leave out disability um and shoot there was one other thing I was going to say but it slipped from my mind so I'll pass the mic and then when you have do you have any closing thoughts Julie before we open it up we probably had time for like two questions so if you have a burning desire to say something please do okay so do we have any any questions I think a mic is coming your way hi I'm Kristen from City Theatre right here in Pittsburgh and um I have a question and it might not be the best question given the amount of time we have because it could take a long discussion but I feel like I want to at least put it out there now and maybe it's something that continues throughout the day and it revolves around language and this has been something as I've sat through some lead sessions earlier this week that has been coming up and it really excites me to sort of have this conversation Christine when you were talking about the alliance you referred to the artists that you work with as disabled artists and you know for the last however many handful of years we've been really big on people first language and using that as sort of our basis for how we talk about you know our patrons our artists but I've been encountering more and more artists who have disabilities who are are flipping that back the opposite direction and talking about that you know as as sort of you know so important in their art and just in their identity and I'm not sure that there is a a right answer but I'm just curious to hear since we have all you wonderful ladies up there sort of your perspective on that a little bit. I'll just give you my perspective personally I prefer I prefer disabled artists because it's it's a it's a term of empowerment for me right but in our organization we use them interchangeably because we understand that the industry the industry has fairly caught up to people first language so that's why we haven't sort of fully adopted the using disabled as an adjective first the empowerment sort of social justice component but we use them interchangeably I don't know how do you feel Reagan. You know I don't have one perspective I think if anything yes I see myself as just somebody who as all of us are we're all unique in our abilities and so I've I've kind of historically not gone for disabled because I just think I operate I move through the world in a my own unique way however I think the biggest thing to that I like to emphasize in this way is don't let the terminology get in the way of having the discussion that we are all going to is I don't know if it's okay to cuss on Hal around but we're all going to fuck up you know like and that's okay the important thing is that we continue to have the conversation and that we you know if you're having a conversation with somebody then ask them what terminology they use and then get on with it you know don't let that be the thing that holds us up from you know having the more difficult parts of that discussion about how we how we just get actors on on stage and I think that's a if we have one huge takeaway from today if we had to pick one I would say talk to the artist consult the artist because they're going to know what's best for them and what they prefer instead of making assumptions about what you think they'll prefer what you think they'll be prefer to be called so I would you know if we had to choose one which of course we don't that that would be my one Julie one of the benefits we've seen from the open dialogue series that happen every two weeks is that we're learning how to talk about these issues because even though we have great support from our leadership team from the artistic director and the executive director we have it in our mission statement not everyone in our organization is in the same place on this journey of learning how to talk about diversity and inclusion and accessibility and by having these regular discussions on different topics we're all learning together how to talk about it and how to be comfortable with the words coming out of our mouth or off of our hands and so that's one of the benefits of having the open dialogue series we come up with a lot of ideas we don't come up with a whole lot of answers but we're asking a lot of questions I've got a question for you because as as you were talking I was thinking about my own scenario teaching at Duke and the head of the arts program there is has got hearing impairment although he's come to that recently and he's a musician and thinking okay we got to get him to think of being a part of the disabled community so that we can get him to loosen up some purse strings I mean just practical thinking there strategic maybe and I was wondering what it was at OSF that provided the impetus for them to really jump on board and and get so engaged in this you know and maybe there's some lesson there of how to get other places to jump on board and was it a person was it going to lead somewhere along the line I mean I think it always probably originates with people because we're also dealing with a an art form that deals with people I don't know who but I I think it's probably a combination of patrons that wanted it I think it's Bill Rausch realizing hey we want to reflect the world and the world includes people with disabilities and company members and you know bringing in people that do have disabilities and then all of a sudden becoming aware of where you're where you're missing the boat so I don't think it's I don't know if it was one particular person but it all comes from people and that's where another takeaway I would say is you know for any of us who are patronizing the arts who are involved in the arts it's a it's a group effort and therefore it can't just be the actors with disabilities that are advocating for the accessibility to continue beyond the audience it has to be the people who are going to the shows saying hey we really enjoyed seeing Howie we really enjoyed seeing spring awakening we enjoyed these things we want to see more of it and as my cultural you know my community institution you need to be doing this and continue to you know give that feedback to to the cultural leaders and I think you know I think in Ashland that has been happening but that doesn't mean that it still can't happen more but I think you know the arts are based on demand a lot of the time it's based on artistic vision but it's also based on who's coming to see it what are they coming to see what do they want so the more we give that feedback to our theaters and our cultural institutions of this is something we want to see more of and we demand to see more of the more you're going to see of it and I also think as organizations we have to remember that if it doesn't it does if it starts with one person it shouldn't end when that person's tenure is over which is often what happens if somebody has a if a particular artistic director has a commitment to an issue often it just dies after that person leaves that position and we have to remember that what we're trying to do is change the culture of the institution so that diversity and inclusion is is part of everything from the top down from the boardroom you know to the actors on stage and everything in between our mission statement includes inclusion and one of the ways that we are showing that to the community is in all of our job postings it's got the job description and at the bottom there's a statement about diversity and inclusion at the Oregon Shakespeare Festival so if you are if you don't are not interested in that don't apply because for all of our outward facing positions at all levels part of the interview process is an interview with members of the diversity and inclusion planning council and I've been on plenty of those interviews there are usually three or four or five of us from we call it DIPC DIPC and it's really obvious which candidates have either never thought about diversity and inclusion even though it's written into the job announcement or and are not interested in it or are interested but just don't know how to talk about it and so that's been very clear as well and that's just something that we do on all of our job descriptions from from leadership positions down to house staff and and other positions so that's something small that your organization can do as well to to make people aware of what you're doing and there was one other thing i was going to comment on oh our board of directors has several subcommittees the finance committee and this committee may now have a diversity and inclusion subcommittee on our board and there are people who are who are thinking about these issues how to make our board more diverse and how how that impacts and the rest of the organization so so it's not just one person we're very lucky that we have bill roush as our artistic director and Cynthia Ryder as our executive director and the leadership team but our board is our board of directors is is on board with this no pun intended and so it helps that we have organizational wide support that doesn't mean that everybody in the organization or a large organization is in the same place as i mentioned before but it's it really helps to have that commitment from the the leadership are we good tiffany i think we're going to take a break um we'll try to keep it to 10 minutes and start back again at 11 40 um i want to give a huge round of applause to this amazing reagan andry thank you so much and please i would encourage everyone um because we had to cut the q and a session a little short if you have additional questions please write them down on your on your post-its because we'll have time at the end of the day to to address any additional burning questions you might have thanks so much great see you in 10


For the next speaker, we have Teddy and who's going to talk about mandos. So please introduce please welcome the speaker Thank you. I Can't see my slides from here. So I'll have to read from the same display as you Mandos is something that enables you to use this full disc encryptions on your on your servers Which you should do Probably let's see. Yeah, if you use physical or bare metal hardware And you have more than one physical machine then you can and you want to use full disc encryption Which is you do then you should use mandos because it enables you to do that If you don't already used full disc encryption, you probably should But if the only reason you wasn't doing that because you couldn't then mandos will probably help you do that So the problem with running full disc encryption is normally that the you can't type in the password if the server reboots But mandos of that problem it mandos One running machine Can send the password to the other machine which is booting up which needs the password? So if one machine boots reboots the other machine can Send the password and then the first machine can run the reboot and get the password from the second machine So two machines can reboot and still be Secure both of them the full disc encryption and if both machines are turned off Let's see Dang it. Yeah, and the crucial thing is there's no interactivity here You don't have to approve although you can configure it to do it So you don't have to and normally it doesn't require approval. Yes It's basically invisible while once you install and configure it It just reboots normally you don't have to see anything It's just a password prompts appear and then it disappears. You don't have to type in it anything And it supports all the normal interim FS tools and raccoot both with and without system D But both are used now in Debian the server side is all configured and controllable by debas and various command line utilities for control and Inspections are provided I thought I had a slide there, but never mind. Let me check here Think I'm skipping slide. No, I guess not There are various Objections to to this protocol because everyone thinks that wait, isn't that insecure? But now that it's actually not insecure We use TLS encrypted communication with perfect for security and that that data that is a transmit It's not a clear text password even though it's TLS encrypted It's double encrypted because the data that's transmitted says open PGP encrypted So it's quite easy to install it's been in Debian and Ubuntu for about ten years No, maybe five. I can't remember many years and in case So if you want to just install it You just install it from a normal Debian or Ubuntu approach story or if can you can use our private package Index from Instructions are on that website Let's dang it. I think I skipped some some slides. Yeah These keys Okay, let's see slides. Yes Ah, here we go Mandos has a threat model That's probably what your threat model is also because what you really want to protect From is that what could reasonably you could reasonably assume to happen like that there is someone coming in taking all your service and Running off of them turned off and if that happens if you don't have folding the footprint then of course they can read all your discs but if you have mandos then Since both servers are then turned off the discs are fully encrypted and you someone have to some type in password to either One of the servers to get both up. So in that case, that's secure So in that normal expected case, it's just as secure as normal for this encryption of course So as I said it in that case it fails safe. It looks like it deadlocks both of servers if both are turned off Yeah, and if you currently do not run for this encryption Then you could probably use month full this encryption with mantas anyway because that it's least that's better than nothing In theory, there is one weakness because you could in theory take one server offline Inspect the in it run my face and extract the secret key within this very short timeout and then use that to unlock the other server But you'd have to assume very sophisticated get attackers to do that And if the your attackers were very sophisticated, they could just just as well do a cold boot attack and read the raw the keys directly from RAM so That's not really what we aim to protect against what we put aim to protect against is the usual expected attack of somebody turning off both servers and making off of that with them and Of course, if you want to you can configure mandos to require approval For each reboot So you can okay some server wants to boot up and you have to log in and say yes Allow this server you don't have to tap in the possible just have to allow it to boot and Then it's just a secure again, but of course then you can't reboot while you sleep That's the installation instruction basically. It's very easy. I Think that's it. I'm just mostly here because I want to Promote awareness that this system exists because I see many many people Running servers and not using full disk encryption because they think they have to type in the password every time they reboot Which you know with remote servers or servers not in their room You can't do that, but with mandos you can so I'm just putting it out there This this exists and has existed for like ten years, but Not very well known still I think that's about it. I think we have time some for some questions Which most faster than I thought I can't hear anything from a microphone Let me come from the others. Oh Now I think it's working Just to make sure that I understood correctly. So if I have two machines and both of them are down Then to start it again There will be a passport that has to be entered, right? If both are down not for every reboot But if it happens that all the machines are down And they have to pipe in password for at least one of them then that one can Automatically respond with passwords to the others amongst and that's I read that said it was GPG encryption Is that the it's that's the way is that the key this GBG GPG encryption We use both TLS encryption for the actual network communication But the thing that is communicated over that encrypted channel is open PGP encrypted data Thank you. I think Thank you for a talk. I have two questions. The first one is How do you provision the the TLS certificates and the PGP kids for the communication? They are automatically generated when you install and then you know manually But you have a system with a fingerprints of all the keys But don't you have to copy them or send them to some key server? No, no key service. You just manually copy the fingerprints of the keys to the configuration files of the servers Okay, and the second question is Let's say I have two machines which are in different physical locations and one attacker smash and grab the first one and I didn't notice that One of my machine disappeared Kenny like rebooted over the network and get access to it by trying to to send some Packets to the overmachin which can send back the password Well, if he's really really fast he can do that, but not not normally there's a timeout, but He's shaking his head. No here Mr. Co co-author here Tell me why local network Okay, it's only on the private network normally the mandos server and the mandos client is assumed to be on the same local network You can manually configure it to ask a specific server remotely, but that's not normal the normal case In this case can we have like something like a private virtual private network? Like we're using a VPN like a wire guard or something like that. Yeah, you could do that you'll have to Create some scripts to Because the mandos client runs before the root Fire system is decrypted you run without any specific good system utilities You have to run write a script that runs in that environment to take up your VPN and stuff But we provide hooks for all that we have scripts. Okay. All right. Thank you Do we have any other question? Okay For the TLS connection. Do you have client authentication? Client authentication we check the exact fingerprint of the key So you check it for the server which I guess it's a server that's already actually no We we're we're kind of funny that way. We don't run the TLS connection backwards up here we that we the Till the the mandos client which wants a running running in their small inner parameters environments Which wants the password is running is connecting But is then doing the TLS handshake as a TLS server So it has a key which is automatically proven in the TLS handshake to be I'm I have that key So then the server acting as a TLS client check that fingerprints against its database So, I mean it's automatically verified by the TLS itself. I See we have time for more equations Is anyone who wants to ask something? I have a mention which doesn't have for this encryption, which is really bad. Mm-hmm How can I easily migrate it to a to full this encryption like is very some Tooling you provide or is very something which can we don't provide the actual for this encryption the We use the normal looks Linux for this encryption system We just provide the hooks which provides the password at boot time when it needs it Okay, so if you just convert to normal for the full this encryption, you can then install that and use it On those all right Do we have any question? We'll have some time so oh, yeah, I don't see any hands. So thank you, Teddy


Cool. Thanks, Zane. So as I mentioned, I'm going to be talking today about some new tracing capabilities that we've added to Pixi. So we've been focusing on adding more protocols so you get more out of the box observability using Pixi. And we've added two new protocols that we wanted to announce today. So I'm super excited to say that we now have support for Kafka and NATS. Both of these protocols are essentially message-based systems. So you can post messages kind of in a pub sub kind of way and then you have consumers which can read the messages off. And these two protocols work the same way that we trace all the other protocols that we have inside Pixi. So this is part of our EBPF-based approach. You don't have to instrument anything. You don't have to change any lines of code. You don't need even to redeploy anything. We just automatically EBPF to snoop all the traffic and then detect whether that traffic is Kafka or NATS. And when we detect that, we automatically start tracing it for you. And then we surface it up through the Pixi platform so that you can see all the good data. And I'll be showing a demo in a second so you can kind of see how that feels. Before I get into the demo, I just wanted to talk a little bit about what it is that we're actually tracing under the hood. So at the bottom of this slide here, what I have is a screenshot of some of the raw data that we're actually capturing. So this is the data table that drives everything else inside of Pixi. And so you can see that each row is kind of an event that we've traced. And for every event, we have a timestamp of when that message occurred. We have a source and destination. So which pod did it come from? Which pod was it going to? And in this case, since it's Kafka traffic, we have a command. So you can see that there's some fetch commands here happening. Fetch is when it's going when there's a consumer trying to get data from Kafka. There's some produce commands, which is when a producer is writing data to Kafka. And so you can see all the kind of traffic that's going on. And in addition to that, because of the EBF based approach, you can actually get all of the content of the messages as well.  So you can see some of that in here. Like if you look at the produce request, which is the third record, you can see that there's in the response, there's a topics order. And I know that this particular produce request was just published something to the topic called order. So Kafka organizes all of its messages into topics and this one was posted, something was posted to the order topic. You can also see when you click on them, you can click on any record, you can see more details about it. So same information just zooming in here. You can see, for example, this is a different example, we see a request command that was a fetch. So we've kind of automatically traced that some consumer dispatched a fetch to the Kafka server. And then again here we see it's also to the same topic. So if you look down near the bottom you see name order that was the order topic and it gives us all the information like the partition and the message number and all sorts of other goodies in terms of what's happening so you can debug your applications. On the right, we have the request latency this is the latency at the protocol level so it's like individual messages from the client to the server. And so if there's any issues with that as well you can monitor the latencies. Now, while that it looks really like that's that's great we can trace all the messages the real question is, how can you use this stuff to actually debug real issues with Kafka or any sort of message bus system. So focus on Kafka here. And so the, we're going to use a demo and I've got a slide here showing what the demo setup is so we have a simple Kafka broker in the middle. That's our message bus. And we have a, this is an e-commerce kind of website where you can place orders so there's an order service kind of that's our front end it takes orders from the website. So an order is made it's just going to publish something or produce something to the Kafka broker into the order topic. And so it'll, it'll push that there. And then we have these two consumers on the right hand side. One's called the shipping service the others the invoicing service, and these two services are just kind of constantly polling to see if there's any new orders inside of the the message bus inside Kafka. So they're constantly trying to fetch from Kafka. And when they get something new, what they're going to do is they're going to take some action. So the shipping service would, you know initiate the shipping process, and then the invoicing service will, you know, take the order take that information and generate an invoice out of that. Now, when you have a Kafka broker when you have an application that has something like a message bus in it. One important question that often arises is, what's the, are my consumers keeping up with the data that's being produced is there any lag in my system. So for example, if the producer creates a message with offset seven offset is Kafka's terminology so just think of it like a message number seven, and it pushes it to the Kafka broker. Right. Ideally, the shipping service and invoicing service, you immediately pull that same order number and start working on it. Right, they pull it out of Kafka and start working on this order number seven. But if there's any issue in your application then you might see a lag and it's important to know if any of your services are running behind. And so this is often a question when you have a message buses is, are my consumers lagging are they running behind. And this is sort of, so the demo we're going to go into is going to try to answer this question we'll see how we can use pixie to answer questions like this. So with that I'm going to switch, so we'll move switch go to go to pixie. So I'm going to go to the homepage here for pixie. And then, here's my cluster. So we have the main page so I'm coming here to the main page of pixie. And what you see is generally a service map of everything inside your cluster and some other information, but in this case we're interested in Kafka rate. So there's a number of Kafka scripts so if you click on the script button here you can search for those by typing Kafka. And where I usually like to start with, like when I'm trying to just understand what's happening in the application is we have these flow graph scripts for various different protocols. In this case we're looking going to look at Kafka flow graph, but the flow graph script kind of gives you a nice overview of what's happening inside of your system.  In this case our demo is in a namespace called Kafka demo that's our application. So I'm going to click that. And so immediately what you see is kind of all the Kafka traffic in your, in your namespace in your application. And so I'm going to, so on the right hand right hand side here we have is the Kafka server itself, and I'm going to move that here into the middle. And then on these other circles are different pods so we have an order pod that was our producer I'm going to drag this over to the right to just make it a little bit more clear. And then we have our two consumers which are the shipping service and the invoicing service, and they're the ones fetching from Kafka so on the left we have order it's, it's writing to Kafka and then on the right we have our two consumers which are reading So this matches exactly what we had in the diagram on the slide, and we're able to see that instantly with Pixie that like okay who's talking to who and what's my setup what are all the things that are reading and writing to the Kafka message bus. So I find it a really useful place to start. And then at the bottom there's some various different metrics there to that you can monitor and kind of see in terms of latencies and throughput and such. But again the question we were trying to answer if you remember is, is, are my consumers keeping up with the producer so as we produce orders, are we able to keep up. And so there's a different script dedicated for that. I'm going to type Kafka here again, and then we have a dedicated script called Kafka producer consumer latency. So I'm going to click on this one. And so when we come here. First off it shows you the list of producers that it knows about the list of consumers that knows about. And what we want to do immediately is we want to focus on a particular topic. So I'm just going to populate that right now and I'm going to say we're interested in the order topic. So we know that from our application that that our consumers and producers are writing to the order topic. So we want to say between any producer consumer combination we want to check for a lag. So we'll say we only have one producer in this case so I'll just put producer one that was the name I got from the table here. And then on the right we see we have our two consumers. So let's just check consumer shifting one right, and we'll enter that in. And now we have a graph at the bottom. So we look at this and it doesn't look all that interesting honestly right it's, is there's actually data there if you look carefully, it's a blue line at the bottom. And so what this is actually telling us is that the lag is zero all the time. Now this is good news, like if you don't have a lag that means as soon as the producer made an order and pushed it into a Kafka. The consumer was able to fetch it immediately and start working on it immediately. And so it's telling us everything is healthy with our Kafka setup and our applications doing just fine. Right. Now I'm going to switch over to this other service that we have which was the invoicing service I'm going to type consumer invoicing one here. And we're going to check that one. And so here, we see something different. It's not at zero. I'm going to extend the time window here a little bit. So we can see what's going on. And so what we see here is, whoa, it's not zero. So this should be sending off alarm bells right. It started off at zero, but it's gradually been creeping up over time. Now, what's happened is as I've been talking through this demo, my colleague Hannah has actually started some traffic onto our web application so she started generating some traffic to our website. It started placing orders. And the shipping service that we looked at initially is efficient so it's able to kind of keep up with the rate that Hannah set up and it was able to process all the orders that were coming in and being posted to Kafka. But this other service or invoicing service seems to have some sort of performance issue and it's falling further and further behind right the rate of orders that are coming in it just can't keep up with them. It started off kind of zero lag, but then it went up to like two seconds then four seconds and eight seconds and 16 seconds and it's, it's trying it's fetching data starting to work on it is trying to work on them work on work on them. And then, you know, it finishes that working goes back to Kafka and says what else do you have for me, and then coffee overloads it with a bunch of more work because it's falling further and further behind. So by the end of this time window over this 10 minute window it's already fallen like 60 seconds behind in its work and this is super alarming in this case right, it means we have a problem with our application. If we actually come to the application itself. So in this tab I have the application. It's a very simple application just meant for demo so it's nothing fancy but if you clip up click on shipping, what you'll see is all the shipments that have been made, and I'm going to scroll to the bottom here, and we see it has the last thing it knows about is shipment number 1253. So if I go to the invoicing page and we look at it. It thinks the last order that was made is 811. So we can actually see this problem manifested in the web application as well. We were able to catch it in pixie but we actually see the effect in the website it's running behind. And if I refresh this page, you know it is the invoicing service is trying really hard to kind of keep processing these things it's now gone up to 827. It's really not just able to keep up with the rate and it's falling behind and this can be a frustrating experience if imagine you were a customer and you were using this website, you wouldn't be happy because you're seeing conflicting information in the shipping and invoicing pages. So what do you do in a situation like this right so once you kind of catch this sort of issue with pixie you would want to go back and see what's wrong with your invoicing service right there's clearly it's not able to keep up. So you probably want to go back and maybe spread it so it can process more orders per second, or maybe there's some actual performance performance issue in there that you want to go fix you maybe want to go study it is there some bottleneck somewhere that you need to relieve. You want to go fix it and make sure that this line goes back to zero. So that's it for the demo. I'm going to leave it there. Coming back to the slides. We, we have a bunch of different scripts for Kafka so we covered the flow graph we covered the last one which is the producer consumer latency. There's other ones that on your own time you can go take a look at and see if they're useful for you and sorts the sorts of questions that you can answer with them. And then this is going to be the last slide though I want to talk about so we're switching gears a little bit here. So we're done with the Kafka demo, but I wanted to take a moment and talk about the sterling roadmap sterling is our EBPF based data collector. And it's what's getting all the data that feeds up into the rest of pixie. And we have a number of tracks inside of sterling that we work on, we have multiple tracks but two of the major ones are the protocol tracing track and the CPU profiling track. The protocol tracing track is the one that automatically grabs all your protocol traffic without you requiring any instrumentation.  And today we have now Kafka and that's which are in beta, which we encourage you to play around with and see, you know, what sort of information you can get out of them and obviously if you run into any issues please do report them to us. And so that's those are the ones that are kind of done today and where we want to go in the future with our protocol tracing is to kind of expand this, this set. So in no particular order, things that we're looking at are things like gRPC for C++ and that would cover interpreted languages to gRPC for Java. And then there's AMQP, MongoDB and there's others, right. And if there's any other protocols communities interested in as well please do get in touch with us because we're always trying to keep a pulse on what's important to the community. And then on the other track the CPU profiling track this is the feature that provides you with the popular flame graphs. It's been it's been a kind of a popular feature of ours. Today we support profiles, CPU profiles for Go, Rust and C++ so you can see the nice looking flame graphs for those languages if your application is written in Go, Rust or C++. And we're looking to add support for other languages so things like Java and maybe Python and Ruby or things are, Python and Ruby are a little bit further out on the horizon but where top priority for us is actually Java next is to take a look at Java. And so that's just give you I just want to give you a little bit of a taste of where we've been and where we're going. And so that's it for Kafka and the Sterling roadmap. And with that I'm going to pass the baton to Vihang who's going to talk about end to end encryption. We'll keep the questions for the end. Alright. So yeah, hi I'm Vihang. I'm one of the engineers at Pixie and I'm here to sort of talk to you about a new feature we just we recently added to Pixie. However, before we get into some of the very nitty gritty details about end to end encryption, I want to start by quickly doing a recap of the data model and how how your data is collected and stored in Pixie. So this is like a very high level rough architecture of what how your data flows through Pixie. So data collected by Pixie what the work that the Sterling team is doing of that data is stored just locally in your cluster. Our script execution framework also runs within your own cluster. So the data processing itself is also happening within the cluster itself. So when, when the Pixie client, let's say you're running the UI as omit should or maybe you're using a Pixie CLI or something like that. When the client needs some data to render what happens is the client spends the script to the cluster. And then all of the data processing is done in the cluster. And then the script results are sent back to the client. So in one of the models, what happens is that the client will directly connect to the cluster to fetch the process data. So this is what we call direct mode and this is what we are indicating on the right side of the graph you're seeing. In this situation, you know, your client is directly fetching the result data from the cluster. So the disadvantage of direct mode that we had to address here at Pixie when we're testing our own product and also we have noticed elsewhere is that in this scenario your clusters might actually be behind some firewalls. And then now you have to like punch some holes in these firewalls for all of the Pixie clients to be able to access these clusters and get the script results from. So to address that challenge and simplify sort of the firewall configuration. We built a way for the Pixie cloud to proxy the script results. This is what we call password mode. And so this password mode is a convenience method where Pixie cloud is just proxying the data between the cluster and the clients. The data isn't persisted anywhere in the cloud it's just a proxy for for the data. And then just a quick reminder like Pixie cloud itself is also open source so when we open source Pixie it's not just the vizier parts of Pixie but also cloud. So folks can run folks in the community can run Pixie cloud themselves. And so in past remote it would still be flowing through an instance of Pixie cloud that is controlled by you. No matter which of these two data transfer modes you use all of these connections do still use TLS. So the data is always point to point encrypted in transit. So even in this scenario it is still possible that you might want to use Pixie cloud for the convenience, but you might be running a Pixie cloud instance in an environment you don't fully trust. So we really wanted to address that scenario where you're using past remote with Pixie cloud you like that convenience, but you still want to sort of protect your data and transit. So to address that we decided to work on end to end encryption. So into an encryption will provide an additional layer of security, where the data itself gets encrypted at the Pixie vizier and will stay encrypted during transit and only the client will decrypt the data. So we can dive into some of the details behind how we implemented this into encryption. So, thankfully, there was, there is an IETF proposed standard for data encryption. It's called a JOSC or I don't know what the pronunciation is I didn't see any guidelines for it. But basically this was a new standard that was proposed for encryption of JavaScript data. Even though this is not a completely accepted internet standard yet it's just a proposed standard. There's already client libraries and many different languages. So we were able to use the cryptography API which is supported by all major browsers to to do this on the client side when you're using the UI. So we have a CLI, which we've written in Golang, we use JWX, and then the Golang and Python APIs use JWX and offload respectively. So basically you can you can get into an encryption no matter which of the Pixie clients you're using. And then let's walk through, like, example of how enter an encryption would work from the UI. What happens is before we can make any requests to Vizier for data, the browser first has to generate a key pair. So, as I mentioned earlier we use the web crypto API for this, that all major browsers support. And the first thing that the browser does is generates a key pair. This key pair is then the public key from this key pair is then sent to Viziers on every request to run a script. So, anytime you want to get script results, the UI, the browser will send this public key along with the rest of the request to the Viziers. As before, all of the data processing is done in the Vizier side. However, now there's an additional step before Vizier responds with the data. The Vizier will use this public key and encrypt the table data before sending any response out. And now the response that Vizier responds with on a successful script execution will be encrypted with this public key. And this encrypted table data then is sent back to the clients either through Pixie Cloud if you're using pass through mode or directly if you're using a direct mode connection. And then the browser which generated the key pair to begin with has access to the private key of the key pair, which is still controlled by the browser it wasn't sent to anyone else. And so the browser can use the private key to decrypt the results and render the UI and so on and so forth. So yeah, reminder that the private key will never leave the browser. In fact, the private key is scoped to the session storage on the browser so the same user using Pixie on different computers or different browsers will have different key pairs. And these private keys will be local to their browser store session storage. As far as the CLI and the API's go they behave the same way you just replace the browser with either a goal based binary, or the go or Python API clients that are equal and instead of using the web crypto API, they will use the libraries and go and Python, the crypto libraries there. So that's sort of a very quick view on how into an encryption words. And this basically now gives you this additional guarantee that if you're using pass through mode, your data is still encrypted even when it's proxying through Pixie Cloud. And that sort of gives you the freedom of having full guarantee that no one can sort of look at this data in the cloud, no matter what environment Pixie Cloud is running in. So that's, that's all I have. Happy to take questions. Okay, well, thanks everyone for coming to the meeting. I just have a few quick updates about the community. And then what we're going to do moving moving forward so Pixie was officially accepted as a CNCF sandbox project. So we're currently in the process of actually transferring ownership of all of our assets including our GitHub repo to the CNCF. And as part of this process, once our repo is moved out to CNCF will also be opening up all of our issue tracking and roadmap. In addition, I wanted to say we plan to have a live event at KubeCon North America, assuming that that event still happens in person. And that is planned for the week of October 11. And please stay tuned for the details. And we also plan to have a Pixie governance board meeting in October. So stay tuned for all those and, you know, we look forward to seeing everyone on future calls and events. Thanks for coming. And if you have any questions, you know, please feel free to hang on. Well, we'll stay on for a few more minutes. Thanks everybody. I have a question. Is other ways for the community to contribute to protocol tracing. Yeah, that's a great question. We have, we've gotten a number of requests about that. There's a how to contribute protocols. There's a lot of people out in the community who want to have a protocol of interest that has not been supported yet. Obviously we're working hard to get those out, but it's great to have community contributions as well. And so one of our goals for a future Pixie not meeting is to actually outline the steps that's required to implement your own protocol parser. So that you can just plug it in. So it's the way that sterling structured is there is a protocols directory where you can go just implement your own protocol parser but we're trying to make it a little bit easier to use and document the exact steps that you need to go through and falls and things that we've learned along the way. And once we have that document ready, we'll release that out to the community. And we highly encourage people to, to contribute to be super awesome and there have been some people out there who have already taken the initiative to try to implement a number of protocol parsers and we're super excited about that. And we're just trying to make it easier for everyone who wants to contribute. And we'll be tuned. We'll be publishing a doc for that. Another question that we've gotten on slack lot is, can you share how pixie traces encrypted traffic. Like what are the, what are the limitations for that. Yeah, so, let's see, I think we have three stuff that backup slide. Let me just go to here. So we can use the slide here to take a look so the way that pixie, like the sterling engine of pixie traces things as we typically trace things at using ebpf k probes at the Linux API and there were able to trace all of the kind of read and encrypted traffic. So anytime a network call is made to like send, send packets or receive packets or send a message receive a message, we trace that information. And then we're able to reconstruct what was happening. And so our protocol parsers and then surface that up into the rest of pixie with encrypted traffic that we can't capture at the kernel interface anymore. So we capture at the kernel interface, all the data is going to look encrypted to us and that's kind of useless. So what we do in that case is we actually use ebpf again, but we add different sorts of probes we add probes on the SSL and TLS libraries themselves. And we trace the data right before it gets encrypted. So we combine it with all the other information that we have and kind of plug it into the rest of the sterling framework to parse the protocols and do all the rest of the magic. But essentially, you know, we just have additional probes before right before the data gets encrypted at the interface of the TLS SSL library. And by capturing that data that's how we're able to see the encrypted data. So it's for open SSL and goes crypto TLS library currently. So the yes, the traffic has to go through one of those two libraries if it goes through some other custom library then we don't currently trace it. But but those two libraries cover a good I mean with open SSL alone we cover a really large swath of the traffic is a lot of people are using open SSL. Well, thanks for that on it. And yeah, everyone please feel free to then join stuff on our Slack community and ask questions there or file get up issues. And thanks again for for joining.