Well, let's get started. First of all, thank you very much for being here. I wasn't expecting a full crowd like that, so I hope you can enjoy some of the information that I have to present here. My name is Matheus. I'm from Brazil on a company called Cicredi, which is a credit union. Just a few words about Cicredi. Cicredi is the first Brazil credit union founded in 1992. It's a pretty old company. It's one of the largest credit, credit, Brazil credit union with more than 7.5 million members. When we call members, this is a term to the credit union. It really means clients. So we have more than 40,000 employees in its presence on every Brazilian state. It's important to mention that all our critical workloads, or great part of it, run inside Kubernetes infrastructure. So things like instant payment and ATM operations, all that rely on applications that run inside Kubernetes. So just a few words about me. I'm a platform specialist at Cicredi, working for the container orchestration team. I'm in the company for almost 18 years now. I'm a first-of-the-enthusiast. I was always involved with free software open source projects. I was involved with Debian GNU Linux in the past, Debian GNU HURD, and OpenLDAP and stuff like that. So my job is really replace proprietary systems with free software. I am a retired football player who sometimes I insist to play again. I regret every time because I got injured. I'm a father of two beautiful girls. It's a teenager and a child. So I'm not used to solve conflicts in Kubernetes upgrades. I'm also expert in solving conflicts at home. I'm a competitive Pokemon Gen 3 OU player. If you want what does mean, I am Shahua BHC on PokemonShodown.com. They said it's a child game and really is a child game. Sorry. Sorry, mom. I'm a football lover. I'm a supporter of the best team in Brazil, which is Club de Atletico Minero. We call them Galo, which means Rooster in Portuguese. So, okay, let's go. What do you mean, what is really important now? What do you see in this presentation? Well, we will have a brief introduction about Cicredi infrastructure related to Kubernetes. How do we automate our service mesh configuration? That's a pretty important point because they face a lot of challenges. Just before we get started, really, how many of you here, if you can raise your hands, are using service mesh in somehow? Okay. And how many of you are using Cilion cluster mesh? Okay. People with Cilion cluster mesh will see, I think, important things here. The challenges that we faced, the most difficult challenges and our next steps. So, I will start with the infrastructure because it will be important to understand what we have done there. So, we have a private cloud built in canonical open stacks spread across three different data centers. That is on-premise infrastructure. We have public cloud built on Amazon Web Services. Kubernetes clusters are managing using cluster API on a private cloud. And on AKS are managed by Terraform. Here we have, in Cicredi, we have the concepts of stacks for clusters. So, each cluster has what we call in stack. What this really means is a repository in Git, GitLab, containing the information about the cluster configuration setups and stuff like that. So, the Kubernetes clusters that manage it on-premise are basically formed by a cluster API description of the cluster in a YAML format and some Ansible playbooks that run Ansible roles to install clusters components like Cilion. On the AKS for the other side, we have a stack of pure Terraform using, of course, modules like HelmModulus to install the components. We have a dedicated Amazon Direct Connect link with all data centers. This is great because the latency is very low. So, we feel like we are operating in the same data center. This number is a little bit outdated, but I didn't want to change this slide because I already had it updated before. But we have more than 40 Kubernetes and AKS clusters. These numbers are an average numbers because as we have horizontal pod outscaler and cluster outscaler, these numbers tend to change across the day, across the traffic. But in a medium, we have 7,400 pods running production and 500 Kubernetes and AKS nodes running production. I know I saw some huge infrastructure, another talks, and this made me think, oh, this is not so big, but for us, it's really a great number of nodes and pods running. And this thing keeps growing. So, the canonical open stack infrastructure will look like that. We have a region and we have spread across the ability zones, three ability zones. So, the key points are search view lanes between data centers. So, we have fully communication between them. Storage is not shared or replicated among the zones, and open stack control planes are spread among the zones for high availability. This is a very high level description. The idea here is to show what are the components that we have because we have some challenges and you will see further are related to these components, to some of these components. So, we have our data center connected with Amazon Direct Connect. Then we have a transit gateway. And then we have a gate or load balancer. And behind that, we have a Apollo auto fire infrastructure to reach AKS clusters. Of course, this flow is both direction. We have traffic coming from our premise data center and reaching AKS and AKS reaching our premise data center as we work on the fully infrastructure. So, a little bit about our CNI history. We born with Kubernetes in 2018 using Flannel. We changed to a project called Weave in 2019. But due to some problems with Flannel in the excellent type of infrastructure. But we saw that Weave was dying. And we had some problems with it. So, we changed it to Cily in 2020 looking for the security features, EBPF, of course, and the more robust and stable CNI. So, moving to Cily was very important because there was a lot of new applications getting in the cluster. And with more and more applications, security also become a problem. So, most part of the applications were running on Kubernetes did not have any access control. The developers did not write any code to control that. And that was a big problem and an addiction problem for us. So, self-image capability was, of course, an alternative to solve that problem without changing the source code. This is what self-image works for. So, it makes sense. We started proof of concept by the end of 2020 on potential self-image solutions that solved a particular problem. We wrote a sample application that was very similar to all other applications that we had running at that time in our Kubernetes infrastructure to make the tests. And we selected the following self-image tools to evaluate which was the best. So, at that time, Istio was the most prominent self-image tool. We had a very young project called Kuma, which is a self-image by Kong, including they had some talks yesterday, I think. Unfortunately, I could not be able to watch. Celium, of course, which was our CNI. And ConsulConnect, which is the self-image from Consul, because we are already using Consul and some hash cortic tools to configuration and start secrets like Vault. Okay. What was the key point to us? Of course, a feature to block or allow access from one application to another. This was the main point. We would like to have some layers having security policy if this was important. Multi-cluster policy capability. Of course, at that time, we were running multi-clusters, so this should work across multiple clusters. Great part of the self-image tools at that time used sidecars. So, we were a bit worried about the resource consumption and we decided to do some kind of performance test with that sample application that we wrote. A low priority feature that we want to look at is mesh expansion. Mesh expansion is just a way to work with workload that are not in Kubernetes, but you want this to be part of the self-image. So, you can enable this. You have some tools to some service mesh that implement this. This was not so important, but it's something that we would like to check. This is a basic draw about the application that we wrote is a microservices application. We have the employee data connecting to employee proxy, reusing RESTful services, then connected to two other services, employee test A, test B, which connects to a NailedApp database. At the great point here is that we would like to test if it was possible to put rules in that connection points. That, of course, we will solve the problem that we had. So, the Istio service mesh Pock, Istio access control works, policy works, with authentication authorization using MTLS. It have the sidecar envoy intercepting all the traffic to apply effectively, apply the policies. As I said before, we were worried about resource consumption because of that sidecar. It's just to show it's good performance, with no major problems. It could detect a little bit more resource usage, but that was not an issue for us. We thought it would be worse. There was an issue at that time with mesh expansion. It would like to test. The point important here I would like to mention is that information is about the end of 2020 and 2021. Some of the subs mesh may have bugs which already solved it, or functionalities in them could be changed. I don't know, but this is what we've run at that time. So, Kuma was a very, very young project back in 2020. We had several problems that made it impossible to really do the tests. When we applied the policy to validate the access, the probes didn't work, so the applications never could get up and running. And unfortunately, we could not be able to finish the test. This issue was solved by the end of 2020, but we already finished the proof of concepts. Well, console connection. Here is a very weird one. Sorry about that. Console connection versus policies by unicycle cars and containers at that time, just like Istio. But we found very unusual configuration to name that. An application to be protected needs to be bind only local host, which is we basically had to recreate all our images to applications by only local host if they want to be protected in the mesh. And this is most the weird one. Applications that access another need to access local host. So, employee data in our example, employee data as accessing employee proxy, the configuration, the properties inside the employee data should point to local host and the port. If it connects to multiple services, you should still use local host and different by port. I'm not sure if this is still working like that, but if it, yes, I don't know, it's really complicated. And then you need to put some annotations like connect services upstreams and the service name and the port and the original data center is a concept on console agent should be installed on Kubernetes nodes. So, we can't do with all that. We want a little simple infrastructure. I'm not sure if this is the way they work now, but back then it was the way they work. So, oh, Celium here. And Celium work with Celium network policies to allow and deny access without the need of sidecars. This is great. Multicluster policies works perfectly with some requirements that pod IP CDR should not conflict. And, of course, services must be deployed on our clusters, which are part of the service mesh. This is if you want the services to be accessed from other clusters, of course. Services discover uses Kubernetes coordination with school. Cluster mesh observability using EBPF is also. So, we did a test using KubePROX replacement in its rock. You don't need to have KubePROX running in your environment. And you can do a fully EBPF thing. So, the performance showed very good results without a sidecar. So, there is an obvious answer to our question. Why we choose Celium as our same mesh. Clusters network policies. Crosscluster was exactly what we need to implement the security services. We don't need sidecars. We have the EBPF. And it was already used as a CNI. So, no need to install new software. When you enable cluster mesh, it will install new components from Celium, but not a different sort of software. Like, for example, if we use Istio, there is a bunch of Istio controllers and Istio software that needs to be deployed. Liz Rice gave a very good talk, I don't know, in the day, too, about cluster mesh, including the she did a demo. So, I will pass this very briefly because they have more information on that talk, if you want to take a look. Here is the requirements. Our clusters must be configured with the same data path mode. Celium installed may default to encapsulation, native routing. The native routing here is the fully EBPF thing that have very good performance. As I said before, earlier pod CDR ranges in all clusters, and now nodes must be non-conflict and unique. Nodes in all clusters must have IP connected between each other. The network between the clusters must allow the intercluster communication. This is what Celium cluster mesh really is, a very important part. When you enable cluster mesh, what really happens is that a component called the Celium cluster mesh is installed in your ecosystem namespace. What is this? It's basically an ETCD. And what is the point of this ETCD? It's to store the service identities for all your services, and the agents of Celium will connect on that ETCD to get that information. So, if you have two clusters, the agents from one cluster will connect in the other Celium cluster mesh to get that information and make things work. But again, Liz Rice did a very good explanation about that if you want to check out. Okay. Here's some important questions. Enable cluster mesh using Celium CLI or Helm installation? How do you connect the clusters? How do you distribute that key securely? And it's possible to automate our cluster mesh configuration. When you look at this Celium documentation about cluster mesh, they will use Celium CLI to do that. But we did a little different. And I think this is more appropriate when you're talking about an environment that is not a playing environment. That's a really production environment. So, Helm was easy to install CNI. So, let's use Helm to manage cluster mesh installation and configuration. We are using Terraform and Ansible to fully automate the cluster mesh process. Just mentioned that in case of Terraform, we're using Helm models behind the scenes. But that stack that I said earlier are changing if we're applying this on our premise infrastructure or in Amazon infrastructure. We are using HashiCorp Vault. Now, HashiCorp, fantastic job with Vault and Consul, but not with the mesh at that time. We are using HashiCorp Vault to store clusters connection information and its certificates and credentials. So, there is a, in Helm, in Celium Helm, there is an option called TLS Auto Method, which we choose Helm. This means that Helm will be generated, will be used to generate and store the certifications and credentials. These also have other options like Set Manager, if you want to do that job, or if you want to provide yourself by hand. We need to generate a new certification authority that will be used across our clusters to sync cluster mesh certificates and credentials and store it on Vault. For each environment, we create and have it sound a certification authority. All communication between the clusters are encrypted, so these certificates are very, very important to you make things work properly. So, here is a flow of the automation process. So, we basically have Terraform or Ansible, and there is a flag which is cluster mesh is enabled. Yes or no? If you know, okay, don't do the configuration for cluster mesh and finish. If yes, then we need to check if the certifications and the credentials are already on Vault. If the answer is no, then it means that there is a new cluster mesh enabled. So, there is Helm property, TLS Auto enabled and set to true. This is the default. So, what will happen here is we will generate all the certifications and credentials that you need and store this using the certification authority that we provided first and then we will store it on Vault. Then it will start the information about that cluster, specifically what are the endpoints and the keys to access them. It will get the name of the clusters to connect from a list. It will get all the information in respect of that cluster, like the connection, the port, and the credentials started on Vault, then they will apply on Helm. If there are already certifications in Vault, this means that this service mesh is already enabled and maybe up and running. So, we set the TLS Auto enabled to false. That's pretty important because if we don't set this, what will happen is it will generate new certificates. If you have other clusters connected to it, it will basically block all the clusters from Connect because we generate new keys. So, your service mesh will stop working. Just a short example, we have this Terraform. This is a main.tf from one stack of a specific cluster. And we have an iteration about the clusters list. And then we will get on Vault and get all the information about the clusters that we want to connect. Down there, we have the check if these certificates already exist in Vault. If not, it will set the TLS Auto enable to true and will generate certificates. If not, it will get the certificates from Vault. What we have in here is the local tf of that specific cluster. So, we have this by environment, the flag, enable cluster mesh, which we can control if some environment could be false or true. And the connect cluster mesh, which is the list of that cluster will connect. The other clusters that will connect. So, for example, if this is the stack for the cluster D, right, then in develop an environment, it will connect to cluster A and cluster B. In production, we will connect to cluster A, B, and C. And this is a major difference because if you run what is in documentation using CLI, when you connect the cluster A to cluster B, the CLI do both way. They do cluster A to B and B to A. Helm doesn't work like that. So, when you put in your cluster D, for example, to connect to cluster A, you need to go into cluster A stack and put the cluster B. So, this is pretty important. Okay. How users control Selium network policies in our case with Dev Console? So, what is Dev Console? Dev Console is an internal developer platform solution for offering infrastructure resource from all platform product teams. So, a developer, when they need to start a new project, he accesses the Dev Console and asks for a new project, give a name to the project. This will trigger GitLab repository. And he can choose the template. He wants to develop using Java and Spring Boot. It creates a template with Java and Spring Boot with a sample of GitLab CI that will do build, test, and deploy. And he can also configure the resource usage for that specific component, the HPA, and stuff like that. So, here is a part of the screen. It's in Portuguese, but I will try to mention the most important point here. So, this is a screen for a service called Demo Dev Services KO2-6. So, here is the Ingress and Negress rules. So, when the developer needs to access some other API, other application, you have a button here, which is called, which has a new access, new request. Then he types the name of the service and he won't connect. This will trigger like, for the other team, some kind of improvement rules if the user is the developer of that API approved. So, the access will be okay. What this really does behind the scenes is creating ceiling network policies. So, we have that ceiling network policy for Demo Dev Services KO2-6 having access from Demo Dev Services 2-6 and the other way around. So, this is basically what Dev Console do is create those policies in all clusters. And this policies applies to all clusters that we have in ATS, in a no-premise infrastructure. The challenges that we face, this was the most difficult one. Palo Alto Fire was generating VX land drops due to a bug. So, if you have infrastructure using Palo Alto, you should check this document because we spend a lot of months on that. We were thinking that maybe the problem was in that Amazon components or gateway and we tried to do, but the problem was on the Palo Alto, which was dropping the excellent package. The solution was basically some kind of profile that they write there. I don't know really about Palo Alto, but our security team did that and it works. At that time, we have just our clusters in our own premise data center talking to each other through cluster mesh really well and ATS talking to each other really well, but when they need to connect to infrastructure that are on different data centers, it was not working. Ceiling agent memory leak bug, this was pretty complicated. When you have the cluster mesh enabled and clusters are connected, the Ceiling agent basically increases memories a lot and we don't have limits to Ceiling agent, so they start to stop working our nodes because of the lack of the memory. Cluster connect and enable cluster mesh with Ceiling CLI and Helm was a bit confused because of the lack of interparability between the two. So, they have an issue about that, but basically, in the past, we connected our clusters using CLI. So, okay, now we will do automation. So, when we started working with Helm, things become weird. And then we saw that they are conflicted, not work. If you are working with CLI, you need to keep going with CLI until the end. And if you work with Helm, you just have to work with Helm to control that configuration. There was an issue on Celium. I don't know if it fixed it, because we just worked with Helm and no use for Celium CLI anymore. One important point, we had to disconnect everything and disable cluster mesh with CLI to get it working with Helm, so it was really complicated. With cluster mesh and self-discovering mechanism working, we are now able to deploy the same application on both cloud infrastructure. What happens now is when a developer creates a project, it will be in one cluster, or in on-premise, or in Amazon. And you can migrate this from one site to another and from clusters to clusters. This is possible with Dev Console, but we cannot have the ability to run both in the same data centers, which is a very cool feature that we have with cluster mesh, and we would like to use. So, working will be done in Dev Console to enable this, because we do the deploying in the pipeline using Dev Console APIs. Extend observability with Hubbo and Grafana tools, because of the eBPF, we would like to use this a lot, but we use Dynatrace as a main observability software right now. So, this is something that we are discussing internally. We would like to use Gateway API to split traffic and enable counter-deployment. We need to see how this works in cluster mesh. So, we are studying and doing some tests, but it's all that. I'm here for your questions. Thank you for your time. If you don't have enough time, my LinkedIn is on the schedule, and you can reach me to more detail. There's a lot of things that we did, but I could not be able to speak just in 30 minutes here, but you can reach me to find more things. Just one quick question regarding the, I'm here. Regarding the on-premises CDM cluster mesh config, are you using no port or low balancer for that? If you are using low balancer to connect both cluster desks external or using metal LB for that? We are using, in OpenStack infrastructure, we are using the OpenStack LB, and on Amazon AKS, we are using Amazon LB. Okay, cool. Thank you. Thank you. I have one question. Thanks for the presentation. Thank you. I just wanted to ask what component uses the VXLAN. So is it from the Amazon Direct Connect? I'm not sure because that network part of the intercommunication between our on-premise data center and on-premise and now Amazon is done by other team. So I really don't know the protocol, but I think there is a lot of protocol because I get a low balancer work on Geneve protocol, but we could be able to connect VXLAN directly from one site to another. You can reach me out after I can ask this question for our network team. Thanks. And did you have any challenges with the IP management over the sites? Yeah, you need to control the cluster IP CDR, and when you control that, you will not have problems, but if you don't control and get the same IPs from one cluster another, this will give you problems, but we don't have face at any of them. Have you done a lot of traffic management between your clusters? So the documentation states every service needs to exist for that traffic to do, I think essentially it's defaulted to around Rob and then trying to do any kind of, what's your experience on that? Because at the moment I'm trying to be very declarative in my traffic management, and I was speaking with myself from my surveillance, we're thinking that you could just not create a service in a cluster and it won't and it'll go to the other clusters, I'm just curious. We don't have any problem in traffic management, but this is something that we need to do. All clusters should have the services, so Dev Console basically deploy all services in our clusters. Our link with Amazon is very good, so I don't know of any problems of traffic management between these connection points, but again, I'm not in the network team, but I think if you had something, they had reported me. Hello Matheus. Something we are dealing with is ClusterMesh right now. Brazilian company choose, Tony. Okay, we understand that pod IP must not conflict, but services, how you deal with services? Because in the cluster mesh, if we have the same IP for services in our entire environment? Okay, there is no problem with services. You can have the overlapping IP address for IP for services. I mean, you can have the same services with the same IP on different clusters, that's not a problem. It uses the services just for reference. What it cannot be overlapping is the pod IP, which is the problem. If you had overlapping or same IP in both clusters or in your clusters in the cluster mesh, you have problems, but you don't need to care about services IPs from our perspective. Okay. Thank you. Hello and thank you for the talk. I have a question if you have one node or even a cluster of Kubernetes running behind nodes one or two or more. Can you connect those with SeriumMesh? I think you can, because I think there is a lot of net between our connectivity with Amazon, but the point is that VxLan traffic should be enabled in all these components. You should guarantee that you have VxLan working on both, but I think it's working well with net behind the clusters, because this is also an area. We have nets in some parts in the communication between our own premise and Amazon, and it works well. All right. Thank you very much. So you need to have non-conflicting networks for pods, but if you initially had, do you have experience changing the network, pod network on the cluster, on the kind of fly without destroying and creating the cluster? Yeah. Yeah. That's right. We had, when you enable this, when you put some pod CDR, you need, and you want to change. I mean, if you start with some CDR and you want to change, this is very complicated. We have to restart and destroy every node to get a new one. So we passed this in our test environments and it's kind of annoying. But when the cluster is born with the right CDR, then you have no problems in our experience. Okay. Thank you very much for your time. I appreciate having you here, guys. Thank you.


to our next talk. Our next two speakers are Stefan Becker and Stefan Kolosser. Stefan Becker holds a master in IT security and is a research assistant and PhD candidate at the Embedded Security Group at the Ruhr University Bochum Sausgötz Institute for IT Security. Stefan Kolosser is also a PhD candidate at Ruhr University since 2017 at the Institute for International Law of Peace and Armed Conflict. Stefan passed his first legal state exam in 2014 and is now among other roles, a legal advisor to the project, legal implications in hardware, reverse engineering, in cooperation with the Horst Götz Institute. The two will talk about the potential legal implications of a new trade secret which has been introduced in Germany in 2010. So let's give warm welcome and applause to Stefan Becker and Stefan Kolosser. Yeah, hello from my side. Thank you very much for being here actually. I have to say that the time of the day is a bit late for a lawyer, but I think it's just the beginning for everyone here. So, indeed, we are Stefan and Stefan and we want to talk to you about some reflections on the new reverse engineering law that actually has come into place this year. So it's kind of a brand new law. And the implications for reverse engineering is actually quite huge. Now, as a little disclaimer, we are not giving you an in-depth legal analysis because it's not possible. Every case differs. Every case is a different situation, for example. And in law, all the details count. So that means that we can only give you a broad overview about the developments, about the law in general. And then we will give you a little bit of a guideline maybe in the end to be on the safe side. Of course, you might be challenged by some lawyers or some lawsuits, but in the end I can already say that you shouldn't worry too much in this regard. And first also a little apology for the translators and interpreters because legal terminologies are really hard to translate. So, where appropriate, I will just use the German and the English version. Vice versa. And yeah, let's start. Okay. Hello and welcome from my side as well. So the question is why are we actually here? And the answer is it's my fault. So I watched last year's talk, more Schlecht als Recht Grauz ohne Sicherheitsforschung from some researchers from three different universities who reverse engineered a software which claimed to provide absolute security. And of course, they didn't believe in it. And then after like pre-publishing the paper about their research, they got a lot of legal trouble. First of all, they got a declaration to C Synthesis. I had to look this up. Unterlassungserklärung in German from the company producing the software, which if they would have signed it, would have been the same as an employment ban for them because it wouldn't allow them to possess tools for decompilation, like to install Ida Pro on their computer. So of course, they didn't sign this declaration. And then the whole thing went in front of the court. Yeah, this was in total like more than one year of personal legal trouble for them. But in the first instance of the court, there was already a settlement where the company then paid for the legal fees. And the researchers said, okay, like the next time we go through a responsible disclosure process. But the question which arose for us as a research group, as an embedded security research group, is what the legal situation of researchers utilizing reverse engineering here in Europe or in Germany actually is. So I want to give you some background about the research history at my group, at the embedded security group at Royal University, which now moved to the new Max Planck Institute in Bochum. So we have a long history on like reversing embedded devices such as smart cards or electronic locking systems or even like satellite phones. And more recently we are taking a deep look into hardware, into chips. And we apply reverse engineering on the one hand to understand like the reversing process and to do research about the reversing process itself. And on the other hand, we want to understand better if we can do malicious manipulations to hardware such as hardware trojans. Yeah, and thankfully, we also have like an interdisciplinary research graduate school, which is where Stefan comes into place. So there we have people from other disciplines who think about IT security. And even better, we also have lawyers there who understand a lot of security. So we approached Stefan to give us some legal counsel on the research project, which I will introduce very briefly. So this is about hardware reverse engineering and we deal with proprietary chips, which are protected by a lot of patents. And what we want to do is like reverse engineering, so we decapsulate it, we do images of it. And then we want, for example, to extract a net list or to extract some higher level description. And we want to know if this process is legal. So could you answer that question for me? Well, it's a bit difficult, but I can try. So first of all, he came to me that question. And given that I'm like this IP law or computation law, for example, is not exactly my core area. But I was really intrigued by your question. And then I dig into the topic. And now I came up with the answer. And actually, I can say clearly and definitely it depends. So let's look at the relevant areas of law. So we don't unfortunately have one book or one code of law that we can look into that gives us the definite answers. So we have different areas of law, such as intellectual property law, for example, and competition and trade secret law. Intellectual property law, again, has some different sub-branches, some kind of trade, patent law, for example. We have copyright laws and so forth. So the legal situation is a bit complex. And the potential consequences could be also severe if you get involved with one of those laws because sometimes you have only civil procedures that we have to face. It means that you have to pay maybe damages or compensation for loss of profit, et cetera. And the number of euros is really or can get really high for that. Thank God we have no punitive damages unlike in the U.S., for example. But also more importantly, sometimes you have criminal procedures or criminal charges that you might be threatened with if you're infringed, for example, with semiconductor laws. And that's why the question of is it legal or not is not just a simple question of, yeah, probably, or most likely, but exactly a serious one. So let's look at the first act of law. This is the semiconductor protection act. And yes, that exists because we have a law in Germany for everything, also for semiconductors. And the main idea is actually it's parallel more or less to the patent law. The semiconductor act wants to protect three-dimensional structures of microelectronic semiconductor products. And it is not my invention actually to phrase it like that, but it is a legal definition of a topography that I took from the law. So if you look into the law yourself, it's not really long, so you can just read it at night, for example, as a good night lecture. And you might always, you will always find the word topography, and it is unfortunately this kind of definition. So here the idea is that the topography is protected, but only the topography as such. So only this three-dimensional structure of microelectronic semiconductor products. That also means that information that is stored on that, like firmware, any kind of other information, is not protected by this act, so it's not protected actually by the registration. And the basic rule is simple. You must not repudiate one of the topographies. So if you do that, if you reverse engineering, for example, and put it together again and try to out-works, it's actually prohibited, like per se, under the basic rule. That's pretty unfortunate because it's exactly what we want to do. Well, we have a fortunate clause that gives you an exception actually. So the exception is found, again, this is a legal terminology, section 6, paragraph 2, number 2. And there it says that reproductions of the topography for the purposes of analysis or education are not protected. So that means, simply, as a kind of background, that, of course, you want to protect the intellectual property, but at the same time, you have the freedom of research protected under our constitution, for example. And that means that there must become kind of exception for researchers, for universities, for institutes that serve the aim of knowledge, of making the product even better, or closing security gaps or something like that. So for researchers, we have this exception clause, and actually under the Semiconductor Protection Act, at least you're fine for that. Okay. Are you arguing with the constitution is always a good way? It is, actually. It is. Now, let's go to the second law that could come into play. Let's say you don't have the Semiconductor Act in place. You might be involved with a patent act, with a patent protected product, which is not sometimes improtected by one single patent, but by several patents at the same time. And here again, the idea of the law is simple. They want to protect the technically innovative invention, the intellectual property. And again, here, the basic rule is simple. You must not unauthorizedly use the product that is protected by the patent. So if you have an authorization, it is fine. If you don't have a legal per se definite authorization to use it, you must not do so. Quite simple. But again here, this is actually parallel to the Semiconductor Act. We don't have an absolute protection, but the patent is not protected against actions for experimental purposes. Now, here again, the wording differs. And for lawyers, the wording is always really important. But again, the backgrounds of that is that you want to protect, actually research. You want to protect the ones that don't want to use the knowledge that they gained for maybe bringing up a competitor's product or to use it per se against the other company, but actually who just want to make maybe the product safer or want to debug it or maybe find any kind of malware on it. So for that, you have an exception clause. And also in the jurisprudence, this term of experimental purpose is usually widely interpreted. So it is for everything that has to do with gaining new knowledge on a technical uncertainty. So whenever maybe because as a patent, you have to describe when you register your patent how your product works in quite details. But it's, for example, there is maybe a legal uncertainty somewhere. You can just dig into that problem and do research on that. And for that, also maybe infringe the patent. So that is fine. So also under the patent act, you're fine. A bit different was at least the situation under trade secret law. And that is the main law that has changed. Also, that's why we do this talk, actually. First of all, the idea of trade secrets comes with the competition law. That's anything that is protected in a kind of like de facto or the euro, for example, and that can be used against the competitor in unfair use, for example, there's protection to not to use the secret. Now, how? Now, so what you what is prohibited is actually the the accretion or the acquisition of a secret. Now, how in order to use it against a competitor and most likely in unfair way. That's why also the former unfair competition acts comprise these rules. And especially in section 70, it was said that the is generally prohibited to use any kind of trade secrets. So why am I affected on this? I think I'm not a competitor or of the hardware vendors and the hardware manufacturers. That is absolutely true. But at the same time, what the law wants to make sure is that the law that the trade secrets actually protected in a most absolute way. So especially how right now, not maybe not so much with regard to the old law, but with the new law, any kind of person could come could reveal actually this kind of trade secrets and any kind of person any kind of natural person could be the infringer in theory at least. And especially this is this area of law has been awarded a lot of attention lately, because sometimes you have now some kind of information, some kind of maybe even firmware or something like that that is not protected by the patent or that is not protected by the semiconductor act or something like that. So the IP law falls sometimes short. And then what can come into play is simply trade secrets. Also with regard to the distinction, of course, where normally and the patent law, for example, you need to disclose all the information that you have and the trade secret actually gives you the opportunity to just keep the secrets and not disclose anything regarding that kind of information. So it's a different mechanism of protection. And regarding that, we had an EU regulation adopted in 2016 already. And it's quite detailed, actually a quite detailed regulation under the EU and the time limit, because it's a regulation. So it needs to be adopted and to transferred into national domestic law by the member states. That time limit for adoption and for transferring that regulation was June 2018. And Germany decided not to play with the rules and not to stick with the deadline. But it finally adopted the domestic law in April 2019. A bit later, but better later than never. Because now we have quite a harmonized rules on the trade secrets. And that is important because you used to have a quite diverse situation in France and UK and Italy and Germany. So sometimes some of the certain things are protected in one state, but not in the other. So especially when you work in an EU environment and not just locally in Germany, that is really handy. So the trade secret acts. Usually it was a bit of a difficulty to define actually what is a trade secret. And that has been an issue for decades, I would say. Now it is defined as information that is not generally known among or really accessible to persons within the circles that normally deal with the kind of information in question. Also legal terminology, sorry for that. Then the information must be subject to reasonable steps to keep it a secret. And there must be legitimate interest to keep it a secret. Usually that interest is simply the secrecy of being a commercial value, for example. Now the problem here is already what is a trade secret for reverse engineers. Because especially we have this requirement of information that is subject to reasonable steps to keep it a secret. But again, reasonable is an undefinite terminology, undefinite word. So here we need some clarification. And actually, if we look back into the history already under the old law, it was not really, it had some kind of comparable approach to it. And we can look back, for example, to 1935, to the Reichsgericht, where there was a chupress case involved, or Stiefel Eisenpresse in German. And the idea was that a competitor of that producer produced that chupress, actually wanted to acquire the chupress for a cheaper price, but the competitor declined and then they just tried to reverse engineer that chupress. And to reverse engineer the hardware, the mechanism of how that worked. And then, so finally, the case ended up in front of the court. And the court decided several issues. And first of all, it's kind of tried to define what is a trade secret and what is actually reasonable steps to keep that information a secret. But also, it didn't end up really lucky, because again, it decided that it depends on the reasonable amount of time that you need to do the reverse engineering process, or the reasonable effort that you put into the reverse engineering. So in the end, we don't really clear with what is actually reasonable or not. But at least for our case, when you deal with hardware, with chips, for example, computer chips, to hardware reverse it, it's, I think, most likely very time consuming and costly. So that's can be regarded as a trade secret per se for that purpose. So in general, for reverse engineers, it always depends on the simplicity or easiness of the reversing act. But in the end, at least for the hardware reversing on chips, that will certainly be met, I think. Now we have the prohibition, maybe a bit more broadly construed than before. So a trade secret must not be acquired through unauthorized access to relevant documents subject to the control of the trade secret owner, some kind of spying is, for example, prohibited and through any other immoral conduct. And actually, immoral conduct sounds a bit weird in that perspective sometimes. But also in this chupress case, the court had to decide whether this reverse engineering was in the end immoral or not. And decided that yes, it was. So here again, actually, we had the question of is reverse engineering per se immoral conduct or not. But the good aspect is right now that we have a new rule that points out that actually reverse engineering, at least on the trade secret act is legal or is lawful. Because right now we have a specific rule that says the acquisition of trade secrets is lawful by the means of observation, study disassembly or testing, which means reverse engineering. And the product that's another requirements, the product has to be made available to the public. Actually, that's the most important alternative here of that phrase. So whenever actually the good of the product is on the market publicly available, then it is available to the public. So everybody can buy it. And then you can do research on reverse engineering, for example. This might be a bit different when, for example, certain companies are being made the offer, for example, to pre test certain kind of products. That might be a bit different there. But at least as soon as it's publicly on the market, purchasable for everyone, or by everyone, then it is subject to section three. So that's actually the very good news. So in the end, I would say that we have, first of all, a good idea right now that intellectual property law protects reverse engineering. So it is not against it. We have competition trade secret law that at least right now, specifically allows for it. And that also allows for another debate that actually exists amongst lawyers, because certainly, this is true for hardware reverse engineering. If you do software reverse engineering, it might be a bit different because you might, you're subject to the copyright act, for example. So there are a bit different rules sometimes. Also the main idea that reverse engineering is not prohibited per se. That is also true. But here, also, when it comes to hardware plus firm wear, then you might end up sometimes with software and with copyright act, it might be a bit difficult. But again, also the main ideas that reverse engineering is true, or is is lawful. And wherever there is an uncertainty right now, people or the lawyers say that whenever is there is uncertainty in the intellectual property law side, with regard to reverse engineering, then it must be also interpreted as legal because we have now the specific laws in the new trade secret law. So actually, that law is quite important for reverse engineering right now. And it's also a good, actually, a highlight, I would say, in the future debates of IP law and related fields. So in general, the outlook is quite good, I would say. So in the end, as a guideline for research, it's actually quite simple, because first of all, keep calm and do your research.  I mean, certainly, some lawyers will try. And maybe they will succeed in some cases, but usually overall, again, they shouldn't. Then what the law does not provide for actually, but we should do is follow the responsible disclosure process. In general, with regard to the trade secret act, for example, it does not really differentiate between the reverse engineering act per se, so the information that you gain out of the act, and what you do afterwards with that information. So to say, in terms of research, you want to publish it in a journal, for example. So is that allowed or not? Well, it's not clearly said so in the in the code. But because we don't have this kind of distinction in the code, it's most likely also legal. Because we have now this general allowance in the know how law, so to say. So in general, it's most likely also legal if you just publish it in a journal. But nevertheless, to be on the very safe side, you should follow a responsible disclosure process. And also you have made some good experiences with that so far, right? Yeah, recently, in our group, we made some some good experiences with responsible disclosure. So a colleague of mine found like a hardware vulnerability, where like millions of devices are affected, which will be in the market, probably for at least 10 or 20 more years. And then like those big companies as hardware manufacturers, they have mechanisms in place to disclose responsibly. And the experience my colleague made was that he got like really like he got an answer within just two days from the company. And they asked for a technical write up, then they needed a little more time to confirm this technical write up actually. And afterwards, on the one hand, they, they sent the vulnerability to their customers under NDA. They didn't disclose how it actually works. But they told the customers, okay, there is a vulnerability in our products. And on the other hand, right now, we are coordinating like the publication of the paper and the publication of the vulnerability together with the company. So like some of those like bigger companies have mechanisms in place. I don't know how it is for, you know, like small German middle stand. They might never answer to your responsible disclosure. But nonetheless, and then you should do it and you should give them some time at least before you before you publish. And just in case maybe you end up in an emergency situation that you maybe get a nice letter in your mailbox, and it's from an opposing attorney that tries to sue you, for example, and then also keep calm and just ask a lawyer because first of all, if maybe you're threatened by a horrendous sum that you should pay or something like that. Don't be afraid of that. First of all, because if you go to a to a lawyer and just ask him for a first time of advice, this per se, so the costs of the lawyer per se, they're not super high. Actually, they're also covered by law. So it's it must not be higher than 190 190 euros plus tax. And so that is also a good site. And then in the end, also, because you have quite a good law on your side, if you do hard to reverse engineering, then if you win the case, for example, then also the opponent, the losing side actually pays all the fees for the lawsuit. So that's also a good part. Of course, it doesn't solve all the problems because especially certain areas are not very clear in terms of jurisprudence. They also have to maybe discover this law. But at the same time, also, and I think that's also a point that we could take from the last year's talk, was that the judge, even though they ended up with a with an agreement, but the judge actually mentioned that the case against the our colleagues was quite weak. So in the end, I think they wouldn't have won the case. I think the opponent's attorneys wouldn't have won the case, but it would have looked really good for the researchers. So as a summary, it's actually a good point that security research overall is taken into a broad condesertation by lawmakers. That also holds true for other areas. We have a different regulation that specifically deals in the recital with the permission of the pattern or the copyright law infringement, for example, if you do research on encryption or something or decryption. So that also, if it's regarding cybersecurity, this kind of aspects, the research on that is usually largely protected by now. It has several instances where that was mentioned. So overall, it shouldn't look so bad. Of course, that's no guarantee, like in from the court in the law, and on the high sea, you're in God's hands. So you never know, of course, but if you follow the guidelines, actually, and if you just keep calm, there shouldn't be so much of a problem. Thank you very much. Thanks for your legal advice. Yes, so thank you, Stefan and Stefan. And we actually have a few minutes for your questions. Yeah, maybe there are some, I suppose. If you have one question, please just use the microphones here in one, two, three. And we start with question from microphone two, please. Hi, thanks for your talk. I wanted to know what if I develop tools for reverse engineering and I want to sell them or release them, am I some way liable or like, be scared? So selling, so maybe selling it to come like in general, on the markets, not just to other, no, in general, no, because if in the end, always the one who does the research or the reverse engineering actually is supposed to display or declare that their research or what they're doing is for the purpose of research. So whenever they use maybe your tool that you used for maybe your solid grounds for a different purpose, then it's up to them actually, that they may be infringed patent law whatever. But the reverse engineering product per se should not be illegal actually, no, thank you. Okay, thanks. And mic number three, please. Hello, yes, thank you for your talk as well. I was wondering if vendor specifically states in their terms of services that disassembling reverse engineering and decompiling of the product is not allowed. Is that something that this talk that you just gave is superseding like is a how strong are the terms of service in a legal way? Excellent question. In general, always what you want to do, of course, if let's say the law prohibits a certain act, then you want to buy an individual contract just prohibit that behavior. And that happens quite frequently, especially in the general terms of agreements. Now, you mentioned decompilation. So if it's regarding software, it might be a problem if you really decompile software because that's actually not reverse engineering that is allowed. Like that's what I said, software is a bit different sometimes. But if you have a clause that says you must not reverse engineer basically, or you must not study or like the law, for example, phrased it, this clause is most likely will not uphold the court because if it's a general term of agreement, the court can decide on the lawfulness on this kind of general term. So not if it's an individually discussed contract, but if it's like this general terms of agreement. And then the court must also decide whether some kind of clause is against a basic legal idea. And right now with regard to the trade secret law, it says really clearly that reverse engineering must be allowed. So when then it infringes with that really clearly stipulated rule, actually, then also that general term of agreement would not hold up in court and such. But again, with regard to software, there's sometimes some kind of exception. So with especially regard to decompilation, so that might be a bit different. But that's the general thing. All right. Thanks. We go to mic number two, please. Yeah, hello. So you talked mostly about hardware, reverse engineering, but often what you do when you hardware reverse engineer something is you extract some data from from inside the chips and then you end up with a sequence of bits and those bits usually encode a computer program. So the rest of the reverse engineering then is deals with software. So you didn't talk about the computer programs directive, I suppose that's relevant here. As far as I remember, that one has some it allows you to do some things, but it's very strict about publishing things. So for instance, publishing the result, the information that you gain through the compilation in the cases where you're allowed to decompile. So I'm wondering if that if you're the moment you start analyzing the bit stream that you've extracted if you're then in software land already, or if you can use the hardware. Yeah, also excellent question. And you're also discussing that a bit beforehand. Yeah, if you end up with software, that could be protected by the copyright acts. So we have a good sense. And there you have one rule also that's this kind of basic reverse engineering is allowed, but you also have another rule that says you must not decompile. So in the sense, if you just translate your or produce some kind of source code in totem, but completely, that would be regarded as the compilation. And that is only legal if you want to enhance into operability with different systems. If you don't do that, actually, then it's a bit problematic and most likely prohibited. So but on the other hand, if you do maybe some kind of black box testing, so not decompile the whole code, but maybe use only more specific areas of black box testing, then also this kind of reverse engineering on that part is not regarded as the compilation. So then you're also out of that rule. And then also again, it holds true that reverse engineering is legal. So it depends on the exact sort of circumstances actually. Yes, I have one question to our signal angel. Do we have any questions from the internet? Okay, well, so then we go over to Mike one, please. In your answer to the first question, you said that if someone used a tool that was originally mean for some other benign purpose and used it to reverse engineer something, the toolmaker would be not liable. So what if the toolmaker specifically said, okay, this tool can be used to reverse engineer X, Y, C. I never done this, but I could think I might think it might work. Would they still not be liable? Well, you must in the end, the one who you mean the one who who does in the end, the reverse engineering with that. No, no, the person who makes the tool, not the person who reverse engineers. Well, if that tool is is a belatedly is also potentially a perfect legally tool to use reverse engineering, and then the other person just misuses it or abuses it, that is actually totally fine at that point. Even if you say you can't break the law with that? Well, you shouldn't do so. Just I would never say that loud, of course. I mean, don't get yourself into even the discussion of the trouble. So just avoid any kind of that and only like state and stipulate that you're doing it for research and hardware reverse engineering or reverse engineering in general. Thank you. Yes, we have one last question, I assume, from Mike number two. Yeah, so I will use this for two questions. So as a researcher, I can I'm allowed generally allowed to re engineer products, which is good news. So first, how does anything change? It changes if I make this documentation publicly available. So I re engineered a piece of hardware that only falls under patent law. And now I publish these design files for free under free license on the internet. Is that legal? And also here's a little discussion. Because it is clearly legal if that information is part of intellectual property law. There is one discussion that says this kind of information is also some kind of know how protection. So also in the direction of a trade secret, more or less. If you interpret it and that's not completely clear yet, but most likely it is actually also intellectual property and no know how protection. So if you maybe have this hardware infringing on the on the patent rights and then you publish it in the journal or something like that, that's most likely is also legal in that regard. Yeah. But there is this internal discussion actually amongst the lawyers, whether it's know how or whether it's simply intellectual property. Well, I could publish it on GitHub and then link in my paper to that. Is it still legal? Well, in general, I would say yes without liability here. But yeah. And second, how do I qualify as a researcher? I mean, can I do the research just by myself and claim I am a researcher and just doing it for the matter of science? Whatever I clarify as science? Yeah. So throughout the different areas of law you have really broad terminology in that regard. So of course you're on the perfectly safe side if you work with an institution like a university or an institute something like that. If you do it completely privately, it would well, there's another exception clause that if you do that simply for private purposes, but that would include that you don't publish anything. If you just do it for the research, at least you must state what kind of expectations you have to acquire new knowledge or maybe to solve a kind of a mechanical problem or something like that. So you cannot just broadly state that I'm doing research, whatever that is, but I'm doing research. But you need then at least to specify what is your expectation, your findings, what you want to do actually, what you want to achieve with it. And then but it could be also it can be regarded as research as such. Cool, thanks. And that wraps it up. Unfortunately we're running out of time and let's all say thank you again to Stefan Becker and Stefan Kulossa for their talk and let's give them a warm round of applause.


The Minister of the Federal Capital Territory, Nyesum Wike, says he did not invite President Borla to intervene in the political crisis, Rockham River State. Wike stated this today while addressing a congregation during a Thanksgiving ceremony for the immediate past commissioner for works in the River State, George Kelly Alabo at the King's Assembly in Port Hackett, the state capital. The former governor of River State said it was the residents of the state of Nigerians who called on the president to interfere and intervene in the political impasse. The minister stated that now that the president had intervened in the crisis, some Nigerians are criticizing his decision, saying that he does not have the same constitutional power to intervene in the state. Some of you do not even know that Mr. Pellet had invited us perfectly and said, do this, do this, do this, do this. And he agreed, deformed Mr. President. And he didn't do it. And Pellet had done, but okay, the larger state, come. We must allow people to simply truth. I've done my own part. And I'm happy. And I'm doing well in Abu Ghatu. So all of us should love the state, but don't leave this propaganda. Leave blackmail. That's nothing I'm looking for in this state now. I had my own budget as FCT minister. It's like a governor of the state. I have my own commissioners. By January 1, I present my budget before the National Assembly. I will preside over the expenditure, while I'm saying, if you're a politician, Pellet, call it to the rules. If you want to settle us, find out the facts. Don't just shout, Asawana, no. Because when we are choosing who will go, we never shouted Asawana. All who shouted, come. You will go and present us. You can't be a governor. And then you look at what's happening within your environment.  Part of governance is managing people. If you cannot manage people, they don't have business being in government.


What's up, what's up everybody? Hope you're amazing today. I'm amazing and Back in town I have been away hunting for a wedding venue for my sister and It's just got back in town and it was great seeing my family my mom and my sis Back to the world real world and today I'm going to embellish Hey Carrie this piece that Jeff created a little while back To look like one of those beautiful Spanish Blankets I always forget what they're called but you know what I mean because you look at this and tell exactly what it is That I mean and so I really like how it looks. It's very clean, but you guys know me. I'm not That so I want to create Some movement in it and I was thinking that I would just take these lines and embellish them to give them Just some movement and I don't know if I'm gonna use these or not, but I got these from Amazon. They're just little Squeeze bottles who I don't want to do that. Well, I already did it. Well And There's supposed to have a cap in there They're okay. Oh here they are We don't want to do that yet. So it's got a little Tip on it. So I'm gonna fill it close it and then I'll be able to control my resin in theory because you know resin's gonna resin So I'm gonna leave Some of these Clear Some of these some of this clear, but I'm gonna mix some colors. We're gonna see what we like Claire is out today. She's supposed to be getting some of her results from some tests. So Send her some good vibes prayers juju, whatever you're into There's some good news for her And let's get going so This piece was done with this was a Acrylics right beam Yeah, it was acrylics in Posca First color I'm gonna mix up is one of the new colors that we have it's called cotton candy by just resin It's in our shop artist till death comm along with all the colors that we're gonna use today I like this color because it's very vibrant and it's got a slight shimmer to it Let me see if I can Already got resin on my phone It's got a slight shimmer to it But the shimmer is like a it's like a pearl shimmer so it's Very not overbearing and a lot of people ask me all the time why I choose paste instead of powders But it just mixes in Oh Beautifully so effortlessly, and I don't have to worry about a whole bunch of Micah particles Floating up into the sky Oops are y'all how beautiful is that color? Yes, Gary. It is one of my new pace. Look at that delicious color and This one is opaque just for the record I'm doing good. I haven't made a mess yet. I probably shouldn't have said that next time I'm gonna mix up is blue lagoon This is a translucent or transparent. I'm mixing up this color because I want to see if I can see through my resin to the lines even though I Made it a pretty dark color But the tense this color is blue lagoon by color obsession also available in my shop But they are forever see-through. What's up, Tia? Thank you for stopping in We always love seeing your beautiful face So this no matter how much pigment I add will always be see-through and I'm gonna do some magenta from Just resin I Think This is an old old jar so Maybe not Grab a different color real quick So They're green on there. Nope. Let's just do a turquoise Do a turquoise luster And if you guys have any questions about any paste powders tints dies What's up, Tressa? How are you doing? Let me know when you have time to come by That's beautiful color and then I'm just gonna do a white because they're oh There is white, but it's not that big of a line of white. So maybe not The color just mixed up is turquoise luster by just resin So let's do a purple instead because there is purple For sure in the piece this color is called pretty periwinkle. It's from resin art It's a dry paste. So it looks like a powder, but it Really just melts into the resin and since it is a dry paste and not just a regular mica. It's very The particles are heavier. So even if I were to vigorously mix this up You can see even with the flash on that nothing's really hitting the air Pretty periwinkle. I probably would have called this an indigo, but you can see it's very rich color The resin our colors have such a sparkle to them. It's bananas Okay, so we have our colors mixed And I've never done this before so semi nervous. So I'm using the stone coat art coat today Because it's my jam resin But I went ahead and pray and mixed it up before we Started filming so that you guys don't have to just secure and watch me do that now once you Put resin in these bottles most likely it's gonna be one and done in terms of use There's probably a way to clean them out I don't have the time patience or knowledge Ultimately could probably just mix up some Acetone or some Like 90% alcohol And be able to clean it out, but yeah so I am gonna start at the top and Create my design and then for every other color that I add. I'm just gonna break Around it So make sure you guys can see what I'm doing We're gonna start with this line up here Okay So let's do a test Sweet it it kind of seems like it has like a little bit of a texture of like a puff paint out of texture, but like the consistency coming out of This little squirt bottle It's pretty handy for control if I do system myself now Now After having just done that I can tell you that it's gonna squeeze out at Probably a quarter inch so Even though I squeeze out a kind of a skinny line. It's already blooming Because it's gonna want to self level down to An eighth inch so just be advised That it's gonna bloom.  Can I say pipe up squeeze out? I don't know Thank you, Tressa that Yes, I think everybody needs to spell it to my new favorite it's cotton candy from just resin. Okay, so I'm going to I'm just gonna drip down this way When I squeeze less and move faster, you can see it's kind of a skinnier line I'm gonna have to widen it a bit because I did not draw it straight and then whenever you have drips You can round this top edge to make it look more realistic and then since Blue it's kind of bulb out at the end We're gonna go ahead and do that Remember resin's gonna go where it's already been.  Just like that You know, I was just gonna squeeze a whole bunch of that out to fill it in but don't do that because then you'll have to open your Little squirt bottle and refill it Just fill it in. If you have any resin left on the side just like that. Um, I don't have any needle tip applicators In my shop right now. I just I'm out of them. So We're working with what we got. And sometimes you have to do that. And anytime you have to do that. It is okay. You know, a lot of times I just have to kind of just Make do With what I just got available and there's nothing wrong with that. Something's missing over here. And I think it's gonna make this skinny one.  It just gets out of hand sometimes. All right. Got that. Let's do a blue next. Oh my goodness. Okay. Now when you add a tent as opposed to a paste. It's going to be a thinner resin than What your paste resin next is because the tents are very watery. They actually have the consistency of water. And a paste is like a pudding. So when you mix that with a resin, you're going to get Kind of the average consistency between those two mediums just me advised about that. Now I didn't think this all the way through in that I'm not sure what I'm going to do when I come up to two colors touching because I don't want them to Bleed into each other and ruin my lines. So the way I'm going to work around that is just First of all, I'm going to wing it, you know, it would probably be easier as if I just draw a line and then make adjustments with one of my sticks. Sorry, guys. Sorry, guys. How are the gels consistency compared to the tents or the pace. So the gels are A lot thicker. They're probably what I would say in between the consistency of the pace and a tent. If you've tried the Illumini guys, they're, they're a lot like that, but just slightly thinner to give you kind of a base of comparison. And we are going to end up heating this a bit, but we're not going to add too much heat because When you add heat, you thin out your epoxy and when your resin is thinner, it's going to level down to less than an eighth inch. On my flight back from Nashville, my sister. I watched a lot of the great British baking show And now I want to do a whole bunch of piping and I'm not sure why, but I feel like I just want to Anybody else do that watch cooking shows or baking shows and then decide that you're that you're going to do that. Even though you probably shouldn't even try it. At least that's true for me. I'm the only one that's fine, but it can't be the only one. Right. So I'm going to get fancy with some of these strips. I say fancy. It's not fancy. It's just, I'm going to get artistic with them. We'll just connect them this whenever you do drips Always round your corners. Because that's what water does or anything that is dripping, at least as far as I know. That was a good question carrier. Are there any other questions regarding The pace or any other of our Materials that I can help people out with I love answering questions. I'm going to the turquoise and I think how I'm going to address the two colors meeting this is just let it cure up a little bit. And once it's got a good tack to it. I'll just Kind of scoot things together. And I think that'll be just fine. Just fine. How are the effects of the gels. So the gel pigments are a lot like The tense But they're a little bit thicker. So if you want to make cells, you'll probably have a really Good effects with cells on the gels because they're thicker. And in my experience, the thicker pigments just give me better cells. However, I have gotten cells with the color obsession tense as well. And they always look really good. Some people have problems getting cells with the tense, though, just because they are thinner. They are transparent or translucent. So it's just a different look. But I honestly, I haven't had any problems. Getting cells with those cloudy art. That's a great name. And you're in the UK. That's someplace that we've My husband, I've been meaning to go to teach some art classes, but we haven't quite made it yet, but we're going to promise where Have you guys ever done any embellishment work with your fluid art something like this. I typically am very particular about doing embellishments because I don't want to take away from it. The artwork that I spent all of the time doing But I think there's Definitely a place for it. I've also been thinking about doing Some of my texture medium artwork and then putting resin over it to give just another new look What do you guys think? What are you guys into watching?  Lankenshire I would love to How is the art scene there? There are a lot of artists I need another Squeezy bottle Also, I hope I said that right because Words are hard generally for me Has anyone ever done the dot art with resin? Maybe I should do that too It's so sparkly This pretty periwinkle But all of the resin art Dry pastes are this sparkly The galaxy edition resin art Pigments are Ultra shimmery and sparkly There we go You can definitely see how the thinner ones are kind of bleeding out like this So maybe Maybe don't do tints if you guys are going to attempt This type of work Probably the dyes Would have been a better choice because they're thicker When you do drips kind of vary the length of them The width of them Any kind of little fun action Also This is on a canvas So I know I'm going to have a little of a dip problem That's okay I think it's still a great idea anyways So once this has cured up a bit I'm going to go in and attach the areas Like this that are kind of broken And then it will look like his piece is melting Hey look I made your piece melt Oh my gosh I love it So I'm going to have just a little bit of heat Because we do want our resin to have a beautiful complexion And if you don't those air bubbles will Kind of just stay in there and pop late in the game Or not at all And give you a bunch of issues Also don't blast it with high air pressure like I just did You can definitely move a lot of your resin out of where you want it And if you wanted to be kind of a naturalist with it You could just draw a line of resin and then tilt it up And let it drip naturally But I don't leave things a chance like that Now I do have a little bit of that resin left over And I'm thinking I want to do I just want to see what it looks like I have a regular coaster That I wouldn't mind messing up I just want to see if I can dot a bunch of These colors and see if they all stay I did this one I guess a couple weeks ago last week Will there be larger sizes of the tents Sorry spell check is stupid Evelyn are you talking about the Are you talking about the Color obsession tents You guys hear him I love his laugh Now I'm just dotting these out just for proof of concept Just to see if I want to explore Doing any of that dot work that's going around so popular right now I don't know if I have the time or the patience to do one of those But I want to see if my resin will stay Don't Oops it's a big air bubble So it's good that I have some of my translucent Some of my A paste Some of the dry paste For my thick mica And so I can kind of see engage how much each one of these will relax And settle or self level See if one of them Self levels more or less than another one It already looks like my Blue dots Already Kind of relaxing out a little bit more than the rest of them Since we're playing I just want to see So since resin wants to go where it's already Been and anything other than that you kind of have to force it to move outward Doing things like this where your resin has to work to grow outward Is always really neat Because essentially Sometimes your resin has to kind of roll over itself to move outwards And it's gonna have to move outwards because you're stacking Color on top of itself so it has to go outwards but to do that it's going to roll Over the outside colors In order to move outward I hope that makes sense Nothing's going to stop it from moving outward when you stack so much color on top of itself So I just want to see what it's going to do ultimately I'm going to take this Test piece and put it up Whenever you have a resin left over from doing a project or piece I always recommend Taking the time To Experiment Because odds are You're not going to mix up a whole bunch of resin In order to experiment because you don't want to waste it But when you do it In order to experiment because you don't want to waste it But when you have some left over It's good to capitalize on the opportunity to experiment Like so I've been thinking about doing Like an entire resin embellish Like a resin doodle like this But on a huge, huge-ish, huge-er scale I think that would be Beautiful and a lot of fun Oh my goodness, what if I get a whole octopus Great Now I'm very much thinking about what I could be doing With this type of Thought process Because I think it would be a lot of fun to do An octopus like this and just do all the tentacles Like this Like this I mean, maybe it won't look right Maybe it'll not hold its shape well enough But You don't know until you try, right? And I'm definitely one to try And not give up in the meantime His laugh is so infectious There's a lady in the audience laughing so hard I'm going to quit going before I Do too much, but I think I'm going to definitely Explore this I say I'm not going to do anymore Because I don't want to do the most And then I just keep going Anyone else have that problem? It can't be just me Well, every larger size is the gel-tent room color fashion I will I will find out for you, Evelyn I'll ask Kim I'm supposed to be having a call with her in the next couple of days And she says you and a few other artists were the inspiration for me to give resin a go Well, I'm so excited about that Thank you for sharing that Because my only reason for doing YouTube is to help people To find different ways to express themselves in resin So I really appreciate hearing that And if you have any questions I'm always happy to help Resin is just a very awesome medium to Do a whole bunch of different things with And if there's anything I can be of assistance With I'm very interested in always helping Cloudy art, what's your main medium? I feel like I'm just creating a paisley And also I'm okay with it Oh, goodness, like I'm out of resin now At least in the pink So I'm going to have to Best for this No, I have one more idea Okay, so here this looks like I'm going to do one more Hopefully my phone won't die before I get it done Obviously that would not be the most functional coaster Obviously Oh, I like all those What is this? I'll get it Oh, Wayne Nice to meet you, Wayne I'm going to do a trick I learned when I made brownies a lot Just cake design A lot of just random coasters sitting about That I've made And I'll probably be doing this In the Big piece that I want to do Oh, pretty I just tilted it Should have known I was going to do something silly Oh, my goodness, okay Careful It's having an awesome Tuesday I hope so This makes this a little Too lazy I'm going to explore this more So it doesn't look quite so Slappy, messy, and horrible But it's going to look great Once I figure it out Just y'all wait But at least I know it works I've been experimenting with resin for a couple months Sweet Oh, you sold a piece Called Macaw That's awesome, Wayne Congrats I'm going to sell a piece of artwork It doesn't matter if it's The first one Or you sold a thousand It's so special every time Someone makes a sale Don't take that away from yourself All right, you guys I have got to get back To work But if you are interested in any of these colors They were cotton candy From just resin Blue lagoon Way to go, Wayne Pretty periwinkle from resin art And a turquoise fluster from just resin Jeff is working on his airbrush rig Because we're going to be airbrushing At a pool party On the fourth Yep It would You could do it with UV resin But coloring or tinting UV resin Is kind of tricky business Because The UV has to get through All the way for it to cure How does that make sense And on the back of that His daughter wants me to do a blue and pink one Way to go, Wayne Congrats Can't wait to see it If you haven't yet joined our Facebook group So I can see all of the work that you do I can see it Yeah, we are setting up Tick Tock Shop Red Oh, sorry Gwen, I'm happy to answer your question What you got Massive thank you for the inspiration you've given me Thank you for saying that And I'm always here Always super happy to help So Always let me know What I can do And what you guys are interested in If there's anything you guys want me to give To you guys If there's anything else The Barbie I recently did She is available Bowie is not available But he's precious And so yeah That concludes our live for today But I'm going to stick around For another minute or so To see how I can help Miss Gwen So I hope you guys Subscribe if you haven't yet Please purchase from our shop We're a small business And the first thing I want to do Is make sure that all the stores like you guys Is what keeps us Open And so yeah Help us out Please share our videos If you haven't So I'm pregnant And it's outside And my cousin lives with me And she's five I'm so pregnant And it's horrible just because I don't know the research behind resin and pregnancies. So I can't advise about that. Have you done acrylic arts or I wouldn't do alcoholings or watercolor? For kids, a lot of times they like doing the little shapes that we do. I did these on a live, these cute little stained glass. Oh yeah, the Smush videos where you just put a whole bunch of resin down. I do it in a lot of my videos at the end, put a bunch of resin down and then, or not resin or acrylics in your case, put a whole bunch of color down, put two coasters on themselves and then pull it apart like an Oreo. I do do classes. Watercolors are great for kids because they're very forgiving and even if you accidentally leave your colors out like this, they reactivate as soon as you put water on them. I don't have any water I would show you, but I guess I can just lick my finger so they reactivate super easy. So watercolors good, acrylics are good. If she's about putting anything in her mouth, these are not it, but there are paints that are made, don't do oils. There are paints made for children and they're safe if you put it in your mouth. They're called temp, temp. Be aware of those paints called that babies can eat tempera, temp. Is it babies can eat tempera paint? Well they're not supposed to tempera paint. It's like mostly water. I'm not saying she should eat it. Please try not to eat it. It's like being used on construction paper in kindergarten. Yeah, it's kindergarten paint.  Yeah, tempera paint. Thank you Evelyn. Oh yeah, outside is crazy. It's 114 in Dallas right now. Anyways, she doesn't put seven in her mouth but honestly she's five. I can never be too sure. Yeah, understood. So you guys, I hope you have an awesome, awesome day. I gotta get back to doing some work on a commission piece that I hope I nail and I hope you guys have an amazing, amazing day. Thank you Gwen for asking those questions in Cloudy Art, Wayne.  Those are beautiful places, Wayne. Oh, you're Dallas too? Yeah, it's a whole nother world right now in Dallas. All right you guys, be kind to one another cause you never know what someone's going through and always remember that we do the tests so you don't have to and we'll see you guys in the next video. Bye. I said it cause I waited. Oh, I wasn't listening. I'm trying to get these cleaned up and returned. Always remember we do the tests so you don't have to and I said bye. Way to go. Yes, all the things, be kind to each other. You never know what someone's going through and always remember that we do the tests so you don't have to. They were repeating it with me. Anyways, y'all are amazing. We'll see you guys tomorrow at 6 p.m. Central. Bye. Can I just say bye? Yeah, but we say bye.