There has been much talk about creating a culture of creativity and innovation in the global higher education sector and elsewhere. In fact, this June, June this year, more than 300, I mean more than 30 university presidents from 16 countries will convene in the Hong Kong University of Science and Technology for the first Times Higher Education Asian University Summit. The theme of the summit is how universities nurture creativity and innovation. I've been fortunate to have been invited to speak during the president's session on the topic culture, creativity and innovation. Specifically, and being asked to talk about how culture can affect the environment so as to nurture creativity, innovation and entrepreneurship in a university. Earlier this month, the fifth Asia-Europe meeting, Rector's Conference and Students Forum held in Prague. By the way, our Chancellor of Pupibagyo attended this forum as well as our student region. That forum or what we call ARC-5 conference focused on the need to equip young people with a more flexible, innovative and employable skillset. The forum pointed to the need for cooperation between universities and businesses to help students prepare for the labor market. The two conferences share a common vision of the future that of a vibrant culture of innovation, adaptability and creativity, a culture that is reflected in the outputs or products that result from the research and creative process and the ventures that bring these products out into the market and for the use of humanity. A culture that is seen in the caliber of the workforce who drives industry to new heights of development and a culture reflected in the resulting development of a country and the improvement in the quality of life of its people, especially those who are disadvantaged. This same vision brings us together today and tomorrow. We are here to remind ourselves that as diverse as our fields and perspectives are, we share a common vision, a vision to serve the same country and to fight for the same causes. By now, the words creativity and innovation have become buzzwords in both industry and agadim. These are important or there are important distinctions between the two, however. According to a survey of literature, creativity is the ability to produce work that is both noble and appropriate. There are three levels of creativity, discovery, which is the lowest level of creativity followed by invention and finally, creation. Innovation, on the other hand, refers to the process of bringing any problem-solving idea into use. It is the generation, acceptance and implementation of new ideas, processes or services. That is innovation. Artists, writers, musicians and humanists understand creativity. Scientists, engineers, technologists and systems analysts know innovation. Creativity is about imagination. Innovation is about action, putting creative ideas to work. Creativity is unquantifiable. Innovation can be measured. Without creativity, there can be no innovation. But it is true innovation that creativity can impact the world. Several studies have been made regarding the impact of culture on the ability of a country or an institution like a university to promote creativity and innovation. One study of European universities, I have to cite this for one of any study of Asian or Philippine universities, has found that the capability of a country to initiate innovation is related to its culture. Specifically, cultures that are less hierarchical and centralized and a more open flow of communication among levels of society are more likely to foster innovation. Cultures that are able to tolerate uncertainty, conflict and change and those that promote the so-called feminine values of tolerance, solidarity, trust and social emotional support over masculine values of independence, achievement and competition. These two promote culture of innovation, meaning the feminine values. It has also been found that cultures that value the family tend to be more conservative unless open to new ideas while cultures focusing more on relationships with friends and other persons with different backgrounds are more open and provide a resource of new ideas. Such studies provide a number of points to reflect on. Although this is a study of European universities, I think people are people. People are the same wherever they are and they are influenced, of course, by culture but they form culture as well. These studies showed that culture can help us in designing structures. We need to promote the kind... I mean, we can design the structures. We need to promote the kind of culture we need in our country as well as in our university given our goal of inspiring creativity and innovation. The kind that produces solutions and modes of expression that support national development. An important mandate of the University of the Philippines. It begins with a vision. The vision of a country that enjoys rapid, inclusive and sustained economic development. A country that is home to happy and productive people. As has been born by the Ambition 2040 Survey of the National Economic Development Authority. This is the vision of our country, the Philippines, the future of our country and people. A vision like this generates energy but without the proper structures in place. We have no way of transforming this energy into concrete realistic actions and progressive results. Structure that is the fundamental parts of a system and the way they function in relation to one another determine behavior whether at the individual or institutional level. Structures do not only include physical infrastructure. It also include policies and political structures, social structures and systems and processes. Our culture is part of this vast structure. In fact our culture along with our assumptions, beliefs, aspirations and the objective reality exerts the most influence on whether or not we welcome creativity and innovation. But as any engineer knows structures can be changed. We can redesign, retrofit, optimize, reshape and transform structures so as to reflect the flow of energy. Change our structures and we change our behavior and our culture and in turn change our future. It's about time we change our future. And in light of the imminent political shifts we must ensure that this truth is understood by our leaders in the university as well as our political leaders in the nation. This is what we are trying to do in UP. Building new structures and bolstering or redesigning established ones. We are doing this with our mandate as the country's low national university to perform our unique and distinctive leadership in higher education and national development. And we are harnessing our resources to aid our country's quest for true and inclusive growth. In UP we understand the most important ingredient in achieving our vision is our people our human resources our human and knowledge capital. We need a world-class workforce for our country with talent, passion, aptitude, attitude for learning and sheer fortitude able to navigate the world of work in this fast pace globally interconnected knowledge economy. We need a nationalistic citizenry whose sphere of responsibility extend not just to their own families and communities but to the country as well. I think this is an area where we are very much wanting. We say we are nationalists but our perspective can go beyond our own tribe, our own families. We never think of ourselves as Filipinos. We never think of ourselves as Ilocanos, Bisayans, Sibuanos, Tausugs, Maranau and that's why our country up to now is very much divided. Our basic education system is our primary means of building this workforce and citizenry. For this we have the K-12 basic education program which UP fully supports. In a society like ours where every batch of 100 students who begin schooling at grade one only 12, mind you a mere fraction of 12% will graduate from college. Thus a strong forward-looking basic education program is a fundamental need and we need to strengthen our basic education system to the K-12 program. We must also improve the quality of and access to higher education in our country. Prior to develop our human capital, our human and knowledge capital into the kind of innovative multidisciplinary leaders we need, not only in government but in all fields of endeavor in our country. Other than that we must create a strong culture of research and development and artistic work so as to produce the kinds of creations and innovations that generate inclusive economic and social growth and can put the Philippines in sync and in step with our more dynamic Asian neighbors. We are so far behind now and we realize that. Indeed for UP this both a function and an advocacy. Last March we launched a think paper produced by the UP Office of Vice President for Academic Affairs and the UP Center for Integrative and Development Studies under the guidance of the UP Office of the President. This think paper is entitled Knowledge Based Development and Governance challenges and recommendations to the 2016 presidential candidates. In this think paper we exhort our government which will be led by a new president in a couple of months from now to increase investment in higher education quite apart from investment in basic education and in research and creative work so as to increase our capacity the capacity of our university and the capacity of other research institutions in our country to undertake innovative activities. I don't know whether you are aware of the statistics our Asian neighbors are spending 2% to 3% I mean 5% of GDP for education. The Philippines still at the level of 2% to 3% although there has been a significant increase over the past few years. In research and development our neighboring countries spend an average of 1% we are at the level of 0.1 to 0.1 3% way behind. We need higher levels or higher level experts and expertise that just higher education but higher level experts and expertise those who go beyond bachelor's degree these are the experts and expertise that will constitute our country's supra structure that is the human and knowledge capital needed to build innovative capacity for without a strong supra structure we can only continue to limp along on our weak agricultural sector our low value manufacturing and on the remittances of our poor OFWs while our growing GDP continues to fail to trickle down to the great majority of our people only the rich will continue to become richer and the poor will remain where they are we need innovation to bolster our manufacturing sector because it's the manufacturing sector that can guarantee sustain and inclusive growth some of that massive investment I will now talk about some of the other specific remittances we are making in the think paper some of that massive investment in the supra structure should go to the large scale training of the best Filipino minds in leading knowledge institutions overseas we need to learn what's there already we don't need to reinvent the wheel and in providing sufficient and attractive incentives to come back home maybe not return service agreement per se but something more these should be complemented by investments in non formal education which will raise the skills of our workforce moreover continuous improvement in the basic education is also necessary to replenish and sustain the knowledge capital pool what else are we recommending in the think paper Filipinos returning with advanced degrees in various disciplines should be attracted to the country and they can form the vanguard of R&D and innovation in Philippine education and industry while we are still developing people who are homegrown but they should be given ample incentives and institutional support and encourage them to come back to the Philippines and do research and raise our productivity furthermore international experts and educators should also be brought in the country and our government should facilitate this to help their Filipino counterparts and Filipino students catch up with global standards of R&D and with the latest innovation and industry I'm not saying we should follow what Singapore is doing okay because they don't have the people so they have to rely on foreign experts NUS has about 50% of its faculty coming from foreign origin Nanyang technological university I think has 60% no, that's not the idea we need these international experts to accelerate our catching up process because we can develop our own eventually one notable recommendation in our think paper is that of a hub and spokes model of organizing the suprastructure this an organization that should be adapted at the national and regional levels the hub is an established center of strength an institution like UP or an individual who has knowledge and respectability and the spokes are other agents of learning and change in the area the hub and spokes organization provides a focus and coordinated use of knowledge from various sectors like government, industry civil society and akadim in framing development efforts with this kind of structure work I believe it can as a proof simply look around you then later take time to explore the exhibit boots posters video production products and creative works and presentations in this venue the layout of this knowledge festival is itself inspired by the hub and spokes model centered around UP's mandate vision and mission in sum this knowledge festival is a celebration in the true essence it is the celebration of what UP has accomplished in the past several years and what UP is capable of doing going forward this knowledge festival is a demonstration of what UP and other institutions like ours can accomplish with proper structure in place fostering a culture of creativity and innovation it is with pride that I invite you all to join us in celebrating our achievements and the capabilities of our scientists and artists in UP to create and innovate in ways that can transform the lives of our people Padayon let us move forward and seek strength from each other as one UP Padayon let us continue to network and share our resources together let us uphold our tradition of honor and excellence as we commit to continue with our task of shaping minds that shape the nation thank you Padayon UP


Live from the Oracle Conference Center in the heart of Silicon Valley. Extracting the signal from the noise. It's theCUBE covering the Oracle Cloud Launch. Brought to you by Oracle. Now your host, John Furrier and Dave Vellante. Okay, welcome back everyone. We are here live for the post game or post event coverage. This is theCUBE. We go out to the events and extract the students with noise. I'm John Furrier, the founder of SiliconANGLE. Join the founder of wikibon.com, Dave Vellante. Our next guest, Andrew G, is singing EVP of Fusion Middleware Development. They have a great demo up there. Tom's Curry and the announcements was pretty significant. Biggest cloud announcement, fastest growing, dollar growth in the industry and SaaS history. I mean, too much stuff to digest. We'll just jump in. Cloud platform, how does it compare versus the conference? Let's break it down. Get three tiers. Infrastructure service put pass and SaaS. Right, I think it's important to point out, first of all, the breadth of what we offer today. And I think it was a breathtaking announcement. I think it was great. Let's take a step back, specifically on the paths. The way we break down paths, in fact, is four different personas. One is to do with development. Second is to do with integration. Third is to do with line of business users for collaboration. And the fourth one will be business analysis, data analysis. And each one of them have specific differentiators. So for development, that would be application servers on the cloud, Node.js in the cloud, JRuby, for example. By far, the most comprehensive and standards-based approach for development of the cloud. If you take a competition, either it, these guys are, most of our competition, either it's infrastructure-based, where the platform there is very thin, okay? Or there would be proprietary platforms that are very tied to the SaaS application itself. What we offer is the best of both worlds, right? It is a polyglot environment, multiple programming environments. And the ability to be standards-based, with Java-based development as well. That's fundamentally the differentiator of the development line, okay? So one of the things Larry mentioned was the different use cases. Obviously, we were talking prior to the event, you know, things like BlueMix Cloud Foundry, and the Able's like BlueMix, kind of like competitors. And there's some, like low-end use cases, I don't know, you call it low-hanging fruit, but on the higher end, much more proven platforms or engineering platforms, like you guys have, it's complicated business cases. So that middleware and pass is interesting, because the pass is emerging technology. It's not really that old, and it's been around for a while. So what is it about this kind of new hard middleware that makes you guys confident that you guys can move back and forth and say it's complete? I mean, that's going to be the question. It's certainly complete on paper, but is it complete, and what is that new dynamic where you want proven professional grade middleware? Right, and the fact that it's complete, as I was describing, it's not just the developer. Most people associate pass with either data management with application server and the cloud. That's basically table stakes. What you see is over and above, that's where the completeness part comes in, right? Let's talk about the second persona I talked about, which is that fluid integration. This is net new innovation in the cloud, right? Integrating cloud to cloud, cloud to on-prem, on-prem to cloud applications, and you saw me doing a demo of this as well. It's really as simple as making it viral, okay? Making the integration so easy to use and easy to develop and deploy, entirely done in the cloud, without you downloading a single piece of software. That's where some of this innovation comes, and you would see a lot more behind this, by the way, right? The completeness of the cloud is to do with SOA, with data integration, with data movement in the cloud, and big data discovery, big data preparation. That's where the completeness factor of the integration line comes in, right? So the line of business dynamic, because the data we've been hearing shadow IT and it's been a cloud dynamic where lines of business have been going around IT because IT's been slow and unreliable. Now you have data silos all over the place. So now you guys are extending that out. You can move to and from the edge of the network or edge of the application. So the question I have for you is, where do you see the customers focusing their time on innovation and development from an investment standpoint? Also you guys are trying to extract away some of the stuff under the hood, if you will. And then on the app side, where's the hardened line, if you will, in-pass, if you could peg that. That's a great question. I think what we are seeing is customers are buying line of business applications. But in a lot of cases, they need to extend these line of business applications, the cloud applications, to satisfy the particular need. You heard from a customer of ours, Avaya, for example. In their specific case, they wanted a partner relationship management application. In fact, they bought one of our competitions, CRM application, to do that. But the need was to extend that in the specific use cases. And they found it was too hard to do and very proprietary to do with our competition. So the use case there is, you use our application server in the cloud to develop custom functionality to extend our software-to-service applications. And you integrate it with other line of business applications together as well. Together, that forms the value driver. And this is what our customers have found in a standards-based way, with commodity skill sets rather than proprietary skill sets, very expensive for them. That's where the value lies. Energy, can you talk about the development effort that went into this? Because a lot of people leading up to this announcement said, all Oracle's going to do is they're going to put a face on all this hosting stuff and call it the cloud. Talk about the development effort that went into this and what's the tech behind it? Oh, thank you for asking that. I think that's a very good point. This is by any stretch of the imagination, there's a lot of innovation behind this. ICS, for example, we've been very careful of how to innovate in this space. In certain cases, rewriting the user interface and the user experience on top of a proven engine makes a lot more sense. That's what we did with ICS. The core engine is the Oracle Integration Service Bus. And on top of that, we've completely reinvented the experience for that. And the reinvention of the experience is where the innovation lies. In other cases, it's entirely fresh new development. MCS, which I demoed as well, Mobile Cloud Service, is entirely done from scratch. We never had any of that before. API management, entire mobile development, the user interface scaffolding as well, complete net new development. For PCS, process cloud service, we've also taken the gut engine and kept it the same because there's no reason to mess with it. We completely re-engineered the experience around it. The overall effort for this has been years of effort inside Oracle to get these things out. We've been very, very concerted and focused about it, not just cloud-washing. This is not a cloud-washing. So you're done? You're complete? You're not done? Find not a stretch of the imagination at all. So show us a little leg on the road. Sure. I think a little bit of it would be every one of these develop, integrate, collaborate and analysis lines. For development, we're working a lot more on things like microservices. Something that we're working on in currently. In collaboration, you would see a lot more customer engagement, collaboration services, customer experience services that we're working on. In terms of integration, working on Golden Gate, for example, data movement. These things that are- Hard problem, yeah. We're working on data pipelines in the cloud, merging what is called lambda architectures and kappa architectures for real-time streaming and batch processing all on the same platform. These are things that we've been thinking about. In terms of business intelligence, there's a lot to do, a lot more to do in data visualization, data analysis. Make it far more easier for line of business users to consume. So. I just laid out- Not done by any stretch of the imagination. M&A roadmap right there. It's not complete. That's really a good point because microservices are hot. You've got this developer environment in the cloud, DevOps is matching into analytics. So that's a perfect fit that's going to power the analytics market. So I got to ask you, outside of the Oracle environment, so I love the messaging that's here, it's very clean, moving Oracle from on-prem to cloud, really awesome. Now for outside of Oracle environment, as developers are working on stuff like microservices containers, what is you guys, your view of the middleware vision in that regard? Obviously standards will be key there. I mean, that's clear. But what specifically do you guys see intersecting with your Oracle cloud for outside of Oracle's current scope? Sure. No, that's a very astute question. What we see is that the reason people, our developers use microservices, for example, are actually they want lighter weight containers. They want lighter weight functionality. They want very easy to use, easy to deploy. There's one side of it, we make our existing middleware and cloud technologies very easy to deploy in microservices, in containers. Docker, for example, is one example of container technology. There's others as well. We believe that the net trend there is to break down functionality into manageable chunks. We believe that the management of these microservices where the value is going to lie, where the actual microservices can provide a lot of value as well. There's going to be a lot of innovation in the entire ecosystem for this. In terms of the integration, we believe mobile and integration together, mobile cloud service and integration cloud service provide the glue for not only Oracle, but non-Oracle applications as well. Most of our customers might not. Some of our customers might not go with Oracle SaaS applications. They might have a competition as well. We want to be the paths that doesn't simply provide Oracle technology, but our competition's technology as well.  All right, so I got to ask you the philosophical questions. Larry is up on the stage and I love this part about, there's a new way. Thanks for telling us and we see it as well. But the competition slide highlights his thinking, right? IBM, the old competition was IBM. Now you got a bunch of new companies up there, quite frankly, that are looking good next to Oracle. It's nice to see these young companies, but they don't compete, but it shows the new way. So I got to ask you the software question. From a software development lifecycle standpoint, what's the biggest shift that you're seeing? Because now you're talking about the old days of waterfalling and now you have all kinds of agile. So what is the preferred method of software development in this new world? Cloud has got to be the table stakes that you mentioned passes table stakes. What is the philosophy of this new software development lifecycle? Oh, it's completely agile. In fact, in the cloud, we're releasing software to the cloud every six weeks. In fact, the entire development platform is development lifecycle, the development tooling is completely different. We've changed our entire ecosystem of how we release software to the cloud. Even the fact is this, it's actually made our development on-prem far more efficient as well. Think about that. I think what we've done is, we've provided the vehicle for deliver some of this engines to the cloud in the same way that we've done on-prem. It's your agile internally. Absolutely. 100%. Yes. Awesome. All right. Why aren't people moving to the cloud if they're not? Sometimes they are regulatory environments. Sometimes there may be some concerns with data privacy, for example. You know, sometimes they're data residency requirements. I might be in a country in which I don't have a data center with Oracle. Now, what we've done though, this is a very important point. We have engineered systems in which the cloud services, what we have plans for is we're taking these cloud services and making them available on the engineered systems. So the same way as the revision occurs for integration cloud service on or Java cloud service on the cloud, that revision will be available on the engineered system on-prem as well. This is what Larry was talking about. That makes the pitch to the customer that is not able to go with the public cloud, making it able to deploy the same innovation in the public cloud on-prem with the same interface as well. So internally, we got to wrap up. I want to get one more point if I can from you. It's that years ago, engineered system when it first came out was purpose-filled, kind of a dirty work in the industry. Turns out that was a good bet when you look at what happened with cloud, because at that point Larry was kind of poo-pooing the cloud. Oh, you know, was dismissing it in a way, calling false clouds out there. But it wasn't all in yet on clouding. This is like six years ago. That's paid off pretty good. What's the internal feeling around how engineered systems kind of, the world spun in that direction with cloud with engineered systems? Can you share any color on dynamic and internally and how that's rendered itself in the product in the middleware? We certainly believe that engineered systems are the vehicle for delivering this innovation on-prem. It's very simple. I think the, no, of course, look, there's one way to take a look at engineered systems. There's a very, it's a way to deliver our functionality in a far more performant way than it was done before. Great, okay? But there's an additional value and that is to do with delivering this cloud innovation on-prem as well, which is the new thing. Yeah, and that's good timing, that's good. Well, thank you very much for coming on theCUBE. We're breaking it down, we're going to get the boot here. We always go to the, to lay, pull the plug. This is theCUBE, more post-event coverage here, the Oracle Cloud Platform launch. We'll be right back.


Hello, my name is Koen Becking. I am president of Tilburg University. Let me please invite you for the opening of our academic year 2016. This year our theme will be the digital society where people matter. How can we contribute to society with an eye on the human perspective? This year we will have our Minister of Finance Jeroen Dijsselbloem as our keynote speaker. We will also have on the spot election of the best student initiative on entrepreneurship. So make sure you're at the event on September 5th.


thank you for joining us on In the Studio. Today we'll be talking about the California Raptor Center at UC Davis. The Raptor Center is part of the number one ranked School of Veterinary Medicine here in Davis and I'm joined today by two guests. First to my left is the Director of the Raptor Center Dr. Michelle Hawkins and Julie Cotton who is our outreach coordinator at the Raptor Center. Thank you for joining me. Hi good afternoon Matt. And who did you bring with you today? So this is Grasshopper. Grasshopper is a Swainsons Hawk and they are threatened here in California because they nest during their migration after their migration from South America and because of pesticides and loss of habitat here in the United States their nesting sites have dwindled and so now they're a threatened species in California. And Swainsons Hawk they are native to California they've always been here? We do have Swainsons Hawk here and pretty much through the United States but we're part of the Pacific Coast Flyway migratory pathway for them as well. Excellent and who do you have today Julie? So I have with me this is Forrest. He is a great horned owl. Forrest is about two years old now he was brought to us at the Raptor Center as a baby bird in the summer of 2015 and there's nothing physically wrong with him he's a very healthy bird but unfortunately the person who found him kept him for too long before they brought him to us he became what's called imprinted on humans so he lacks the normal behaviors of a wild great horned owl and he is far too comfortable around humans to ever go back out into the wild. Now great horned owls are a very common species one that people very likely have either seen or heard in their own neighborhoods. You can find these guys across the United States from the west coast all the way to the east coast. They are the owl that makes the very stereotypical hooting sound the hoot hoot hoot that we're very used to hearing at night in and around our neighborhoods in forests. They're a very adaptable and powerful nighttime predator. Okay so Forrest cannot be released back is that the same with Grasshopper? Yes he came to us as a juvenile and he had cataracts in both of his eyes and so we were able to help him get vision in one of his eyes but not in the other and these birds need both of their eyes to be able to hunt correctly. So if we have a bird that is a daytime bird that has to use its eyes to hunt whereas a lot of the owls use their ears and acoustically identify their prey. These guys have to have both of their eyes working and functioning properly to be able to to do their job out in the wild. Okay so both Forrest and Grasshopper then are education birds or what you call the education birds for the raptor center. There are two of our educational ambassadors. Great yeah we have about 35 birds that currently at the raptor center that visitors can come and see whenever they would like. Some of them are trained to the glove as these birds so that we can take them and take them out into the public so that we can educate the public about about these birds and how we impact their environments. And maybe we should get into that a little bit. If someone were to want an educational program to come to their school or something like that how would they go about getting that? So we offer programs both on-site at the California Raptor Center as well as off-site where we bring some of these animals in our museum specimens to classrooms. We do have an education office anybody who's interested in one of these programs is welcome to give us a call. We do recommend calling at least a month or two in advance because we actually do book out pretty quickly. So we do offer those on-site tours where you can come to our facility you can see some of the birds as Michelle mentioned we have up to about 30-40 birds that live full time at the raptor center so people can come and get a class on raptors get a guided tour around the facility. We also have off-sites which I lead we go to classrooms we go to community centers in and around this area we bring birds like forest and grasshopper and same idea we give basic classes about raptors teaching people about the birds in our area and what they can do to help our wild raptors. But there are other ways that people can come and visit these birds and find out more about them from us we do have two open house events every year one is coming up on May 6th May 6th Saturday May 6th so it's always on the first Saturday in May or the third Saturday in October we're also now participating in Biodiversity Day and these birds will be welcoming visitors next weekend not this coming weekend but the following weekend April 22nd for the UC Davis picnic excellent and so we've talked about the raptor center a little bit let's talk about where it is exactly in the town of Davis if you would like to come and visit the raptor center how would you get there yeah so we are about a mile south of the campus on old Davis road excellent so you just go under the overpass the I80 overpass and straight over the train tracks over the railroad tracks that are now open again for those of you and Davis and you take a left right before the levy yes and the raptor centers open Monday through Friday Monday through Saturday Monday through Friday is 8 to 5 and on Saturday is 9 to 12 9 to 12 on Saturday and people are welcome any time there's no fee for parking or anything like that they can just come and perform a self-guided tour at any time absolutely as long as it's a group of under six people you can do a self-guided tour we do ask if you have a group of more than six people to make a reservation for one of those on-site tours at the raptor center but yes as you were saying we are open on weekdays from 9 to 4 and we're open on Saturdays from 9 to 12 and then you can check our website and check our bulletin board at the raptor center for updates on any special events around campus that we're participating in and something fun to do too is bring a bag lunch there's a nice picnic table right out there at the raptor center and another fun thing at the raptor center is not only do we have the raptors that stay at the raptor center there are many wild raptors that live in and around davis and there's a great walking trail along the creek where you can see species such as wild swainsons hawks red-shouldered hawks i've seen harriers kites so there's a diversity of wild raptors that you have the opportunity to see around the raptor center and so these are education birds but then the raptor center also rehabilitates wild raptors that are injured or sick and but the public doesn't usually get to see those right that's right um yeah i mean our primary mission is to provide medical care and rehabilitate these birds we want to see these birds going back out into the wild for sure so the the veterinary medical teaching hospital at uc davis um it provides all of our medical care so our team there um we can we can work with all of the specialists in the hospital if we need that level of care so we feel like we can offer the highest level of care these birds could get anywhere and then once we've we've completed the medical at least treatment plan and if the birds can get out of a hospital cage we will get them back out to the raptor center so that they can be put into a cage there where they're exposed to the natural sounds that they're accustomed to that helps to minimize their stress while they're in captivity rehabilitating and then um and then a group uh brett stedman leads our group for the rehabilitation end of things once these birds for whatever their injury or illness was have recovered from that it's just like us if we have a fracture um we it takes many weeks to really rehabilitate that with physical therapy and getting your strength back so think about having to get up and fly and so we work with these birds for a good while and and have confidence that their strength is back before we release them back out and i should mention the numbers of birds that get brought to the raptor center in any given year can vary of course depending on the conditions of that year but we can get between 200 and some years even 300 birds brought to the raptor center we take care of injured orphaned and sick birds of prey and our ultimate goal is to get them back out into the wild where they belong so this time of year is our baby season so our nursery is in full swing usually the first crop of birds that come in in fact are babies of this species we get great horned owls they breed early in the year and we're starting to get some of the hawk species as well little babies that have just hatched so we take care of birds from all the way from young birds to older birds all species of raptor in this area can come through the raptor center and actually in fact you know we're saying that these um we had these chicks that literally were coming out of the egg last week when they came in we also incubate eggs if they're brought to us very commonly harris hawks will nest in the grasslands in the agricultural excuse me harriers harrier hawks in the grasslands in the agricultural areas and so when those fields are mowed they'll often find the nests and unfortunately they need that land so they'll have to remove the nest but we'll try to then take that bird through um basically pipping from the egg and then get it up to the point that it's strong enough to fly away on its own and i think there's an important lesson that forest here can teach us about baby birds i had mentioned earlier that he's imprinted on humans well imprinting on humans happens when a baby bird sees humans feeding it hears human voices i should note number one it's illegal for anyone without a permit to keep one of these birds so anyone who finds a baby raptor the best thing you can do for it is to bring it to a center like the california raptor center where we know how to raise these babies the right way to keep them healthy and to keep them from becoming imprinted on humans so we do not talk to the babies we wear a costume around them we feed them with puppets we do many things to keep them from becoming imprinted so in forest case he unfortunately was around people too much before he was brought to the raptor center and because of that because of the behavioral issues that arise from that he can't go back out into the wild but fortunately with babies that come through the center we do our best to make sure that those babies can go back and become wild birds again excellent so now is the season so just as a citizen if i came across a nest should i just immediately grab it out of the tree and bring it to you guys no tell me more about that so one of the one of the biggest challenges of course is as the babies start to fledge you know the first flight it doesn't usually get very far and so very commonly they'll drop out of the nests while they're trying to get their strength and they'll be on the ground and and that's okay the parents will feed them and as they get their strength they'll be able to fly but when people see those babies on the ground they they think that they're in trouble and so you know they're trying to do the right thing and they rescue them and bring them to us and in fact those birds generally don't need rescuing but we've then interfered with the process with the adults and in some cases some groups will even re-tree birds if they've fallen out and the nest is intact but very commonly they're brought to us people don't have a specific location even if when we go back and try to find it sometimes we can't find that's that place to to put them back so we end up having to take on the parental role so we do have a guide that we're working on that will be up on our website for telling when to help a baby bird and if you ever have a question about it the best thing you can do is call us and ask because there's some cases in which a baby bird really does need help if it's a really little baby that has been blown out of the nest and you can't get it back up in the nest that baby probably needs help if it's sick if it's injured has blood on it is very ill it needs help but when they're old enough like you were saying they're ready to leave the nest they are ready and mom and dad are still sticking around on the territory they're still bringing food to the baby and we don't want to interfere with that we don't want to kidnap that baby in our attempt to help it right totally makes sense and then also so other things that we as citizens can do I know I put up an owl box last year it is still vacant for all of those owls out there they're looking for a home but what other things can people do all right well different things that we can do to help these guys out well number one the owl box is only going to bring in certain species of owl so this guy is not going to use an owl box you'll get barn owls potentially in a larger owl box and a smaller one you might get western screech owls so that's one thing you can do other things you can do big concerns that affect raptors around here are exposure to different toxins so one step we could all take if we have rodents on our property is to not use rodenticide rodenticide poisoning ends up affecting more than just the rats in the mice that we're trying to get rid of because a sick rat becomes a very easy target for a predator like a great horned owl or a Swainsons hawk one of these guys eats a poisoned router mouse they themselves will get that rodenticide poisoning so we advocate the use of traps that aren't for example the next snapping traps or the rat zapping traps the ones that kill the prey instantly instead of poisoning it thank you so we are ending coming up towards the end of our program today which is unfortunate because it seems to have just flown by pun intended so if people want to come visit the raptor center we talked about where it is but i know that there's also a website and people can visit california raptor.org and that will take you right to the california raptor website and again come by any day monday through saturday for that self-guided tour and come to the open houses there are great time as well and that is the first saturday in may and the third saturday in october and details of those events are always on the website michelle and julie thank you so much for joining us and thank you out there for joining us on in the studio


Today, we shall now study a number of examples. Before that, I will give you one more definition namely of a sub complex. Like a simple shell complex, a sub complex, so there is a definition of sub complex in the case of CW complex also. A sub complex, let us define sub complex of a relative CW complex. So it will be a relative CW complex, y comma b. It is a reducible sub complex of xa, xa is original thing and yb is a sub complex. What is the meaning? Meaning is that yb itself should be a CW complex on its own wherein y is a subset of x, b is a subset of a and each cell that you are attaching from getting y out of b, whatever cells you are attaching, the attaching maps should come from the corresponding cells from whatever you are attaching from getting x. Each cell in y should be also a cell in x with precisely the same attaching map. So in other words, some of the attaching maps in between along with the cells you may delete. But if you delete arbitrarily, it may not be a sub complex because whatever is remaining, their domains, the attaching maps, their code domain must be there. If you have deleted that part, then these functions should be also deleted. These cells must be also deleted. That is what it means. So there is a very strong restriction on being a sub complex. So sub complex like subgroup, there is a group operation. The set must be a subset of the original thing. But the group operation should be also the same as the original one. So here it is attaching maps and attaching cells. They must be the same as the original one. But the collection of this lambda each time may be smaller. That is the meaning of this sub complex. So if y, b is a sub pair of a relative CW complex xa.  Then yb is a complex. Take some close of simplexies inside b and then look at that. That will be already provided that boundaries are already there. Then only the cells will be there. The boundary attaching maps will be already there. So if you look at the pictures, then it will be much easier to determine whether something is a sub complex or not. Then just looking at the data given in the, you know, if it is F alpha or this given, then you do not know whether it is a sub complex or not. So this is an easy way of determining if something is a sub complex or not. If y is a sub complex of x, then x, y itself is a relative CW complex. Suppose you start with a pure CW complex x. x is a CW complex on its own. That means that a part is empty, a is empty. Now you take a sub complex. Definition of sub complex for y, it is the same thing. The second part here, namely relative part b has to be empty. So this will be also a CW complex. So y is a sub complex of x, then what happens is x, y itself is a relative CW complex. So then x can be got out of y by attaching all those cells which you have missed in y. More generally, you can put the relative part also. If yb is sub complex of xa, then x, y union a will be a relative sub complex. So you have to throw in a also, it is not just xy, xy, a because y may not contain the whole of a. y will contain b. So y union a then you can attach all those cells which are missing if you get x. This will also relative CW complex. For all k, this xk is a sub complex of any CW complex. If you stop at the kth stage, that is a sub complex.  So that is another example of a sub complex. So these sub complex are named, they are called k-skeleton. For a relative CW complex xa, you just take xk only up to k cell comma a, because a you have to take now, because the starting point was you are here also a, that will be a sub complex. Sometimes you can write it as xa and then bracket k. That is the same thing as xk bracket a. So now we will let us have a number of CW complexes as well as relative CW complexes. You start with any discrete space, it is a CW complex. Any discrete space is obtained by attaching 0 cells to empty set. So any discrete space itself is a CW complex, no relative anything. If you take a subset of that, you can think as a relative CW complex also, no problem. And what are the cells here? 0 cells. What is the dimension? Dimension is also 0. So this is the most easiest example, but it is also important sometimes. Let us take the standard sphere. The spheres and disks, these are our basic objects. If you have left them out, then you will be in trouble. So n dimensional unit sphere is a CW complex. How? Where do you start? Remember if you have a pure CW complex, you have to have a 0 cell there. The x0 cannot be empty. So what is the 0 cell you have to tell? So you can start with a 0 cell to be any point. For example, you can take 0 0 0 1 or 1 0 0 0 1 of them. The single 0 cell you can take, if you remove a sphere, if you remove one point from a sphere, what do you get? You will get an open cell namely homomorphic to RN. RN homomorphic to RN, same thing as homomorphic to open cell DN. So the entire boundary has gone to a single point. Take DN on the boundary, you take a constant map, constant map to a single point, no matter what it is. That is the 0 cell. What is the quotient space? Quotient space is precisely homomorphic to SN. The simplest case is when you take D1 which is minus 1 to plus 1, the open interval, closed interval, both minus 1 plus 1 going to a single point, what do you get? You have a circle. So this is the generalization of that. 1 0 cell and 1 n cell will give you a CW structure on SN. So that is the simplest way you could have got a CW complex other than the trivial example that we have taken earlier. The attaching map is a constant map again I think so. So this fact follows because if you take the quotient space of DN wherein the entire boundary is identified to a single point, that is homomorphic to SN. Observe that these CW structures even though SN minus 1 is a subspace of SN via the equatorial inclusion, it is not a subcomplex. What I am telling is you can take SN contained inside SN plus 1. For example, SN the circle contained as an equator on S2. Now this is subspace but this is not a subcomplex because for S1 you have to have attached 1 cell. For S2 you are attaching only a 2 cell directly to single point. The single point can be made common to both of them that is fine but the 1 cell which is inside the subcomplex is not present in the bigger one at all. So this is not a subcomplex. So I am giving you an example of a nice picture which may fail to be a subcomplex picture. Equatorial inclusion from S1 to S2 or S2 to S3, S3 to S4 and so on or coordinate inclusions from SK to any higher SK plus 1, SK plus n are at a state. They are not subcomplexes. So here are the pictures I have given. So this is S2 that dot dot dot is representing the equatorial thing S1 that is not a subcomplex. But each of them is a CW complex, single point and a cell. Now we will consider more examples here also. So I will come to that and we will refer to those pictures again. Fix a CW structure on SN, whatever you have done namely point and n cell.  All that you have to do is fill in the DN plus 1 n cell with identity map as the attaching cell from SN minus 1 to SN to SN. DN plus 1 it can be viewed as CW complex by attaching a N plus 1 cell via SN via the identity map. So this follows that SN is then a subcomplex of DN plus 1. So this is a nice example of a subcomplex. The boundary is a subcomplex of the disk DN plus 1. So how many cells are there in DN plus 1? DN plus 1 itself before that there is a n cell SN and before that there is a 0 cell. So there are three of them. So this is the example here. I start with a 0 point here E0. Then I attach E1 I got a circle. Then I filled up E2 with a 2 cell. So this disk D2 is a 3W complex with 3 cells 0 and 1 cell and 1 2 cell. The same picture you can get 0 cell and then n cell and then n plus 1 cell. You do not have to go for 1, 2, 3 and so on. 1, 2, 3, 4 it is not possible by the way. So there will be more complications. So that is what is shown in the next picture. So let us come to that one later on. We can have different CW structures on the same topological space. Like we can have different triangulations of the same space. The topological space is a sub structure over that there can be or there may not be any CW structure. And when they are there may be more than one such structure. For instance SN we have given a CW structure with 2 cells 0 cell and an n cell. But now we will do so that each equatorial inclusions become a sub complex. So consider the usual equatoral inclusions S0 is minus 1 plus 1. Not 1 cell now, not just 1 but 2 points. I start with 2 points as my vertices. Then how do I get S1? Now I attach 2 1 cells. I can attach 2 1 cells for S0 and to get S1. Having got S1 how do I get S2? I will get 2 2 cells upper hemisphere and a lower hemisphere. Like this you can keep on upper hemisphere or hemisphere of higher dimension. You can go on getting S1, S2, S3, S4, SN. Each SK can be obtained by SK minus 1 by attaching 2 K cells 1 above 1 below. Namely the upper and lower hemispheres. And this is the picture here E0, E0 1, E0 2 correspond to minus 1 plus 1. So those are 2 points which are the 0 cells. Then E1 1 and E1 2 make it as a curve. In the top there is one E2 cell and bottom the other E2 cell. So this is the picture of S2. How many cells it has? 2 2 2 and each dimension it is a it has 2 of them. So keep going like 2 2 2 each time. You can go all the way to S infinity also. So this is a nice picture wherein each end damage subspace end damage thing will be a sub complex. This cell decomposition is more useful than the earlier one. It immediately gives a cell structure for the real projective space because this cell structure is invariant under the antipodal action x going to minus x. The 0 cells will be interchanged. The 1 cells will be interchanged. The 2 cells will be interchanged. That is the invariance. So therefore, you know if you identify a plus 1 and minus 1, all that you have to do is identify the corresponding cells that will give you cell structure on the projective space. How many 1 cells, how many 0 cells will be there? Minus 1 and plus 1 will be identified. There are 2 of them. So in P, in projective space Pn or P1, P2 there will be only 1 0 cell. There will be only 1 1 cell. There will be only 1 2 cell. There will be only 1 3 cell and so on. So Pn has 1 cell for each dimension 0 1 2 3 up to n. So that is the structure coming out of the equatorial structure for Sn because it is now it is invariant under the antipodal action. So that is the picture of Pn here. I am repeating this one. Recall that Pn is a quotient space of Sn under the antipodal action X is equivalent to X. With the definition of quotient topology Q from Sn to Pn, suppose this is a quotient map, a subset U of Pn is open if and only Q inverse of U is open in Sn. If we first observe that quotient map Q is both open as well as a closed mapping. This follows easily from the fact that for any subset f of Sn, f union minus f is open. If f is open, if f is closed, it will close. If f is open, it will close respectively because minus f is what its homomorphic copy. The closed union closed set is a closed set. This will be the inverse image of Qf. That is why it is an open mapping as well as closed mapping. From this, many of the logical properties of Sn pass on to the quotient space. You can use this to prove that Pn is a hostile space. This is a wonderful thing because quotient spaces are quite often not hostile, even under group actions. So you have to be careful. This is easy to do. So, for example, you can use Pn is second countable, Pn is compact of course. A Cw structure Sn, as described in four, is compatible with action in the sense that action preserves each skeleton and merely permutes the various cells by homomorphism. In such situations, the quotient space acquires a natural Cw structure, which you can call it as quotient structure. So we begin with X0 as a single 0 cell in Pn. This is a general remark. Now in particular for Pn what is happening, a 0 cell in Pn is the image of S0 under the quotient map. Inductively having defined Xk minus 1 whose underlying space happens to Pk minus 1, we attach a k cell, you have to choose only one of them. But what is the attaching map? Attaching map is now the quotient map from Sk minus 1 to where Pk minus 1 double covering. So, one single sphere Sk minus 1 wraps around twice in some sense. Pk minus 1, that is not a sphere of course. So, you have to understand what is the attaching map carefully here. It is no longer an identity map. In the case of sphere Sk minus 1 upper hemisphere, the boundary is precisely Sk minus 1. So, attaching map was identity, but the quotient space structure in this P again, attaching map is the quotient map. So, for definiteness let us choose upper hemisphere and take the attaching map to be the Q restricted to Sk minus 1. The space obtained is equal to Pk. So, Pk is obtained from Pk minus 1 by attaching a k cell. The boundary of the k cell maps Sk minus 1 to that one is the quotient map. So, what I want to tell you here is that this process can be carried on all the way to S infinity. S infinity is what? Union of all these increasing sequences of spheres. What is the topology? The topology has to be defined by taking a set to be closed if and only if intersection with each SN is closed in SN. The coherent topology is obtained. That S infinity is a subspace of R infinity with R infinity is a direct sum of copies of R, not direct product. Do not make that mistake. The standard Euclidean inner product can be taken, but the topology is not the metric topology. So, you have to be careful about that. Topology is weak topology. The cell structure on S infinity is compatible with antipodal action. The vector space structure is there on R infinity. So, in particular x equal to minus x makes sense there also. This cell structure is compared to the antipodal action. Hence, we get induced cell structure on the infinite projective space P infinity. What is its k skeleton? It is just pk, the projective space of dimension k. In homotopy theory, this is a very important space. Its fundamental group is Z2 and all the higher homotopy groups whatever you do not know, whether you know, they are all 0. So, such a thing is called Eilenberg-McClain space of type Z2, 1. Pi 1 is Z2 and all other things are 0. This is a very, very important space. Exactly same way, you can define the infinite projective space and before that all the projective spaces are cpn. Remember, cpn is the quotient of cn plus 1 minus 0 under the scalar multiplication. Z0, Z1 Zn is equal to lambda times Z1 Zn. Lambda must be nonzero scalar. So, scalar are now complex number that is all. However, the cell structure is a different story number, it is a very interesting story here. So, we will we will study this one carefully and perhaps that is the last example for today. So, we start with C contained inside C2 etcetera just like R contained R2, R3 and so on. And then, you see multiplication by scalar, these are all subspaces. So, it is compatible, whether multiplying by scalar here, treated as element here, they are same thing. Hence, we can use the same notation Q for all the quotient maps Q from cn plus 1 minus 0 to cpn. And then, we can restrict it to the unit sphere here. The unit sphere here is s2n plus 1 because this is real 2n plus 2 dimension. So, the unit sphere there will be s2n plus 1. You can restrict Q to the sphere here that will surject because after all every vector nonzero vector is equivalent to a unit vector. There may be many of them namely, if you multiply by unit complex number, we will get a whole set of a circle of those elements. They are all representing the same element in the projected space. In the case of real place, you had only two of them or two unit vectors namely, x and minus x. Here, you will get take any vector, take multiply by unit vector, multiply by a complex number of unit length. It will be still a unit vector. So, cpn as a quotient of s2n plus 1 modulo the same relation that namely lambda restricted to being a unit vector, unit length. In any case, what is cp naught? cp naught is complex line, one single line. Namely, one unit vector in c up to equivalence. Any two unit vectors are related by a complex number. So, cp naught is a single point. Just like rp naught is a single point. What is cp1? It will be a quotient of s2 minus 0 or s3 by the s1 action there. That is an interesting object. First, you have to study what is cp1. The quotient map Q from s3 to cp1 sends the center circle z1 equal to 0. See, z1 equal to 0 defines a circle in s3. It is intersection with a plane to a single point which is our cp naught. 1 z1 equal to 0 is a plane. There are in s3 contained inside c2. So, there are two independent planes z1 and z2. z1 equal to 0 is a plane and that plane goes to one single point after every plane here is a line in terms of complex vectors. The subspace, now I am having e2. I am taking a subspace here. The first coordinate is z naught. I am writing z naught comma z1 for elements of s3. z naught is a general vector, complex vector, but second coordinate is a real part z naught comma r. I am just defining z naught square plus r square equal to 1. So, that will be an element of s3. The first coordinate is any complex number. Second coordinate is real. Take such a space that naught square plus r square equal to 1, r positive. Okay. It is clearly homeomorphic to d2. Why? Take any mod z. Since square plus something is h to 1, that must be less than equal to 1. Take any mod z less than equal to 1. Whatever it is, okay, the second coordinate you take it as the modulus of that. Okay, sorry, 1 minus square root of 1 minus modulus square. So, r square is defined to be 1 minus mod z square. So, take that number in the second coordinate. So, okay, so it is like a graph. So, this is clearly homeomorphic to d2 because r I have taken positive. So, r should be positive, non-negative, non-negative solution of this equation. Okay. So, then the variable is only mod z. It will be homeomorphic to d2. Okay. And its boundary is given by z1 equal to 0. What is the boundary? Mod z naught itself is of square of mod z naught equal to 1. Mod z naught itself is 1. Okay. So, that is the meaning of the boundary here. So, boundary is given by z1 is 0. Note that if you take q of that, that will cover the whole of cp1. Every point here is now equivalence class of z naught comma z1 up to scalars. Okay. One point we have taken namely the second coordinate being 0. There is a single point. All other points, second coordinate will be non-zero. Right? Once it is non-zero, you can multiply out by its real, its complex part. Any complex number is r times e power i theta. So, divide by e power i theta, you have left it just r. That is this equation. That e power i theta you have divided, you divide by this one also. So, that is the equivalence class. So, I have proved that this is an all to map. Okay. q of e2 is cp1 and q restricted to the interior of this two cell namely when r is strictly less than 1, there is a unique solution. Okay. So, this will be and r positive is a unique solution. Okay. When r is 0, there is a problem. But then you get only one point. So, in the interior, it is an injective thing. So, this is precisely what we wanted for a characteristic function to have. Injectivity on the interior, on the boundary is some continuous function. That continuous function, you can take it as an attaching thing and the interior gives you the characteristic.  Okay. It is boundary collapsed to a single point. Hence, is homeomorphic to what? If you take a disk and collapse is bounded to single point, it is nothing but s2. Therefore, we did not know what is cp1 by getting in the pretext of getting the CRW structure on that. We actually showed that it is actually homeomorphic to s2. Okay. It has a better structure. You can think of this as the so called what? Extended complex plane because these complex numbers are involved. So, that is left to you to decide. This map s3 to s2 now, I have identified cp1 with s2. This is a very, very familiar and very, very important map. Okay. It is called half vibration. This was used to get a big landmark result that pi3 of s2 is not trivial. At the time of half, that was a very, very big invention. Okay. It is a landmark invention with milestone invention in algebraic topology. So, that is the name half vibration. Okay. Inductively having established that cpk is obtained by attaching a 2k cell to cpk minus 1 via the quotient map s2k minus 1 to cpk minus 1. Okay. You see that the subspace e2k plus 2 contained in the s2k plus 3 given by e2k plus 2 equal to z0 z1 zk comma r, i range from 0 to k zi square plus r square equal to 1. Okay. That e2k plus 2 will be homomorphized to t2k plus 2. The proof is exactly same. There are k plus 1, there are k plus 1 coordinates which are free here. And r is completely determined by the values of these by this equation. Okay.  Okay. Look at the last coordinate. If it is 0, already you are in cpk minus 1. If it is non-zero, you can solve for this equation. That is it. So, therefore, cpk plus 1 is obtained by attaching a 2k plus 2 cell e2k plus 2 cpk via the map s2k plus 1 to cpk. Okay. Keep doing this all the way cp1, cp2, cp3, cp infinity. Okay. This will give, will give the even dimension cells only each time. e2, 0, there is a 0 cell. Then there is a e2. Then there is a e4 and so on, e2k plus 2. All the way to c infinity. And this is another important space cp infinity. This is again a Eilenberg-McLean space. This time it is simply connected. So, pi1 is trivial. So, pi2 will be infinite cyclic group and all other homotopic groups will be trivial. So, this is what is called as Eilenberg-McLean space of type z comma 2. Okay. So, one cell in each even dimension, 0, 2, 4, 6 and so on. Okay. So, we will study more examples next time. Thank you.


Hi, I'm Tiffany Jernigan. I am a developer advocate at VMware. So for a warning, this is my first time giving a security talk because I didn't really do security beforehand. So the whole goal of this thing was learn security to be able to talk about it for people who are not already security experts. So if you're already a security expert and focused on security, you'll know everything in here. And you can tell me if I did something wrong later too.  This is my first time giving a conference talk besides like the smaller events since 2018. So a little bit nervous, but thanks for coming. Also, that's an awesome mask. All right, so hopefully my clicker is nice to me since sometimes it's not. All right, so less is more. So basically the opposite of what is happening on this slide right now, because there's a bunch there. So basically the less you have, the more secure that you can be. So basically you want to have things like less code. So if possible, you can use existing security solutions instead of going and creating your own. Also off the shelf, likely has maybe more effort focused on that specific thing since that's one of the things they're trying to specifically create and therefore may have more eyeballs on it unless you hire your own entire team to do it. It may therefore be better unless you want to go take the effort and do that. Also give fewer permissions. For instance, basically only give the permissions that someone actually needs.    Also avoid having long lived secrets. Have fewer dependencies. So you're minimizing the attack surface. For instance, you may want to use something like a distreless image instead of using Ubuntu. Also keep up with whatever the latest recommendations are. This keeps changing, things keep evolving, people keep finding out new things. One of the things that you can go to is that link in the Kubernetes docs. And you can periodically check it as to what they suggest for a security checklist if you're specifically dealing with Kubernetes. So the Kubernetes documentation breaks down cloud native security into four Cs. I stole this graphic from there. So there's cloud, cluster, container and code. So as a practitioner, I can't even talk, I'm so nervous. You have to think about hardening your infrastructure at every single level. So every single one of these you need to worry about. You can't just be like, I care about one thing and not care about the rest. Maybe as a specific person, you can worry about one thing because you have maybe a big team and there's people dealing with each part of that. But you can't ignore it. So first, I'm going to start talking about things with platform and cluster components. So unless you need to run everything yourself or you need to have all that kind of specific access, for instance, say you want to be able to do very specific things inside the control plane, I suggest using a managed Kubernetes offering. Basically, managed services take care of a lot of the work for you. So that means there are fewer places that you can potentially make mistakes and then therefore have more issues with security. Security and hardening is one of the primary value ads for these cloud platforms already. So specifically for securing control planes and nodes. So you might hear the word hardening a lot when people talk about security. So basically make sure you harden the control plane. So for instance, only allow people to interact with the API server, the Kubernetes APIs. If you go to the Kubernetes docs, which has a lot of stuff, it will tell you how to do things like restricting access to at CD. So the less that you have running on your control plane servers, the fewer potential places that people can go and attack and exploit to be able to gain access to your cluster. So for instance, you also might want to deal with, if your pod has access to something, it can do things like obtaining node credentials. And that could be a problem because other people might be able to get access to your node, which you don't want to have happen. You want to be able to do things like using a TLS cert. So you can use something like less encrypt for instance.  Or basically it's as good as not using TLS at all. There is a talk by Tabby Sable called PKI the wrong way. So in that, it was from KubeCon a little while ago. And basically it's demonstrated how the end user's ability to be able to create certificates from MTLS and how that can be used to gain access to the entire cluster. So for instance, that shows why you would want to restrict access to at CD. And obviously things like that happening is really bad. Basically at CD it goes and it assumes that if you can successfully authenticate MTLS, you have proper access. Did that actually move on? OK, cool. So also make sure that you have pod security standards. You want to be able to make it so that others shouldn't have access that they shouldn't have. Up until 1.21, the default way of going about that, you may have been dealing with pod security policies. And that was deprecated in 1.21 in favor of pod security standards. Lots of acronyms. There's a lot there. So if you're dealing with running stuff specifically like on, say, some cloud provider, there is a cloud metadata server. And that's where credentials are given into the virtual machine. You basically never want your pods to have access to that. Lots of pretty scary vulnerabilities can happen there that if you allow attackers to have access to the metadata server. So for instance, they could get credentials associated with your VM service account. That would not be good at all. And the link there, Jerome Pedazzoni, has a YAML that basically gives attacker access to your nodes if you don't have those things. So you can play around with that. So upgrading Kubernetes. You want to make sure that you're upgrading Kubernetes. You don't want to just install, set up Kubernetes, and then just be like, OK, everything's great. Continue on. There's a few reasons why that could be bad. Some of them include finding big CVEs and wanting you to move past that. So Kubernetes is basically designed so that upgrades can be relatively seamless. You don't have to go and be like, hey, here's my cluster.  Move everything over. You don't have to do all of that stuff. You may have had to do it back in the day. It's basically gone a long way since OpenStack. So again, a lot of people are still using very old versions of Kubernetes, which is not great. And the more times, the more often you upgrade, the more seamless that is. If you're using a managed offering, you might even have an option there to enable auto upgrades. Or if you don't, it's usually like a one-step-click button for updating what version is on your nodes, what version is on your control plan, et cetera. Basically, try to stay up to date with whatever the latest patches are. If you're scared about what could go wrong, most likely things won't be breaking. But when you're upgrading, especially if you're doing it, you're not waiting an extreme amount of time or to the point where things are starting to get deprecated. So you might see some of those warnings there. So for your enjoyment, this is the list of the things that you need to do if you are specifically going through manually updating each thing of your cluster. So first, you'd have to update your control plan, then your nodes, things like cube cuddle, and then adjusting the manifest and other resources based on whatever is changing with the API. And if you are running your entire own Kubernetes cluster, there's a lot of little things that you have to manage with that. Hence the whole suggestion of using a managed Kubernetes offering, because they deal with a lot of this stuff for you and making sure versions and all these things go all together. So isolating compute. So quotas and limits, they can be used so like basically noisy neighbors don't affect other workloads that are on the same host. This can also prevent an attacker from using your infrastructure for like DDoS or crypto mining, which you probably don't want someone else doing. You can use taints and tolerations to schedule workloads away from each other. You can also add another layer of security by using things like sandbox container runtimes. So there's things like G visor, there's kata, there's firecracker. Basically, these add another layer of compute isolation between the containerized workload and the underlying OS kernel by adding another layer of virtualization. So basically a lot of these things just keep adding more separation so it's harder for people to be able to attack. So there's only one thing on here because I really don't know much of anything about storage in the security realm, but there is the container storage interface or CSI. As you see, people love acronyms, but it makes it easier than saying out the whole thing. So it's a standard for exposing arbitrary block and file storage systems to containerized workloads on container orchestration systems like Kubernetes. And you can go, I should have put a link there to see how much empty slide I have there. Sorry. So isolating network resources. So by default with Kubernetes, every pod can talk to every other pod. If you're not cool with that, you want to use network policies. So Kubernetes also assumes that you trust the underlying network. So for example, the network of your cloud provider. You may not. So if you don't, one way to address that is to set up a service mesh. So with having like full end-to-end encryption, for example, with MTLS, some people might say that's overkill, it just everything with security, well, not everything, but a certain level of things with security depends on what you specifically need and how far you need to go with that. You could also go the extra mile and you could use tools like Cilium for things like advanced network policies. For instance, you could do filtering on specific API routes. So for instance, if you want to have like a route that's like something, user API, V1, users or whatever, and you want it to be able to talk to, your pod to be able to specifically talk to just that, but you don't want that pod to be able to talk to, say billing for instance. And you can do that using EBPF, which I am not getting into in this talk. But another key word to go Google or Bing or whatever later. So secrets. Secrets can have different RBAC permissions. If you go a little bit hardcore, you can even encrypt them at rest. There is a link up there for being able to do that or telling you how to do it via the Kubernetes docs. Again, yeah, Kubernetes docs. So basically it supports encryption at rest, which will encrypt resources like secrets in at CD, basically preventing parties that gain access to your at CD backups from viewing the content of those secrets, which is very important. Also, don't put the data of what is in your secret directly into a config map. You want to put that into a secret and have your config map read from that secret. Basically otherwise it's just like plain text passwords somewhere. So even better, don't put stuff directly into your secrets, but use something that will put them in there for you. So basically the whole point there is to avoid committing secrets to say your Git repos, which you might find obvious, but definitely ends up accidentally happening. So you don't want to manage secrets yourself unless you really have to. You basically want to use some sort of key management system such or service such as like hash to corp vault. There's your cloud providers KMS or key management service, again, my acronyms if you're using one for basically secret data encryption. So basically what I was mentioning a while ago, try leveraging the work that others have done to make your life easier versus starting from scratch on every single thing that you need.  There's a there's steel secrets, there's KMS and SOPS and by name you can Google them on when I, because I am bad and I did not upload the slides yet. When I upload the slides, you'll be able to click on these things, which I will do after this talk. All right, so next section is on user management and permissions. So people, whether that's you, your devs or who not and robots, so like automated services and code running on your clusters need to be able to talk to the Kubernetes API so they can do things like deploying things, scaling up, scaling down, rolling out new versions, monitoring, viewing logs, et cetera, basically all of the things. But we don't want our auto scaler to do something like mining Bitcoin or developers running away with like, these are credit card database or maybe more realistically, someone steals their laptop who tries to get credit card information. And laptop stealing definitely happens. It definitely happened to me when I was on a like work trip a couple of months ago. Whoops. And so that's why we are going to, not because it got stolen, but the rest of what I said is why we're going to be going over user management and permissions in this next section. So there's two main things which are Authent, which is authentication and AuthZ, which is authorization. So basically there's like a little separation there. So Authent is who are you? And AuthZ is basically what are you that specific person or robot or thing or whatever, what are you allowed to do? So with Authentication, Kubernetes is very flexible here. You can use things like TLS certs, maybe with your own CA or not. You can use OIDC tokens with any OIDC provider. So there's like in-house things like DEX, Key Cloak, or you can use SAS, like Okta, that can turn like plug in with whatever you're, say if you're using a cloud provider using it with IAM. So for instance, you can map like cloud provider users to Kubernetes users for that. So if we go back, thinking about what the best practices are. So use things that are short lived. So for instance, you could use OAuth access tokens instead of using a username and a password. So there's things that like for specifically like for humans or everybody in here. You could do things like TLS, OIDC, services accounts, et cetera. And then like in-client, dealing with client certs. So in Kubernetes, you don't basically create a user. You give, hey, I want to give create pods permissions to like Bob. And as long as someone shows up with a valid cert or OIDC token for Bob, this person or thing or whatever can create pods. And then robots, they end up using service accounts. There is also this project called Spiffy. And you can use that for authenticating from one service to another. It's an advanced use case, but basically short lived identities can help you moved away from long lived secrets. So then on Z or authorization. So again, that's basically, do you have permissions to do what you are trying to do? Say like, do you have permissions to create a pod? Can you do a get on this? Can you delete things?  So there are a few API server authorization modes. So there's node, which is a special purpose authorization mode that grants permissions to key blitz based on the pods that are scheduled to run. There's a back, which isn't used as much as mostly people end up using our back, which is what I'm going to be talking about in the next part of the slides. There is also webhook. So webhook authorization allows you to use custom OSD system, such as what are plugging in whatever your existing system is. So I'm not going to give you like super accelerated course on our back because in total we have 40 minutes. So it's, I'm just going to give you like a few little things. So like the high level idea on Kubernetes is that you define something that is called a role. So this has a specific collection of permissions. So things that can be done, like can I list these pods? Can I create a deployment? Can I specifically scale up scale down or do something with a specific deployment or resource? And then the next thing is you would bind that role to say you have a user or you have a group or you have some sort of service count. And you can do that either as a role binding or as a cluster role binding.  So also once you have created these our back roles, don't just be like, hey, this is, I created them. This is probably right. Or like manually be like, create pod, do I back? Can I do this? That's a lot. So make sure to audit your RBAC.  So by default, cube cuddle has one that is a cube cuddle, can I, and you can list the things that you specifically can do. There are also those other ones here, which are a bunch of plugins that you can add and therefore be able to just use via cube cuddle as well, which is pretty cool. Note though that you can't take away permissions. You can't be like, here is admin access and I'm gonna take away, like make it so you don't have access to like delete pods.  So yeah, like for instance, you can't be like, hey, I'm gonna be like, oh, you can update deployments and you can't do it to some specific one. If you wanted to be able to do stuff like that, for instance, you could have things in separate namespaces where someone only has access to do things in one namespace and not in another. All right, so namespaces again. Basically, permissions can be defined cluster wide or you can do it in a specific namespace.  You could give some permissions to do whatever they want there, but then you're like, hey, I have maybe some other namespace of things that I don't want this person, maybe I don't want them to see at all or I don't want them to be able to delete something in this one. I need to make sure this is working maybe once they're playground, dev prod, whatever you want to do. So you can just give specific access based on that. They could even be an admin in their own namespace if you want them to. So maybe for instance, you might have some sort of workshop and everything is running on the same cluster and each person doing this workshop has their own namespace and they can only do what's stuff in that namespace.  So there's a few gotchas. I'm only going to, there are a bunch of gotchas but I'm only gonna talk about a couple of them. So for one, don't give admin permissions to just anyone. That might be obvious, but sometimes you may be in a hurry, you might not think about it. Be like, I just want this person to do this one thing and it's easy, I'll just give them full access. Whether it's intentional or an accident, things might happen and you might regret it. If you want to be lazier about it, maybe just give them access to a specific namespace, but again, the less permissions that you give someone, the better. So there's this thing with a list secret, like being able to, if you want to like list secrets or just use list, for instance. At least last I checked with Kubernetes, basically you would assume that list just literally shows you a list. Say if you did on secrets, it would just show you here's what the secrets are and that's all you can do. And that get is what you would use to see specific details about it. However, that is not the case. If you do list, you can actually get what is with the secrets as well. So for instance, like, hey, if you were to deploy some sort of Ingress Controller that manages TLS, the TLS certs are usually stored in secrets. So if the Ingress Controller, for instance, has access to be able to do list on those secrets, it actually has access to all of those secrets. So say if it's deployed cluster wide, as opposed to being like in a specific namespace, which is generally what ends up being default. Now this Ingress Controller has access to all of the secrets on your entire cluster. So not exactly great. So if someone else be able to get into your cluster now and via like your Ingress Controller now, they can see all the secrets that you have ever. And at least if you don't have any sort of restrictions up there. So next up is software supply chain, which has been one of the big key terms that people have been talking about probably in like what, at least in the last year, if you especially have been going to some of the KubeCon, I guess KubeCon conferences going to KubeCon. So to give, who here has like heard of supply chain security? Okay, cool, small number of people. All right, so to give you an idea of like what it is in a way that is not specific to tech. So there was, a while ago there was this thing that they termed as the Chicago Tylenol murders. Basically, at some point along the path, things were being put into the Tylenol that was killing people. They weren't sure where that was. So like, was it someone, it was like a man in the middle attack, like was it when they were getting the Tylenol and they were passing it off elsewhere, did someone mess with it then? Was it in the factory? So the factory you can view as like a CI CD pipeline. So you could, at least in software, you could check that for say, I have two CI CD pipelines that are doing the exact same thing is something happening with one versus the other. And basically you could check, hey, is this binary the same as the other one? Then there's like threat modeling. There is like identifying like, who are the actors in the organization? Is there like an angry employee or something like that? But basically for say like the Tylenol, there are so many steps along the way that you have to be like, where in this path did someone put something into the Tylenol to cause this to happen? And you had to figure that out.  So like there's things like, who has access to your source or pod stories? Like what about the dependencies? How is your software built? Like where are you storing things? How are they deployed? Basically there's a whole trail of breadcrumbs they can go through. So like say if a new vulnerability is disclosed, like how do you determine one? Are you affected by it? And if you are, how do you deploy a fix or some sort of mitigation for what that is? Like how do you know that you aren't unwillingly running some sort of like Bitcoin miner? Like that could be happening and you may have no idea about that. So basically you can't be confident in what you're in your software that you're running, like unless you know where it is coming from and how it got there. So things that you might wanna do is like, restrict the pass that code can take from source to production and make sure that you trace deployed code back along each step of the supply chain. So there's a number of questions that you need to be asking yourself or things that you need to be validating as you go, starting from just like writing your code all the way through the step of running it in production. So for instance, do you need to check, hey, someone made a change? Does this change come from someone that I trust or is it just some random person? So one of the things that you can do, use to be able to like maybe validate this is so there's this thing called SigStore. There's a bunch of projects within SigStore and there's a tool called GetSign and you can use that to sign your commits so that you are identifying basically who this person is with this commit. It's keyless so you don't have to worry about using GPG keys. You can also later down the path, I just figured I wouldn't like put SigStore than other things that SigStore, but there's also a cosine which you can use for assigning container images. So after that basically like is the source coming from your source repo? Like is the code, say if you're pulling down code, is it actually from where you think it is? And then can only authorize people push to that. Like again, like you want to make sure that it's not just some random person that can push code up to wherever you have your code stored. When you're building your artifact, is it from a trusted source? Like can you actually trust the build system itself? Can you trust like where that build system is running and what it's running on? So like once your artifact or your program is built, at that point can you trust like where it's being pushed to? So whatever, let's say it's a registry or if you're dealing with like NPM or something like that can only trust if people push to that. So ideally, the only thing that can be able to push to wherever you're trying to push to is your CICD pipeline. That way you know specifically this is what is pushing and it's not some, if I gave access to every single person in this room, for instance, that's a lot of people to figure out like who had pushed something and what's happening with that. So also make sure that you are dealing with vulnerability scanning for your images. So you can look for known CVEs. There are tools out there such as like Clear and Trivi. Some container registries such as like Harbor, they have that built in where you can just turn on image scanning and pick which of the tools that you wanna be able to use for that. You should also consider using an OPA implementation or open policy agent for policy enforcement. So one of the options that they have is Gatekeeper. You could also use Sigstore to, since they've provided a mission controller to assert image signatures and attestations as well. And apparently I forgot a space there, but yeah, you get the idea. All right, so some actual threat models of things that have actually happened. So for instance, someone might make change to code that you depend on. For instance, maybe they broke the code or maybe they just decided they were gonna delete everything there, whether it's malicious or not. Something happened. For instance, someone might delete a package and end PM that's like widely used such as left pad. So basically a thing to do to avoid this problem because otherwise say you have your code, it's pulling down code from somewhere else and oh no, everything broke. It's not working anymore. So you want to have immutable dependencies. So like are you rendering your dependencies? Or are you giving, basically if you aren't, you're effectively giving someone else arbitrary right permissions to your code in a way. Another thing is there was a SolarWinds attack. It was attack on build infrastructure. So basically a code that was produced by build server had malicious code injected that allowed external access to it. So then people were able to basically inject malicious code and sign it with SolarWinds signing key, which is not good. So one way to avoid that is to have ephemeral builds. Basically don't have a dedicated machine that someone can just hack into. You would want to have it so that basically you have a build so it spins up a new machine on demand and then builds it at that point. Basically if it doesn't exist, it can't be hacked. And then you can also have a hermetic builds which are basically builds that don't have access to the outside world. So people, so basically you have to deal with all those things I've already mentioned, which is a lot if you memorized it, please give me your memory skills because I don't have them. But there's a few more things that I wanted to mention that don't specifically fall into platform or RBAC or supply chain.  At that point your cluster is basically far from being production ready. It has a lot there for you, but it does not have everything. There are things that you might want such as being able to back up your cluster. Like say something happens, if you are having backups you could easily revert to what was there beforehand. You can use tools such as Valero to be able to do that. Another big thing is observability. So metrics can basically help you determine if things are going as expected or not. And then if they aren't, they can also be used to help you figure out what is happening. Whether maybe someone did something or if in general maybe just something broke. Good logging, that is super important. It's basically indispensable for having good security because we wanna be able to audit who is doing what. You want to be able to see, did some new, for instance, did someone just get access to be able to do whatever they want in the cluster? Who did the specific thing so you can track to see why did something break or why did something happen and who did that? Like you wanna be able to see user and privilege changes. Like things that are being created, security events, interruptions to logging, et cetera. Basically log as much as you can in a way that is useful to you. Also don't forget at the end of the day, everything, assuming you are writing code, not running things that everyone else is doing, you are running code. If you have problems with your code, Kubernetes is not going to just by default catch everything that is wrong with it. So you want to use some sort of like source code analysis tools such as OWASP to help you analyze that source code or like compiled versions of the code to be able to find security flaws. There are some more resources. I mentioned some of these on some of the previous slides as well. If you go to say the CNCF landscape, you can see there's like a section specifically there related to things with security. The landscape keeps growing. If you know every single thing on landscape, that's crazy and wow. I definitely don't. But it's basically like my coworker and friend, Josh Long basically described it as kind of like a fractal. You just like click it and it just keeps getting bigger and bigger. The Kubernetes docs has a specific section on security. There's, if you're specifically like dealing with your own cluster and administration of that as well, there's links to that. Again, there's a bunch of stuff for Sigstore that you can look at as well. On Friday, the coworker I just mentioned, Josh, who is very much into Spring and Java. We have, it's prerecorded. So since unfortunately he did not come to Dublin. But if you want to learn about creating Kubernetes like operators controllers using Spring and Java, we have a talk on that. It's at 1555 to 1635 at Wicklow Hall, assuming things don't change. Cause I've noticed a few people have been talking about the times and such for their talks have changed in the last day or so. So I guess check with that. Yeah, so thank you all for coming here and sitting or standing. Special thanks to these lovely people who have taught me a bunch of stuff about security that I did not know in advance. Cause again, I want with this, I propose this talk with the goal of learning security and be able to present it from the viewpoint of somebody who is just learning it. Since a lot of times like if you're new to something and you attend a talk by someone who's super senior, they, the level of like what they just learned is like six years ago, 20 years ago or whatever it is. And it may not be, it might be way too advanced or just a different level than what you might be familiar with. Please come and tell me your thoughts and things that I should change and whatnot since I am also giving this talk in 10 less minutes at cloud native security con, which is the Kolo event with KubeCon. So yeah, thanks everyone. And yeah, that's my, my Twitter is, has been on every slide. It's up there. I'm really bad at using it lately, but I will try to be better. So thank you. Have a good rest of your conference.


about 26 years ago my dad met Thane Knight and he offered me my first job at night so I mean I started at night because of my dad I was looking for a new opportunity to work and I saw how much my dad really appreciated the company and how much they've taken care of him throughout all these years so one of the most beautiful things that I've noticed ever since I've been with the company since day one is that you always feel like you're working for a family and that you're you're part of a family so I mean I remember my when my dad was working here and I was just a little kid probably like six or seven years old my mom would always come and bring my dad lunch during the summer and I'd come with him and we would just hang out with my dad he would take me on these trucks drive me around the parking lot and I thought it was the coolest thing ever it was really kind of funny it was my first I guess my first real job I was a paper boy and I was putting away papers I didn't last long because I guess I wasn't I don't know what I was expecting if I was expecting to work on trucks but they just put me to file papers but I was like this isn't what I thought it would be at all but it's on my dad just kind of laughing I think I was like 15 still and so he's like you still need to go to school and focus on that he's really happy that because of night he was able to put all of his kids through school and and through through their childhood and adulthood lives and he's really grateful for the economic blessings that they gave him and he's grateful for the position that he's had and he wouldn't switch it for anything else but he knows that I was able to grow within the company