Welcome to a virtual program celebrating the sister city relationship between Enfleur France and Burlington, Vermont, with the mayors of both cities. I'm Fran Spodard, and I'm a member of the sister city committee. 10 years ago, Burlington representatives visited Enfleur France to honor the 400th anniversary of Samuel de Champray's discovery of the lake to which he gave his name. Champlain made numerous trips to New France, which is now eastern Canada. Most frequently departing France from Enfleur Harbor. After many exchanges, delegates from Burlington and Enfleur met last fall to formalize an ongoing sister city connection with the charter. Since the initial visit to Enfleur 10 years ago, there have been numerous visits and exchanges involving high school students, boy scouts, Champlain college students, Vermont artists and residents, members of the Lake Champlain Region Alliance Alliance Francaise. And Enfleur officials and residents have been hosted in Burlington in 2013 and in 2017. And there are already talks of a future crypto Burlington in 2021. These exchanges aim at promoting and understanding our respective cultures and economic development opportunities in a global and mutually rewarding way.  And they signed this charter last fall in a ceremony held simultaneously by a video conference in Burlington City Halls, Contois Auditorium, and Enfleur City Hall. So they were not strangers working and meeting virtually even before the pandemic took place. We appreciate both Mayor Lamar and Mayor Weinberger taking the time out of their very busy schedules to discuss how their cities are faring during these very challenging times. Bienvenue. Merci de voir trouver le temps de nous parler aujourd'hui. Je suis désolée que mon français n'est pas bon de tuer. Mais nous avons Richard Glish, qui est un traducteur extraordinaire. Et je suis heureux aussi d'accueillir aussi Madame Lechavier, Lisa, et le président de notre comité de moulage. Et aussi Marc Adona, Lisa, Peter. Why don't you all say hi? We welcome Monsieur the Mayor Lamar of Enfleur. And these are part of our committee that are here. And we would like you to welcome the Mayor before I ask these few questions. Bonjour Monsieur the Mayor et bienvenue. Bonjour Monsieur the Mayor. Bonjour. Bonjour, c'est un honneur de vous voir malgré toutes ces difficultés. Bonjour Monsieur the Mayor. Je regret que Mayor Weinberger ne pourra pas ne rejoindre aujourd'hui, peut-être un autre temps. Mais vous savez tout seul que c'est bien que c'est l'opportunité de rejoindre les maires de les villes. Merci pour aujourd'hui. Non mais ça fait très plaisir de vous voir. D'abord, je suis content de vous voir tous en bonne santé. Déjà, ça c'est très important. Et puis je reconnais des amis, donc des visages connus. C'est presque un peu de la famille. Voilà Lisa, Marc, Adona, Lise. Voilà, et les amis chez qui j'étais reçu. Je garde des souvenirs magnifiques de la maison de Lisa et des écureuils sur le toit, d'ailleurs. Ça fait du bien. So the first one is how you and the people of Enfleur are doing during this challenging time of the pandemic and around these surges as well. So d'abord, comment allez-vous, allez-vous? Et les gens d'Enfleur pendant cette difficile période de pandémie avec les, et spécialement avec les poussées les plus récents? Alors, nous attendons demain soir et puis ce soir, surtout, le discours du président de la République sur les nouvelles mesures qui vont être prises en France par rapport au coronavirus. La difficulté aujourd'hui, c'est le nombre de personnes qui sont hospitalisées et qui arrivent en réanimation. Donc les hôpitaux, certains déjà sont saturés. Ils ne peuvent plus prendre davantage de patients. Et c'est la grosse inquiétude. Et on pense que si on continue de sortir dans les rues, d'aller dans les bars, de se rencontrer, le risque est grave et on a peur que les malades se transforment en morts. Dans le département du Calvados, il y a déjà plusieurs décès depuis une semaine qui sont dues au coronavirus. Et on a l'impression que, cette fois, par rapport au mois de mars, avril, on a l'impression que le virus est beaucoup plus contagieux. Je vous donne un exemple. Moi, je ne connaissais presque personne qui avait le coronavirus au mois de mars, juin, juillet. Je ne connaissais presque personne. Quelques employés, 2 ou 3 personnes de la mairie, de la communauté de communes. Mais là, tous les jours, j'ai des témoignages de gens très proches qui ont attrapé le virus. J'ai une cousine qui est hospitalisée depuis 2 jours et qui a été plongée dans le coma. J'ai des gens que je connais, des proches, qui sont dans les hôpitaux. Cette fois-ci, je pense que le virus est beaucoup plus dangereux, beaucoup plus fort, et qu'il prolifère à une grande vitesse. En France, on a un indice. Il y a un mois, on avait 60 cas pour 100 000 habitants. Aujourd'hui, on est à 350 pour 100 000. Et ça continue tous les jours. Je pense que demain, ce soir ou demain, le gouvernement va se prononcer pour un deuxième confinement. So, Mayor, comment voler les entreprises, les restaurants, les commerçants ont-ils bénéficié d'aide ou de soutien? How are the businesses, restaurants, shopkeepers, fairing, have they been supported in some ways I think we can say sincerely that the French government, France in general, has been exemplary in the matter and that hundreds of millions of euros, or even billions of euros, have been unlocked to help the companies. We are part of the rare nations in the world that have brought the unemployment thanks to public money. That is to say that today, the restaurant that closes in France, the whole of the employees are paid by the employment agency, by the employment body, so the government, the taxes, public money, finance the employees' salaries that do not work in other countries. If the restaurant closes, the staff is immediately in unemployment without any remuneration and sleeps in the street, well, after a few days. In France, we are lucky that there is a very powerful social system that takes charge and helps companies. I have met several companies, several restaurateurs, and they all agree to recognize that the help of the state is exceptional. But despite this help, there are, for example, the employees of the businesses that must be paid, the state cannot help at all, so it already carries the salaries, it also takes charge of the different social charges that some companies will not pay or it will be different. But there are important help and we, the community of the country of Don Fleur, we gave money, in an important way, which helped small local businesses, small local businesses and local artisans. The region has helped, the department has helped all the collectivities of the community. In the past, by the department, the state region has invested money to help the businessmen, the artisans' businesses. But it will never replace a normal economic activity, never. And we see in the streets, in Paris, in Accent, unfortunately, we see in the shops small labels on paper, small labels that say, thank you to our loyal customers who have been coming to us for years, who have bought from us, but we have not been able to keep the store closed because some have not been able to keep despite the help of the government and the collectivities. And Mr. Ramair, how are the schools? How are the schools, Gérant-Elle? So, the schools depend on the mayor in large part, that is to say, the buildings are managed by the mayor and the mayor has put in place a reinforced municipal staff, much more staff, because, of course, to prevent children from touching or bordering, we need more surveillance. And then, of course, the children, the smallest, it is complicated for the wear of masks. So in maternal schools, it is authorized that children do not wear the mask, but the institutions, the institutions have to see whether the children do not touch each other. So it's still complicated because the school is precisely the place to meet the other, to socialize the children that we teach them to be solid, to play with the others. And there, for several months, we teach the children not to touch each other, not to play together. So, but if we close schools, we will have an economic problem because parents can't go to work, they can't keep the children. So the government, even if it reconfines tomorrow, has decided not to close schools, school establishments, but to strengthen schools, the wear of the mask, the use of the gel, and the distancing. And for the largest schools that are universities, colleges or high schools, the government takes the work so, in particular, to do the homework by work, by tele-transmission, the classes by tele-transmission. So, but the schools will not be closed because it's a children's nursery problem somewhere. From our group, you might have another question or a follow-up from Elimar. We don't want to keep him much longer. We might have just a few minutes with him. Are there other questions that have come up for you? Dana, I see you moving forward. Go ahead. How did tourism have been affected in Flair? Because, anyway, for Flair, tourism is something very important. And of course, I think it has decreased. But are there measures to try to compensate for what is happening? Thank you, Dana. So, I must tell you that it's a paradox, but the 2020 season has been one of the best seasons in the history of Flair, with thousands, thousands, thousands of visitors, on black streets of the world. Of course, with the mask because, as a mayor, I had asked whether the mask was mandatory in the hyper-center for all the reasons that you could understand. In addition, as we receive a lot of people, there is no more risk of catching the virus because it circulates even more. But paradoxically, there have not been so many cases of COVID during the summer. It's incredible, but there have not been many cases in Flair during the summer. A lot of people, because the French, the Parisians, the French did not go abroad. And they all chose destinations that reminded them of holidays. So there were funny ads that showed in Flair. You can't go to Amsterdam, but you can go to Flair because it looks like it. You can't go to Tokyo, but you can go to such a city in France because it looks like it. So the French played the game. They were very present. They spent a lot of time. And the restaurateurs were happy. And everyone said we had a fabulous season. We are calm. It went well. And they thought it was going to continue until September 15, when the Prime Minister explained that the virus circulated again. And where he decided, especially to distance himself in the restaurants, so there are measures in the restaurants, the restaurants must lower their judge by 30%. That is to say that if you have 100 covers, you only have 70 covers. You have to put plexiglass between the chairs, between the tables. You have to... And the servers, the cooks must wear the mask all the time. And there, I think that tomorrow, Satan is waiting for a closure in the evening. I even believe in the day of the restaurants. The administrations apparently remain very open, but everything that is trade and traditional restaurants, except food stores, everything else is closed. And then, on the trade, we realized that the small shops, the proximity shops, the bakeries, the pastry shops, the charcutiers, had made exceptional months because people find the shops again. People come back to the small shops and they have a council, we help them, we prepare their colleagues. We also had volunteers who were brought by volunteers to bring them to elderly people, to sick people, to run them home. So the pandemic also had positive sides because we saw that there were people who were solidary and who thought of others everywhere. Winter, in my opinion, is going to be difficult because there is a sort of... I don't know about you, how is it going? It must be about the same, I think, because there is a morbidity in the environment and then there is fear because now families have relatives who are affected by the virus. And in front of this virus, no one is equal. You have people who are 1.90 m, sportsmen who fall into the commune, who are very ill, and then you have even elderly people who come out. We have, for example, we have three cases, we had the last week three cases of COVID, of people more than 80 years old, and the three are much better, and they will come out. And you have young people, 25, 30 years old, who unfortunately are dying. So there is this morbidity. At the top of Christmas holidays, which are usually nice holidays, all the demonstrations are cancelled. There is no more Christmas market, there is no more Christmas parties, the cities are sad, it's cold, it's gray. So it's not joyous. You have to keep the cost. When I think of our old people who have known 40 wars, it was also very, very hard, much harder in my opinion. But we feel that people are tired. We feel that people are tired and in hospitals, also in hospitals, we feel a kind of depression that hurts the caretaker who is tired and can't take it anymore. And we fear that if they fear, there is no one to take care of the sick. Thank you. And Peter, and I know Lisa has a quick question as well. Peter. Thank you Fran, and I'll ask you in English and then in French. My question is about I understand you're waiting remarks this evening from the President of the Republic, but whether is thinking back to March through the summer or this fall now and what you anticipate coming ahead, has there been consistent messaging from the federal government in France about how to... how it is asking the public to respond to the virus? And aside from the government's message, to what extent is there tension around or protests against masks, against measures that some perceive as overly restrictive? And then, aside from the government's response, how has there been public reactions against measures, against confinement, anti-mask demonstrations, etc. that we have seen in the United States sometimes, for example? Very good question. So on the last question, we don't have so many people who have contested the mask, the mask's port, or who have cried out for the manipulation, all of that is false, we lie, we want to have fun. There are always, and we often hear more about the minorities who cry out loud, rather than the vast majority who, in a good way. I think that those who think that the mask is not useful, that all of that is cinema, if we take them tomorrow morning in the reanimation rooms of hospitals normally, they will really regret their proposal. Because when we see people who have returned several times a day to be able to breathe, when we say to the family, we can unfortunately, unfortunately, I would prefer it to be a conspiracy that is not dangerous, it is less dangerous, it is unfortunately the reality of people, every day in reanimation, and 50% said to me, someone in between does not come out of reanimation, they die, people die. So in France, there has not been this movement that is maintained by the networks in large part of itself, at all levels.  So, when the capital of Calvados, in the department where I am, there was a distribution, yes, indeed, of traces in the toilets, saying to people that it was not necessary to believe that there was coronavirus, that all that was a assembly of governments. On the management of the pandemic by the way, I tell you what I think, I think that the government, like all governments in general and in Europe, do not know too much what it is. They are in front of something that does not depend on it. They are in front of something that is quite extraordinary, that comes out of our habits, and we find this kind of situation in the pandemics of the Middle Age, in Hanfleur in 1437, I believe. In 1437, in Hanfleur, a boat arrived, a hundred people without doubt on board, and these people were reached of a virus, of a microbe, and there was, in the space of a few weeks, 3,000 dead, 3,000 dead. So, indeed, we had forgotten, our modern societies had forgotten that viruses exist and that they are dangerous and that they can decimate like the plague, etc. So, I think that the government, whether French, Spanish, Italian, if I may, American or Mexican, in front of this phenomenon, it has little means, if it is born to tell people to stay, confined to them. It is the only real practice that has been officially recognized in the world. Less people come out, so, of course, there are also detractors who say, look in Sweden, we have left the virus, and finally, they are better out. Yes, but we are not Swedes, we have habits that are not there, and then again, no one is equal in front of this virus, someone can get out, the other can die. The only solution to this virus will be the vaccine. It is a vaccine that must, and we hope to arrive, but like vaccines, a process for it to be effective, when we say, a process that is inevitable, I think it is a year and a half to two years, we are obliged to wait. So yes, there were maybe shortcomings, especially at the beginning of the pandemic, I think governments, not only the French, but governments did not see the pandemic coming, they did not have the number of tests necessary, they did not have material in hospitals, and did not expect what would happen. And then, in general, for a long time, we saw the hospital politics suppressing the posts, and now we realize that we had time, but it is too late, we cannot make people come back who no longer work in hospitals. On the other hand, we, the local collectivities, there, governments realized that proximity, small cities in France, especially villages, we do an extraordinary work of proximity, for in the continued solidarity to feed the people who were at home, in their homes, in the streets, in the countryside, these are the people who have worked a lot. We were on the bridge every day. And we have, I can tell you, for example that we here in Hanfleur, it is the mayor, it is the community of municipalities and the mayor who bought masks, 40,000 masks that they financed, that they distributed, whereas it could have been the government, but unfortunately, they could not, they did not do it. They are the municipalities that have to distribute to their inhabitants masks. And I think that the government, to have a mahj in France of 36,000 municipalities, which were often criticized or criticized, and the government realized that it was a force, it is thousands of municipalities, close to people who were sick, it was a force. But I think that the management to compete over it, I look at the news, when I can, every day, on BFM or elsewhere, I see that in Italy, in France, in England, in Spain, everywhere, it is They don't know what to do. One day, we close. One day, we close at 21 hours. The next day, we close at 18 hours. After, we close the schools. After, we reopen them. And then, the Germans look at what France does. France looks at what England does. No one holds the exact solution. Unfortunately, the only solution, the only solution, will be the vaccine. One more question, Mr. La Mer? Yes, I would like to ask you at home, how is it going in Burlington and in Vermont? There are two things. In the United States, things are not really better than in France. Maybe even better. There is a strong ultrudescence of cases. On the other hand, at such a local level in Vermont, there is a governor who has done an excellent job in terms of information, prevention, and a general public who plays the game. So, currently, like everyone, we are starting to have a small recrudescence of cases, but in lower proportions than elsewhere in the country. For example, we have something like 7 cases, 7 or 8 cases per 100,000 people. There has been a trial for months. There are two people hospitalized in total, in the entire state of Vermont. There is a follow-up, once the follow-up, there are cases dedicated, it is done very quickly. We are a little in this situation. On the other hand, we ask all people from the outside of Vermont now, in theory, to be confined and stay in quarantine for two weeks if they want to visit Vermont. We are also very close to what is happening outside and we try to control the entry and exit of the state compared to the rest of the country. In the national press, I think we say that Vermont is one of the states of all the five years, where there is the least of cases. Okay. Here, Vermont, Burlington, Mayor Weinberger, every week, he announces the improvements of education, business and governor. And my question is about the vaccine. If the vaccine comes from you, is the world ready to try it? Are the people in France, when the vaccine becomes available, ready to take it? Is there any apprehension on that? Because I think that's the next step. So, yes, I'm answering Alice. Yes, there are already young people who have been appointed candidates, young people who think it's interesting to try it and in a solid way. Because it's true that there are fears. We hear everything and everything is on the contrary. We are told that, for example, in China, in Russia, they already have the vaccine, but teachers, doctors who don't understand each other say, be careful, it's very dangerous. These vaccines, they have been damaged. In fact, you have to at least a year and a half to two years to verify the effectiveness of a vaccine. And if people are vaccinated with vaccines that have been done too quickly, there may be consequences. So, of course, of course, it scares people. But I think that from the moment when the French government and especially the health regional agencies will say that a quality vaccine, a really officially recognized vaccine at the international level will be ready. Yes, yes, people are ready to be vaccinated. Because now, for 15 days, three weeks, the number of people in our knowledge who have the virus and who are in very bad states is scary. And I think that people today are ready to be vaccinated to avoid having to end up like these people we see in reanimation. Thank you, Richard. Thank you, Mr. Rehmer. Thank you for everyone. We are so grateful. Thank you, thank you very much. We wish you good health, Santé. And if anyone wants to say another goodbye, thank you so much for the time. Thank you very much, Mr. Rehmer. Thank you very much. Thank you very much. I hope to see you again. Take care. Take care. Okay. We have your bed, Mr. Mayor. Come and see us. Gladly. Good continuation. Goodbye. Thank you.


Welcome traders to have a technical charter with me Patrimonial, we want to draw your attention to a developing opportunity, we're looking at the S&P 500 cash on the hourly time frame and we've got some market symmetry developing here, we're looking for a way for low to develop, this is way one and two, you can see the similarities in terms of the consolidation before the pullback consolidation and now we're potentially seeing the pullback here, we've watched for some two-way price action to ultimately hold the 180 area, 183 is resistance, see a move down now into the trend line support, the equality objective at 14.95 and if we can get some bullish reversal patterns here, we're looking to set long positions, talking move back through the hives and ultimately to a 4373 equality objective, there's always a plan to try to plan to manage your risk.


New post-war old Dutch cleanser famous for chasing dirt presents Nick Carter famous for chasing crime Every week at this time two great names are joined as new post-war old Dutch cleanser brings you one of the most Resortful and daring characters in all detective fiction Nick Carter master detective But Nick that's fantastic no one would cooperate in his own murder Maybe fantastic patsy, but all the evidence points to it Then I don't believe the evidence. There's only one way to prove what really happened the method I hate to use why me because it puts an innocent person in danger We haven't any choice now. We've got to go through with it Now the case of the wrong mr. Right today's adventure starring long Clark is Nick Carter Brought to you by new post-war old Dutch cleanser Even though she's 79 years old and confined to a wheelchair old Mrs. Right still enjoys picnic and Since her two great-grand nephews John and Charles expect to inherit the right pharmaceutical company one day They're always willing to go along One day early last fall Charles wife Janet wheeled old Mrs. Right to the picnic grounds in its occluded corner of the estate and Stop the care near the edge of a cliff overhanging the river How's this aunt match your spine Janet? Oh, I've always loved this view looking down at the river like being on top of the world It is beautiful. Where are the boys? They went back into the woods looking for dead branches to build a fire with wine I know my shawl, but you might know he wouldn't be around when I need him I'll get it for you. I'll run. I need him. I'll get it for you aunt match. Thank you Janet. I'll be right back Still wish she'd married Johnny instead of Charles Well, this is a beautiful spot up here with the Sun's Johnny take your hand away from my eyes. I know it's you. Are you waiting me to Johnny Johnny?  Oh Mrs. Right those two fishermen hadn't seen you fall in and got to you in time Well, they did are you sure you're well enough to talk Mrs. Right? Of course I am. But aunt match you know what dr. Maren said about your heart No pneumonia left this week may quit any time all the more reason this thing has to be settled now But aunt match I don't cut it. I sent for you to tell you someone has tried to murder me You mean someone deliberately pushed your wheelchair over the cliff Exactly, but that match no one was near that part of the estate But John and Charles and me and the boys were in the woods gathering firewood I know it wasn't you Janet That was a man's hand over my eyes and Johnny wouldn't hurt me. He loves his old and then you think it was your other nephew Charles I know it was and I want you to prove it. Mr. Carter. I'm afraid you're asking the impossible Mrs. Right Why don't you see this all happened three weeks ago even if there were any clues? They'd they'd be gone by now then investigate Charles. You'll find something. I'll be bound I don't understand you aunt match talking about your own nephew like this and in front of me his wife I just assume say it to his face Even as a boy Charles used to sneak lies steal money out of my purse I could see the difference between him and Johnny even then you've never given Charles a chance I put them both through the same school didn't I? Feigned them both to be chemists so they could take over the business together someday. Didn't I? And what happened Charles went into real estate with no more reason than that you're accusing him Who had mad you're being unfair? All right. I'll show you whether I'm unfair or not The cutter I want you to investigate both Charles and John very well Mrs. Right And let me know what you find out as soon as you can I will in the meantime be careful He won't try it again. I fixed that you fixed it. How? My lawyer was here this morning, and I changed my will you did what changed my will The way it stands now. I'm leaving everything to John mad. How could you maybe I'll change it back later But I want Charles to know that if anything happens to me before I do He won't get a red cent Soon Carter only been three days, isn't it? Well, that wasn't a great deal to find out and I she looked Mrs. Right you must be feeling a lot better I wouldn't be out of bed if I wasn't this is that mages 80th birthday We're getting ready to have a little party. I don't mind that Jonathan will be here, but Carter found out Well frankly Mrs. Right what I've learned doesn't prove a thing. I'll decide that Okay First of all your nephew John Wright seems to be pretty steady young fellow No bad habits or associates lives within his income save it regularly and so on I could have told you that What about cows? Well, Patsy can read that part of the report to you. Go ahead. That's right Nick Charles Wright credit rating very poor business heavily mortgaged Overdue loan at the first community bank several large personal loan I don't see any reason for parading Charles business difficulties. You're Janet. What else young lady three days before Mrs. Right's accident Charles Wright attended to consolidate his debts with a loan from the Halliday Trust Company Offering as security the fact that he was soon inherit half the estate of his aunt who was very ill and could not possibly live long Couldn't possibly live long. Well, he did his best to make you such a thing This is right. It'd be very unfair to condemn anyone on such flimsy evidence only confirms what I thought before Janet if you what?  Oh there cool that word fair again. All right. I won't say anything until tomorrow You love it and man come on open your present open this one first and that yes It's from Charles and me I can read the car Yeah, and I'm at this brooch Good-looking very pretty. Thank you Janet. You too, Charles. I'm glad your wife for that marriage I'll talk with your mouthful Charles. I should think three pieces of cake would be enough for you Anyway, I'm afraid my gift will look pretty sad after that and that Anyway Here it is with all my love. You know, I like it Johnny, whatever it is Well, I'm music box. It's beautiful Johnny open the lid How thoughtful of you, but where are my chocolates? You're what now stop feeding.  Well, you know, I have to order them from Switzerland and this year It just slipped my mind. Oh, I don't believe it. What's that?  I only took one You ought to be ashamed Doesn't taste so high Hand me that box Janet before each the rest of them. Well, all right What Charles what's the matter then seconds of eating one of his aunt mages birthday chocolates Charles right collapses and even before Janet can reach her husband's side. He's dead We'll see what happens in just a moment now back to the case of the wrong mr. Right today's adventure with Nick Carter brought to you by new post war old Dutch cleanser An hour has passed and Sargent Matheson of the homicide squad is at the right mansion with Nick and Patsy Trying to arrive at the facts of Charles death a medical examiner says there must have been enough Solid night in that piece of candy to kill half a dozen men, but it couldn't have been the chocolate Sergeant stop pretending John. This is one thing you can't blame Charles for well I'm not trying to Had eaten that chocolate before she put Charles back in a will you'd have inherited everything That's what you wanted wasn't it? Do you say the chocolates couldn't have been poisoned because they arrived by registered mail from Switzerland only this afternoon? I didn't even have time to unwrap the package before I gave it to Aunt Wrapping's could have been taken off and put back again Of course they couldn't that's exactly what he did I did not if there was poison in those chocolate somebody else put it there Oh sure sure as a biochemist mr. Right you have access to cyanide don't you well? Yes, but so do lots of people and when Charles started to eat that chocolate you try to stop him didn't you I I don't remember I do you said put it back Charles those chocolates are for aunt man Well, I think we've heard enough come on young fella come on where to headquarters. Where do you think? I'm booking you for murder Nickel we have to wait here at the post office very long no no Maddie said he pulled ahead and get an okay for us to Look at that receipt good. Oh, here's the inquiry window over here. I hope the sergeant didn't forget the phone Hey, yes, sir. My name is Nick Carter. I came to see about a receipt for a registered package from the Switzerland Oh, yes, I have it right here The assistant postmaster said you'd be calling boy. Thanks Why Nick John right didn't sign for the chocolate the name seems to be Evette That's his right personal maid. Huh and look at the date Yesterday then John was lying. He had that package a whole day before the party. It looks that way But before we make up our minds, let's talk to a vet It is yesterday after noon I signed the what you call in the Certificate the receipt we've been the cell I signed him then I place the package on the old table Well, mr. John is sure to see him not a half hour have passed until I hear the voice of mr. John greeting Madam and I say to myself why he is home so early and why was he madam see? You have a headache but what about the package when I put the regular mail on the whole table about three o'clock The chocolates are gone Mr. Jean has picked them but you didn't see him do it notice you but the package is there when he come home It is gone after he passed through the whole So I know he has find it Isn't it funny Nick the smartest men make stupid mistakes when they try to commit a crime John left a trail of evidence a yard wide how about you're forgetting Patsy that if Mrs Right had eaten that chocolate there probably wouldn't have been any investigation you mean because of her weak heart sure Everyone would have assumed that death was due to heart failure. Well What now Nick? Let's get on the headquarters and see what the laboratory boys have found out Sorry to keep you waiting Nick that box of candy was more interesting than we thought how do you mean sergeant? Well first of all Patsy the poison must have been put in with a hypodermic needle The lab boys found marks like pinholes in the bottom of every chocolate nothing unusual about that Matty No, but what was unusual was the cyanide itself Nick in the lower layer. He used a solution so weak It wouldn't have killed anybody but a person with a bad heart like Mrs. Right Well, what do you mean in the lower layer? That's just it Patsy. He gave the top layer a solution ten times as strong enough to kill anybody That is interesting. Yeah, and that's not all there were some impurities in that cyanide Nick It'll be a cinch to prove where it came from once we locate the original supply. Yeah, sure Chemical analysis should take care of that. Yeah, but the most important thing of all was a fingerprint Who's fingerprint? I don't know yet Patsy, but I bet it's John's the chocolate must have got sore While it was holding it to put the poison in have you checked it against John's prints Yeah, the boys are doing that now Nick Matty, where was the chocolate with a fingerprint on it top or bottom layer the bottom? And that layer hadn't been touched until we got the box down here to the lab So he can't claim that it got there by accident after the box was open. Are you right about that? Can I go down to the lab and take a look at the chocolates myself? Sure you can Nick. What for? I'd like to find out why the top layer was given a double dose Sergeant Matheson was right Nick. All these chocolates have the same kind of little pinholes in the bottom No, not quite the same Patsy look at these chocolates from the top layer holes are larger and not quite so regular Well looks to me as though someone had put a second dose of cyanide in these and try to insert the needle in the holes left by the first one What? Yes, it does look that way. That's why the poison was stronger in the top layer Well, of course he decided that perhaps the weak solution wouldn't actually kill her So he gave the chocolates on top another dose with a stronger solution Perhaps But why insert the needle in exactly the same place? Why not? Look at the pattern on the bottom of each piece of candy The pinhole is right in the middle of that little dimple where you can hardly see it. It's a logical place to put the needle You know Patsy, I'm beginning to wonder whether that second dose of poison might not have been put in by somebody else What? You mean two different people had the same idea at almost the same time? Could be. And both of them tried to kill Mrs. Wright with the same kind of poison in the same box of chocolate? Oh, Nick that that's too much of a coincidence. Stranger things than that have happened Patsy Let's visit John Wright's laboratory. I want to find out if the cyanide really did come from there Here's the only bottle of cyanide we have, Mr. Carter But we don't use it because it's not a very good grade. Some kind of impurities in it I don't know exactly what. Impurities? Nick, do you remember what the sergeant said? Yeah, I know what you mean Patsy Must be an interesting job Mr. Jensen laboratory assistant to a biochemist. Oh the work's interesting enough You don't happen to be working for a slave driver like John Wright. Oh, uh, don't you like him? John's all right, I guess. You sure are a lot pleasanter working for Charles. You mean Charles used to be a chemist here, too? Oh, yes, before he went into real estate I was his assistant then and Janet worked with John then after John broke their engagement and Janet married Charles Wait a minute. Wait a minute. This is getting complicated. Janet and John were engaged. Oh, yeah, but he changed his mind Everybody thinks she broke it off. I know different John. Just let us say that say we're feeling Then Charles was Janet's second choice. Yeah Have you seen either of them lately? Yes. They were both up one day last week talking over old times. I see Well, thanks for the information, Mr. Jensen. It's helped a lot Here's the report on that cyanide comparison test Nick. Okay, let's see it. Here you are both of them analyzed exactly the same Then the cyanide and the chocolates came from John Wright's laboratory. Not a doubt in the world Patsy How about the fingerprint of that chocolate? Ah, we drew a blank there Maybe belongs to somebody in the candy factory in Switzerland. Anyway, it's not John Wright's Could it belong to someone else in the right household? Well Patsy the fingerprint boys are checking that now But if that's just routine that print had to be made by either the Poisoner or somebody in Switzerland Nobody else had a chance to touch that bottom layer of candy. I'm beginning to get an idea ready. Huh pretty fantastic Sergeant Malthusen speaking. Oh Yeah, Barger is the report. Yeah, Patsy What? Archey you made a mistake. Oh, no, no, no, you must have yeah, but Okay Okay, Barger Whose friend was it sergeant Nick? Do you know who poisoned those chocolates? I think I do the same guy that ate one of them and died Charles Wright. So go on Nick. You're right It was his fingerprint. Oh But if Charles poisoned the chocolates he must have known what he was doing when he ate one of them Yeah, Nick Are you trying to tell me the guy committed suicide just so he could frame John for murder? No Maddie I think Charles Wright cooperated in his own murder. What? And I'm afraid by doing so He made it impossible for us to get one shred of evidence that will convict the real killer Well, do you know who it is, Nick? I think I do. There's only one way to prove it. How? Method I hate to use Maddie Because it may be pretty dangerous for an innocent person I've he said you wanted to see me at mad so I Wasn't the world are you doing with these two laundry hampers here in your room? Looking for something with a chocolate stain on it near Janet. You look through this hamper chocolate stain What do you mean? The chocolate was soft and whoever poisoned those candies must have got some of it on his fingers Be the most natural thing in the world or wipe them off on something without even thinking about it at mad It's John poison them you know that all right then if we find chocolate on one of his handkerchiefs that will prove it Oh, it's just a waste of time at man. Maybe but Did you find something no no I didn't find a thing and why are you looking so funny? I'm not Looking funny at all. I Janet would you run downstairs and ask Harvey to bring up some tea You're just making an excuse to get me out of the room. Aren't you at match? I know Janet Why should I why so you can make a telephone call to Nick Carter? Oh, what an idea Why should I want as you did find something in that clothes hamper? You're trying to hide? Why should I want as you did find something in that clothes hamper? You're trying to hide it on it One of my handkerchiefs and there is a smear of chocolate on it I was more careless than I thought and it was you you did poison that candy Of course I did but you knew that if I died everything would go to John That's why I took the candy away from you before you had a chance to eat any of it And that's why Charles grabbed the piece first We had a plant very carefully Charles knew about the poison.   I only married him because I thought he'd be rich someday and then you will Why do why did you kill him Janice? I saw that I'd get it all for myself and be rid of him at the same time With Charles dead and John convicted of his murder. Who could you leave it to but me? The poor sorrowing widow I didn't know anybody could be so evil.    No, don't please you won't struggle much Your heart won't last that long. Oh my gosh. Your heart won't last that long All I need to do is press the pillow over your face Oh We can ill Mrs. Wright hasn't the strength to defend herself against Janet's murderous attack We'll see what happens in just a moment for the conclusion of the case of the wrong mr. Wright today's adventure with Nick Carter brought to you by new post war old Dutch cleanser Helpless in her wheelchair Mrs. Wright struggles feebly against the suffocating pillow which Janet holds firmly over her face Ah They've been hiding in the closet listening. Are you all right, Mrs. Wright? Yes, I'm quite all right, mr. Carter It was such an interesting confession that I'm sure the jury will enjoy it as much as we did when you go on trial for murder Charles who pushed my wheelchair over that embankment wasn't it mr. Carter? That's what Janet told us at headquarters That was Charles own idea, but the poisoning scheme was Janet I began to see through the plan when we found Charles fingerprint on that chocolate and Obviously Janet had to be in on the scheme too Why because when we found out that the chocolates had been poisoned the second time with a stronger solution That made it pretty clear that somebody who knew what Charles had done was double-crossing it and Janet was the most logical Suspect I suppose so but we still didn't have any proof those things were only Circumstantial evidence. Well, you had the handkerchief with the chocolate stain Shall we tell her mr. Carter quite as well? There wasn't any chocolate stain fancy. There wasn't any but there was I saw it. I know Maddie and I put it there ourselves So that's why you went through all that rigmarole and let Mrs. Wright risk her life Oh, I wasn't worried knowing you were all there in the closet Anyway, it was worth it to prove that I wasn't wrong about Johnny Well now you can be satisfied that you put your faith in the right mr. Wright Well neck what sort of an adventure does new post war old Dutch cleanser half for us next week next week well for going after a young fellow I really like he was hiding out because of a murder committed back in 1939 and he admitted killing another man in 1948 and you liked him why Nick well if you asked me Ralph I think was because when Nick tried to keep him from getting away He threw Nick halfway across the room No, that's a fine basis for a lasting friendship with a murderer the matter of fact Ralph That was exactly what convinced me that he wasn't a murderer in spite of his own admission No, I still don't get it. But what do you call the adventure Nick? I call it the case of the forgetful killer Nick Carter master detective is presented each week at the same time by the cut a hay packing company It is produced and directed by Jock McGregor and is copyrighted by Street and Smith Publications, Incorporated Charlotte Manson is featured as Patsy. Ed Latimer plays Matty today's script was written by Jim Parsons Original music is played by Henry Silver this program is fictional and any resemblance to actual persons living or dead is purely coincidental This is Ralph Camargo saying when minutes count use new post-war old Dutch cleanser The mutual broadcasting system


My name is Mark Han, I'm a security solutions architect with Qwallis. If you want to follow along with the slides, you can take a look at that URL there in blue at the bottom. You can pull that up on your phone if you want to keep the slides up while we're looking at that. It's got speaker notes. If you press sort of at the bottom of the MRAP presentation, you'll see speaker notes. And this is... Hi, I'm Ted Han. I'm his son. We are a father-son team. And we like to do these presentations together. Having some fun with it. I'm a site reliability engineer, a consulting site SRE. I help a number of small startups do cloud-native write, security, AWS, all of the stuff around Kubernetes clusters, whether that be the basic setup to running large distributed apps on them. Cool. So this is our presentation on the Kube TLS. It's a tool that helps you achieve neutral TLS by injecting certificates into every pod. In 2002, we built the original version of this. It's a web admissions webhook pod which mutates the pod. And we've updated it to take advantage of new changes that are coming in newer versions of Kubernetes. So in particular, there's a feature called cluster trust bundles that allows you to set the scope of trust for cluster. So let's start off with what is a trust bundle? I imagine some of you have been to the various spiffy talks. So you probably have some idea, but at the same time, I don't think any of them defined trust bundle particularly well. A trust bundle is, at its most simple, a trust bundle is a bunch of CAs. You probably already use a trust bundle that is your browser's web CA store. That's a trust bundle. But that is a very broadly scoped trust bundle. We want much smaller scoped trust bundles. Typically, we want trust bundles per organization or even two or three for your organization. So this is what, essentially, you're familiar with this. This is how web certificates work. This is how HTTPS TLS certificates work. So at the bottom there, there is a workload certificate. That workload is probably a web server. And that web server is signed by some intermediate cert that then in that certificate that you get back from your signing authority typically contains both your workload cert and then the intermediate certs that chain up to a CA. And then at the top level there is that root certificate on most systems that you're running, your phones, your laptops, your Linux servers that are deployed in your cloud architecture and on your clusters. That root CA contains about 160 different CAs. Some of which are just, well, next slide. So some of which you know and some of which are the Peruvian central authority. Go ahead. So what do trust bundles allow you to do? So trust bundles allow you to verify that somebody is saying something, right? Web certificates contain claims, typically sands, and web certificates verify that the trust bundle has said these things. So what trust bundles will allow you to do is to make the, well, make your Docker images smaller and they'll allow you to much more rapidly update trust bundles such as the web root of trust. Currently you build the web root of trust into the very base most layer of your Docker image. So you've got all of those things and they're actually, you know, sometimes even the majority of a Docker image, the Google distro list image has just four things in it of which the trust bundle is the largest by far. That's not true for most Docker images but, you know, that is one of the base most layers. But sometimes that trust bundle changes, right? Just a few months ago trust core was removed from every web CA, you know, is in the process of being removed. I think they have like two or three more days before they're disallowed. But that is still embedded, right? That certificate is still embedded to all of the Docker images you built last week. Cluster trust bundles can be mounted like config maps and you will mount them like config maps on at CSSL to update the web root of trust dynamically so you can keep that up to date regardless of when your Docker image was built. But more importantly, trust bundles can be mounted like config maps and you can have a bunch of different trust bundles for all of the different little scopes that you need. And so that's what we're looking for is to try and limit the scope of trust. So as we said, you know, that top row of CA's of root CA's is essentially the web root of trust and the trust that's in most Linux distributions, Amazon Linux, Google distro list, Alpine, you name it. It's got 160 of those. What we recommend and what our opinion is, you know, on your clusters, you basically want a very limited set of top level CA's. You want essentially your internal private certificate authority to be your root of trust and no others. Maybe a partner or two, but not on every server that you've got. So what we're looking to do is try and provide a way to implement easily trust bundles that limit your scope to just the part in blue and not the 150 items in red, right? There's no reason that any server should have to trust, you know, a Peruvian cafe website. But your system would accept that Peruvian cafe website's TLS certificate because it's got an intermediate chain that roots up to the Peruvian root authority, which is in your trust bundle. And part of this point is not that you shouldn't trust all of those web certs, but you should trust them for when you're going to the web. For most applications, for most of your internal calls, you are not going to the web. You should be using a trust bundle that is scoped to your internal network. So the web to root of trust will still be around. It just won't be the default for most of your applications. Right. So in our keynote this morning, we just added this slide. The presenter, Zach Butcher, mentioned, you know, trying to get to a zero trust architecture. These were the five points that he made. Kube TLS helped to implement those first three points very easily. So we'll show you how this works. Yeah. So Kube TLS automatically injects certificates that provide workload identity onto every pod and every container in the cluster. They provide privacy by TLS encryption. They provide authentication by TLS mutual encryption. And authorization comes very quickly from that simply because you're, you know, once you have those identities, those per pod, per service account identities, authorization becomes a very quick layer. So how do you do, how do you do secure networking on Kubernetes? Well, you know, in the last talk, there was a number of, they went over a bunch of those ways. Any number of talks here are going to talk about different ways to do that. So the two most common ways are these first two sub bullets is one is you're using sidecars. And we're not a big fan of sidecars. They don't cover all the space. They're complicated. They're typically managed in enterprises by teams that are not your application development teams. So they're orthogonal to your application architecture. The other thing is that your application security architecture should be designed in your application. And one of the, one of the 12 factors in the 12 factor app is that there's a sort of a single point. You're, you minimize dependencies. And so if your security of your application architecture is depending on not only your application, but also these sidecars, now you've got two points that are, that are doing that, not a single, single dependency for it. The other choice is some kind of CNI, complex CNI thing with Calico or something, where you're trying to limit network access and who can send packets to who. And again, this is at the wrong layer. It is in your network architecture, your application security architecture is now dependent on your network architecture. And the two have to change in sync and that can be very difficult. So neither of these two ways are very, they're difficult to manage. Typically in most organizations you have two separate groups that do it. And so there's a lot of communications that's got to happen. Our recommendation is the right way to do this is that every service speaks TLS natively. So it doesn't send a packet anywhere unless it's over a TLS link. And to do that you need certificates in every pod so that you can create that TLS connection. In our demo repository, which is linked at the end of this presentation, we show different examples of how you configure your service so that it speaks TLS natively, how to get that private key and that certificate bundled into however your particular language does web service. And it really is usually that simple as, you know, when you are making a GRPC connection, you have to specify, I am doing this the insecure way or you can specify, I am doing this the coop TLS way. We provide just a GRPC dial option that makes it, you know, just picks up the right place, picks up the right certificates for your cluster. We provide a Java version of this as well. Yeah. And if you've ever gone, you know, Google how to do MTLS with Java, like half of it is how to create this, not half it, 90% of it is how to create the certificate and 10% of it is like, here's the Java code that just simply uses that certificate and private key. And we've simplified that 90% down to 5%. One of these days I'll get around to writing the Python version. So the nice thing about TLS everywhere at the application level is that there is no chance of it being sniffed whenever it is leaving your pod and in fact your application's, you know, memory space, it is TLS encrypted. TLS native, it's encrypted and it's mutually authenticated everywhere you go. So yeah. What is coop TLS? At its most basic, it is an admission controller. It's a mutating webhook configuration object inside of your Kubernetes cluster. What that means is the Kubernetes cluster is going to, based on the filters that you set up in the YAML for this object, it's going to send every pod request to our service. It makes a web call to our service. We return data back to the Kubernetes master. We modify that incoming pod request, add the certificate secrets, add certificates to it that contain the secrets so that they're mounted on a file system visible to that pod and so all that pod has to do is pick those certificates up from a well-known location. And so this is the building blocks of trust architecture. So yeah, it's got a private key, a matching private key and it's got essentially the trust bundle. So it's got the root certificates that you care about for this pod in there, which is basically just your internal CA in most cases. We'll talk about the different types of patterns that you'll use. That bottom bullet will get replaced by the cap when it's doing cluster trust bundles and that feature is added to Kubernetes and then all you need to do is provide a secret and a key. And this is the building blocks of an architecture that we'll talk about. Yeah, I think we've already mostly covered this, but the application should speak only TLS. Your organization itself is a zone of trust. There is no such thing as zero trust, but you can make your application-to-application connections and start of a zone of trust. And once you have done so, adding the identity-aware part of allowing things to connect becomes very simple. Once you have the core identity and authentication provided on every request, the rest of this just falls into place. So this is an example of how not to do it, which is basically just the side-card pattern we think is flawed because there's open text that is, as the previous presenter mentioned, like if somebody is a muck on your network, which you have to think of that as a valid possibility, you have to assume breach. And so if you assume breach, that clear text connection can be sniffed and used in various and nefarious ways. So this is why we don't like this architecture. We'd rather that that application pod speak TLS so that's encrypted well before it hits any of your network architecture inside the code, inside the running application. It's encrypted before it hits network networks. And just to be clear, this is hard to sniff. This is not easy to happen. On the other hand, Istio fails open. If your side cards aren't injected, your application will still try to talk and the proxy won't be there and it'll just talk to the network. That's a problem. That is actually pretty much the crux of our argument. And Istio fails open. You don't want that. And there are ways to bypass the network. If I have a rogue app that's been deployed to the cluster, I can ignore the fact that there's a side card there and talk. Now you can fix that with complex CNIs, but those are complex CNIs that... This is our opinion. This is much easier to implement in our opinion. Although this looks as complicated as anything else, this is just a set of repeated patterns done the same way with slightly different regular pre-planned variations on what they are. So here's... Yeah. So this is what an app looks like. It is serving something and it is acting as a client. And it does so with certificates provided as... Or certificates chaining up to your trust bundle. It connects to... It has an identity on your network. And that identity might tell it, might say, I am the server for X. And that identity might say, I am the client that has this service account. And you might just put both of those into the same client certificate as Kube TLS does. It just creates a client certificate, a client-slash-server certificate for each pod when it comes up. It figures out which services it should be valid for. So it adds the DNS names, the appropriate DNS names to it, as DNS sands. And it adds the service account in as both the common name and the spiffy sort of style ID. And probably more as we figure out and turn ad feature flags to make this work in interesting ways. There's still some question about how exactly those identities should be represented, though spiffy seems to be a pretty clear, pretty commonly used. So this is another way to apply the same pattern. So this would be talking to partners on the web. So there are two different ways to do this. We prefer the way on the top because we think it's more long-term robust. But let's talk about that. So what you do is in your internal service and their internal service, you trade trust bundles. And that way when their API server uses its internally generated certificate to talk to your server, you're going to validate that certificate that you're going to do an MTLS, mutual TLS authentication, becoming client-cert with the trust bundle that's been injected into your pod. That trust bundle in this case is your partner's trust bundle. And therefore, you trust that certificate. On the calling side there, your partner's API is going to make a call to a web server. And when that web server sends back the hello, I am server XYZ, essentially hello, I am blue server internal API, it checks that blue certificate to see if it's valid. And it does so against your trust bundle, which is the blue trust bundle. And so it says, yes, this certificate chain matches cryptographically. So we're good to go. We believe we're talking to the correct blue server and that yellow certificate that we send down the line, the blue server is able to validate that yellow server as belonging to the yellow company. The other way to do this is basically not to trade trust bundles but to trade certificates. That works just as well because the blue server will be validating a blue certificate against the blue trust bundle. That works. The problem with that is that you want to be able to rotate your certificates pretty fast and that means exchanging certificates with your partners on a regular basis, say every 60 days, every month, every week, like whatever your aggressive certificate rotation plan is. You're probably not going to get down to seconds with that. You're probably not going to get seconds. But your certificates, your CAs aren't going to change all that often. So that's something you can do yearly and then still rotate your certificates. You rotate your blue certificates as fast as you want. They rotate their yellow certificates as fast as they want. You two pretty much don't care what you're doing operationally. You just care that you trust each other. You care that you trust each other. So here is the details on what a Kube TLS certificate looks like. So we start by being called as a webhook. We look up the container services. So one of the flaws in our model is that whatever services the pod is associated with when it starts up are the host names that it gets. If you create the service after you create the pod, then you're out of luck. If you change the pod afterwards, you change the labels on either the pod or the service afterwards and change the services it matches to, then you're out of luck. Which is fine so long as you don't do that very often. It's also fine if you move away from doing the DNS sands and start moving to a model where rather than authenticating the services, you authenticate the service accounts that you're trying to connect to. And that's sort of the step that you want to go to eventually. But for the moment, DNS sands is really easy and compatible with everything. So Kube TLS then creates a CSR. CSRs are an object, a top level, cluster level object in Kubernetes. And you can use them to do certificate signing and approval. It will approve or its controller to approve will approve. And then it attaches a secret to your pod by way of mutating your pod and responds back to Kubernetes with that. Yeah. So these are the key fields that we use in the X509 certificate that we're creating and injecting into the pod. So the common name is the name of the pod. So common name used to be the website that it served for, but now that has moved to the sand, the subject alternative name. So we've used sand many times without defining it, but the sand is the subject alternative name. And that's the list by which most of your HTTP mechanism will validate. Like, am I talking to server X? If the certificate that server X presented you contains the sand that says server X, then yes, you're talking to them. I know, by the way, that it cryptographically chains up to the root, right? That's what we do. So the name of the pod and the subject alternative name, it's a DNS with the names of the service, the name of the pod, and any other DNS name that makes sense based on the flags that you give Kube TLS. We also throw in a spiffy ID that's based on the service. And so you can use this with your spiffy IDs. We set the key usage. So in a X509 certificate, there's a field that says how can you use this key? There are a couple of values there. One is this is a root CA. This is a signing, typically an intermediate CA. Or this is a web server or this is a client certificate. And we set them both. You are a web server and a client certificate so that you can use the same certificate on either side, on the client side or the web server side. We do the same thing that Let's Encrypt does. Yes. That's what's important. And then it also has the identity of the root. It's signing up, too. So let's do a demo. Demos are fun. Apologies to Semisonic here for the lyrics. Let's mirror this and let's make this a little bit bigger. Is that big enough? Can people read that? It probably helps if I move it up so you can actually see what's going on. So I already have some of the pods running but I am going to delete it so that we can see a fresh one. So what we've got is a greeter service and a greeter client that we'll demo. It's the Hello World example. It's the GRPC Hello World example but modified to use TLS nicely as we want it to. So here is our pod and we can exec into it and look at the certificate that has been generated. It helps if I get my flags quite right. Cool. So here is a certificate. You can see its issuer is our issuer. And that will match up with the CA certificate that it's also provided in that file system. You can see the DNS names. It's got the service name. It's got the pod name and then it's got a spiffy UID. And it's just a standard TLS client server cert. RSA at the moment. I was potting around with adding ECDSA but close enough. And this more or less works. And you can see the CSR that was generated a few seconds ago when I deleted this pod. Kube TLS went through the process of creating this CSR, approving it a signer that we've set up for this, which you can use cert manager, you can use an external signer, or you can use a very basic one that is here for this demo. All of those work. It's agnostic to the actual signer, which allows you to provide your own or do something better. And then we can just call a service. So the Greeter service, the Greeter client, is just a batch job that runs and exits. And so the pod runs and then shuts down. So it's a job. Kubernetes doesn't restart it but saves the logs so we can examine the logs after it's run. Yeah. And so this just connects. It connects to the appropriate name. It gets the greeting. And it also sees the service account that we've been running as. So if I were to modify my Greeter client, I can set the service account name. That has chosen a very weird indentation. Here we go. Can you stop for one second? Yeah. So scroll down a little bit. We've got some stuff coming out. But when you look at the, okay. Yeah. I don't know what you're pointing at. Yeah, no. So we can create another version of it with a different service account. Running is a different service account. And now it has this other identity visible to it. Again, through the Kube TLS certificate. And this through other identity is not, it's not our client saying that. That is the server that it is connected to that has said, you know, here I know who you are. I can verify who you are. So what else is there that is interesting? The other thing that's sort of interesting is that, you know, it's MTLS, right? If I override the CA and I use some other random self-signed MTLS cert. Oh, geez. How did I screw this up? There's a mix of tabs and spaces. And now I am realizing it. Let's fix this. I don't know why you have a caps lock key. We create yet another copy of this. And this one will fail because it is using a self-signed certificate. This one is actually failing on the client side because it's signed by an unknown authority. But we can have it fail on the other side when we present it an unexpected key. And if we go look at the logs of our, okay, the debug logs are not working. It should have printed out that we got a failed connection from this other server. That we denied a connection. So the first failure was when we saw the other side certificate, like when it sent us our certificate, when it sent its server hello certificate, I am server XYZ, along with that certificate, we looked at it and said that doesn't change to our certificate authority. So we're closing the connection from the client side. The second error was we accepted that certificate because it did chain up. And then we sent it an invalid certificate that didn't chain up to its cluster trust bundle. And so the server closed the certificate on that side. It says use of closed network connection, which means we tried to write, because we thought this was going to work, but the server closed down on us because it didn't trust our certificate. Cool. I think that's all we have. A couple of wrap up slides. Yeah. So, yeah, let's move back here. Yeah, there we go. Yeah. This makes it really easy to have certificates populated and have certificates populated in your application's name space so your application can make use of certificates rather than trying to wrap it in some network layer that does this all magically. You know, their advantage is to both kinds of magic. We like ours. Yeah. We think all your developers should learn how to use TLS and mutual TLS. Like we think that should be the price of entry for being a programmer on cloud native. But also that we should make it simple enough that they can know. Again, you know, your MTLS demo is 95% plainware certificates. We've collapsed that down to certificates are provided for you. Just do the right code. Yeah. And, you know, there is some agnosticism to identity policy. We intend to provide a reasonable set of defaults that you can flip on and off. And hopefully one day it will, you know, be just one. But at the moment there's still some question. Once everybody's establishing authentication through MTLS, then the authorization layer becomes, you know, relatively easy. You can see who you're talking to. So then you can pick what their actual authorization level is. So other future directions. Private keys should be generated on the nodes and never leave the nodes. Currently they're created through secrets. That's suboptimal. If they were generated on the nodes, then the private key material would never leave the nodes. That would be great. So we're planning on moving to a CSI model. There is not ready for demo, but there's some work on that. So that rather than mounting a secret, you mount a Kube TLS CSI that just generates for you the private key material when the node comes up and the rest of it happens pretty much the same way. But it happens on the node rather than at a central set of pods on your cluster. So because it happens on, you know, that logic is on every node and the private keys stay on every node, never getting transmitted. Even though it's being transmitted by the Kubernetes control plane in TLS, we'd rather just not transport those around. Yeah. And this should be built into Kubernetes. But you know, that's our opinion. We like it. The cluster trust bundles is one step in that direction. It's a huge step. We hope that will knock down those dominoes and move forward. Cool. Plan for world domination. Yeah. Here is our repo. Here is our presentation slides. And here is the session feedback link. Sorry to keep you from the vendor booth crawl. So there should be beer available now soon. But thank you. We're here for questions. Yes, though, in a branch. Yeah. I will be glad to help you run that demo on your cluster if you would like to. If you look at the git commits, it was like, I don't know, about an hour ago. Yeah. Go ahead. Yes, but we're not confident enough in the code quality yet to do that. Mostly because I wanted to make the demo work. Yeah. Yeah. Cool. Thank you very much. Question in the back. So we work with any CA that provides a Kubernetes signer. So that is a very short list at the moment. That's cert manager. But at the same time, there is also a not even in the branch but a super janky demo of here is how you use a AWS CA to provide a Kubernetes signer that I spent 20 minutes on last weekend. So let's talk about it. I'm glad to do the work to make that work and I do intend to do the work to make that work. Microsoft has CA, like parts of their Azure CA are exposed in their AKS stuff, right? Right. Oh, then it will just work. Yeah. Yeah. Yeah. Yeah, it should just work. If that is already exposed, then yeah, it should just work. So I've tried it with our own CA and I've tried it with a cert manager and I see no reason why it wouldn't work with the other CA that I've used, which is the hash or vault signer for CSRs. And that, like anything that is a Kubernetes CSR signer will work unless there's something really weird about it. Excellent question. Thank you. Yeah. You get an extra beer. Yeah. Yes and no. The simple answer is that a trust bundle is all equivalent in most SSL implementations. And that means that you want to be careful about what you put in your CA list. There are additional, like I do believe that you are getting at a leading question about how open SSL handles CA PEMs, which I, yeah. And then you add new certs. Oh, yes, of course. Yeah, and that answer is no. That answer is very clearly no. And if you start your application and then we, and then you want to rotate certificates, the answer is still no. Your application, unlike with some other things, like it doesn't pick up new certificates on a regular basis. We don't provide a rotation mechanism of these secrets. What should you do about that? Kill your pod. Kill your pod.  Yes, but at the same time, like we're going for the least common denominator here of we don't expect, yeah, yeah. We don't. We are absolutely limited by all of the limitations of your open SSL library, whether that be open SSL, Libre SSL, Golang's and go SSL implementation, whatever you're using. Bouncy castle, whatever. Yeah, please not bouncy castle. Yeah. Okay. Cool. Well, we got the one minute. I think we, yeah. We're good. Yeah. Time to turn off the mics.


If you need MEN 21 coins for anything, make sure to go to buymuntcoins.com Check it out with the link in the description and my code MMG is 15% off Dear Will Clown, please forgive me Last episode, I benched you because you had the worst pull block I've ever seen in my whole life On an imaginary defender, on the most crucial play, but... I understand! I understand where I went wrong in my faith I'm so sorry! I'm switching it up. It's reverse psychology. Will Clown tossed that game. I got the Will Clown jersey on today. Here's your reminder. Take outside princess of Julia. It said take outside princess of Julia. Alexa off! Also, good try. Take outside apprentice of Julio. All right, looking at three and three season right now, which is kind of scary, so I'm hoping we can keep it all together and go for an O right here. My first wheel spin. Oh, Will Clown is my father wheel, and I have the jersey on. I should get an insane... I gotta get something insane here. What? So far, all of my store packs have been literally incredible, so I have no reason to believe this won't be. Let me just see an insane corner pull here. That or a half pack. Both would just be beautiful. 77, 78. Tyson Alululu. Getting the 82 probably here. Oh, Elimes. Actually pretty good. I think I go Rod Woodson here. 81 Rod Woodson. I like that a lot. All right, the top... I literally can't get the good animation. It's not possible for me. Tremaine Edmonds. Tremaine Edmonds will be helpful. We're gonna go with him. All right, the final pack. I haven't gotten a gut to your corner yet. We're gonna need it here if we're gonna squeak it out. No, no, no. Definitely not. Did I get the good animation? It's gonna drop us off with Josh Allen. This isn't a good animation either. It's Brandon Linder. That is a good animation. Are you shitting me? I just got the same damn thing last time. Oh my God. How did that happen? Brandon Linder was on the team last season too. So all right, he's making a return. Riley Reed, Thuni Ragnar, Larry Allen, Brandon Linder. That's pretty good actually. And then defensively, Tremaine Edmonds is gonna come in for Kamala Kareya. Very cool. First wheel spin helps me out, but it's not the corner I wanted. Hopefully this one. Wait, is that a jackpot? Legend jackpot? Again? No. Rookie Premier? Rookie Premier. I remember this one. Rookie Premier was from last season. You get the rookies and you always get. Man will always update it to their best possible card. I'm actually gonna throw in Jeff Ocuda here. That Ocuda has a chance, hopefully within the next two or three weeks to get an upgraded card. He probably won't. I'm gonna be honest. He probably won't. I'll just be happy to have him on my lineup because I love Jeff Ocuda. Which lands us on our store pack challenge wheel. What do you got for me, dude? I got the last one. I wouldn't mind this one either. No turnovers? No.  What do you got, boy? Stealer's team team. That's gonna be scary. That Chase Claypool's gonna have like 96 feet. Okay, second and 10.  That guy was gonna dust it. Yes!  That was lucky as hell, but a great play.  I really do.  Just press covers.  Let's his team do the rest. All right. He's gonna have to make a decision here. Let's see if he goes good. Oh, DK Burnham. DK Burnham. I think, I think, I think. Let's go!  Get done it. Huge play right there. And we are gonna try the holder blast with Russell Wilson. Can we get it, Russ? Ah, maybe not. Jeez, this team. This team is fast. First in 10, he's gonna go. Oh, play action.   Good, no. I was gonna say good tackle. It wasn't. Who's in there at quarterback? Oh, it's Mahomes. So does he just have partial stealers chem? Cause he has, his Leroy Glover has stealers chem. So he has some extent of stealers chem. Wow. All right. We're gonna send this pressure here. And I'm also gonna send Jamal Adams. This is gonna be really risky. Oh no, it's a slip screen. It's a slip screen. I'm all over it. Did he drop that? No, he caught it. He lost the arts. Play action. Play action. Play action. Yup, get there. Big hit. Eridot will hit him. Makes him throw a bad ball. Let's make a stop. Fourth and 10. We can do this. Crossers. I'm on this one. He stole that one. Picked up for Mahomes. Who stays on his feet? God. Two point conversion. I'm just gonna send this to the edge. I'm gonna fake it back to the right side. Send it to the edge. Cut it up the middle. Yes. 14 to zero. Big. Another big blitz. I got the over the top routes. Oh no, I don't. What was that? What a great play. Second and eight. Got the dig? No way.   I think I can just get DK across the middle here. DK across the middle. Or, or that.  How's that dead eye lob pass if the corner's in a posited position to make the catch that my wide receiver is?  Yep, there's the run play. Oh, it's play action. Fuck. How does he keep throwing that? Your corner is experiencing network issues. Wait, am I about to get a bailout? I would not mind a bailout of it. Against this guy, dude. Uh, I can't motion Julio. Either I lost or he lost. I might have just got a bailout.  All my wide might never really stop. I think I got the win there. Yes!  One bit. When a win is a win.  Okay, wait, wait, wait, wait, wait. It's officially two hours since that happened. I chocked it up as a W. I was so excited and I laughed. Then I thought about it. Do I want a cake walk to the Superbowl? Do I want an asterisk next to this Superbowl ring in the event that I were to go to it now? You know what, dammit, I was probably gonna lose that game. I was getting lamp by that man coverage and I was about to accept that free win and get off. But you know what? I'm not doing it. I took a loss. Our season is reset. We are zero and zero. Welcome to our brand new season. We got an 84 overall team walking into it. So we're just gonna spend the challenge will again. We're gonna do the rest. You're recording today and we're gonna hop into a game. I think this is the right call. This is an integrity move. It's one TD, three different players. I need a touchdown for three different players. We know what I can lose anyway, but at least we walk out of there with props. Paul Amala McClaren. It's good, but so is mine. We got this. First in 10. He's rolling out. He might throw it deep now. He throws short. Oh, damn.  Is he gonna take off? Oh, he throws over the middle. Wait, did he catch that? No. Oh my God. He caught that. This is Verts. QB Spy on. It is verticals. Oh, there's a corner route that's open. He's gonna playmaker.  Yes, but he dropped it. Yes. I knew he was gonna playmaker there. Fourth and four. He's taking the field goal. 3-0. That's fine. I also need a touchdown with three different players. Passing touchdown doesn't count. I say that every time, but it doesn't. I guess we'll just have to see. Kick return would be nice though. That's an easy way to get this one going. Oh, okay. Damn, I juke through there too. I thought I was gonna get it. Yo, this might be there. Let's see if that end screams down. He does. Josh Allen to the edge. So much room. A great block. 26 yards. Yeah, we're gonna hand this off to Lydani and Tomlinson. Huge hole in the middle. Just don't get rocked. Thank you. All right. First and 10. Going with a random set here. That's not someone random, but I don't think I'll get a touchdown. Excellent drive right now. All right. First and 10. We're just gonna go right back to inside zone. I'm gonna make sure I cover the ball though because we're running a lot. Okay. Cut it up the middle where Paloma was. Oh, I didn't get it.  You know what I'm gonna do? This is kind of cheesy. I'm gonna sub a mile Sanders in for this touchdown. So then technically I can get another rushing touchdown just with Lydani and Tomlinson. This is cheesy as shit, but I expect stretch to work. It's such a good play. It's it's Barker's how good stretches do. I'm gonna do fake B.A.T. Holder blast here. We got this man for one reason and one reason only. And that's Russell Wade. Yup. Russell Wilson. There it is. Swerve. Easy swerve. That was just like last episode. It looked the exact same. I think this is the one. Yup. Yup. Just gotta swerve it. Yup. There was almost no purpose in me doing that. I don't think, but I love an extra point. So I'll hold on to it. I got the middle. I got the middle. No I don't. I don't have the middle even a little bit. Ooh. Wham. Wham. Damn. Two people. Three people. Aaron Donald came crossfield to get that. I'm gonna put a QB spy on for this. Just in case it's a QB run.  Good play. I respect it. Honestly now it's huge that I got that two point because it's 10 to eight right now.  Because I'm gonna get back down there and I'm gonna stretch till they need Tomlinson. And there's two of them and I just gotta pass one in. Or I summon Chandler Cox. No I won't be that cheesy dude. We'll see how it goes. All right. Cover two man. I'm sorry you guys. I know how boring this is to watch like drag slant, drag slant. But when people do this man coverage meta, there's not that much you can do against it. So I just have to run the drags, make the read and throw. I wish it wasn't this way. Third and two. I'm gonna go with the dive here. I don't like my full back running back duo. But maybe I do. Oh my God. Hated her through the huge block on the user. Let's see what he does. First and 10. Is he going with Julio? Nope. He's not. This Julio is so good. I love this Julio. I don't plan on throwing any of these.  All right. We'll just go Josh Allen out of bounds. Okay. I think we should be good. Hey, I like having Greg's Whirling a lot better. I think Fabian just has horrible accuracy or something because that kick felt a lot easier. So we're going to go slant, slant, and we'll figure out which one his user takes. So he didn't actually take either. I just didn't get the pass off. That would have been a touchdown. He just got a lucky block shed. That's going to happen though. Julio slant, Metcalfe slant. Yup. He's not on X. There's Julio, big catch. Oh, this is sketchy, dude. Fourth and inches. Big blitz. There he is. Julio Jones. Yup. He goes X. I go to B. It's really revolutionary. God, it's so boring. Is this what you want? You came to look like EA. I'm going to send this to the left side anyway, even though I don't know how good this looks. Ooh, never mind. Looks really good. All right. So I'm going to fake flip sides here. I'm going to keep it left side.  What did I say? I said I do a stretch down the other guy. I do a stretch down the other guy. That's two touchdowns with two different players. I will just go PAT here. I'm going to force him to make a two.  Why is kicking so hard in this game? Well, now my two point conversion lead means absolutely nothing, which is really depressing because I worked hard for that. I almost want to let up a touchdown early so that I can just march down and win it on my own accord. You know? Three timeouts still. He's moving down the field pretty quickly. He's going to throw here. I got to go try and score to complete my challenge. All right. So he's pressed up. We just want a good release out of Julio. That's what we're looking for. I think that's a good release, ladies and gentlemen. Is it?  Just let him return it.  What even was that? And then I couldn't get the tackle? But you know what? That's what I get. That's what I get for trying to be cocky and get my extra touchdown. It doesn't matter what hole this dude is in running this coverage. He will not suffer. There you go. Slant, slant. Max for deck. There we go. Do it again. Let's see which side he goes. All right. So he's... Wow. That was a good one. Hey! I'm going to slam him out better than DK Metcalfe. And he doesn't catch it. I almost just lost the game. Miles Sanders with Damian Talos and DK Metcalfe. If you guessed that two-degree touchdowns are going to be, you're gone. Because I don't think anybody knew that I was coming. Oh my God. Clutched up there. Almost choked it. Then clutched up. Welcome to our brand new season, gentlemen. We're starting out 1 and 0. And we've completed our challenge wheel. So I get a pact open here. All right, boys. Most of your fantasy pack once again. I know you've seen a lot of these in Wheel of Mott. I apologize. We'll have new packs hopefully for Thanksgiving. All right. So nothing of use in the first run, obviously. Oh, is hoping for an elite. We don't get the good animation. Matt Piratus, a team of the week player. Devin White. Wait, that's good. Wait, Devin White's a stud, actually. That's awesome. Pretty sure he's a really good user. All right, boys. We're sitting clean at an 84 overall. Hey, I love you guys. I will see you in the next one. Thanks for watching as always. Peace out.