Welcome. I'm Judy Russell, Dean of University Libraries at the University of Florida. I'm joined today by my colleagues, Lori Taylor and Todd Digby, to share information about our collaborations to develop broad and deep digital collections for public access to Cuba and Patrimony. Celebrating Cuba is the result of a collaboration between the George A. Smathers Libraries at the University of Florida and the Biblioteca Nacional de Cuba Jose Marti BNJM, as it's affectionately known, the National Library of Cuba. The collaboration began with a visit to UF by the director Eduardo Torres-Cuevas in 2011, during which he joined the Digital Library of the Caribbean, D-LOC, as a means to provide broad worldwide public access to digital copies of Cuban historical and cultural material. In 26, as you can see from the map, Cuba is an enormous in size and incredibly close to Florida. It's been connected for over 500 years. UF has long collaborated with Cuba, and indeed one of the preeminent collections in the Smathers Libraries is our Latin American and Caribbean collection, which has a major focus on Cuba. In 2016, the Smathers Libraries and the BNJM signed a convenio committing to an expanded partnership. Dr. Torres-Cuevas wanted to focus on digitization for public access of content uniquely held in the BNJM and asked UF to coordinate an effort to create a digital collection of Cuban materials available in the U.S. and elsewhere outside Cuba. Together, these efforts would build a broad and deep collection for global access to Cuba's patrimony, celebrating Cuba. Because of limited internet capacity in Cuba, UF agreed to host the collection for global access while BNJM would host an identical collection for access within Cuba. Other partner universities and contributors in the United States who've already joined the effort include Cornell University, Duke University, Florida International University, Harvard University, History Miami, Kent State University, the U.S. Library of Congress, LLMC Digital, New York Public Library, the University of California, Los Angeles, University of Kentucky, University of Miami, University of North Carolina Chapel Hill, and Yale University. So you can see that the collaboration has been growing and expanding as we bring on additional partners.  Thank you, Judy. Celebrating Cuba currently contains more than 1 million pages organized in 10 different collections, as you can see on the slide. Project work today includes creating a U.S. partner community for the identification and digitization of materials from and about Cuba, targeting specific areas for developing comprehensive collections, sharing catalog records of holdings at BNJM through WorldCat, conducting core bibliographic work to determine publication histories, developing a database of all known historical books published in Cuba, collaborating to confirm permissions, and then coordinating digitization of current periodicals to have complete years online, identifying holding locations of materials for various worldwide libraries, and completing U.S. compliance requirements to be able to transfer hard drives, those with digitization materials to and from Cuba for access within and outside of Cuba. In 2016, BNJM had completed a major portion of record conversion, moving previously print-only catalog records to digital, with the incredible work to convert these records from print to digital. The problem remained that the digital records were only accessible in Cuba. Through the Celebrating Cuba Project, UF transported the digital records via SneakerNet, internally to support record validation and collaboration with OCLC, to have all the BNJM records added to WorldCat. BNJM has additional materials with record spending, even with more to share, BNJM now has over 135,450 catalog records in OCLC for worldwide discovery. Over 97,000 of these records are unique. The enormous amount of work for creating the digital records and sharing the records is one of many foundational activities in BNJM's wide-ranging work. All of the work by BNJM and other partners support developing comprehensive collections from and about Cuba. BNJM is leading the work to develop other foundations for comprehensive collections on Cuba. BNJM collaborated with UF to identify four major projects for initial development. Cuban monographs, Cuban journals and newspapers, and Cuban legal materials, and maps of Cuba. BNJM identified each of these as priority areas to help focus the collaborative and cooperative work. BNJM serves as an advisor and digitizes and contributes copies of materials not held elsewhere. With the overall goals identified along with these specific projects of interest, other projects have emerged in support of the overall goals. Many defined projects and activities are interrelated and have additional related impacts. Another example of this is with maps of Cuba. With this project, the Library of Congress is contributing maps of Cuba, including working with UF to support additional inventory of their collections to identify maps of Cuba for digitization. This collaboration supports a more comprehensive collection of Cuban maps. Another example includes works to identify important periodicals and newspapers, and then working with collaborators to identify how many issues should exist to find holding locations for issues, and then to digitize as many issues as possible. In some cases, single institutions have nearly complete holdings. But in most cases, a comprehensive run for any given title can only be created with the aid of five or more institutions working together. Another example of how this initiative has expanded beyond the collections of the BNJM is the unique collaboration between UF and the synagogue at Shalom in Havana. Many of these their materials are now digitized and online through Celebrating Cuba. Collaborating with colleagues in Cuba requires ingenuity and many unique processes, including using KonekerNet or physically transporting equipment for digitization and drives with digital files because of internet access and speeds are not sufficient for transferring files. So we have to do this using people. For another example, UF has worked close with Adela, Vice President of the Community Center in synagogue in Cuba. She supported the digitization of unique materials in the collections, which has enabled worldwide access to these materials. But that's for all who have internet access. This means though that the digitized collections were not accessible within her buildings for her users to meet their needs, which had to have a non internet solution. I set up an offline database using Zotero to ingest records for all of her items and added PDFs to each record. This Zotero database was set up on a large USB flash drive that could be used on a laptop, which was then used on site in Cuba as a local digitization database for access to files. Also, Fletcher Durant, UF's preservation librarian, had strips of colorful acid free paper, which serve as flags for the physical items in the collection, letting all users know that these items are digital and available from the local laptop and the internet. For all the projects and examples resulting digitization materials are now accessible through BNJM, your streaming partners and venues they select and for global public access using UF through celebrating Cuba. The models for these collections that are housed are over 3,055 titles. This includes about 33,754 items and then this is pages-wise it's over 1,167,000 pages. And for just to get a sense of kind of viewership and use these materials have, in January alone of 2021 there was 685,692 views through these titles. Initially BNJM and UF shared materials transported by DVD and then removed to high density USB drives and hard drives. Materials shared include this historical materials, historical reprints, current research, archival documents, maps, books, photographs, newspapers and much more. And now turn over to my colleague Lori. Thanks so much, Todd. Yeah, so in addition to digitizing historical materials, UF is collaborating on new resources, including new publications on Cuba with the library press at UF. You can find our publications on your preferred bookseller site, including the University of Florida Press website. These publications build on smaller earlier work where we reprinted historical pamphlets, we printed them locally, and then we shared them in different ways at different events and with collaborators to help people understand and think with materials and more ways. This relates to the areas of learning and communication where objects can be boundary objects that help connect us across fields and areas of expertise and a bucket of objects that help us to think to feel and to imagine. We're writing collections from and about Cuba with the small print runs, the historical reprint items, as well as with major publications. Our first book in this initiative is inspired by Cuba, a survey of Cuba themed ceramics by Emilio Cuedo, noted historian and collector for Cuban history. We're now in process for our second book in the inspired by Cuba series, and this is delivering Cuba through the mail. This will be published later this year. In the ceramics book, this book showcases materials from outside of Cuba that feature Cuba. The prior book focus on ceramics and this is on stamps. It's simply astounding to see how far and wide Cuba is referenced inside and included outside of Cuba. This book will be available from your favorite regular booksellers again, including the University of Florida Press website. So in addition to looking forward to having this book out soon, we're really excited as we look forward to our virtual book launch and book plates and other promotional activities. In addition to publishing books you have is also creating new scholarly resources that are digital for understanding and using the digital resources in the collections. Cuba, the pearl of the Caribbean is a digital humanity site to showcase materials from celebrating Cuba. Shown here is an excerpt of the part of the top of the site, and a part of the front page which includes the timeline. So this is on the full digital humanity site. The contents of the site already includes important information on important Cuban thinkers information on their works, more than book reviews more like context essays on different works. We also have a Zotero bibliography, a timeline and timeline JS, and all of this is anchored in materials from the collections. Also, Dr. Paula de la Cruz Fernandez continues to develop the site with more content and English and Spanish to be added. So we have these fantastic collections and partnerships and work that builds on the collections. We also have other broader impacts to conclude we wanted to share on how this project has changed us and our ways of working. So on the slide you have a number of examples and celebrating Cuba overall reinforces and illuminates critical needs for large scale international collaborations, including the need for bilingual metadata, the need for dedicated staffing for project management. It informs how we make workforce changes for language and for project management. We know that leadership from the top and throughout is absolutely critical to project success flexibility patients and mutual respect. For celebrating Cuba, there's a very special emphasis on collaboration with the compliance office for taking equipment and digital files to Cuba without violating us export controls for always dealing with the different levels of paperwork that are required to make this successful. So to take one of these examples, we now have new positions and people in them who are making bilingual metadata. So workforce has changed. This is kind of really two of the examples. We have people in special and area studies collections, digital support services and cataloging. It includes Dr. Paula de la Cruz Fernandez, Nelisa Caraballo-Ramos and Angie Soto. I've no thanks to their work we have many finding guides that are now both in English and in Spanish. And then we've learned that this is not currently supported in archive space. Archival folks have already been attached to request the functionality, but it's really interesting to consider. Had we not worked on celebrating Cuba, we would certainly still needed this at some point. But the question is when, when would this need have come up and when would we have started to make the changes that are necessary to best support our collections. This project moved us along further and faster to meet the project goals and for our larger questions of how we work with such dynamic unique unique and world class collections across languages to support immediate needs and for the larger goals for diversity equity inclusion and justice. We're thrilled to have been able to share about celebrating Cuba today and we would love to collaborate with more folks to participate please contact the team at UF. Please also see the fantastic collections and read the newsletter to see new updates. Please note if you read multiple issues of the newsletter, you'll see that each collection has standard information at the top and then updated information below. This is important and it's part of the collaboration. It's the fact that when we share the reports with our collaborators in Cuba, we share them as a printed document. And so they need to have the newsletters printed and shared with them, and the text is meant to be supported for offline reading without immediate reference to other prior reports. So just another learning that we had come out of this and how we present materials for online and offline usage. Again, thank all of you for your time and give thanks to all of the partners who collaborate on celebrating Cuba. Please feel free to contact us with your questions and suggestions, especially if you have content to contribute. Thank you.


So I'm a bit of an imposter here. So this project is linked to the fact that in 2008 and 19, so basically in the last two years, Micah has been, sorry I've tried to stay here so I can move from the computer. Okay so basically Micah was in Sheffield for two years as part of the Marie Curie Actions project and and we had this broader project on the on the study of long-term developments in captain management and mobility in the Netherlands for the Aaron H. Ruhman period. So this was a broader project and largely was its work a larger project but I will focus on our isotopic results here because obviously the theme of the session. Why cattle, why the focus on cattle is the main species in the Netherlands in both periods and therefore that the opportunity to provide us with the largest possible sample. There is evidence that obviously we went to operating in a vacuum. Obviously we have evidence from previous archeology of work that has been done before. There are changes between the Aaron H. Ruhman period as you won't be surprised to hear but obviously we also wanted to know about what was happening in the Aaron H. Ruhman before the Roman period. Also the other questions was what is the evidence that we have for cattle mobility and and about herd management. Obviously a lot of the work of herd management is based on archeology of data that I won't be able to present now but it's part of the project but of course the mobility is also part of the story and talk about mobility. What do we know? Well we know from the study of material culture that actually in this period there were extensive trade networks and when I say in this period I mean not just in the Roman period but also in the Aaron H. Ruhman period. You will hear about this more in a minute. This movement of people has been documented historically and also archeologically so but we actually don't know much about the livestock and this is why we want to contribute to these questions. Obviously we are mainly interested in the livestock as a proxy to understand human mobility The other thing is that there is a size increase in cattle in the Roman period that is well documented like in other areas of the Roman Empire and one suggestion is that this is also associated with mobility because of the introduction of animals that from elsewhere that led to a size increase true interbreeding. The isotopic analysis that we have done is largely based on strontium although you will hear in a minute a little bit more about a couple other isotopes and a ski that we have this collaboration, a long-standing collaboration with Jane Evans at the Neck Club in Keyworth and Jane really is integral part of this project that she will play in the publication. We have as an opportunity to understand our strontium data it was very lucky that Kurt published this kind of map of what is now generally known as isotopes for the strontium and this is for the Netherlands that obviously helps us in our interpretation. We worked on two sites one is Heart and Castellum which is a rural settlement which spans from the Middle Iron Age to the Roman period and from there we actually sampled 40 cattle teeth and in particular we targeted the lower end trees and the other side sorry just to see how can we see that okay just in the middle Netherlands but Ireland which is a Roman because it's right in the south of the Netherlands here this is a much more tightly dated site is only Roman 1st century AD and we had a much smaller sample there we could only sample five cattle teeth which is the reason why we decided to stretch out and do a little bit of the other species too. Okay so Alton is there is a little bit of an abitation here which is Roman a settlement but most of what we know comes from a waterlogged channel and and where amazing there is amazing preservation and among other things a fish trap a canoe part of a bridge so this is quite remarkable site with excellent organic remains because of waterlogging of course and there is continuity occupation from the Middle Iron Age to the Roman period and as you can see here a large sample size for animal bones which allowed us to take quite a few samples for isotopic analysis. Okay so let's come to the results that we have from the strontium. Okay basically this is Alton and this is the isoscapes in which it sits which you can see is very generic in the Netherlands because lots of areas have this kind of strontium signature so if you look at the samples and our values you will see that there are a lot of them which are actually consistent with that area which means that they are consistent with local animals but that this should not underestimate the possibility that actually they are coming from other areas which have a similar signature but that we we can't prove that they are from elsewhere and they may well be local but they can also not be local. Okay perhaps more promisingly we have some other specimens that do come from other area and these two specimens are consistent with the isoscapes DNE which would be this yellow area here and the orange area here and of course it goes without saying that they could come from outside the Netherlands too. Okay so we have some other we have some introduction and there is another specimen here that is consistent with either E or F so with other this area or here but not to the the area where Alton sits and then we have three specimens which have much higher strontium values and here you see the question marks because these are values that are not reflected in in the map of the Netherlands so therefore they could come either from elsewhere or there are some areas where there is actually a little bit of a gap and that there has been some work although it hasn't been mapped that the show so that this bold clay area here may have isotopic values which are consistent with this so basically these three specimens either come from elsewhere as they are an arrow show or perhaps from this area that is not mapped. Okay just okay sorry I have now been talking about the Iron Age and the Roman period as they were together but obviously we have a chronology that you can see here and just to make a long story short I'm just dividing it between the Iron Age and the Roman period and the remarkable things that you can see here is that most of the specimens that come from elsewhere they are actually from the Iron Age which is maybe a little bit of a surprise it is the Roman period and you have only one specimen which definitely comes from elsewhere so for the Iron Age we have at least three other regions involved from which the cattle were coming and for the Roman period only one. Okay oh one thing I forgot to mention is that you can see we have specifically labeled these two specimens okay with a very high strontium values and the reason why we did that is for these two specimens we also done some oxygen and carbon analysis and the white one is together with others is plots with the others and it's not that different in terms of carbon and oxygen one is really stands out as very different so emphasizing further the fact that this is likely to be an exogenous specimen coming from elsewhere okay and in fact it is the low carbon value could indicate a specimen coming from an area of dense forest. Now the trade network for out and was big on the basis of the material culture from pottery, metal and store you know that the wear in the Iron Age contacts through lots of places therefore perhaps it's not surprising that we get also livestock coming from elsewhere in the Iron Age and and you know the question here refers to that particular specimen which is strontium values high oxygen low carbon and maybe we should look for an area which has this characteristic to provide more detail. In terms of the site so we could conclude that as I say that the mobility in the Iron Age indicates that there is livestock coming from three different regions okay. The material culture in the Iron Age points out to links with lots of areas in the northern Netherlands in France in Germany and indeed the strontium analysis shows that some of the animals came from quite a long distance and you can see at least 100 kilometers away. Okay the one thing which is very interesting the low mobility towards out and in the Roman period but if you consider that out and is actually a rural site which I didn't say at the beginning but it's rural site so it's a site which has is likely to have a kind of producer element which is greater than the consumer element so it's quite likely that in the Roman period when it was a rural site actually these people were actually exporting animals from this web taken elsewhere okay and this is why we don't have so much evidence of animals coming in. It's my question animals going out. Erlen is really famous for its bath house you can see a photograph here and the analysis the bones come mainly from an old excavation I'll try to go a little bit quickly here and here we have a much smaller sample size and what we see here is okay this is the local signature which is here it's a quite small area in the Netherlands okay you can see that there are some specimens that are consistent with this but we have a number of other specimens that don't belong to any of the isoscapes known for the Netherlands so they must have come from elsewhere and you can see one here okay so one region here we can identify another here and a very high value here so this must have all come from elsewhere and if we try so at least three regions involved like for Alton okay and then you can see that as far as this is these are the capital specimens only five you can see none of the capitals or none of the cattle are consistent with the local signature which obviously considering a small sample size it doesn't mean that they didn't have local cattle but obviously quite a few must have come from elsewhere the big solid two samples they could have both been local and a wish ship we have at least two or the five specimens that come from elsewhere is probably just one area that is recorded so here we do have like at Alton and probably in the Iron Age but here we're talking about the Roman period we do have a lot of evidence which is consistent once again with a trade network that we know from the material culture or lots of contacts with the broader area okay so what can we see about Alton so mobility of cattle from three different regions as this one can you see it? No, I can't see it, you know, maybe it's not, never mind okay so it comes from three different regions the ship got we know evidence from one region of course if we had a larger sample probably more regions would have been involved one thing that we know from the zarchaeology most of the cattle are old so these cattle are coming in and they're probably cattle that were used for farming and then at the end of their life were taken towards the site and also the introduction of so much material you know stone pottery from elsewhere may also mean that the cattle were used for transported towards the city and eventually slaughtered there okay and we have seen that there are also patioship garden pigs which are consistent with the local signature so they could have been kept locally okay so try to make some kind of final considerations about this okay I think one thing that the one consideration that I think it could be potentially interesting is that we see we have seen one site Iron Age to Roman in the Roman period there is very little evidence of animals imported and then we have seen another site okay it's much more than sample but a lot of evidence of importation so obviously we have to be careful here to generalize different Roman sites provide different evidence and that's probably related to the different function one is a rural site which is largely produces a producer's side the other is probably a site which is with a bath house and all that is probably more into what's consumption and you expect the most of coming in now the other thing which I found is very interesting now is that although we do expect that in terms of trade the extent and the energy of the trade probably increase from the Iron Age to the Roman period but we've seen this is not necessarily reflected yes okay I'm finished it's not necessarily reflected in in the evidence so that we are from out and for me this was interesting in comparison to the evidence of that for instance of the project Sylvia and I put together with Claudia Minicchi in England where we saw this clear increase in mobility from the Iron Age to the Roman period we have to be careful not to generalize because we can see here that other scenarios are possible and also the other thing is that what we have to be careful about as I mentioned before is a lack of indication or movement in the sense of imported animals doesn't mean movement that didn't occur but in some cases it is possible that the movement was out of the site rather than towards the site so we should be careful not to use the strong evidence as a simple indication of mobility okay many thanks tomorrow and see you guys in days obviously Jane Evans who had that important role in the project and I'm particularly keen and remembering the Marie Curie actions because being based in Britain maybe the last time that I will continue to say


i'w ddweud yr ysgol am y dyfodol yma gweithio weithio, bob ein sgolio'r radio yn Cres Tympo yn gweithio i'r newid i wych yn ffagorol o'r ysgolion'r Llyfriddau Cymru. Cymru oeddwn yn cael ei wneud. Felly mae'n gweithio'n gweithio'n cyffredinol i Watford o'r Ffordd. Mae'n ddweud i'r ddysgu'n aron ramstael a'r cyfrifffreddau'r seisaf. Felly mae'n gweithio'n gweithio i'r amddangos i'r pethau o Manchestr Unig. Well, we're going to start back at last week and that nil-nil draw with Watford. Chris, we don't have a nil-nil draw for a year and then you get two in two weeks. Yeah, the London buses, it was better than Norwich wasn't it in terms of a spectacle, in terms of all those opportunities to win the game. Probably should have won it, I think really, with the better of the opportunities. I mean actually, by the end of the season it might look a good point, but at the moment the way Watford had been playing it, it didn't look, you know, an away point and a clean sheet in the Premier League is not to be sniffed out, but when you play the bottom two, I think you expect him better than two nil-nil draws. I think the team would accept that, Eddie would accept that, absolutely. But yeah, it was a difficult game, Bournemouth showed glimmers of some of the attacking prowess coming back. I thought Ryan Fraser had a bit more of an impact than he had done in previous weeks. He's still just searching for that form, isn't he? But I thought he looked a bit more willing, he looked a bit more hungry, he had a couple of chances, had a good chance at the end himself. Just couldn't get the service to Cameron Wilson, that was the problem. I think I read a stat, you only had one touch in the Watford box all game, which for you number nine is obviously not enough service, but that comes from everybody, because Bournemouth expect goals from, I guess the whole of the front four, really, that Joshua King, who obviously got his chance back in the team, Harry Wilson and Ryan Fraser out wide when they came on later on, and obviously we saw Dan Juma for the first time from the start in the league, so yeah, all in all, frustrating to come away with nothing, but a better point than against Norwich. And speaking of Dan Juma, that chance just before halftime, he looked a certain goal, didn't it? It did, he got caught in two-mind slightly, did nothing, he didn't know whether to dink it over the keeper or whether to go low. In the end, he said after the game, I should have dinked it over him, but that's easy to, for anybody, we're all goal scorers from the stands, aren't we, when it looks easy, but I think a few games down the line, he probably would score that. A bit of pressure under the microscope of the Premier League, he probably bangs them in in training, you make the right decision in training, but of course a Premier League match environment is completely different kettle of fish. So, yeah, I mean, all in all, I thought he had an hour which is positive, one or two flashes, nothing major from him yet, but I think he's one of those who, that's his first 60 minutes properly in the Premier League, getting his teeth into a game. So, let's not jump to too many conclusions too soon, let's give him a chance to show what Bournemouth have paid 15 million euros for. There's definitely a player in there, a couple of nice bits of footwork, got a couple of shots away, obviously he got a couple of shots away here in the Norwich game as well. So, it's just going to be finding his best position. He obviously started on the right last week, which is his right footed, which unbalances the cherry's knack for having inverted wingers, as we've spoken about before. So, I guess where they're going to get the best out of him, he prefers to play on the left. So, yeah, we'll see whether he gets his chance of going against United. And we mentioned that chance for Dan Jimmer, but also Diego Rico looked like he could have striped one from 25 yards. Oh, yeah, that was a pelter, wasn't it? It really couldn't have, in commentary I said it was elements of Charlie Daniels here against Manchester City, where it just falls and you strike it with everything you've got. It didn't quite have the accuracy that Charlie had banging it off the top of the bar, but certainly gave Ben Foster something to think about, and we should mention Ben Foster because he, again, made a few saves that, you know, kept Bournemouth out. The chance that they did have, they found him equal to it. But, yeah, Rico, you know, he had a free kick as well that forced the keeper to make a save. So, he's inching closer to that first Bournemouth goal as well. And of course, you know, we mentioned up in the attack, but in the defence, another clean sheet, and that's two and two now. Yeah, and you know, building clean sheets is, I mean, Eddie, as a defender will love the clean sheets for sure. Again, they're relatively untroubled. You know, Aaron Ramster had to make a couple of good saves, and then we'll talk about him again in a moment. But, yeah, he had to make a couple of smart stops. Dele Feuw's always tricky, you know, he's always got that chance to unlock it, but I thought Steve Cook and Nathan Aker, again, were really solid. Adam Smith, you know, again, straight back in the team, but to good effect. And even Rico, you know, the problem with Diego Rico is he has got that chance to drop a bit of a clanger for want of a better word, where he just loses concentration for a second. We saw it, he tried a back heel on the edge of the penalty area. His own box, you know, they're the things that can really cost you. But I thought, actually, he defended pretty well against the likes of Dele Feuw who are tough customers. So, yeah, I continue to think he's grown with every game. And perhaps just one slight concern for Eddie House side, Jefferson Lerma and Philip Billing, both on four yellow cards each. Yes, it's a tightrope for sure. I mean, good in a way they didn't get it before this game coming up against Manchester United because you want your best players available for sure. And the hope is, of course, they're not suspended for the same game. The good news on that front is Dan Gosling is now back and available. So there isn't some more options in there along with Lewis Cook. So, yes, they are going to pick up yellow cards. I think you have to take that with these kind of players. You've seen Jefferson Lerma get suspended for big games before. That's part of the game that they are going to run that risk. So, yeah, the key now is hopefully for them not to be suspended for the same game. And just finally on Watford, a nil nil draw away from home. Yes, they're bottom of the league, but the cherry is just gradually adding points week after week in building that tally. And last week went up two places for drawing nil nil at bottom of the table. You know, that's the league table. I hadn't actually noticed the draws column, but there have been so many draws in the division. You know, apart from City and Liverpool at the top and maybe Chelsea and Leicester, of course, in the top four. But apart from that, everybody else is drawing. No one's really winning that many matches. I think Arsenal are fifth and they've won four out of 10 matches. So everybody's sort of, you know, three wins, four draws, three losses or something. Just Bournemouth's record. So they go into this game against United in that real tight cluster level on points with United in the middle of the table. So, yes, one point can count for a lot at this stage of the season. Absolutely. Well, one player who has had a great start to the season is, of course, Aaron Ramstell. Earlier this week, he won our Player of the Month competition. So let's take a look at his October highlights. Aaron Ramstell, his October highlights there. Chris, just how impressed have you been with Aaron Ramstell this season? Really impressed. Yeah, he's been fantastic. He really has. I thought last week against Watford, there was a nice tweet from Schwann Jallau. The former Bournemouth keeper about Aaron Ramstell's performance. Just saying that he's just growing with every game. And I thought he encapsulated it really well. The thing about Aaron Ramstell is he's not just his saves. The saves are what get the headlines. But I can't remember the last time he dropped across. Again, I'm touching wood as I'm saying this. You know, last week in really greasy conditions at Watford, he didn't put a foot wrong. Some of his playing out from the back. Willow was absolutely purring about one of the balls. He just pinged halfway down the field. Just picked out Adam Smith on the run. He didn't even have to break stride. So his distribution is improving. I think his communication has never been in doubt. But I think one of the question marks against him at the start of the season was his ability on the floor. And of course, with the new rules of the, you know, the goal kicks and things, that can come under a little bit more pressure as well. But he hasn't been found wanting at all in the area at the moment. So, yeah, fully deserving of that new contract that he earned. Fully deserving of the player of the month award as well. And when you look at the three players of the month that have been voted for already, Harry Wilson got the first one, Diego Rico got the second one, and Aaron Ramstell got the third one. At the start of the season, if you were forcing me to predict things as you do at the end of every preview show, and I usually get it wrong, I probably would have got it wrong in suggesting that none of them would have won a player of the month. You'd have been looking at the Callen Wilson, the Ryan Fraser's, Steve Cook, Nathan Ackay, some of those kind of regular stars, if you like. So I think it's really encouraging that some of the players you wouldn't have expected have really stepped up to the mark. And it's worth mentioning with Aaron Ramstell, he won it with over 50%, which is a huge margin considering, you know, how strong the defence had been. Steve Cook and Nathan Ackay both in that vote as well. Yeah, and saying that, of course, the goal of the month hasn't got many contenders, is it? So, from that point of view, it had to be someone at the other end of the field who was going to be in contention. So, yeah, for those clean sheets, I think absolutely right that he should win it ahead of some of the defenders as well. But I think again, you know, the fact he's established himself and that, you know, Bournemouth fans will have been unsure at the start of the season. They'll have known what he did last year at Wimbledon. They'll have seen him in and around the place, but haven't really seen him that much in action. What can this guy do? Might have watched him under 21s or England under 20s matches. But now, you know, he is a popular figure already. You know, he got a great reception last week from the fans at Watford. I just hope tomorrow, you know, against United. He's already proven himself against the big guns that they've played already this season. So, I'm sure it will be a big stage for him and he'll be up to it again. And of course, he's had his lone spells. He's been out at Chesterfield, out at Wimbledon last season. He would have learnt an awful lot to now prepare himself to play against Manchester United. And I think there's probably, as a goalkeeper, you probably, the key is that you treat every game the same. You know, whether you're at Wimbledon playing against whoever, Fleetwood or Morkham or whoever, to something playing against United or City or, you know, dealing with some harsh away fans as well as he's had to do at Aston Villa and Places and Southampton already this season as well. So, yeah, the occasion doesn't seem to be anything that bothers him as a goalkeeper. You know, sometimes there can be nerves.  But it doesn't display any nerves at all. And I think if you back yourself and you back your ability, and obviously you've got the faith of people like Eddie Howe back in your ability and the players around you, I think that's really key as well. He's obviously instilled confidence into the back four. And as a unit, yeah, I mean, yes, the goals have dried up at the other end, but you can't, sometimes you can't have everything. You have to, there has to be a bit of give and take. So solidifying Eddie Howe would like to win 1-0 rather than 4-3 every week. Absolutely. And it's worth mentioning with Aaron Roundsdale. Yes, he's very young, but across the whole squad, Bournemouth have the youngest average squad in the Premier League with 25 years and 66 days. So it's not just him, but across the whole squad we've got youngsters coming through and really showing their potential. Yeah, and you look at, you know, some of the bigger clubs. You look at Chelsea under Frank Lampard this year and they're trying to obviously move towards a younger model and promoting some of the players who've been working hard in their youth teams to earn their chance. Manchester United, who we'll see here, we'll see some of their homegrown youngsters as well because Oligodd O'Solshaw is going that way. So as we've said before, you have to produce your own players. Sometimes, of course, you'll, you know, sign some in. Aaron Roundsdale will sort of class as a Bournemouth product because although he hasn't actually played that many games here, you know, he was signed before he'd played too many for Sheffield United and obviously went out on loan and really earned his trade. So the hard work that Bournemouth have done on the training ground with him, you know, has obviously played a huge part. But yeah, now's the time of Bournemouth hopefully to see some of those in the under-21s, making the step up. Sam Surridge, of course, is the obvious example who's out in the championship at the moment doing well and obviously, you know, has earned himself international recognition as well. So yeah, I think, you know, to have one of the youngest and obviously a predominantly British sort of base squad as well with one or two foreign imports as well, I think he's really encouraging. Absolutely. Well, next up for the cherries is the visit of Manchester United here tomorrow. Let's take a look at what Eddie Howell had to say in his pre-match press conference. But the players have really given two good defensive performances, actually three because I thought for the majority of the Arsenal game we were pretty good as well. So that's good signs for the future for us. And then you look back to last week and we had chances again against Watford. So in two of the three games, I think we've had opportunities to score, hasn't quite happened, but I back our players. And I think that's the simple message from me. I think we've got good enough players to score goals. We believe in the team and the way that we attack. And I think the goals will come. I think from our perspective, we're relatively happy with what we've done so far this season. I think there's a lot more to come from the team. I genuinely believe that we can play better and we can achieve some really good things this season. Certainly looking at the last few games, which I have in great detail, I think they've played really well. Last year was a really tight game. Swung their way in the last few seconds of the match, but I thought we gave them a good match. Yeah, Dan's getting closer. Really pleased to have him back. He's a real energiser, great character, really upbeat guy. And it's been great to have his energy and personality in training this week. Well, that was Eddie Howell speaking in this morning's press conference. Chris, Manchester United. They haven't perhaps had the start to the season that they would have wanted, but it's Manchester United. They're going to be a threat, aren't they? Yeah, and they've just oiled the wheels, haven't they, in the last three games really? It's amazing to think they hadn't won a waste in February before these last three matches. But yeah, I mean, three games on the bounce. They've done a bit of travelling, obviously, to part of Zambill grade and then to Norwich and then down to Chelsea. And actually, to be fair, you know, a hard game at Chelsea on Wednesday, back up north, back down here for a Saturday lunchtime game. And they play quite a strong team against Chelsea as well. They didn't make that many changes. So, you know, hopefully, you know, that might give Bournemouth a little bit of a percentage edge somewhere. But yeah, I mean, they've had a tough start and everybody's already talking about the fact that the biggest thing they can hope for this year is Champions League qualification, which if you think of Manchester United going back five or six years, I mean, it's unthinkable that they would be happy with just qualifying for the Champions League next year and maybe winning a trophy. And I think, you know, the winning of the trophy was probably why Solcia went quite strong in midweek. They've obviously built up a bit of momentum as well. He wanted to keep that going, I'm sure. But the League Cup is a very realistic opportunity for them to win a trophy. So not surprising at this stage to see unlike Liverpool and Arsenal and other teams who made a lot of changes, who've got bigger fish to fry, higher up the league probably. For United, the League Cup could be a big competition this year. So from that point of view, let's hope that one or two of those players have got a bit of a hangover from that, albeit you don't get many hangovers when you win usually. So, yeah, three wins on the bounce away from home. Obviously nicked it in the last minute here last year, which was really heartbreaking for Bournemouth having worked so hard to get a point. And to be honest, the games here against United have been relatively competitive. There's been one or two that United coasted to a two-nil win a couple of seasons ago, but Old Trafford's been a difficult place to go sometimes. But here, they've always been pretty entertaining games when we go back to the one that has been out on social media this week as the Thursday throwback, the two one from the first Premier League season. That will be a great memory for everybody to have. And it's about time that obviously Bournemouth haven't beaten United since then. So it's about time that stat was rearranged. And you mentioned there that, of course, you know, there are three unbeaten. They have done a lot of travelling and playing a Wednesday night and then a Saturday early kickoff. It's not ideal for anyone, is it? Not great. No, we've already seen, you know, Jürgen Klopp talking about pulling out of the next round of the Carabaugh Cup because it clashes with the FIFA Club World Cup in Qatar.  That's not, you know, mess around with that. I mean, the travelling for Bournemouth and the fixture schedule for a squad like Bournemouth would be a lot tougher.  You want to be seeing the best players play. So, you know, no problem at all with Solskjaer playing that team on Wednesday night if they obviously get a result tomorrow from a United perspective. Obviously, we're hoping that the players are shot from the last three games they've had and come down here a bit, you know, a bit leggy or whatever it is. But I'm pretty sure the luxury jets that players travel on these days aren't so bad as sitting on the coach on the M6 coming down. But yeah, ultimately, you know, they have, they've missed the car coup, haven't they, this year? They haven't replaced him. They've lost Pogba through injury. So that's two pretty big holes in your team. Obviously, Harry Maguire has solidified things at the back. So Cullen Wilson tomorrow up against his England teammate who, you know, they've played a back three, which has been taking a little bit of time to settle in with Lindelof in there as well. MacTomone seems to be, you know, inking himself in as a sort of a bit of a replacement for Pogba and is one of their rising British stars, obviously a Scotsman who's impressed in the last few games. So, yeah, and of course, Rashford, you know, scored a great free kick in midweek, scored the winner here last year, scored against Bournemouth at Old Trafford last year. So, you know, when given the chance in the right position, you can't keep someone like him quiet. It's difficult. Absolutely. And as for Bournemouth, they'll be given a massive boost by the fact that Dan Gosling is back in training. And, you know, David Brooks isn't too far away. It's all coming together quite nicely over the next few weeks. I think the medical staff are pleased to see the door keep revolving and another one heading out and not coming back in. So brilliant to see Dan Gosling back. He had obviously a pre-season worked so hard to get to get ready for the start of the season and then had an injury just before the start of the season. So, you know, when you see some competition come in in your place as well, you'll feel building obviously coming in, albeit a different type of player. So, I think it's, I think in the midfield we are going to see with Dan Gosling back in there now and Lewis Cook available as well. We're going to see a bit more of Eddie's sort of horses for courses for a particular game. A particular player is going to be more suited for tactical reasons. So, the one thing about Dan Gosling is he is different to the others. You know, Lermer and Billing pretty similar. Lewis Cook, bit more that creative sort of player. Dan Gosling, all energy, all over the pitch everywhere. Often is the one who covers the most ground. You know, it does offer that slightly different option. And sometimes people feel like, at the moment I think, the sort of the drive from central midfield is maybe one thing that's lacking slightly. You know, with Jefferson Lermer and Billing doing so much hard physical work up and down, sometimes Dan Gosling is the one who does pop up from midfield. He'll be there on the penalty spot to finish it. I think of that Southampton goal away last season, brilliant goal. He was the one who'd run 80 yards to get there. He's the guy that can do that. So, at times you need someone like him, whether they'll get thrown straight back in tomorrow, on the bench, I would think would be the sort of percentage play from Eddie. But yeah, really good to see him back.  So, the start I wanted to throw in, by the way, is that Bournemouth haven't drawn 3-0-0s in a row for 20 years. And Eddie Howe played all three of the ones that they did draw. Back in 1999, there's probably some cherries fans watching you. Went to those, Charlton in the league cup twice and Blackpool away. Cherries won on penalties, I said to Eddie this morning, you must be happy with the three clean sheets. And he was more happy to blame Steve Fletcher for the fact they hadn't scored at the other end of the field. So, yes, hopefully not another 0-0 tomorrow. Well, anything can happen, can't it? And just on Manchester United, obviously, no Pogba for them, but you mentioned Rashford and Marcial as well. They've got threats all over the pitch, don't they? Yeah, Marcial scored here, of course, last year as well. So, he's another one that Bournemouth have just struggled to pin down a little bit.  Some of their youngsters, you know, the likes of Brandon Williams, who's been involved, James Garner was involved as well.  We haven't mentioned Daniel James yet. I know he's not a homegrown youngster and import, but he's been the one player. Actually, if you read United's sort of blogs and listen to podcasts and things, he's been the one player, I think, who has actually managed to maintain a level of consistency after making that huge jump from Swansea to the glare of Manchester United. So, you know, again, he'll, as a Welsh international, he'll be well aware of, you know, Harry Wilson and David Brooks and Chris Mepper, I'm sure, obviously not all of whom will be involved tomorrow. But yeah, so we'll have to keep an eye on him as well and those curling balls inside the far post. And just finally, what's that school prediction? I should always give up doing these predictions because it's not been going that well actually. At least the one thing that people can use if they aren't having a go on mansion bit, they can basically completely ignore what I say. That's very true. So I've never yet predicted Bournemouth going to lose a game because why would I do that? So let's say it's going to be a draw this week. I'm going for 1-1. What we're going to end the 0-0 run? Well, there we go, a 1-1 draw. If you are over 18 and you want to have a go at predicting the score this weekend, head over to cherrieschampions.com. You could be in with a chance of winning a signed Bournemouth shirt. It's also worth mentioning that if you're coming here tomorrow, we will be giving away Cherry Rolypolys in association with Mansion Bet. Rolypolys? Your eyes just lit up right there. I am, straight into the Rolypolys. Here we go, fantastic. Is Harry giving them out himself? Well, you're going to have to ask Mansion Bet that one. Come to the ground. They'll be available from 10.30am. That's all we've got time for today. If you're not coming, make sure you listen to Chris on BBC Radio Solent for free live commentary. Bye for now.


I don't know exactly if or how many wallets have been hacked, but I got to tell you since the 4 a.m. this morning when this came out, this has been quite a big deal. And what I'm talking about, you're obviously here because you took a look at the thumbnail. You also took a look at the title and said, atomic wallet being hacked, that might be a big thing. I know it, so it is. So what we have today, and it should be a quick piece, is that atomic wallet, and this was actually from about almost 5 in the morning this morning. Atomic Crypto Wallets says, we have received reports of wallets being compromised. And then real quick, let me just check one thing. Yeah, that's true. We are doing all we can to investigate and analyze the situation as we have more information. We will share it accordingly for any questions, concerns, contacts, support at atomicwall.io. So this was at, you know, pretty early. Right now, that is my time, usually when it shows. And that would be almost 12 hours, 11 hours so far. And I didn't really think too much of it until the comments started to roll in. And this is Tom, GD, all my hard-working money has been vanished from atomic wallet only. This is your responsibility to secure the funds, what will happen to our funds. Please don't copy-paste anything here. Da-da-da. And then Zach XBT, who is an interesting person. I'd love to have him on the show at some point. Says send me a deal with Transaction Ashstone Funds, and we'll get into that in a second. But I took a look at the website, and here's the CEO, and he's not a big tweeter, so he hasn't put up anything. And then Atomic Wallet itself, that's not it, let me go back, da-da-da. There we go. So they haven't tweeted out anything else since 11 hours ago, which is pretty concerning. So if it was just like a bug or an issue, and they did the research and they go, well, that's it. But I'm not for sure if more people are losing funds. And I will tell you, what's concerning about this is that, whether it's a bug or a hack or whatever else it is, people lost their funds in some way, shape, or form, right? The thing is, and the problem is, is that, if you don't remember Atomic Wallet, first of all, it resides on your phone or on your desktop, which means it has readable access to internet, which makes it warm or hot wall, however you want to call it. It's not a cold storage device, but it is non-custodial, meaning that you yourself keep your private keys, not your keys, not your crypto, right? Your private keys are encrypted and never leave your device. You fully control your funds. No accounts, no verification, no KYC, 27 live support. So when I'm looking at this, now it's not cold storage, but however, it is concerning about the things that I'm reading here.  My funds are also gone, XRB8 and 8th, Cedric, or this is my, they took everything. This guy, $250 was a stellar. I'm sure he's not going to miss that. And some other things that go forth in these tweets. It's pretty eye-opening. At first I was like, maybe this is something else. Tom makes a good point here, Tom Crown. I did recently see fake Atomic Wallet accounts linking to obviously malicious sites on Twitter recently, don't know if related, maybe, but you have to wonder like the timing of it right now, why so many people are losing it right now. And there is some, some parts down here where people have said that they haven't lost anything.  I just opened a new Atomic Wallet a few weeks ago to spread some of my bags around. So far, my wallet is fine. Nothing is missing. So it's an odd thing. If this is compromise or not, or a bug or whatever it is, all I can tell you is this, it doesn't matter how it's happening. It's happening. So if you have an Atomic Wallet, it may be in your best interest to move those off to another wallet. And the best case scenario would be a cold storage device.  Like that was it. And ledger is either ledger or tracer, essentially, and I think it's pretty much what it is. There's other options these days, but it sucks that we have to second guess the cold storage itself when something like this happens. So if you have something in Atomic, the best option would be cold storage. The second best option would be to put it into another warm storage device, not in custodial wallet. I know that's not the best option, but I mean, do you want to leave it in Atomic? And that's up to you. But it begs the question, how the hell does this happen? And then what's going on? I'm not going to jump to any conclusions as to what is happening. I'm just reporting the news to you and saying it is happening right now. We don't know for sure exactly why it is happening, but it is going on. So I will leave that up to your own devices, but I just want to put this out as fast as possible and just tell you that, hey, you're at risk. Anyhow, I'm going to think about that in the comments section, but here's some good news, I think, Robert F. Kennedy. This isn't a political channel, right? I have my own views on politics, which I will not share here because if I do that, why don't I just tell you my religion and then we can get into that debate? That would be like a disaster. So I don't do those things, but what I did think that was pretty cool is this is from a Bitcoin magazine. They said Robert F. Kennedy is the first and only presidential candidate who is allowing donations into Bitcoin.  And I do appreciate this. It says, the contribution rules, I'm a US citizen, I'm 18 years old, I'm not a federal contractor. And then it says, it asks for your occupation employer. And it says, if you don't have an employer or are retired, put NA. And if you're self-employed, put self-employed. So I just put, well, that's what I am. But I mean, I'm just saying anything to that.  And then here it is over here. Once you get to the Bitcoin part, let me just blow this up again. Very simple. It takes on chain and lightning, very smart for them to do lightning with the transaction fees are minimal or almost nothing. So I thought that was great. I'm going to step in the right direction. I like to see these things. Once you think, I like to see that. And then lastly, just to finish off, and then we'll, we'll talk about what does do a little, a little back and forth conversation. So get your questions ready. I'll answer the best of my abilities. But I want to touch on this. Uh, Nakamoto games, Nakamoto dot games. As you know, on this channel, I think blockchain and web through a game are going to be big, but I'm not for sure that everything's going to be big. And what I want to ask everybody to do is this. I linked their website in the link in the description. They have free to play, play to earn games and dot it on. Some people say, Rob, I'm an adult. I don't play games. I'm like, Oh, okay. Well, I'm an adult too. And guess what? I'm pretty sure most of us don't do adult things all the time. I don't find it very adult like as I'm strolling through Twitter constantly because I have a horrible addiction to that or Facebook or Instagram or whatever else you got. Let's just be honest. We're all there, right?  But the question I have for everybody is this, uh, for Nakamoto games, I want you to go there.  And I also want you to be able to link your wallet on the polygon network because everything is in polygon transactions. All transactions are done on the polygon chain. So I want you to do that and tell me how easy it is for you. I've already set it up. I already know the answer for me, but I want to see how it is for you. If this is suit, if this is truly easy and on its way for mass adoption, that will be very interesting. And you can put it on the comments section or I put that on Twitter and you can answer there, the link for the Twitter feed is in the description below. But that's it. I just want to make this short and sweet Saturday. It's a beautiful day. So I thought I'd warn everybody about the dangers of atomic wallets. Robert F. Kennedy accepting Bitcoin and Nakamoto gave me to see what people think. So we'll see. And yeah, that's it for today. If you like today's video, thumbs up, consider subscribing. I try to keep you up to date as best as possible. A lot of things are happening. You don't have to subscribe to me, just gets your news from somebody because things are going to start moving faster. That's it. So thanks so much for stopping by. I appreciate you now.


and share containers distributing your VM host by Christopher. So I'll share my screen, it's recorded. If you have any questions, drop in Q&A section. Is this not audible at all? It's very, very faint. Okay, let me try again. We're going to play out of time as Christopher's using the correct containers to teach the things we can do. We're going to go beyond that, we're going to ask the question, will there be a potential in this download how to add this assistant and workload and how to separate the tenant and host security realms completely? First, let me start with a problem statement. Can we trust the host? The containers run on a host which is often managed by a third party like your cloud provider. The sandboxing provided by the Linux operating system or by virtualization technology goes only one way. It's designed to product the host from containers and not the other way along. So that means that the resources that the container uses like memory, CPU, this networking and so on really belong to the host which owns them and has free and unrestricted access to these resources. Containers are carved out of the host resources and that begs the question, what do you need to do is if as a container owner, you start considering the host as potentially hostile? Now, why would you think that? Well, the truth is that the data in the container can be read by the host. So data exposure of information held in the container is fairly possible. This is why multiple tenants may not want to share the same host because of that risk of data leaks between containers. There may even be legal concerns and consideration that preclude the use of containers if you cannot enforce or guarantee confidentiality, make sure that the data doesn't leak to the host and possibly outside of it. We have now an emerging enabling technology called confidential computing that lets us address these problems. Confidential computing is more than just encryption. It starts with memory encryption which prevents the host from getting anything, any secret out of the container's memory. So if it reads it, it's going to get garbage. But there's more. For instance, there is integrative protection to make sure that the host cannot corrupt the guest state or inject bad data in order to crash or extract data out of the guest. There is also an attestation mechanism that lets the guest owner or tenants validate what runs in the guest and possibly block the execution of images that are known to be malicious or compromised. There are many vendor-specific technologies that enable confidential computing. AMD started the fire with the secure encrypted virtualization technology with two more recent variants called encrypted state that deals with the CPU register file, among other things, and secure nested pages that adds integrative protection for memory, interrupts, and more. Intel offers trusted domain extensions. IBM main friends have secure execution. The Power Platform has a product execution facility and are recently announced confidential computing architecture. All these technologies are based on virtualization. So it could seem like it's easy, but in reality, each of these technologies works in a slightly or more accurately, markedly different way. And so for an integration platform like Kali Containers, there will be zombies trying to integrate all these technologies. Let's talk about the basic architecture of Kali Containers and how we can move from Kali Containers to confidential containers. Here's a quick overview of Kali Containers. As you may know already, Kali Containers is designed to run containers that are described the usual way. In other words, with the same APIs, the same Miano manifest file, the same container image formats, the same volume storage, the same networking. But now we want to run them in virtual machines with their own independent channel and very little in terms of user space to reduce the attack surface. Basically just a Kali agent that starts the container and monitors it. So we are talking about benefiting from the ecosystem of containers with the additional sandboxing provided by virtualization. Kali Containers is made possible by the flexibility and extensibility of the Kubernetes architecture, which has a number of interfaces such as the container runtime interface, the container networking interface, the container storage interface. And we can basically add a plugin that replaces existing runtime such as RunC or C-RUN and is invoked by the container runtime interface to start a virtual machine in which, so the virtual machine represents a Kubernetes part and inside this virtual machine we are going to run containers. So this allows us to at this conceptually separate different trust realms for the platform, the tenant and the host. Let me illustrate on this diagram where the trusted platform is drawn in red. It's a trusted execution environment that offers confidentiality guarantees using hardware level cryptographic enforcement. The host which is drawn in blue on the diagram will offer and manage the physical resources that are used to run the container that includes CPU, disk, memory, networking, and so on. Finally, the tenant security realm that is drawn in green on this diagram include a confidential area that can be carved out of the host that we call the trusted enclave and that is protected by cryptography so that the host cannot see it or access the data in it. But this also includes in that same security realm things that may run outside of the host and that includes, for instance, key brokering services, attestation services, container image download, and so on. In order to enable confidential computing for Kata containers, we need to modify a number of components which are highlighted in red on this diagram. The first one obviously is the Kata runtime which needs to pass the right options to the virtual machine monitor to enable confidential computing. The virtual machine monitor itself, like QMU, for instance, needs to be modified to be able to support and activate encryption, setting up confidential VMs and so on. The kernels, both a host kernel and a guest kernel, also need to have additional support. On the host kernel, for example, to support base tables for encrypted memory and for the guest kernel to offer services that let the user space access any secrets that the trusted platform delivers to the guests. The firmware also may need to be modified with additional services, such as page validation. That's the process of transferring ownership of physical page pages from the host to the guest and back. And the hardware obviously needs support, for instance, in the memory controller to encrypt memory on the fly. As far as Kata containers is concerned, this phase is already largely underway. It's mostly complete except we don't have much hardware to test it with many of the platforms that I mentioned. Now, the next step is to secure the image download. And that's basically making sure that the pool image operation happens from within the guest instead of happening on the host as it does today. So what happens today is that the Kubelet sends a pool image request that is delegated to the image service in the container runtime. And we need to forward that information to the Kata agents so that it can itself put the image instead of the host doing it. Now this highlights a relatively typical API situation for the kind of problems we run into for this project, where the APIs today will send the data to the wrong party or in the wrong security realm. Also notice that for the initial prototyping, we need keys to decrypt the images or to access encrypted disks. We're going to bake them inside the image for prototyping, but of course later we need to find a way to fetch these keys in a way that is scalable in the cloud, we can't have a different image for each container service. So we need to find another mechanism and I'm going to talk about this next. So for that, let's talk about attestation, which is the process that lets the owner, the tenants, know that what is running inside its guest is exactly what is intended to run. So the first step for that is to be able to measure what is running. So there are various services that are provided by the trusted platform at all levels, but typically you have hardware registers in the CPU that can be accessed to measure the memory, specific ranges of memory, et cetera. And what is being measured there is selected depending on the platform and on what you want to do, but you would typically measure the initial boot image that includes the firmware, the guest kernel, the agent, that kind of things. The container is a vying part, so we are going to attest that separately. We'll see later how. There are two really big ways to attest the workload. One is called preattestation, which measures the VM before even starting. So you check the boot image before you even allow the VM to boot. Most platforms now provide remote attestation in which the code in the VM can attest itself, can access the measurements and send that to a remote relying party for attestation. All attestation mechanisms can deliver some kind of data, typically secrets like encryption keys, but remote attestation also makes sure that you can invalidate vulnerable images or that you have final grain control on the kind of information that it's being exchanged. So the attestation process that we plan to implement is the following. The kubelet is going to start to ask for a part to be created. That involves the runtime picking up a boot image for the virtual machine that will then be run by the virtual machine monitor like QMU. One additional step that may happen here is when you're doing preattestation, you're going to attest that boot image and make sure that you do not start the VM unless you know that the boot image is good. Then once the VM is created, there are a number of APIs that are sent to the Kali agents and we are going to have, so this is happening over VSOC, but we'll have to restrict some of these APIs because the workflow is no longer correct for confidential containers. For example, you cannot let the machine decide when to start a container because you want to make sure that the attestation happened before the container really starts. So we need to find a way to receive these start container requests, acknowledge them, but not really start a container until we know that we haven't tested it. So there are many changes inside the Kali agent itself which needs new components for instance to be able to manage keys or manage cryptography, as well as additional processes that will be added in the image, like an attestation agent in order to perform the remote attestation process. Scopeo that is going to deal with container images and Umachi that is going to deal with the expansion of these images locally. Let's start with the attestation agent. So the attestation agent starts by measuring what you want to measure also. As I said, typically the guest firmware, guest channel, and the various components in the boot image. And from this, it can build a quote that is sent to the attestation service. And the attestation service gives a gonna go. If it's okay, it's going to let the broker, the key broker service deliver keys to the guests. That can be used for instance, to decrypt the container image that you fetch from the container image registry. Once you have your container image locally, you can expand it to disk. So initially you are going to use a run disk. So in all cases, the container image has to be at part scope. It cannot be shared across parts. But we are going to expand that container image locally. And since encrypted memory is quite expensive, we are very quickly going to want to have some way to store the container images, either in some fmworld block device, or even in the persistent block device so that we can reuse the expanded image at next boot. So here's the attestation flow. As you can see the pool image process will now be forwarded inside the VM. And Scopeo is going to request a decryption that requires keys. And these keys are going to be returned by the validation that was done by the attestation agent. So now we can decrypt that image and say, okay, we put the image. That pool image will let us then proceed with create container. This is where I was talking about blocking APIs. Create container is going to ask you to unpack the image locally. And then that unpacked image will let us return that we created the container. Now, next let's talk about integrative production. And that's a big change inside kind of containers from hotplugging to what we call now immutable parts. How do we configure a virtual machine as a part today? Well, we have to use hotplugging to add memory, CPU, or devices to the part. And the reason is that the historical Kubernetes APIs are designed for the hosts. And so they do not give us information in a timely fashion for the typical use case for a virtual machine. In particular, when you create the part, you don't have any information about things like container sizes and resources. So that means when we create a container, we need to dynamically add the resources because that's when we receive the request. So we get information, for instance, that this container is going to request two CPUs and four gigs of memory. And we have to hotplug two CPUs and four gigs of memory to the part that we created earlier. So obviously this adds a lot of complexity to the runtime, but it's also inefficient because hotplug takes some time and we need to resolve more resources like more base tables, base table entries that we would need because we need to think that maybe the memory will be extended to inordinate amounts. The conflict with confidential containers is with respect to integrity because it's very hard to guarantee integrity if you can change the configuration of your pod after you have measured it. So that's why memory and hotplugging or balloting mechanisms do conflict with encryption or page validation. There are also problems with any kind of device that can access memory with direct memory access because these devices are not part of this trusted platform. So we cannot grant them access to guest physical memory. And so that means we cannot hotplug such devices after the fact, but also that even if we have them ahead of time, devices such as VGPUs or SmartNIC may not be allowed in the confidential computing until the vendors of these platforms find a way to exchange keys with the trusted platform. So now we are talking about something called immutable pods which are fully defined before boot. So before we boot the virtual machine, we are going to know what is going to run inside. And that requires rather massive changes in the existing Kubernetes APIs because these APIs typically put things in the wrong spot, in the wrong realm from a security standpoint. For instance, logs in the Kubernetes APIs are defined in the create pod API and are designed to be sent to the host. That doesn't work in the confidential container cases because they belong to the tenant security realm. The good news, however, is that this change would really vastly simplify and optimize even the non-confidential case because we can remove all that hotplugging complexity. So it's likely that Kata Containers version three is going to be largely influenced in its design by the requirements of confidential containers. This is the need for a shadow control plane. The tenants now need to be able to access the tenant trusted enclave without going through the host because we don't want the host to see things like logs, container metrics, and so on. The good news is that in order to establish the attestation, we have to establish a secure network RPC channel. So we can leverage that channel to run the other APIs through it. So all APIs and all comments that really talk to the container, to the workload, would now go through these tenant side whereas things that deal with host resources like creating the pod, getting CPUs, memory, and so on, a host metrics would have to go through this side. Obviously, that's a lot of work if we want to make this transparent because, for instance, the user-level comments like Qtctl exec would have to go through this side, but creating a pod would have to go through this side. So Qtctl exec or OC exec would have to select which key to use, which credentials to use dynamically based on the common values. That's really a lot of project. It touches a number of components. So it's going to take a few years. So as you can see, getting towards confidential containers is a very interesting project. We have things that we are doing right now, like enabling the hardware, things that we are going to do in the next three months, like image download, things that we are likely to start doing end of this year or next year, like at the station, and things that will take way longer because it touches components largely outside of the container and that includes completely separating the host and tenant reuse. Very interesting project. I really hope that you will want to join us after this talk. If so, please join the KDAI containers discussion forums. Thank you and talk to you in the question and answer session. Thank you, Kirsavi. Oh, is there any questions when we started? There's one question for you. Yes, so I see one question which is the difference between sandbox containers and confidential containers. Sandbox containers is an OpenShift product that was introduced with OpenShift 4.8 as tech preview, and that's basically KDAI containers for OpenShift. So it includes an operator that lets us install the KDAI containers run time easily on an OpenShift deployment, things like that. So we provide an additional sandbox in the sense that the pod now runs in the virtual machine so there is additional sandboxing. Confidential containers will leverage this technology and when we talk about confidential containers, that's the terminology we use upstream as well in the KDAI community, not just in the OpenShift scenario. And it did specifically with protecting the data, the transient data in your containers from the host. The idea is that any data that you want to protect will be that you would store on disk or that you would send over the network would already be encrypted. So we had an earlier talk that you may have seen about how to use secrets in Putman to make sure that you can store secrets somewhere but not send them over, for instance, a few. So the part that deals with the images themselves and secrets in the images is also being addressed. There is also a huge effort that I sort of rushed over regarding the encryption of the images themselves, so the encrypted image layers. That's an effort that we're going to leverage as well. And so all these parts are sort of being dealt with. The thing that is not yet covered is what you have in your memory and that's what confidential containers will address. So now you can run completely secure. You can run bank account management stuff and any user secret passwords for the bank account, et cetera. If you're running on Azure, on Google Cloud, whatever, any public cloud that would still fly because these platforms could not read the data. Does that answer the question? Yeah, it looks like yes. Any other question for Kristoff? Looks like there is no other question, so we can lay. So that's the last session for today. Yeah, so we're done with the new conference for today. So see you all in the tomorrow morning. Thank you. Thanks a lot and talk to you later. Bye. Bye-bye. Oh, there is another question. So I don't know if you can hear me. Yeah, yeah, yeah. Confirm way is attested computing. So I think you're referring to the attestation process that I'm talking about in the slides. If you could confirm in the chat that this is a question. Yes. So I would say this really depends on the platforms. Free attestation, the way it's exposed by the existing AMD SCV, there's a relatively large amount of hardware that is available today with the original SCV technology. So this exists in various clouds today. And we have demonstrated, for instance, how to do attestation in that context, in the context of Leap Caron. If you're interested with that, there's a QVM forum talk that is going to be given on September 16th that addresses this aspect among other things. So that part is done for SCV because the hardware basically exists today and it's widely available. Remote attestation is much more of a battle because different platforms do it slightly differently and they all have developed attestation servers with some sort of, some way to talk to it. Some of them have tried to leverage existing infrastructure that could be used for other kinds of attestation or Trusted Boot or whatever. And so this is a bit, we are in a reconciliation phase at the moment where the various teams are trying to decide together, okay, what are we going to use for this attestation so that we have a single service that could serve multiple platforms? Ideally, we'd like to have a single attestation server be able to serve a TDX machine as well as an SCV and so we are not there yet. We are still discussing, we're still phototyping that. I suspect that upstream you will be able to start playing with that probably in the coming six months. If you want to feel for it, I think the best option for today is Leap Caron. Does that answer the question? It looks like yes. Any other question for Christophe? Let's wait for a couple of seconds. Three, two. I mean, in case that's a very interesting question. Oh, no, Leap Caron. Let me spell it in the chat. So let me just give you the link to the chat to the KVM forum.