Hi, I'm Matthew Horkey. Hi, I'm Shreveen Tan. And welcome to... Croatian Wine 60 Seconds. Today we're going to talk more about plavatsmali, but with a twist. The Peliša's Peninsula is the most famous area for plavatsmali in Croatia, but now it's grown all over Dalmatia, and we have three different examples today. The Risman plavatsmali is from Kumana. It's one of the newest appellations in Croatia. The vines in Kumana are young, and the wines tend to be more perfume and lighter in body. This Risman plavatsmali has a lot of strawberry, rose on the nose and on the palate, fantastic acidity, a little bit sandy, but not aggressive taste. This is really reminding of Nibbjolo. The stein of plavatsmali barbeque is from the island of Brač. This is kind of like Nibbjolo mixed with zin and gal. The notes are baby, steely, darker food, fuller body. The Zlatan plavats grand cruise from the island of Kuala Lumpur. This is very Mediterranean, like kind of rusticky almost. This actually goes more in the way of Kronash to me, like Kronash's about a bit. And that's Croatian wine in 60 seconds!


Hi, I'm working on version I so that's a project to monitor GitHub repositories So this is here one project on GitHub and version is monitoring it And so I can see immediately which dependencies are outdated and which are not and beside the dependencies Show also a list of all licenses so I can see immediately what for licenses I have in the project and And Yeah, you can configure how frequently this project should be checked weekly or daily can also select email address where you want to get the email notifications and Yeah, that's it There are different ways kind of offline Network is not really working here for me There are different ways to create a project so with simplest ways just to upload a gem file pump file whatever so it works for Ruby Python Java PHP and closure and Node.js and It's all written in Ruby. So I just wrote all the parsers in Ruby It's a good way to learn all these package managers. How we work a little bit difficult way, but okay You can also put in a all to to your gem file if your gem file is for example on a bit bucket or source for wherever and Of course, you can also log in with github and then just fetch all your github repositories and then we go a github API and we Check your project Okay, I'm currently version I is monitoring 200,000 more than 200,000 open source projects and every single open source project has a page on version I and We also try to show important Meta information So for example the average release date of a project So this is a page of Ruby on Rails and you can see the average release time is 80 days 18 days So it's pretty good and we also show which version was released how many days ago and How many other packages are referencing this package? so there are almost 10,000 other gems who are referencing Ruby on Rails and That's pretty good. So that's a good information for me because I know okay This package is high quality if it wouldn't when this other packages wouldn't reference it and so on and We show also a requisite dependency graph. So it's all written in a JavaScript so it's Draw on canvas and this is also open source I didn't start it with project. It was a sub project of mood tools and I reached out to the core committers Because of a bug and we didn't reply So I just fought the project and I did some bug fixes and put it on github because before it was on source watch I guess and yeah, it would be cool if you guys could also check out this JavaScript library and contribute to it because right now I'm the only guy who is Continuing with JavaScript project All right What else we have also API So you can also for example send your gem file via Via post to this API and you get back a JSON string with information if the dependencies are audited or not You can also fetch all the license information via the API So you can basically integrate with service into your tools and some PHP developer tools integrated already and It would be cool if if there are more integration so I will be here tomorrow and Yeah, if you would like to integrate the API and you need help or you want to work on the JavaScript stuff with a cool dependency graph Yeah, would be cool yeah and we have some statistics and The fastest growing community is no JS. That's the green line here so the packages in MPM are growing really fast and Yeah, otherwise Ruby is catching up with Java Java is pretty flat And yeah, you can check it out on version.com Yeah, that's it


Welcome, this is Melissa with the Stock Swoosh and Facebook obviously went to 180 which was the target and then went above that went to 181. So really I've had absolutely no sleep. I mean what I consider no sleep which is anything less than five hours, three hours is very difficult for hard to. But anyways I was on TV very early this morning and so you know early, early exit and this but it went, went not only to 180, went past it a dollar and obviously it's only a quarter of noon. So I mean this could continue going here today obviously the market screen, Facebook's rallying and we did this as just a strong momentum play really today. And let me just show you, I mean first of all here's the daily chart. This is earnings out Wednesday night this week but I mean clear sailing here for Facebook really today. I mean I don't see any problems with this whatsoever I just ran out of patience and you know there's nothing wrong with making one hour or a little bit less than one hour but I mean with the stop in this, with the 50 cent stop in this, this actually, if you held this which I'm sure somebody did because I just sent an email out, if anybody in the room held this to 181, we had an entry in this around 179.30, 179.40. This went, gosh if you size this for 50 cents which I'm sure some people did this was more than three hours, if you held it up to 181. In fact I think it went a little bit over it did it, well nine cents. Anyways what a nice play out of nowhere for a Monday and again there, this was just a bullish move in Facebook and the chart is getting bought and I saw this initially out of the gate you know pretty early this morning, took a little bit to wild to get going, had all dropped, even gave it more room for the stop but we saw this, gosh what time was it? Well no it was still before 10, it was right in this area in here, right right in here so it was around between 9.40 and 9.45 or whatever I look today. So beautiful call in Facebook, nice long today and if anybody made money this morning got out fine, if anybody held it to 180 fine, if anybody held it all the way up to 181 I didn't even talk about that number I mean and if this was almost four hours I mean over three hours depending on where you got filled and where you get out and and this could keep going so really nice move in Facebook we'll be watching this for earnings on Wednesday night to see what it does. Congratulations everyone the stocks will show live trading room this is a play of the day in Facebook it was a long okay occasionally the room does go long if you're interested in the golden gap course email me and Melissa at thestockswitch.com have a great day everyone


Hi everyone, Joe for Jaspy's casebreaks.com coming at you with a pack of 2019 prism football, Panini prism football hobby edition, random team break number nine, and our last filler to unlock that 2018 Panini Immaculate box, giving away six spots there. But first, the pack break itself. Big thanks to this group for making it happen, appreciate all of you. There are the teams right there, let's roll it, let's randomize it, two and a one, three times. This is just for the break, one, two and three. And then three times for the teams, one, two and three. The bills down to the browns, alright, there's the first half of the list right there, and there's the second half of the list right over here, and let's just print this out. No trades of course in these quick little filler packs. This one box break will be coming up in a, in a different video if you're looking for that, the next video if you're watching live. Any surprises in here? Any an autograph? I've got an Alex Barnes rookie autograph. Not sure what he's up to these days, but this is going to go to Eugene and the Titans. And there's a Joanne Williams and a Darius Layton. Alright, now, here's the important part, who's going to win spots into the next break? Let's gather everybody's names, one through thirty-two, new dice, new list, and it's going to be the top six after seven. Good luck. One, two, three, four, five, six, and seventh and final time. Now from seven through thirty-two it's going to be sad times. Very close Eugene, but it's not quite. Thanks everybody for trying seven and thirty-two. We got another one box break loaded up and the related filler, so if you just want to get a full spot, that would be appreciated if you want to keep trying to work through those fillers, that would be appreciated as well. Alright, so sad times here, but happy time for the top six. Jalen is happy. So it's Russell, Eugene, Jeremy, Eugene, and Jeremy. We'll see you in the next video for the break. Ask these casebreaks.com.


Right, lots of videos to film today. Lots of things to say. And I might actually end up batch recording these videos so that I have more content in the long run because I've got some time now. And yeah, lots of videos to film. Very excited about today. What do you think? Do you think this is a good place to film guys? I would say it's a perfect place. Conditions are perfect for making videos. Look at this. Yeah. So this is where we're going to film. So I think I found the perfect place to film these videos. I'm not sure about the sun reflecting. I don't know how the light is going to be. But look at this beautiful river here running all the way through Banskoe in Bulgaria. It's perfect. If this was a little bit cleaner, I'd probably use this as a cold water dip. But I think there's some sediment and some things floating around. And I'm also pretty sure that the buildings are going to dump water into this river anyway. All right. I don't know how the audio is going to be for this. I don't even know how the video is going to be because the sun is reflecting the lens. Look, I don't think you should lose a dream every night. And there's a good reason for that. If you're losing, but when you have a lucid dream, it's such an intense experience. It's so overwhelming in terms of what it feels like and like the memories and stuff like this that you don't need to have that experience every single night for it to be profound and meaningful. And actually, the more you have it, the more often you have it, you almost become desensitized to it. In the same way that if you were to do something really intense and incredible every single day, you might eventually get bored of the thing or want to experience something different or new. However, if you have it in moderation, if you do these things like, you know, if you lose a dream in moderation, maybe once or twice a week, it always feels exciting and new. And yeah, in my opinion, you don't need to lose a dream every single night. And I actually would recommend against that. I know a few people actually in the comments recently have been saying, have been asking me, how often do I lose a dream? And I've replied, well, between one and four times a week, depending on if I want to lose a dream, if I'm trying to do it and that sort of thing. And they would reply with something like, well, I lose a dream six to seven times a week. And on the one hand, that's great. You know, on the one hand, that is really good. It means that you obviously know and understand lucid dreaming and how it works and you obviously can do that effectively. That's great. However, I would say it's better to lose a dream less in this case. I would say, you know, between one and four times or even one to two times a week is more than enough to actually have meaningful experiences, create beautiful dream memories without overloading yourself, without making yourself so immune and desensitized to the experience that it just becomes normal. It should always feel magical and exciting and new and, you know, fulfilling. And so I feel like that is easier when you're doing it slightly less often. I don't know if this is a popular opinion. What do you think? I'd love to hear what you think about that because on the one hand, yeah, it's great to lose a dream more. And, you know, one of the things when you first start learning about lucid dreaming, one of the first things you wanna learn is how do I do it? And how do I have more? How do I do it more often? You're bigger, better, faster lucid dreams, you know? But that's not always the best.   I think, yeah, I think there's actually an ant on my leg there, it's not good. And these things, they will be more fulfilling long term.  It might feel good in the moment but it's not gonna fulfill you and it's certainly not gonna add anything to your subconscious mind, to your whatever, whatever you want to explain it. It's not gonna add anything to you. So that's my opinion guys. I'd like to know what you think. I'd also like to know what you think of this setup. So at the moment I'm using my camera. It's an action camera, so it's a wide angle lens. The audio isn't great. And if you're wondering what that weird noise is, it's just the river. It's just, this is the main river running through Bamsco town in Bulgaria. And I thought this would be a good place to film. So what do you think? If you wanna see more of my travels, by the way, I do have a travel channel which I'm sure you've heard me mention by now. And that is Transcend Travel, which you'll find it in the description. I've made it very clear in the description where my other channels are and stuff like that. So you should be able to find them. And leave a comment letting me know what you think of, should you lose a dream every day or is it better to lose a dream less often but have more of a profound meaningful experience? Let me know what you think. And also let me know, would you go and bathe in this water here? Do you think it's clean? Should I do it? I don't know. If this video gets a thousand likes, I will film myself on this channel, jumping or wading out into this ice cold water here for you guys. Hopefully it's clean, but we don't know. That's it for now guys, done. Thanks for watching guys, this video and this channel were supported by my Patreon followers. Please consider giving just a dollar a month to support this channel or just click the links in the description. You'll find links to various lucid dream products, articles, techniques and tutorials. If you did enjoy this video, please click the notification bell and subscribe and I'll see you next time. While you're still watching this, you should have clicked one of my related videos by now, right? Or subscribed or gone onto my website or something like that.


This is stock number 21T75A. We are here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used Jeep and Jeep Cherokee headquarters today. We are checking out this extremely clean 2017 Jeep Cherokee Limited 4x4. This vehicle has the 3.2-liter Pentastar V6 motor, which pumps out 271 horsepower. It has been fully-safetyed and inspected by our service shop as a fresh oil and filter change. All the fluids have been checked and topped off and this Jeep is 100% ready to go. Deep Cherry Red Crystal Pearl Coat is the color. We shoot all of our videos in 1080p, 60 frames per second. So if you have HD capabilities on your computer, tablet, or smartphone device, I highly recommend turning them on right now because it is definitely your best way to check out the quality and condition of the vehicle before seeing it in person. And this is probably one of the cleanest used Cherokees that we've had on our lot, so turn those HD capabilities on right now. And if you want to check out all the photos on this Jeep in the upper right hand part of your screen, there's a link to our website. Click that and check us out there. This one comes with the 18-inch polished aluminum rims and it has continental pro-contact tires. These are 22560R18s and they have right around half the tread left on them. Maybe adjust a little bit under, but still decent tread left on those tires. Front fender is in excellent condition, no dents or dings on that. You do get the LED running lights, the HID headlamps, and the factory fog lights. Front bumper is in very nice shape, no major dents, dings or cracks on that looks really good. The hood is absolutely perfect, no dents or dings on there. And you get the chrome trimmed seven-slotted grille as well as the chrome Jeep logo. Passengers side front fender is in nice shape as well. And the passenger side rim, no scuffs or scrapes. As you go down the passenger side of the vehicle, take note of how clean the body is, how reflective and mirror-like that paint is. We take these HD videos so if you are far away or even if you're close by and just cannot make the trip down, but you're still interested in purchasing the vehicle, you can see the vehicle, hear the vehicle, and of confidence in what you're looking at before you even get here, so that when you do get here, there's absolutely no surprises. And that is why we offer the Summit Auto FastPass option in the upper right-hand part of your screen. You can link right to our website where you can apply for financing, get pre-approved, see a payment code, even appraise the trade, all from the comfort of your own home. So when you get here, all you got to do is drive the vehicle, love it, be all set to go. Back rims absolutely perfect as well. You can see a little bit better how much tread those tires have in the back here, both the same as the front. As we come around to the back, notice there are no dents or dings on that rear quarter. The rear bumper is absolutely perfect. This one has the towing package, which includes a receiver hitch, four pin, and seven pin wiring. And if my memory is correct, these are capable of towing up to 4,500 pounds with the factory tow package from the factory. LED tail lamps. Rear gate is absolutely perfect. Back storage area, very nice and clean. Those back seats do fold on for extra storage, and it does have the spare tire and jack tools back here. This is a manual raised gate. As you go down the driver's side, just as clean as that passenger's side, no dents or dings on the rear quarter. And for full disclosure, this back rim is absolutely perfect as well. And down this side of the Jeep looks really, really good.  You just have to have the key fob in your pocket. It'll automatically unlock. You get heated mirrors, built in directional signals.  Both of these front seats are heated. No rips or tears on the seats. You do get power driver's seat with lumbar and factory floor mats throughout. Auto headlamps, tilt and telescopic steering wheel, power windows, power locks, and power mirrors. As we hop inside the vehicle here, we'll turn the ignition so you can see the miles and everything. 41,326 miles on this vehicle. You do get the digital spinometer outside temp and compass display with that seven inch LCD display. Heated leather wrap steering wheel, cruise controls on the right. Actually gonna push it in a little bit there. Bluetooth and information center controls on the left and you do get audio controls on the back of the steering wheel. You do get the 8.4 3C radio, which gives you AM, FM, and Sirius XM radio capabilities. Here's your Sirius right there. You do get your heated seats and heated steering wheel buttons there. And then this is also where your backup camera shows up. Those are dynamic grid lines, meaning that they're going to turn as you turn that steering wheel and that center line lines right up with your receiver hitch, which is pretty nice. You can do your climate controls here, including your dual climate control. And if you don't like doing the climate controls on the radio, don't worry. You still have the tactile buttons down here and the volume and tune knobs as well. Stability control, start, stop capabilities. You can turn that on and off. You have your select terrain active drive one system, which gives you auto snow, sport, sand, and mud. And then you have a USB, AUGS, and SD card slot. Nine-speed automatic transmission. You do get the keyless entry with remote start. Passengers side floor mat is an excellent shape. Passengers side seat in seat storage. No rips or tears. This vehicle has never been smoked in and the headliner is very clean as well. Home link buttons for your garage door security systems and lane systems and map lights up there. 9-1-1 and assist buttons in the rear view mirror. The other cool thing about this radio is if you wanted to add nav to it, you definitely could. This one doesn't have nav, but if you wanted to add, you could. It's a $595 add-on option. We can do it here at our dealership. See your sales professional for more details. We'll check out the back seats and then we'll start it up and check out under the hood. Back seats are just as clean as the front seats. No rips, no tears back here. It does have the latch child safety system for any child car seats you may want to put back here. It does have knee bolster airbags. This vehicle actually has 10 airbags in it, so very, very safe vehicle. And you do get a 115 volt, 150 watt plug-in down there as well. These seats fold down for extra storage and they go down almost completely flat, which is really nice. Child safety locks on the back doors and bottoms of the doors all look really good. We'll start it up and take a quick look under the hood. We'll also check out those HID headlamps. I would personally like to thank you for checking out the video today and hopefully from this HD video. You will have been able to tell just how clean this Cherokee is all the way around inside and out. Under the hood we have the 3.2 liter V6 FENTA Star motor. Engine bay is very clean, runs very smooth. Once again, this Jeep has been fully safety and inspected by our service shop. It has a fresh oil and filter change. All the fluids have been checked and topped off and this vehicle is 100% ready to go. I've had the 3.2 in my two of my Cherokees that I've had and I thought they were very well powered. You can see those HID headlamps, factory fog lights and the LED running lights up there. I would highly recommend this vehicle from a quality and condition and just a setup standpoint. To see more pictures of this Jeep or one of our other 450 new and used cars, trucks, SUVs, minivans, wranglers, you name it. We've got to go to our website right there at www.summitauto.com. Full pictures and descriptions of every single vehicle from two locations all at www.summitauto.com. If you'd like to check out more HD videos you can go to www.youtube.com. www.summitauto.com. Remember to like, subscribe and share on this video and all the videos that you see there. In fact, in a second you will see a link to subscribe to our YouTube channel on your left. They link to more Jeep Cherokee videos like this one on your right. If you have not been on our website on the bottom link to this vehicle on our website, click those. Check us out and we're super excited to help you with this ultra clean 2017 Jeep Cherokee Limited 4x4 in deep cherry red crystal pearl coat. Thanks again for checking out the video.


– Me našli postavilo retromalizacijo na rotacijo. Sreč je nekaj malo je posleda, da je to, da se je vse vse vserobilo, in zelo vsebo, da se predelimo potrebo, da je bilo na nekaj nekaj zelo, zelo vsebo nekaj zelo, nekaj nekaj nekaj nekaj zelo, nekaj nekaj nekaj zelo, ki ustavimo način začeliti nekaj, da je to, da je težko način, da je to, da je tudi nekaj nekaj nekaj nekaj, plugged or get about rotation for a second and just say present this as an algorithm. So algorithm for let's say some geometric conversion of the continuity fraction, geometric continuity fraction. And of course it's related to what we were doing yesterday, but I just ali jerelax veliko začajel oto ostavil razložijo, da sem yeni ricjel po crashed Jozen, veliko so prihalj lässtanje. Zarednja je ne n barba čavljenja, meni spotrečaj z error ot , dar se statistični un undravijo čadroga, i zero is the union. Delta zero, delta one. Picture here. Zero, alpha minus one minus alpha, delta zero. I already did it wrong. Delta minus one. I want this to be minus one. Thank you. Delta minus one. So we take alpha, we build these two intervals, we want to define. Now, inductively, intervals i n, which are made by delta n, union delta n minus one. This chalk keeps breaking. Okay, so I have two intervals, and let me always remark that as n grows, the intervals become smaller. So there's always a big, a large and a small. So in this picture, always delta n is the small interval. And delta n minus one is the large interval. And the position of small and large flips with n. So if n, let's do by case. Let's say if n is even. What did we have? This is the picture we had there. If n is even, n was zero. If n is even, then you have, the small is on the right. So small on right, delta n here, and delta n minus one here. And what I want to do, I take the small, every time I take the small, and I cut the small from the opposite endpoint. So here the opposite endpoint is to my left. And I start cutting as many full copies as I can, until I'm left with the reminder. So if you want to cut, cut, cut, cut. So let me write it, start and cut delta n from, in this case, the right endpoint, from the left endpoint, as much as possible, call delta n plus one, the reminder. So this little reminder is delta. So you take the small and chop it from the opposite side. And if n is odd, the same, but the picture is flipped. If n is odd, delta n is to the left. Delta n is left, n is odd, delta n is to the left. So I need to cut it from the right. So cut from right. And the same. Maybe this is already the reminder. So here there is no rotation, no nothing, it's an algorithm. You have two intervals, you cut the small from the left, you are left with the reminder, now the large becomes small and the small is the other and you do the opposite. You cut. Now the next step, you have the reminder and now you will cut the reminder from the opposite side. Then you have a new reminder and you cut the small reminder from the other side. And once you cut from the right, once you cut from the left, once you cut from the right, once you cut from the left. What does this have to do with rotations? And now let's connect it to yesterday. So if I look at the first, so let tn be the interval exchange, exchange of delta n and delta n minus 1. So this is just a map which swaps the two intervals rigidly. If it's a map t to the n, it's a map from in, back to in. And one is mapped to the opposite hand and red is mapped to the opposite hand.  And this map we already saw is just a rotation. So t0 is actually on from i0 to i0. If I identify this one with a circle, this is the rotation by alpha. Our usual rotation by alpha. So the claim is that these maps that I'm building are actually induced maps of this original rotation on this sequence of shrinking intervals. And this is what we kind of did in class, but also I asked you also in part to verify. So let me say proposition. This is again, I'm recalling essentially from yesterday. Tn induced map so first return map is the induced map of t0 t0, which is equal to alpha which is a rotation opened up on in. If you want to have my original rotation and then I have a sequence of nested intervals which are becoming smaller and smaller and containing zero. If I induce my original map on this small interval what I see is this tn. And now this is this idea of zooming. So I'm zooming on smaller and smaller scales. But now if I want to renormalize I need to open up this small interval. And maybe you can do it. First we can zoom it and then we can glue it back to a circle. So maybe you can do it like this. This is you have your small interval you have t to the n and you can kind of zoom it and rescale it to length one. So if you rescale so rescale in to length one to length one. So say you just multiply by one over the length. So you make it again length one and this endpoint will be actually this endpoint will be gauss to the n of alpha. And this will be minus one plus gauss to the n of alpha. This is what we showed that the ratio between the two intervals is gauss to the n of alpha. Rescale and then if you want you can glue glue back to a circle. And what you see is a rotation by gauss to the n of alpha. Ok. Is it clear what I'm doing? I'm inducing then making the map unit length and gluing it back. If you want yesterday I said the opposite. I said here you can glue this back to small circle and then rescale the circle of length one. It's the same in each order. So let me say again. So this is the algorithm and hopefully today it's more clear. I mean I'm not proving that it's the induced map but you can just sit down and again you did it in some sense yesterday yourself if you did the exercise. And let me recall you the idea which is this idea of renormalization so maybe you will not care about this specific renormalization for rotation in your life but in dynamics there are many instances the picture is kind of like this. You are interested in studying the rotation and you consider the space of all rotations or you consider the space of all dynamical systems that you are of the type that you want to study and in many examples we did mostly entropy zero dynamical systems in many examples there exists an operator so let's say x is the space of rotations and here you can identify space of rotations with zero one because you can think that a rotation is given by the rotation number so the space of rotations will be just the interval zero one thinking that each alpha is a rotation by alpha and this renormalization is indeed this operator here that zooms and rescales renormalization is induced induced plus rescale in this case induced plus rescale so for us here the renormalization of a rotation is really sending me to the rotation by gauss to the n of alpha so in this parameter in the rotation number parameter I am doing the gauss map so some people apparently yesterday asked why do we need to why do we need to do from right once and from left another time couldn't I just when I rescale I could also choose to flip the interval and then I always cut from the right so you can do that it's perfectly legitimate algorithm and it has some advantages to actually flip at every stage but I like not to flip at least this week I like not to flip because let me show you again the rotation picture so because remember in this rotation picture that we saw yesterday what I am doing I am inducing so I am first inducing on this yellow interval and looking at the Poincare map when I am doing this cutting from the right cutting the red from the right what I am looking at first return map on the yellow interval of the rotation so I need to look at iterates of these pieces to see when they come back so this is how do I work does it work is there a pointer no here it is so this picture this is what we were doing in the algorithm you see I have I have the red and the red to the left and the green to the right cut the red from the left of the green three times and I am left with the reminder and this is showing you what is happening on the rest of the circle this is what is happening on the rest of the circle when I am cutting from the left actually I am inducing so I am rotating until I come back here and then I am rotating until I am coming back there and then this is my new smaller interval with previously small and reminder and then I do it again this is kind of cutting to the left and then I have a smaller interval to induce and so on so I am inducing a rotation of smaller and smaller intervals and when you do this inducing you will notice that actually you are always rotating in the original picture clockwise but the induced map once it is a rotation backward and once it is a rotation forward so the induced map it is kind of related to the fact that convergence of the continuous fractions are one to the right and one to the left so sometimes you overshoot sometimes you undershoot and when you undershoot you have the effect of rotating back so that is why I like to keep the flip because it kind of records this backward rotation every once in a while ok but I want to move one step further so I want to explain that not only we have an induced map but we do have indeed some partitions of my original no I have some partitions of my whole space that I began with so this is a general phenomenon when I do inducing so let me tell you in general I want to tell you something about Kakutani or Rocklin Towers skyscrapers ok so say that I have a function a dynamical system from x to x assume that what did I want to say I want to assume maybe it's convenient to assume that f is invertible which will be the case for us assume that it's invertible and then you remember yesterday I look I can look at a subset y and assume that f of y from y to y this is the first return map or the induced map is well defined that only means that every point comes back so this means for every y there exist n such that fn of y is back in y for every y in y ry of n is the first return time I can look at the level sets of the first return time function so look at all points which take the same time to return so let me define yn the set of y in y such that the return time to y of small y is equal to n so these are the points that take time n to come exactly times n to come back ok, so then let me say as a fact if you want you can try to prove it as an exercise it's a little bit like similar to the Poincarere current exercise that Stefano left yesterday but it's a little bit annoying to check and you really want to use invertible the fact is that I can write my space x my whole space as the following union I will write it and then I will give you a picture of this union so I can write it as a union of n of the union from n sorry union from n union from k from 0 to n-1 of f to the i of yn I'll draw you a picture of this it makes it immediately clear what this means yes sorry it's a union and actually the claim is that this is everything and also that the union is this joint so everything that you see in this union all these intervals all these sets are per what is joint it's a disjoint union so every point falls exactly in one of those sets so let me show you the picture so the picture is that maybe I'll draw you first flat sorry so let me chose first you have my space x and then maybe my space x is very big and then you have y and then I look at some portion of y which comes back in time n so this thing means that it will go out this will be f of yn this will be f-square of yn this thing will be out for exactly n-1 iterates and then will be back so these iterates are here so for each n I take yn and I translate and I shift it exactly n times and this will be ah I'm sorry f to the k thank you so as k goes from 0 to n-1 I look so this part is so this part is what I'm drawing I'm drawing these are the iterates which are out and then come back and maybe let me draw it and this part is actually called a tower, a dynamical tower and there is a more visual representation which is this one so let me say your space I'm representing it as an interval and here I'm representing e1, e2, e3 dot dot dot en so e1 takes one iterate and then it's back in y y2 goes out of my space for one iterate so it goes out and then it comes back to y yn y2 goes out for twice and then it comes back yn goes out for n times and then it comes back I can kind of draw symbolically these sets as towers over yn so this is just this tower just represents the images then back for larger and larger so these things are called towers so the union for k from 0 to n-1 of fk of yn is a tower the union of towers so this whole union is many towers form sometimes this is called the Rockling tower or Rockling tower and many towers form a Kakutani skyscraper so basically I'm inducing and I'm representing my space as towers up to the first return time so the claim is that the Kakutani skyscraper gives you all points in the space every point has to be either in a base or in one of the floors in one of these towers so I'm trying to do a little bit of general dynamical system theory when I'm doing my specific example so let's go back to the rotation and maybe it's more clear what everything is so for example when f is the rotation and y is our interval in we have only ry has only two values we saw that it also only has two values qn and qn-1 the return time of maybe I should say that x is 0 and yqn is actually delta n-1 ny qn-1 is equal to delta n so these are only two intervals and one returns in time delta qn and the other returns in time qn-1 so there are only two towers in my skyscraper sometimes I see that people are confused if you are confused do you want me to ask and here we really have intervals so we can really draw towers so I can really draw this picture so this is delta n this is delta n-1 really I can draw qn-1 copies of delta n on top these are intervals and then I can draw qn copies of the interval delta n-1 yes sorry if so I'm actually assuming that the map is well defined that all points come back to y but then you will only have a unique tower for the return time some of these towers are going to be empty in that case you have only one tower which is the empty tower the return time will be sorry sorry sorry so you are saying I might forget some assumption if x is identity and y is some subset it's not invertible did I say invertible? oh yes who can find maybe I need some kind of minimality or transitivity or some kind of in the case of the rotation everything is fine because orbits are dense so this is irrational rotation sorry if the rotation is rational by the way this picture the tower will still work but at some point you will have some identity tower ok let me think I don't know he is worried about if I take identity and y to be some part of space but I'm not spawning the old x I'm not spawning x so there are I think you are right there are points which will never return and you have to put somewhere in that picture you have to add some part of space which is not swept in assumption like the map is sweeping or something that if you take the union of the images of y they contain x I think you are right I will double check but I think he is right so when it's an assumption yes no I really want to find x and that's why he is right that there is some issue so I don't only want to find y I mean certainly I can but I want to I think you need something that y is a swiping set for x which means that when I take y and I look at the images of y all the forward images of y contain x sorry but this example is fine so ok maybe ok so here I'm saying I have a rotation and I induce it on this set in this is my IN it's the base of this picture is IN and then I say look at the what is the return time of my rotation on IN the return time we proved it yesterday or it was part of the proof that we did yesterday that when I induce the induced map is an exchange of these two small intervals and there are exactly two returns one interval return in time qn in time qn-1 and I'm just claiming that if you look at qn iterates of one interval and qn-1 iterates of the other interval these iterates are all these joint up to their first return time and the union is all the circle but I will show you this so this picture is basically I can show you the same picture on the circle so these two towers the picture that we have been looking at at all time so let me go forward maybe so this is indeed the picture so the red is one tower and the green is another tower so just here I'm plotting the the intervals stacked upon each other in their dynamical sequence well here they are somewhere in space so this is exactly the picture is this union so maybe we can even write it with some notation so actually let me put some notation because I saw so let's call, I don't know let's call delta n i delta n1 delta n and delta n i is alpha to the i of delta n and the claim is that the circle the whole circle is union the whole circle is the union from 0 to qn minus 1 of delta n union this is one tower this is say the red and then there is the union from 0 to q sorry this is qn minus 1 minus 1 and this is qn minus 1 of delta n minus 1 i so this is another way to say this is the green sorry? no no no sorry maybe that's what is confusing enough here so this n and that n is not related this n is the return time and this n I'm looking at level sets of the return time function and here there are only two level sets which are non trivial the level set which corresponds to qn and qn minus 1 the n is like the height of the tower and here there are only two towers with two heights one has height qn and one has height qn minus 1 so this n is not the same n so this qn is one of the ns and the qn minus 1 is another ns all the other ns contain nothing because nothing returns in other time does it make sense so I just want to say this picture that you see has this green are all intervals which are images of the original green and the red are all images of the original and similarly here in the next level in the next level again I have my small green and my small red and their images up to the return time together span the whole circle and yet sorry, yet another one I have only a small red and a small green in my induced map but if I look at the images up to the time they come back here the images of the red and the images of the green all together span give you a partition of the circle does it make sense I said that I am confusing ok so this picture is the dynamical picture so if I go from the previous one there are also so this green maps here, here, here and back the red maps here it jumps then here, then here then it jumps to the next then it has a complicated dynamical structure but in this simplified pictures of towers I'm ignoring in which order they appear and I'm kind of stacking them in their natural order so in this picture the rotation actually moves up so this floor is the image by the rotation of the previous the next floor is the image I'm pictorially draw the images by the rotation on top of each other so r alpha moves up up to the top and when I'm in the top from this floor I need to go back to the base according to the induced map then back to base the induced map tn so this algorithm this renormalization produces for you three things it gives you an algorithm one of us short and long intervals and it gives you these dynamical rockling towers it's actually nice to also see what is the algorithm on the towers so now I will do it's a little bit boring to draw it's a little bit annoying to draw the floors so let me draw a rectangle for a tower so you should imagine that this rectangle has floors but I will stop drawing the floors for the rectangles so we have two towers delta n is here delta n minus one is here and actually sorry let me make the second tower larger let me not draw all the floors and again this tower represents the dynamics the base at the base I have the induced map the original so r alpha moving everything up and then coming back according to this map so let me make a connection has anybody ever seen finite rank transformation and cutting and stacking just one so this is a construction which is very much used to study many kind of dynamical systems dynamical so in general you can have many towers countably many but dynamical systems which admit representation with finitely many towers are sometimes called finite rank so the rotation is an example of a rank 2 dynamical system because you can represent it as a sequence of towers so this is just the algorithm that we are going to see now on towers this is actually an example of cutting and stacking so many people in dynamics in symbolic actually in spectral theory many areas use cutting and stacking so this would be a special example of cutting and stacking so I want to say what are we doing on the base do you remember the algorithm of the base on the base what I'm doing I'm taking this interval small interval and I cut it from the right as many times as I can so this operation I was doing it only on the base but actually you can do it on the whole tower like this you can take the small tower and cut so cut the small tower from the opposite side so what does it mean this small tower I cut it here I did too many copies because I'm not going to be able to stack it ok my example is too big so let me make it a little bit smaller so I want it big but not too big so let me say that my tower is like this so I cut actually let me cut for the reminder I'm lying a little bit on the size so I can cut three chunks of my tower of equal width and then I'm left with the reminder this is the reminder tower from opposite cut small towers from opposite side so this is what I mean the base was fitting a whole number of times before having a reminder and I'm just cut do you have is it clear what I'm doing I'm cutting my tower at the points where I was cutting the base and now the algorithm is called cut and stack cutting a stack so what am I going to do next I'm going to stack I'm going to cut so stack them all stack them on top of each other so what am I going to do I still have a small tower I still have a reminder the small tower was blue the reminder was red and what am I doing I'm kind of stacking the first time that I cut I wish I cut the movie actually I don't have a good movie I stack it on top of sorry I cut the piece I stack it on top of the small one I cut the second and I stack it on top I draw you the picture so let's call this is one this is two, this is three and this is reminder and I'm going to stack one, two and three and now what do they have and I stack them in the order in which I cut I cut and stack I cut and stack so let's actually check so this height was qn-1 this height was qn how many towers do I cut how many times can I cut in terms of continuous fractional entries a an so I cut an times because we did it yesterday we checked maybe an plus one sorry an plus one ok, so what is the new base and what is the new height the new base is qn plus one and qn this height is the same that I had is still qn what is the height of the big tower the big tower has qn minus one which was the small tower plus an plus one the big tower which was qn so what is qn minus one plus an plus one times qn everybody knows new terminion this is qn plus one so you see this cutting and stacking gave me the picture at the next stage so essentially this so this is stage n and this is stage n plus one and what you see so this is a representation of the rotation the whole rotation on the whole space as an induced map on this interval in on the base so this is how I see this union is the circle and this dynamical towers show me how points move under the rotation they move up until the first return map this is also a representation of the rotation so the union of these towers is still the whole circle well I'm just cutting and stacking so I'm just moving my intervals around but I still have the whole circle and here the induced map is the induced map on a smaller interval and then giving a dynamic representation of how the rotation act as induced map on this interval so to induce on this interval I go out up to the height of these towers and then come back and why does it work, why this cutting and stacking I'm doing nothing else than following the dynamics because if I start from the small blue if I start from the small blue my rotation moves me up and then where do I come back well I have to go back according to the exchange and then I come back here then my rotation moves me up when I'm at the end of the first copy my induced map moves me exactly here so maybe I will take a color like a yellow or a red so my rotation my dynamics is like this up up up back here up up up up and then back here up up up up back here and that's it so that's why I'm stacking because stacking is following the dynamical movement okay so it's this so wait, when did I start and when I'm supposed to finish I think I'm supposed to finish now so this is a very concrete example in the case of rotation that you can build with your own hands but it's really an example in dynamics that is used very often in this inducing are two fundamental tools in many in the study of many dynamical systems so we spent quite some time to do this cutting and stacking and so let me just tell you tomorrow I want to give you some applications so I will give you a hint of several results that you can use you can prove using this renormalization and cutting and stacking I won't give you details so so that's the plan for tomorrow so thanks


So what we wanted to spend, like Andreas mentioned a bit as well, there are a lot of work being done by the community, by the maintainers to integrate Spiffy and Spire between the broader ecosystem. So I'll provide a quick recap on that. In addition, we have some interesting work being done by a few community members that they'll be sharing and giving an update around that as well. So first of all, Spiffy and Spire, I think the team has been really busy since the last KubeCon. We have added various integrations. We already are integrated with popular cloud platforms, bare metal, different service mesh, and other open source software. So you can check these integrations out on the GitHub URL mentioned there. But again, this is the integration that we know. We have a growing community of contributors who are doing integrations, doing contributions all the time. We don't really know about them until they get included in the upstream as well. So if you have any of the integrations in mind, if you want to contribute to any integrations, if you're looking to integrate Spiffy and Spire with anything else, do reach out to us. So some of the new stuff that has been recent, a lot, we have seen a lot of service mesh have started to use Spiffy and Spire, network service mesh, which is a CNCR project focused on delivering hybrid multi-cloud IP service mesh. I think are tightly integrated with Spiffy and Spire. Frederick, who is one of the maintainers of the project, will also be doing a session later on on his integration story within his organization as well. We also have Nginx recently introduced a service mesh, and the solution is integrated with Spiffy and Spire as this core identity control plane. Fessel will be mentioning that a bit in his CRD session later on as well. Open service mesh is another upcoming open source project. It's a lightweight, sensible cloud native service mesh. They are definitely plans there to integrate with Spiffy and Spire as well. Dapper, a relatively new event-driven programming model driven by the Microsoft team, I believe. They recently had a new release and the Dapper workload certificates are now Spiffy-SWID compliant and carry a strong Spiffy identity for each workload. In addition, we have a mystery from GitHub, which is a bridge between service proxy. Spiffy is applied there to apply Authent and Autsy policies within that tool as well. We also have an integration pretty much done between another open source project, Parsec. I won't talk too much on that because Paul from that project would be talking in a bit. As I mentioned before, the next upcoming talks are by community members who have done some interesting work with Spiffy and Spire. With that, I'll ask Doran from IBM to unmute. Hey, Doran. Hi. Can you hear me? Yeah, I can hear you. Excellent. Okay. Shall I begin? Yep. Go for it. Tell us about the interesting stuff you've been doing with Spire. Right. Can you move back to the previous slide in just a second? Yeah. Okay. So I thought that my email should be there. Okay. Never mind. You can move to the next slide. Okay. The last slide, Doran. Apologies about that. We left your contact information on your finishing slide, not on the first. Just for consistency with everyone else. No problem. Okay. So my name is Doran Han. I work at the IBM Hi-Fi Research Labs in Israel. And thank you for attending my short talk. I work on an open source project called the mesh for data that enforces data access governance policies in a service mesh. And the link should have been on the slide, but it is not. Anyway, so I'm going to describe proof of concept work that we carried out a few months ago in which we tried to replace the Istio identity issuing mechanism with that of Spire. So for those of you unfamiliar with Istio, Istio is an open source service mesh project. Now, okay. Istio already issues PFI identities. And this slide should have shown us what they look like. But anyway, they're based on namespaces and service accounts. So Istio issues identity solely based on namespaces and service accounts. But if you use Spire on the other hand, you can base identities on a wide range of conditions and not just the namespaces and service accounts. So we were particularly interested in determining the identity of a workload based on the container images of all containers running within a pod. In our proof of concept experiment, we use Spire to issue the same Spifi identities that would have been issued by the Istio identity mechanism. So a few words about our motivation. Using Spire allows us to only issue identities after an attestation process has taken place, ensuring that all required conditions are met. Implicitly, this also means that if the conditions are not met, then the workload will not get any identity and would not be able to communicate with any other services. The main use case for using Spire identities is Federation. Federation would allow workloads running within Istio to communicate with workloads in other Istio clusters. It would also allow workloads in Istio to communicate with workloads running outside of Istio in just about any environment. Unfortunately, we did not get around to actually experiment with Federation. A few words about how we replace the Istio mechanism with that of Spire. In Istio, the proxy sidecars receive their identities through a UNIX domain socket that they share with an Istio agent running in the same container. Most of our work involves changing Istio configuration so that identities would be received from a different UNIX domain socket, that of the Spire node agent. We also had to make some minor changes to the Spire code so that Spire would support the proxy sidecar configuration, which is automatically generated by Istio. These changes were approved and merged into the Spire repository. Next slide, please. Thanks. Finally, if you are interested in this work, you have here a link to our repository. It explains how to recreate our experiment step by step. We welcome contributions. Below it, you can find a link to a blog that we wrote explaining in greater detail our motivation for this work. That's it. Thank you for your attention. Great. Thank you so much, Doran. If you can hang it on for a few minutes. If you have any questions for Doran, please feel free to put them in the chat window. There's the option of interacting with Doran on the Kiko chat feature as well, which was the browser that you used to get into the Zoom chat. Up next. Amir, real quick. Do you mind going back to slides? I think your update just reflected on what had been missing from Doran's slide. Just one of the people to part with. Yeah, I have to stop and present again. Yeah, Doran, apologies about that. No problem. I think there was a URL here. That is the schema that Istio follows as the naming convention. Right? Right. That's the point you wanted to illustrate. Any particular, you want to redirect your attention about like water, the sharp edges or trade-offs here, perhaps like you need to have parsing and everything else. Expect that if you're the time you're doing Federation, things would need to look pretty much the same in other service meshes. Correct? Right. So in order not to break things, we used the same schema as Istio. So that did not change, but the mechanism of giving the identities is now totally different. So we can use all the spire selectors in order to determine what conditions need to occur in order for an identity to be given. This is as long as you stay within the Istio framework. If you are trying to federate with other environments, then you can use different schemas. Right. And recent about it more as a syntax than perhaps encoding too much semantics in the structure of the string. Right? Great. Thank you very much. We're very excited about this integration and thanks again for leading the charge and showcasing how Istio can integrate with spire. Thank you. Great. Thank you so much, Arun. Up next we have Andrew Jessup. He's going to talk about another popular topic, transitive identity. Andrew, you're on. Hi, everyone. Quick sound check. Can everybody hear me? Yep. Perfect. Beautiful. Hopefully my internet holds out. Apologies if it doesn't. So I know we've only got a couple of minutes together. Good morning. Good afternoon. Good evening, wherever you are. Thanks for joining. We're going to spend a couple of minutes on this topic of transitive identity. Firstly, wanted to recap what transitive identity is. And I tried last night at about midnight to come up with a sort of concrete pithy definition. I'm not sure I succeeded, but let's try anyway. What transitive identity is about adding additional authentication context to a receiving workload. So that in addition to being able to verify the identity of my proximal immediate caller, I can also bring into my authentication and authorization decision additional authentication context about upstream parties that might have been involved in an interaction. Perhaps an easier way of explaining this might be to look at some actual use cases. So a common one here is delegated authentication. So as an example, on the left-hand side here, we've got a user, Michelle, she logs into a web application. Let's say that web application is maybe like a mail client. And the web application then, which is authenticated, Michelle, is now going to talk over a private API to a back-end system in order to retrieve Michelle's mail. So in this scenario, the web application needs to authenticate to the back-end. And hopefully they're using Spiffy in order to perform that authentication. So the back-end now knows and can prove who the web app is. But doesn't know who Michelle is and doesn't have any proof that the web application has actually interacted with Michelle and is entitled to retrieve the mail records on Michelle's behalf. It effectively just has to trust that the web app is entitled to do that. And in some simple cases, that's probably okay. But in more complex scenarios, particularly when you have multiple call chains of microservices where you've got organizations running shared services where they don't necessarily trust the upstream party completely and they want to provide additional guarantees. It would be nice if the back-end, the team running the back-end infrastructure was able to verify not only that the web app was the party calling them, but also that Michelle had authorized the retreat, it was that the web app had a valid authentication context from Michelle and maybe even a valid authorization context as well to retrieve email. This sort of scenario plays out in a lot of organizations where microservice development becomes more mature and embeds itself into a more disparate organization. Another use case that's similar but is quite interesting one is when you have a long-running task that a user has initiated. So by a long running task, that might be say a render job, it might be a CICD job. But in any case, really, where as a user, again, I've got an interactive with some system and that system is spinning off a job on my behalf. Let's say it's a CICD job. That job is going to run for potentially a long time. It may run asynchronously or it might even start after I've left my machine and gone to bed.  So what we need is a way for this, on the right-hand side here, this task to be able to represent itself as Michelle, as the user who's logged in, and at least be able to represent itself to a subset of the entitlements of Michelle. So this is another case where some idea of transitive identity would be useful here. It would be fantastic if the task was able to present not only its own identity as a workload, but also Michelle's identity or a proxy for Michelle's identity, or for that matter, the scheduler's identity as well, to a resource in order to be able, for the resource, to be able to make that kind of authorization decision. And there's a few variations of these kinds of use cases as well. It's a complex and fairly challenging problem, it turns out. And one that Spiffy today doesn't really solve. Again, Spiffy is really all about the immediate proximal identity of a caller. So the backend authenticating the web app or the resource authenticating the task, but not the broader context that these things are operating in. So we sort of fixed this, if we skip to the next slide, or to address this, beautiful. At the end of last year, actually, we set up a working group called the Transitive Identity Working Group. I forgot to put the link on there, but if you browse around our Slack channels, we'd be happy to point you in the right direction if you're interested in joining this working group and participating in this process. But we set up a working group to explore this problem. And we started that working group by soliciting some real-world case studies. So we had some colleagues from folks like Bloomberg and Adaptance and Netflix, you know, all took their time out to walk through how they were, would like to, or either were employing Transitive Identity in the real world. And those grounded real-world use cases turned out to be really important because when it comes to a topic like Transitive Identity, there's a lot of trade-off decisions you can make between complexity and ease of implementation and robustness and security. And seeing how people had solved for those problems in a grounded real-world setting helps us make some of those design decisions. So we went through that. We also went through and reviewed a lot of prior art. There's, you know, for those who are familiar with specifications like OAuth2 or WS Trust for the older folks on the call, or for that matter, you know, more interesting kind of delegated grant proposals like Google Macaroons. And for that matter, Istio even flirted with this. There was a thing called the Istio RC token. There's been a lot of, there's been many attempts to try and solve this problem in the past. And we spent some time reviewing some of that prior art as well for two reasons. One is we don't want to reinvent the wheel if there are already great standards to solve for this. Let's let the community, or let's figure out how to integrate with and support those standards rather than reinvent the wheel. And secondly, as well, to make sure that to the extent that there have been standards that are proposed that hadn't really seen adoption in market, what can we learn from that? What can we do to make sure that we're not repeating those same mistakes? So we went through and reviewed that and we came up with, you know, first of all, a set of design principles that we wanted to assert. You know, a set of kind of grounded principles for what, you know, SPIFI's implementation or at least initial implementation of Transitive Identity should be. We actually carved out a subset of that problem we call Delegated Authentication. And we put our heads together and put together a proposal. This proposal is still very much a work in progress. It's had some, you know, real-world grant, you know, it's had some initial review from the working group team. What we're now doing is bringing this to SPIFI itself and seeing, because the proposal as it stands implies some extensions to the SPIFI spec, in particular a new token format called the DAS for providing delegated asserted claims. We're now putting that in front of SIG spec and we're starting that discussion. It's been a really useful and robust discussion so far. It turns out the problems that we're trying to solve to solve the Transitive Identity are also problems that people are having in other contexts too, where they want to be able to propagate contexts across calls. So we're starting to get into the meat of that discussion now. And, you know, our hope is that, you know, with the help of SIG spec and the help of the broader community, we'll get to a point pretty soon where we'll have a concrete proposal that we can effectively ratify. The other thing we're doing as part of this is POCing this environment as well. And, you know, actually actually standing this stuff up inspire and making sure that it works. So yeah. And so that's all I've got. If you want to check out the design doc, I encourage people to do so. I also encourage folks to jump on the Transitive Identity Working Group and or join SIG spec if you're interested in that too. And you can find the design doc at the link at the bottom there. And with that, I'll hand over back to Amir. AJ, a quick question from Tat Taylor. Why delegated authentication as opposed to delegated authorization? Sure. Great question. So delegated, so we've tried with Spiffy in general to disaggregate authentication and authorization as much as possible. And the reason for that is it's generally easier to provide to build a general purpose authentication framework that supports a whole set of different use cases than it is to provide authentication and authorization in the same form in the way that say OAuth2 does. To the greatest extent possible, we've tried to do that with delegated authentication as well. There's actually some open discussion right now as to whether or not that should be delegated authorization because how useful is just an authentication claim without entitlements associated with that. So to paraphrase my own answer, I'd say we started from a position of trying to do the simplest, most practical thing that we can. We're starting to hit the limits of that. And so we are starting to explore delegated authorization as well in some form, at least having kind of concrete bounded claims that can be passed around that may capture some authorization decision as well as some authentication decision. Would really encourage you to jump in the dark and or jump in the conversation there to add your voice there too because we'd love to hear from your experience. Great. Thank you so much, Ajay. I know we oppressed for time. Apologize. We're going to run into the break a bit, but I do have a couple more speakers. Up next, as Augustine mentioned about certificate transparency is a big topic within the Spire community. And we have Reed Zhang from Bitense. He's going to walk us through his proposal. Yes. Can you hear me? Yeah, perfect. Great. And thank you for introduction and thank you for inviting me. And I'm Reed Zhang and you can also call me Reed. So I currently work at Bitense and we are known for the creator of TikTok. So here I bet Bitense we heavily integrate with Spire to implement our identity management system for our production network. And during that we noticed that in the current Spire there is actually no very good way to perform auditing on the issued SVs. Like for those who are new to Spire, SV is basically the ID card for an entity in the network. So in this work we try to provide auditability to Spire. We leverage a well-known technology called certificate transparency or CT. And CT was first proposed to enforce public auditing on certificate authorities for WebPKI. And in our case we applied the essential ideas of CT to Spire so that we could enforce auditing on all of the SVs issued by the Spire server. And this way it can significantly mitigate the risk of Spire server getting compromised or having its identity stolen. Without CT malicious SVs could be introduced into the production network without any notice. And so here we will first briefly walk through the original workflow of Spire server issuing SVs. And then we will look at the new workflow with CT edit. So in the original case the Spire agent or workload would first send a request to the Spire server and ask for an SV. And the Spire server would perform validation and logging off the request and then it will issue an SV back. So and this finished the original workflow of issuance of SV. And the case is slightly different for the like for the case with CT edit. So could you click. So in the CT case the old SV would not be trusted. The old SV needs an additional field called SCT in order to be trusted. The Spire server would need to fetch this SCT by logging the SV on CT log. This SCT is short for signed certificate timestamp. It presents that SV to be issued would be added to the CT log within some time. And Spire server would embed this SCT to all the SV issues. And now only the new SVs with SCT embedded would be trusted. And this SCT guarantees the enforcement of auditing through a crypto way, cryptographic way. And could you click. And with that now any interested internal or external auditor can request to the CT log for auditing of all issued SVs. So here in Bydance we would have an internal process keep batching from the CT log and look for suspicious SVs. And this sums up the overview of like the new version of Spire with CT integrated. And in this slide we show an example of issued X549 XP with SCT embedded. The yellow highlighted parts are the SCT field and our newer version of OpenSSL should be able to parse SCT field in the X549 certificate. This certificate is generated by our experimental fork of Spire server. And our current fork all SVs would have SCT embedded. And these SCTs are actually fetched from our own internal CT service here at Bydance. And that's why I want to share. And Umer can go back like can go to the dock link you sent me because like I updated the github link and also the design dock link on that version. But can you put in here? I'll put it in the chat window for sure. Yeah, sure. And yeah, and I think we started the working group three months ago and there have been some like back and forth discussing. And we are also discussing on the on the Github RFC issue. So you are most welcome to check that out. And yeah, and shout out to the great of great work this PV community has been working on. And thank you for inviting me. And that's it for me. Thanks for it. Thank you. Awesome. Thank you so much. I know we are a bit over. So last but not the least, we have Paul Howard from ARM talking about our second SPIFI. Call you around. Hi, can you hear me? Perfect. Yep. Cool. Paul. Sorry. What's that? What's that drawing on that turtle shell in this slide? I see a little parsic Easter egg in there. Oh, wow. That's fantastic. I can't claim credit for the for the handiwork. That's cool. In the thumbnails, I didn't spot that detail. Yeah, thanks to whoever parseced up the turtle. That's awesome. So thanks, and thanks for the opportunity to join this session and quickly talk about the work we're doing with SPIFI, Inspire and Parsec. So just to quickly introduce myself, I'm Paul Howard, Solutions Architect with ARM. And I lead an engineering team here at ARM that is contributing into Parsec. Parsec became a CNCF sandbox project just earlier this year. And so what's Parsec? Well, Parsec is the platform abstraction for security. It's providing ways for cloud native applications to access the security facilities of diverse platforms. So for example, it can handle the complexities of storing private keys, interested platform modules or secure elements, and it can give us uniform simplified interfaces to do those things in our preferred programming languages. And this is so that applications can get access to those best available hardware security facilities in a decoupled way. So keeping them fully architecture agnostic and platform agnostic. So that's what Parsec is. Now, the slide here that Ume has put up, so this is showing us how Parsec can make use of SPIFI identities. This is really valuable for us because it allows Parsec to grow beyond just being a platform abstraction for security. By using these reliable application identities, Parsec can support multi-tenancy. So it can isolate these different client applications from one another so that they can share the hardware, but they can't perform operations with each other's keys, for example. So the diagram on screen summarizes how Parsec can do this with SPIFI identities. So it shows this triangular three-way interaction between the application, the Parsec service, and the SPIA service all along the local machine. So the client application links to a Parsec client library. That Parsec client library can obtain the application's SPIFI ID from the local workload endpoint, which, of course, it can then pass as a job token in a North Header over to the Parsec service, where finally the Parsec service can validate the token back with the original workload end point. So Parsec knows, but by this three-way circuit, that each API call it receives is coming from a client workload with a proven identity. And it can then start permitting access to keys on the basis of that identity. And the really great news is that this is an integration that we've largely completed. So it's still work in progress. It's in the process of being upstreamed into Parsec now. We've done a bit of community enrichment around this as well. So there is a Rust SPIFI library, because Parsec is a Rust project. There is a Rust SPIFI Parsec library that already existed in community, but we've done some enrichment on that as part of this work. There's a Lightning talk taking place later today. That's as part of Cloud Native Security Day, where Andres and I show a demo of this in action. It's pretty cool. We take it at 1,000 miles an hour because it's only a Lightning talk. Do look out for that. Maybe catch the recording. And also, if you have questions for me, either about this integration or about Parsec generally, which I've really only given the nearest hint of what it is, really, you can find me on the CNCF and the SPIFI Slack of WorkSpaces. There's also a Parsec channel on the CNCF Slack. You can come and engage with the entire Parsec community as a whole there. And that's it, really. So, yes, let me just say thanks once again and hand back to you, Humair. So thanks very much. Great, Paul. Thank you so much for doing this.


that Sarah and I are going to be teaching you about the general general, you will stand attached to the age group, general, and talk about it on the right way. Wrong. Common on the right way. Two. Pearl, the devil sees hands. Such assumption on the name. The fact that Sarah and I are on the right way. It's usually wrong. Do you guys know? You will assume that these are the main options for any of their kind of group or to be students. Some. They age group. General. Talk about it on the right way. Keep the wrong foot.  Anybody understand? If you're wrong, then 3,000 will need to think about it. Whoever is dead. To those who don't know, means rather than command, man-to-man, turn on your message to the worker. You need to consider that this will be dead in the last 10 years.  Let's conclude today's video. Thank you.


Okay, I'm from China. The title of my presentation is Hacking Windows C. It's about the security problems of the PDAs and the mobiles. My presentation is constructed with eight parts. First of all, I'll make a brief introduction of Windows C because unprocessed is the most useful processor in PDAs and the mobiles, so I'll introduce the unprocessed architecture. You know, understanding memory management is very important for bubble flow. The second are introduced memory management with graphers. Compared with other Windows system, Windows C choose process in a different way. And then I'll introduce the features of the processes and the threads of Windows C. The Windows API search technology is funny. I'll introduce it to how to write a share code use this method. And I will also introduce the implementation of a system call and use it to write a share code. After this, I'll demonstrate a simple bubble flow. Well, I think this technology will be improved in the future. Then I'll talk something about decoding share code. The decoding share code will make the real share code more universal, but unprocessed is the catch architecture makes it funny. And the last, I'll conclude my presentation. Okay, let's move on to the first part. Windows C is a very popular embedded operating system for PDAs and mobiles. The name is developed by Microsoft because of the familiar APIs, Windows developers can easily develop applications for Windows C. Maybe this is a very important reason that makes Windows C popular. Windows C file is the latest version, but Windows C.net is the most useful version and my presentation is based on this version. Maybe for a marketing reason, there is Windows Mobile Software for Pocket PC and the smartphone in Microsoft's website and MSGN, but they all based on the core of Windows C. By default, Windows C is in little indian mode and it supports several processes. Almost all of the embedded devices will use ARM CPU. ARM processor is a typical RISC processor which implement a load store architecture. Only load and store instructions can access memory. The data operating instructions operate on rest of the contents only. There are six major versions of ARM architecture. The demonstrated device has the same sound, F3C2410 processor which has ARM9 core and the architecture version is ARMV14. More and more PDEs are using Intel X-Scale processor, which architecture version is V-File TE. ARM processor supports seven processor modes depending on the architecture version. These modes are user, FIQ, IRQ, Supervisor, Undefined, Abort and System. The system mode requires ARM architecture V4 and above. All modes except user mode are referred to privileged mode. Applications usually running user mode, but on the pocket PC, all applications appear running in kernel mode. We'll talk it later. Windows ARM processor has 39 registers. These registers are arranged in partially overlapping banks. There's different registers of bank for each processor mode. The bank of the registers give a rapid context switching for dealing with processor exception and privileged operations. In ARM architecture V3 and above, there are 30 general purpose registers, the program counter register, the current program status register and the file saved program status register. 15 general purpose registers are visible at any one time depending on the processor mode. By convention, R13 is used as a stack point in ARM assembly language. The C and C++ compilers always use R13 as a stack point. In user mode and the system mode, R14 is used as a link register which stores the return address while a subrouting call is made. The program counter rest is accessed as R15. It can access the directory by data processing instructions. And this feature is different from other processors and it is useful for code location while writing show code. You know, understanding memory management is very important for bubble flow. But compared with other Windows systems, Windows C choose memory management in different way. Windows C uses ROM and RAM. The ROM in the Windows C system is just like a small read and hard disk. It stores the entire operating system as well as the applications that are bounded in the system. The data can maintain inside the ROM without power or battery. The RAM in a Windows C system is divided into two areas, the program memory and the object store. The object store can be considered something like a permanent virtual RAM disk and it's unlike a RAM disk in the PC. It can maintain the files in it even if the system turned off. That is the reason that, this is the reason that Windows C devices typically have main battery and backup battery. They provide the power to the RAM to maintain the files stored in it. Even when the user hit the reset button, the Windows C kernel starts up looking for previously created object store. The system will use this data store if it finds one. Another area of a Windows C RAM is the program memory. The program memory. Program memory is just like the RAM in the PC. It stores the heapers and the stacks that the applications, for applications that are running. The dividing over the, between the object store and the program memory is adjustable. The user can move the dividing line by the system control panel applet. Windows C is a 32-bit operating system so it supports 4GB virtual address space. Let's look at this graph. This is the 4GB virtual address space layout. The Apple 2GB is used by, is a kernel space used by a system for its own data. And the lower 2GB is a user space. From this address to below, this address memories are used to, large memory allocation such as, it's used by them such as memory mapped files. The object store is loaded here. And from zero to below, this memories are divided into 33 slots, each of which is a 32 MB. The slot one is XIP, execute in place. This is a new feature of the Windows C.NET. It expands the applications of virtual address space from 32 MB to 64 MB. Well, this graph is the slot zero virtual address space layout. Slot zero is very important. It's used by the current active process. The first 64KB is reserved by the OS. And the following is the processes code and data. Stacks and heaps are arranged here. DL files are loaded into the top address. Well, let's move on to the next part. Compared with other system, Windows C choose processes in a different way. Windows C limits 32 processes being run at any one time. When the system starts, at least the four processes are created. Let's look at the previous graph. NK EXE, which provides the kernel service, it's always loaded into the slot 97. FileSys.exe, which provides the file system service, it's always in slot two. Device EXE, which load and maintains the device, drivers for system, it's in slot three normally. And GW ES EXE, which provides GUI support. The other processes are also created such as expire. The threads on the Windows C is similar to threads on the other Windows system. Each process at least has a primary thread associated it up on start. You will never created one. One process can create any number of threads only limited by the available memory. Each thread belongs to a particular process and shares the same memory. But the setprog permissions API can give the current thread access any process. Each thread has an ID, a private stack, and a set of registers. When the process is loaded, the system will assign the next available slot to it and the file is loaded into the top address of the address space. And then followed by the stack and default process heap. After this, then execute it. When the process thread is scheduled, the system will copy from its slot to slot zero. It's not a real copy operation, it's just mapped into the slot zero. This is mapped back to the original slot allocated to the process if the process becomes inactive. Process allocates a stack for each thread. The default size is 64KB depending on the link parameter when the program is compiled. This size can be modified. The top 2KB is used to cut against the stack overflow. We can't destroy this memory otherwise the device will freeze. And the remainder available for use. Variables declared inside the function are allocated in the stack. Thread stack memory is reclaimed when the terminates. Well, let's move on to the next part. Before we explore it, we must have a share code to run on the Windows E. Windows E implements the VIN32 compatibility. The code URL provides the end points for almost all the APIs that implement that in the code URL. We must search the necessary API addresses and then use these APIs to implement our share code. The traditional method to implement the share code in the other Windows system is to locate the kernel 32 or NTDRO via PEB structure and then search the necessary APIs via PEB head structure. Well, is there any structure like PEB on the Windows E? The answer is yes. That's the kernel, the K-data structure will satisfy us. The defined in NKarm.h. K-data structure is a very important kernel structure can be accessed from user mode by fixed address K user, P user K-data. The value over P user K-data is defined in the K-fungs. It's in the normal SDK. The value, the P user K-data is FFFC8-0-0 in ARM processors and file 8-0-0 on the other CPUs. Well, let's look at the last member of K-data structure. It's offset 3-0-0 from the start of K-data structure. There's the, the 8-in-4 is the D-word array. And there's a point to the module list index nine. So, offset 3-2-4 from the FFFC8-0-0 is a point to the module list. Well, let's look at the module structure. It's defined in kernel header file. The second member is P mode. It's a point to the next module of the module chain. This is, the third member is LPSA mode name. It's a module name string. So, we can locate the code URL by comparing the unique code string of its name. Well, we also notice the E32 member. Let's look at this file. E32 member is a E32 litre structure. It's defined in PHDR. Well, let's look at, look into the E32 litre structure. The E32 V-base will tell us the virtual base structure address of the module. So, we can locate the base, virtual base address of the code URL. We also notice the last member is E32 unit. It's an info structure. And the info structure has two members. The first is a virtual relative address and the second is a size. And the litre structure is defined in the PHDR, the start of PHDR. Six members are used by NK. And the first is the export table position. So, from now on, we got the virtual base structure address of the code URL and it's export table, the relative address of it, it's of the export table position. I wrote a small program to list all the virtual base address of the, of all loaded the DL files. This is the K-data structure and offset, offset 324 is a point to the module structure. And the module structure is a change structure. And the module structure is a change structure. The offset 4 will point to the next module. Well, the point to the module structure is in the kernel space. So, this program only execute in the kernel mode, the user mode, it will fail in the user mode. Well, the most over-parked PC runs were built with the full kernel mode option. That's the applications appeared all running kernel mode. So, this small program will execute in the most of the pocket PC. I use this program to call the virtual base address of the code URL is 1-F-6-0-0-0. But when I use EVC debug to look into, this address is invalid. The valid data is from 1-F-6-1-0-0-0. I think maybe the window C is just for the purpose to focus over the memory and the start time and then it didn't load the head of the DL file. Okay, the VINC4.duster uses ordinals to find the API address. But I think use the API name to find the API address is more reliable for shell code. Because the API name won't change even if the code URL file is changed. Because we have the export table position and the base address of the code URL. So, we can use the... We can compare the image export directly to find the API address via API name. To save size, we can use the hash technology that from the LSDs VIN32 assembly components. This graph is ripped from LSDs VIN32 assembly components. It shows the way to locate the base address via API name. Well, let's move on to the next part. The test ASM is our final shell code. It constructs with three parts. First, it will get the export section to get the virtual base address of the code URL and its relative virtual address of the export table position. And then, it uses the find function to find the API address via the hash value of the API name. And then, it stores the API address to its own hash value position. The last part is our implementation. It's the implementation of our shell code. It will change the registered key of the Bluetooth and then use kernel IO control to soft restart it. This shell code will open the Bluetooth over some IPACs. And we must notice the... LDR, pseudo-instruction. Look here, why I comment on these instructions. Because this pseudo-instruction will be this in the EVC debug. It depends on the program. So it won't get the FFFC800 in the shell code. So this instruction will make the shell code fail. And the next instruction will be this in the EVC debug. It's okay. Well, in Windows C, R3 and R0 and R3 used the first to fourth parameters of the API. If the parameter is larger than four, the other parameters will stored in the stack. So we must pay attention while writing shell code because the shell code always in the stack memories. Well, EVC debug has some bugs that make debug difficult. The first, EVC will change the stack contents when the stack is reclaimed in the end of the function. Well, it's difficult to debug the bug or flow because the shell code may be changed. And the instruction or the break point may be changed to E600010 in EVC sometimes where it's very bothering. And EVC allows the code to modify the text segment without error while using break point or when you step-by-step to debug into it. But sometimes it's useful. Well, the adpro for the ARM debug also have these bugs. So I think maybe this is the bug or the debug API over Windows CE. Maybe. Well, let's move on to the next part. The above shell code we talked is complicated and it can't run in user mode. Is there any other method to implement shell code? Well, let's look at an API implemented in the code URL. Well, let's look at the power off system. It has no parameters. The first, the system will check the K thread info structure. And K thread info is initialized in the MD created thread 2 function in the MD ARM.C. If the application running kernel mode this value will, the K thread info will be set with one. Otherwise, this value is saved zero. So it test this memory is one because the K thread info is one then the system will use the API set table to find the real implementation in the kernel space. If your application is running kernel mode and this instruction will execute the R1 is started from the 8 blah, blah, blah it's in the kernel space. Otherwise, if the K thread info is zero the system will use this. This is the system call over windows C. The system call number is from F 000 to F 00100. There is a formula to determine the API, determine the system call number. It's like this. So, using this formula we can calculate the system call number. Well, let's calculate the kernel I O control. Kernel I O control is defined in the K VIN 32.C. And the API set is zero and the index is 99. So, we calculated the system call number is like this. F 0000, FE 74. Well, the system call number is more stable than the API address that implemented in the code year. Because the variable can put the wrong, the API address is variable. So, this show code is very simple. It only uses the system call to... So, this show code will can execute in the user mode, but also the kernel mode. So, I think this show code will used in the smartphone. The smartphone, the smartphones run not build with the full kernel mode option. And Microsoft device emulators run has no this option too. I tested this show code success in the Microsoft device emulator and my demonstrated device. Okay, let's move on to the next part. The hello to CPP is my demonstrate a vulnerable program. It reads the... It reads the bing file of the root directory by fread. And then read the file to the stack variable buff. And the buff is only 512 bytes. So, if the bing file is larger than 512 bytes, the program will overflow. And the printf and the gated chart is just for test. They have no effect without the console DAO in Windows directory. The console DAO can obtained from Windows mobile developer powered toy or from the pocket console. Windows uses BL to call a function. And in the hello function, this is the first instruction. Let's store LOR to SP. It will store the LOR raised to the stack point... to the stack which contains the hello callers address. And under the L-O-D-M-I-R-SP to PC is the latest instruction in the hello function. This instruction will load the LOR raised that stored in the stack to the PC register. And then the program will flow to the WinMain function. Then it will return. So, overflow the LOR stored in the stack we will obtain the control while the function returned. The variable memory address that allocated by the program is corresponding to the loaded slot, both the stack and the heap. The process may be loaded into the different slots each start time. So, the base address of the slot always alters. But we know that the slot 0 is mapped from the current process slot. So, its stack address is stable. Anyway, you can use an jumper address, jumper instruction address to let the program flow to your shell code. Well, I tried two methods to construct the exploit buff. The first is like this. The start is the pad instructions and then is the return address that we overflow it. And this return address is pointed to our shell code. Well, this exploit buff is larger. The PD is frozen when the hello program is executed. I think maybe there are two reasons. The first is that the stack or window C is small and maybe the buffer flow destroys the 2KB guard on the top of the stack boundary. So, I changed to another method to construct the exploit buff. It's like this. I move the shell code in the start position. And then the last is the return address that pointed to our shell code. Well, I used this method as a success. I'll demonstrate it. Okay, the first, the Bluetooth is closed and I'll execute hello. It will print the address of the buff and the size. When I press any key, the device is restarting. Well, it has restarted. Well, after the system restart, the Bluetooth is opened. Well, I'll close it because it's dangerous. Okay, let's talk something about the decoding shell code. The buff shell code that we talked is a concept shell code. It contains a lot of zero. Well, the other vulnerable programs may be filled with special characters before the stream buffer will flow in some situations. For example, overflowed by STR copy. It's difficult and inconvenient to write a shell code without special characters because if you use the R0, the OP code will contain this zero. So we think about the decoding shell code. The newer ARM processor has a Harvard architecture which separates instruction cache and data cache. This feature will improve the performance of the ARM processor, but the self-modifying code is not easy to implement because it will affect the ARM cache architecture and the processor's implementation. Well, let's look at this shell code. Well, this is the decoding shell code for the test. The last four instructions move one to R1 to R4 registers. And the first four instructions will modify the last instructions. It will make the value to 99 because the R1 is 99. So the R1 and R4 registers will get the 99 in my demonstrated device. Well, you can see the last four instructions hasn't been modified. But it will need more novel instructions between the decoded shell code and the real shell code in the Intel XScale processors. You can try it. Maybe only the R1 gets the 99. I think maybe the ARMv5 architecture has six pipelines, and my demonstrated device only has ARMv4. It has five pipelines. Maybe the pipelines will affect the result. Well, let's look at another method. Well, in this method the last four move instructions were encoded with the X-clusive OR with the 8.8. And the start is the decoding shell code. It has a loop to load the encoded shell code, to load one byte of encoded shell code. And then decoded, then started to the original position. Well, the R1 to R4 won't get the one. Even if you add a lot of the loop instructions, well, we saw the last four instructions is decoded. But they don't get the one. So I think maybe the load instructions will catch some features over the catch architecture. So we must need to flush the eyecatch or decatch after the shell code is decoded. Well, the first I think about the system interrupt. I use the system interrupt the success in the X power PC and the thrice spark. But the SWI instructions in the window C is just nonsense. The SWI handle defined in the ARM trap is just to move the LR rest to the PC. So it's just a knob instruction. Well, I have to try another method. Because the pocket PC ROMs were built with the full kernel mode option, the applications running the kernel mode. So I think about the MCR instructions to flush the eyecatch and the decatch. The MCR instruction can access in the kernel mode only. But unfortunately, this method all failed. Okay, let's move on to the last part. The code we talked about are the real life buffer flow example in window C. It's simple, but I think this take note will be improved in the future. Because the instruction catch and the decoding shell code is not good enough. Well, the internet and the hand set devices are growing quickly. The threats to PDs and mobiles becomes more and more serious. The patch over window C is more difficult and dangerous because the entire operating system is contained in the ROM. And if you want to patch the system flow completely, you must flush the system. You must flush the ROM. And it is dangerous and difficult for the normal customers. Well, I consulted a lot of people on the internet. It's all listed here. I'll show my special appreciation to Nestor who helped me a lot. Well, that's the end of my presentation. Hope you enjoyed it. And sorry my lame English. Thank you.