y all right the motion carries unanimously moving on to item 12c resolutions the law month city council approving an allotment contract an escrow agreement and two allotment transfer agreements for the windy gap birming project do we have a motion for resolution 2020-116 so moved all second that all right it's been moved by councilman martin seconded by dr waters all in favor of resolution 2020-16 a resolution along with city council approving the intergovernmental allotment contract between the city of lawnmant acting by and through its water utility enterprise the windy gap firming project water activity enterprise for capacity the windy gap firming project all in favor say aye aye opposed say nay that motion carries herald unanimously all right do we have a motion for resolution 2020-117 so moved all right i'll second that so um we have a motion for resolution 2020-117 a resolution along with city council approving the intergovernmental escrow agreement between the city of lawnmant acting by and through its water and utility enterprise the windy gap firming project water activity enterprise for the windy gap firming project all in favor say aye aye opposed say nay all right that motion passes unanimously all right item 12 three resolution 2020-118 a resolution along with city council approving the intergovernmental agreement between the city of lawnmant city of loveland for the sale and purchase of windy gap firming project stored capacity do we have a motion so moved all second that all right any questions or debate on this didn't think so all in favor say aye aye opposed say nay all right the motion carries unanimously uh resolution 2020-119 a resolution along with city council approving the intergovernmental agreement between the city of lawnmant and the city of fort lepton for the sale and purchase of windy gap firming project storage capacity do we have a motion so moved all right it's been moved by councilman martin seconded by dr waters all in favor say aye aye opposed say nay all right the motion carries unanimously all right now we've got some resolutions along with city council approving the third amendment the redevelopment and reimbursement agreement partial assignment to 320 granary owner llc for 210 emory street and consent to a development concept plan for 110 emory street taking it one at a time do we have a motion for resolution 2020-120 a resolution along with city council consenting to the development concept plan for 110 emory street so moved is there a second all right it's been moved by councilman martin seconded by councilmember peck any discussion on the matter before we vote all right seeing none all in favor resolution 2020-120 say aye aye opposed say nay all right the motion carries unanimously all right and then next resolution 2020-121 a resolution along with city council approving the third amendment to the redevelopment and reimbursement agreement and partial assignment and assumption to 320 granary owner llc for 210 emory street and 320 second avenue do we have a motion all right it was moved by dr waters and was it seconded by councilmember peck you know martin okay it's the seconded by councilmember martin all right mayor uh tony succone all right redevelopment manager uh-huh if you are interested brian bagley the developer 150 main which is the south main station project prime bear you said brian bagley i am not i'm not developing crap brian bear but yeah i probably appreciate him being here anybody have any questions for the developer can we vote well he he would he has a short presentation to give you an update on the status if you're interested yes well all right well if he wants to risk the nays sure go ahead and talk okay thank you but but lesson is you always be quiet when you got the votes but let's go ahead and hear what he had to say hope it's good i'm happy to let you vote well go ahead all right councilmember christian said who will watch here we have to say yeah no real quick wanted to do three things and i'll move quickly because i know it's getting late but i think these will be valuable for you and and thank you for the giving me the time this evening this is all relevant to the tap agreement but i wanted to do a quick update on south main station for you talk also an update on the granary because these things are kind of all tied together and then finish it with the the uh a few slides for the uh for the site plan for 110 emory which is really the purpose of this presentation so i'm not sure who's driving the presentation but if you could pull up my slides that'd be great and i'll fly through it pretty quick if you get advanced to the next slide as you all know these are the these are the pieces phase one is 150 main where the red star is next slide please quick update on leasing we are actually as of today i think we just hit 70% least so it's been pretty incredible during covid to get that kind of velocity really over the last four months it's been very robust there's some interesting demographic data here that i thought you might find interesting 60% of the tenants are under age 30 15% over age 50 over a third of them are from boulder county 30% are out of the area so probably not what we would have predicted and just very interesting information as you know these new projects come into downtown uh retail is 23% least we've got several lois that we're working through right now which would be new uh new companies to downtown uh in the sort of food and beverage and retail world next slide please uh building five which is the last building if you recall we only built four out of the five buildings we started building five about 90 done with cds we'll be submitting that in january for a building permit and we expect to start that building probably in uh april may of uh 2021 that'll be an additional 61 units and i'll finish the finish the two blocks next slide please uh jumping over to the greenery where the red star is i think you all know that building um we were uh really moving quickly on the rehab of the actual old greenery building then covid hit and really as you all know really slowed down the whole uh food and beverage world not to mention the whole world um we put that on hold but we've actually brought that back next slide please um we've sort of flipped the strategy there we were originally going to do the greenery building which just what you see in blue is now phase two and then we were going to do the multifamily their townhome apartments in in phase two we flipped that and now we're uh moving forward with the our new phase one which will be 20 uh townhome style apartments we've already completed our pre-app and we're anticipating a site plan submittal in january so that'll really start to take that that quarter block and uh get that moving the as far as the greenery uh as soon as the you know things start to restrictions start to lift and and some changes start to happen with covid uh we will start to pursue that again the last piece here is 110 emory which is where the red star is that's the four acre piece that's directly east of phase one next slide please this will happen in two phases as well uh many of you you've been out to the site and i've showed you around there's a an old butterball spice building down at the south end of the build of the property here this is where they store it all the spices it's about a 19 000 square foot uh warehouse building we're going to actually rehab that building into an adaptive reuse i'll show you what that's going to look like that's phase one 19 000 square feet we're hopefully about inside 30 days of final approvals with staff uh on the site plan and the replat we've already submitted for a building permit so we're parallel tracking and we hope to start construction in december and deliver that building in march and what's interesting about that building is it fits in with the steam project and everything else that's going on where we've got some maker space we've got some service retail we've got some office so it'll really help to activate the daytime use in this area just north of that is the phase two property which is roughly about three acres we've got that laid out for 155 to 160 additional units multi-family units these will be smaller apartments um with a lower price point and it's a smaller project so they won't be as amenitized as south main station but our view is this whole neighborhood is becoming an amenity and with everything we're doing uh are in the surrounding blocks we think that this is going to be a another real popular place to live in a in a nice development downtown so that'll be two four-story buildings with tuck under parking and there'll be some site parking there'll be a corner amenity building up on second and emory and we anticipate that to start next year in terms of entitlements and construction for that building will start in 2022 right about when we finish building five of phase one so this site plan here is really the crux of this presentation to show you what we're doing on the 110 emory property so that we can move forward with the approval of the tap credits for this particular property please advance slide a couple of slides here just showing you what the building looks like and how it breaks up next slide some some rendering images we're going to be sort of going in a sort of urban look something from out of sort of the rhino district down in denver next slide please same same things here so we're taking an old metal building sprucing it up putting a lot of storefront and glass and windows in it to make it more transparent make it feel a little more retail a little more active next slide please here's just a snapshot of the phase two with the apartments next slide this is we're starting to elevate those units and bring them up so you can see it's a little more I would say a little more modern looking than phase one and as I said these will be slightly smaller units with a lower price point next slide so in summary 110 emory is property five in the tap credit agreement I'm sure you don't have that agreement in front of you but I wanted to identify that I'm we're seeking concept plan implementation plan approval from council per section nine of that agreement which is a is a process that we agreed to as part of the tap agreement our plan is consistent with the first first and main transit redevelopment plan which was one of the key things that had we had to qualify for and it also meets the downtown longmont master plan so those two things we believe we meet and phase one this building the warehouse building that I showed you rehab will be done in april may of 2021 and then we expect the phase two which would be the 160 apartments to be done sometime in 2023 so that gives you an idea of of an update of where we are with south main station a preview of what we're going to be doing on the granary property and what we're doing right now with 110 emory so thank you very much and I'm happy to answer any questions all right councilmember christensen thank you mr bear you've been uh slogging away at this for a long time tell me about it and I thank you for a lot of thoughtful design and a lot of varied design and a lot of it's working out very very well I think and I also want to thank you for putting in I don't know if these are the the smaller apartments there's a huge need for that in long month that's huge I don't know if these will be single room occupancy like studio apartments or if they'll be slightly larger than that but that's what we really need nobody's been building that for a long time so anyway I just wanted to thank you for that and ask you about what the price point is for those single room units are you talking about for the 110 emory yeah the smaller apartments yeah we we haven't priced them yet but they will be smaller square footage wise than south main station with a larger focus on studios in one bedrooms yeah good so what about what size would those studios be I don't know what the studios would be exactly but we're we're targeting about a 700 square foot average across the whole project oh that's pretty big as far as well that that includes the the any two bedrooms that we might do all the way down to the studio so to put that in in perspective for you at south main station we're at a hundred we're at 862 average those would be quite a bit smaller yeah well thank you because you know when this started everybody's I mean you you know that this was a very difficult project you know better than anybody else and difficult to finance difficult to because of the the mitigation the environmental mitigation you had to do and but the whole idea was this would really be a game changer for lower downtown I hope we can find something that is equally as interesting for north main which sort of got the short end of the stick in many ways in our development things but I want to thank you I do think this will be a really uh enormous addition to our town getting people to live downtown is we'll change everything so thank you for what you're doing I appreciate that all right is there anyone opposed the resolution all right hearing none let's go ahead and vote I believe there was a motion made correct who made that motion don may our councilmember waters made the motion marshes seconded okay all in favor of resolution 2020-121 say aye all right I almost said nay just to just approve a point but aye all right motion carries you now anybody in a all right the motion carries unanimously all right um let's go ahead and move on to e discussion regarding councilmember's rules and responsibilities the city of Longmont advisory board liaisons I put this on because there's some question as to what are our roles as liaisons as we all know that this is a council that I as mayor and each of us is city council people we cannot act individually it requires four of us and so um as a liaison are we taking an action role or is it a communication role or is it a what is our role and so I think all of us have been behaving in different ways with different assumptions and so uh we're gonna talk about it who'd like to start councilmember martin and we'll go dr waters yeah and since this was dr waters suggestion I probably should have let him talk first but I've been very quiet this evening so I'm gonna talk if I have found that uh the role of the councilperson tends to vary a lot from one board to the next so for example the senior advisory board which I have found to be both active and effective uh often has questions for me about um what the council needs to hear in order to make changes um or offer support um they often um are interested in in uh information about what's going on between the city and the state legislature they're often interested in in um oh you know cml type information and um so it's it's it really is a partnership where you know they're they are looking to to um understand policy better so so that they can turn it into actions that serve their special constituency um in in other other boards like art in public places for example I feel much more like an observer you know they have a very set um plan of activity and they do that in a very organized way and they really don't need very much from the city council um so you know there's a continuum I think that uh that we need to attend because I think part of our duties are to the council I think that we should know if an advisory board isn't working isn't functioning right and um and as council members it may be our job um to take action in terms of city policy that might correct that Dr. Waters Dr. Waters then council member peck um personally uh I just had a couple of experiences where it caused me to inquire about do we have do we have any guidance in terms of what our our responsibilities are if I thought I was clear in the role at least how I what I do to fulfill the role in the form of responsibilities and and was surprised to to learn I I should have asked this a long time ago that there's virtually nothing in writing that guides council member activity um which seemed peculiar to me especially since we went to some lengths uh to create greater to raise expectations for applicants to boards and commissions to set some standards for attendance for them at boards and commissions as applicants and as participants for boards and commissions um that we had that we'd never asked for feedback and I see here that the that we would collect feedback for so I have no idea whether or not what I'm doing uh how it varies from what others are doing and what you might be doing that would be more productive from which I can learn I'm interested to range of things and the model for boards and commissions what it is um that we're expecting from them so um I think I think I think it would be helpful to have some guidance uh and this leaves a lot of degrees of freedom um but set some standards for for what they can expect from us just as what we've done is set some standards in terms of what we can expect from them councilmember peck uh thank you mayor bagley um to councilman march's point I agree with her in that uh each board and commission is very different and I have made a remark perhaps it should have been in a in a motion that I think somewhere on this agenda we should hear from a report from other council members as to what has been going on with their boards and commissions and uh because we don't know what each how each one interacts or what it is they need or how we should interact with them I also a couple of years ago made the motion that we have the friday morning session specifically for board and commission reports so each one of us knows what's going on with the other board and commission and we can see and judge how we are acting and is this what we need do we need to act in a different way do we need different things from different commission so I I don't think a resolution is the way to do it mainly because a standard that is an umbrella for all boards and commissions they're all different we all have to have different I would rather have a communication first about what each board and commission that we are liaisons for what is going on with them how we interact what do they need what is working and what is not and then come up with as a council uh a format that can be um changed I don't like the idea that we would communicate with each other by email as to what our board or whatever is doing because there's no interaction there it's just it's just an email but I I firmly believe we need reports I want to know what arts and public places are doing and not just from the minutes but from the liaison I want to know what I I would love to tell you what's going on with dr cog with nata with rtd but there's no format for that um and you know some of the the higher boards that I'm on they have a place in the agenda where the boards that met the week before their liaisons give a report this is what's working this isn't what working this board is not following the work plan of city council do we need to change it is it important that they do um and I would rather have one on one than emails so um I won't vote for this even though I do believe that we need to have interaction and I have brought that up in the past on two different ways to do it but I'm glad that we are going to have the discussion about it finally that's for christensen um yes I um I appreciate what uh councilman martins said I think that we've all observed that every single board is very different and our difference there there is a huge difference in our um responsibility if we are a voting member of something versus whether we are merely a liaison a liaison is really not supposed to be um a liaison has no voting power or any other power they're supposed to just communicate with each other but as councilwoman peck has pointed out she did ask for us to put something on the agenda so that we had an opportunity of at every meeting of city council to um comment on various things going on when I see something that's going on uh that I think is interesting as a city council I try to mention it at the end of the night but of course we're all pretty tired by the end of the night um I do think we can certainly expect that council members will actually go to their meetings and I do think that would be useful to um if they miss more than two meetings without I mean we hold the um members of the advisory boards to the fact that if they have more than two unexcused absences that they can be voted off the board I think certainly think that would be a reasonable thing to expect of our city council members and I I believe that most of us do that we go to the meetings and so I don't really see a reason for this resolution because it it's kind of like babysitting us you know we really ought to know better than any of this anyway I things like um check with the city council the whole of city council to confirm council positions before representing council positions to assigned boards and commissions I um these often come up when you're at the meeting and there's no way that you could consult with all the city council members to see what they think before you voice your opinion or I mean no one thinks that we stand for every single thing uh that as individuals it's obvious to avoid that we're expressing our individual opinion if they ask me what I think that city council will say if they bring something forward I don't speak for instance as a city as whole as being able to give them an opinion of what everybody on city council mean uh might think I try to imagine what city council um some of the questions they might have so they can be thinking about those before they bring something before us um I I don't think it's a good idea to invite anonymous feedback we get in people can give us anonymous people can give us feedback all the time and they do already we don't need to ask for more feedback um so I I I still think it would be useful to have the Friday meeting but what I thought it would be would be as I said patterned after what Rick Fitzgerald does at the senior center everybody gets five minutes that would be seven of us so that would be 35 minutes then we can have a few more comments then we can go home but we could also sorry I'm looking for rice um we could also just have that time we could just have that time um on the agenda where if people have something that they need to say um to the whole city council about something that's either coming up or something that has happened we should take that opportunity because it is the only time we get to find out what people think it's really nice that the city uh portal right now has uh because of long run public media they have filming films of everything and they also have the agenda it's very organized and people can check into this that they want but frankly I would rather have the city liaison say okay I went to the sustainability advisory board and these are the topics they discussed there's nothing that really relates to city council right now or you know just I went nothing much was discussed we have to be very careful too about sometimes an advisory board is always um advising about either department or sometimes it's a private entity that we give money to um we have to be very careful to respect their privacy and to respect the fact that what we say in public can have very bad repercussions on them and so we don't want to I just think we have a very uh we have to be very careful about what we say about our advisory board meetings because sometimes people don't really want us to make things public they want to they feel like they can trust us to not um explain all the difficulties they're having um anyway I I don't think this I'm glad that we brought this forward to discuss it I don't think this resolution hits the mark but um and I disagree with some of the things said here but I do think it's I'm glad we discussed it okay that's all I have to say Mayor Pro Tem thank you Mayor Bagley so just to echo a couple of things I absolutely agree with the sentiment that not all boards and commissions are created equal in the sense that there's definitely somewhere we're actually voting members of and I think that becomes an even larger impetus to make sure that you're attending those meetings otherwise you're forfeiting a vote as as you know a council member representing the council for instance and visit Longmont for instance we are a vote there um uh then you have commissions such as planning and zoning and historic preservation but it's actually probably inappropriate to interact too much with them as oftentimes those things can appeal appeal to council and so it's best sometimes just to simply observe um I don't really have going specifically to the resolution offered by council member waters I don't specifically have any problems with the bulleted points listed uh the only thing that that concerns me is that if we make some of these requirements so standardized and to a certain extent a bit onerous for certain members in the sense that this could become a barrier to folks who would like to run for office for the city of Longmont uh as far as starting to dictate so specifically maybe absences from certain boards or attendance issues or or certain things like that to the point where you know I know for for me for instance sometimes it's difficult to attend certain meetings um and that's just part of being a a younger married person working full time and you know life comes at you in different ways uh throughout your life as as you you know continue on the journey and so my time requirements may not be the same and like I said I just worry about that becoming a barrier for other people wanting to run for office so we make sure that we have the kind of diversity of representation that the city really deserves so that's my only problem with really specifying a lot of things like I said I don't really have problems with the bolded points that were provided in the resolution because I think they were they they provided enough leeway for us as elected representatives of the community to have some sort of you know judgment as to whether we're really missing the mark or not to be unceded because of liaison attendance issues doesn't seem like it would be appropriate for a city council member regardless um outside of that like I said it seems like a pretty straightforward and logical things that we should be considering as liaisons and those are just my two cents on it I I know this is a discussion so I don't think we necessarily need a motion um so I'll be interested to see any any more opinions on this at this time council member peck it wasn't that important no um checking with all of city council before we take a position you know in dr cog we always have positions on different bills that are coming before senate the state senate or um legislature and I I have to abstain on most of them because we don't get those bills maybe a couple weeks to take a council vote on uh after the dr cog meeting so it would be impossible to get councils uh input on that um and there are some things that I work very closely with uh phil greenwald and uh tyler steamy to get input on something that's coming on the agenda at dr cog or nata and they advise me on how we should vote for the city so um some of these just don't work on all of our uh boards and commissions it isn't that I don't think we should um not course uh communicate I don't like the word correspond because that leaves out any uh one-on-one talking or telephone calls uh communicate would be a better word for me in that um I would love to communicate what we're doing on some of those boards we just don't have the agenda to do it we don't have the platform and that's what I would like to to see happen and after we learn what the liaisons are saying about their different boards then perhaps we can at that point come up with uh with some points that that all liaisons should always follow but but I think they're going to be very general I can't see how they can be specific let's go talk to waters yeah I just um for me I run in as I said there were some experiences that provoked me to to wonder about do we have any guidelines um and I and I maybe I'm the only one I suspect I'm not uh on the only member of the council uh who from time to time is in interacting with somebody who's a member of a boarder commission and I'm wondering why are you talking to me and the answer is because the person who's assigned to my my my boarder commission the councilmember doesn't show up and I'd like somebody you know to hear what my concerns are and I'm not you know I'm not trying to pick on anybody but I don't know what to do with that other than to say I you know you go talk to that person I I have had I have had the experience of puzzling um over and I'm this is not uh councilmember peck when you're voting on a on a commission it is when a board member of this council represents to a boarder commission a position of the council that I scratch my head and think where'd that position come from because that's not the position that I think we took it's a it's a it's a surprise to me um because I think it's not an accurate portrayal and it would have been a matter of courtesy of nothing else but that councilmember to have checked with the rest of us to say I just want to confirm this is the position that we're that we're representing to this to the city or to this boarder commissioner or anybody um so I when I run into those things um there's nothing to turn to the in terms of guidance for me or for anybody else and I in in absence anything that we could point people to I guess we could come to these sessions and and then talk about and and then talk about them as one-offs I've had this experience last week um you know and if it if it's me that I'd want to hear about it and if this is the only time to hear about it then I'd want to hear about it but but to ignore them I think is irresponsible um which is what is happening now and for us to set a higher standard for the for members of boards and commissions than we would apply to ourselves I also think is irresponsible so this not may not be the right set of of of of um responsibilities for fulfilling the role but to not want to hear that I the councilmember's christensen about not you know wanting to hear anonymous feedback that's that's how we evaluate that's how we get evaluative feedback from folks is to say you don't have to put your name on it tell us what's working and what's not and to say that we're not interested in that feedback again I think is your response so you know we can walk away from it but um but I'm but if but I don't know what else to do then when I run into this except to bring it to a council meeting and say okay here was the problem that I heard last week how do we go about solving it whether it's me or any other member of council council member martin we'll go with council member christensen yeah I think that to adopt this resolution we would need to um I'm sorry I'm having cat problems here um we would we would need to um uh do something different marsha you disappeared I know I'm back um um the uh a little derailed sorry um I I think that the idea of of communicating individually with with council members to make sure that a potential representation of the council's position is not the right way to go about this in fact that it might be uh construed as making policy outside of the public meeting uh if we did that um in in a couple of my boards I do get asked questions like that and my usual example a usual answer is I don't believe council has taken a position on that I mean obviously you know in many cases the council has taken a position on it and I know what it is but otherwise the answer is the council hasn't taken a position and the role of the advisory board is to offer advice you know it would help us it would help the senior population if council took this position if council funded um uh you know back in the old days uh via services to get people to council meetings for example um was was uh one policy that the senior advisory board offered as advice to the council um so uh I I do have I I do have a disagreement with that um I think we do need in my my complaint about most of the internal advisory boards is that they um don't offer enough advice to the council and I would I would like it if they were more active uh in in that respect some of them um are more discussion groups that never yields anything up to council um and while it's fine to have discussion groups um they're not really fulfilling their their charter um by only doing that but then that comes back around to it's a standard for the board and not for the liaison I'd have to give more thought to what we do about that. We're going to go with councilmember christensen and then I'm going to cut off discussion unless there's a motion go ahead councilmember christensen um yeah I appreciate what councilwoman martin said about this I do think that um you know the original purpose of advisory boards was to give the public at large any member of the public a voice in local government and to help them understand local government um we have now um it is true we have changed um we have preferenced people with higher education and um I don't think that's necessarily a good thing we have made it intimidating for anyone who does not have a college education or who is not upper middle class to be on these boards I also do think that as councilman martin said that people are not they don't understand that they actually aren't advisory board and they should come up with ideas and we'll listen to them I I've observed over my last seven years the people are very intimidated by city council and they feel like I mean the whole their whole job which they volunteered for is to advise us about how well a certain department or sometimes a certain entity is working and what is needed between city council and those entities and yet they feel as as councilman martin said they feel like and they're supposed to just be at discussion group and there's nothing really wrong with that um uh you have to educate yourself anyway I mean with the sustainability advisory board there are lots of different people come in and speak and um it's very educational you learn about a lot of different things very a very broad array of things which is really interesting it the difference between these all these boards and commissions and things is so vast that I don't think we can come up with standards and predictability and um all of us are different and yet all of us on this board are equal we were all elected by the people of long want to represent them um and if people don't trust members of this council then I mean if our own council members call each other irresponsible I don't think that's uh very helpful at all as far as getting seeking anonymous feedback we don't allow people to write us anonymously that's why I think it's a ridiculous idea it it leads anonymous messages and communications lead to people saying things that they would never have the courage uh to say publicly because they know they can get away with it because they're being anonymous so I had to take great um um um bridge at the idea of anonymous feedback because we don't allow that in any communications with staff count with council right now and there's a reason for that um I also think there's a huge difference between when I go to um a typical advisory board is like seven members and me um and I have no I found my liaison I have no um voting power as I said none of us do and there's a difference between that and something like um council councilman uh Rodriguez serves on the planning and zoning board that's very powerful and and he gets a vote but no you don't get a vote oh I thought you did all right Marcia Martin gets a vote on ledp don't you no okay anyway some of these these the the problem is that when you have a vote and you're born of say with Colorado municipal league there are probably 150 people there and you get the um agenda two days beforehand and it's constantly changing until an hour before the meeting I sit down with Sandy Cedar because I'm representing not city council I am representing this municipality and many times the municipality and Sandy and the entirety of staff have already discussed these issues and come to some conclusion along with Harold of course and and that's what they want me to represent the Colorado municipal league represents municipalities against the county against the state it's often against what I would choose as either an individual or as a member of this council but what I'm supposed to be doing there is representing the city of Longmont the staff and administration of the city of Longmont and I'm doing that as a city council member and it puts me in a lot of very difficult positions but it's not something that I am I'm I always vote the way that the staff and and the city administrator want me to vote because that's my job to represent the city of Longmont I do that after spending a couple of hours talking with Sandy and so it's not it is that's a totally different role from when you're sitting down with 150 people or more that's a different situation and I don't as far as having predictability and consistency we all like predictability and consistency but I I don't think that's really something we should have a fetish about with boards and commissions so I won't be voting for a resolution but I think we should keep talking about this and figuring out a venue for us to have some kind of consistent comments some consistent time when we can comment about these because I would like to hear what everybody else is doing I guess I would just I just I just just just pipe in I would just ask that if you're not a voting member of the board I don't care what you do just make sure that when you're expressing an opinion when it pertains to me just make sure that you're actually expressing my true opinion if you don't like it I don't care just get it right and as many times I hear from other boards that oh so-and-so said the mayor and it's just wrong so I have no problem with people disagreeing with me or criticizing me just so long as it's factually correct so anyway Dr. Waters if you want to say something else that's fine but yeah I'm gonna make just one more time and I'll let it go and I won't make a motion it's clear where this would end up but I did hear councilmember Christensen make a reference to this council intimidating members of boards and commissions her words and then not wanting any anonymous feedback from boards and commissions and people who might be intimidated by a board or commission like this the one way we might get some honest candidly helpful feedback would be for them to not have to put their name on it if they're already intimidated that would be the whole purpose of gathering some anonymous feedback for the purpose of us getting better at what we do I've heard councilmember Christensen make reference to we don't get better without data those that see there's a kind of data not the only data but the kind of data that that people like us should be able to use to improve our performance whatever the comments are the concerns a fear of somebody saying something that's offensive it's hard for me to imagine if we structured a way to get feedback we get a lot of offensive comments offensive feedback but we might get some comments that would help us sharpen what we do that adds value to what they do so I'll let it go all right let's go ahead and wrap this up meaning that concludes our session on on lasons how about we all just do the best we can and we'll go nuts all right Mary pretend why don't you say something else thank you I just like to move that the meeting proceed past 11 o'clock if necessary a second anybody opposed all right consensus we're going to go past 11 all right um let's go ahead and just briefly let's fly through this uh discuss and establish 2021 city council meeting schedule I guess my herald I guess in the future I guess it doesn't only matter I won't be around so anyway go ahead let's go ahead and go through the schedule and basically it's we it's always the same every year if it's a week it's election or holiday we take it off make sure we get two regular session meetings in there and fill in the rest of study sessions shoot for four months but um let's do what we always do thank you mayor I think we can work pretty quickly through there's just a couple times um where we do want would like some direction so I'm assuming you all are looking at this draft schedule that I have got so January 2021 would be two regular sessions on the second and fourth Tuesday a study session on the first Tuesday on the fifth the question is would you like us to replace the second study session with an open forum yes and if it's virtual so last time you we postponed yes is the answer I believe everyone's going to say yes to that one okay um and then an overarching question is would you like us to begin again with copies with council in January even if they're virtual yes okay so January's done February is a pretty regular month study regular study regular no questions there so I'll just keep going in March um there is a possible NLC congressional cities conference a lot of councils seem or some council when they go fly out on that Tuesday so the question is um cancel that Tuesday we all cancel Tuesday the ninth by the way I'm just gonna say it and speak up if somebody disagrees I'm just going off the what we've done for the last nine years so yeah cancel the lot nine cancel the night that means we'll make the the 16th the regular session would you like to cancel the meeting the week of spring break st st brain spring break what day is that the 23rd March 23rd it's two in a row guys yes all right yes um can I break in for a minute yeah go ahead John since that is two in a row can we hold off on the NLC in case that is virtual or it will be uh in case we can't fly and then maybe we don't have to uh uh do two and a good idea let's hold off so we will cancel it if it's if it's in person don't cancel if it's virtual okay so um then a regular we'll see what happens with that that conference cancel the week of spring break yeah and then the 30th will depend on how the ninth and 16th pan out uh why um because potentially we'll need a second regular session two weeks apart from the other correct okay April is standard study regular study regular no questions there and we'll just keep copy with counsel on the fourth Saturday as we've done may study regular study regular may the fourth really when I'm taking the may the fourth off may the fourth be with you mayor kidding kidding in June um we would do a study regular uh if we've kept your pattern we'd make an open forum on the 15th instead of a study session June 15th would you like us to do that I also think we should get rid of the 29th if we I mean four four that's counsel I we've canceled the fifth meeting in the past anybody opposed to that the question would be the week of the 22nd is possibly cml and generally you cancel that one for cml and then the 29th June 29th becomes a regular session right so four meetings but a five Tuesday month right July would you like to cancel the study session the day after independence day so July 6th or hold that meeting that's not the day after that's uh the second day after sorry yes but the holiday celebrated is Monday the 5th I I'd like to cancel it but what do you guys think anybody opposed to canceling July 4th all right we'll go ahead and cancel it sorry that's ready the 6th okay and then uh the 13th would be regular the 20th of study the 27th the regular moving to August would be normal study regular study regular cancel the 31st cancel the 31st unless you'd like to also cancel the day after Labor Day in the following month and it maybe we hold that in case budget would like it that will Labor Day is the what sixth the sixth yes I say we do the 7th cancel the 7th what do you guys think cancel the day after Labor Day mm-hmm and then keep the 31st if needed yep okay the 31st what it's okay then the rest of September is uh normal the 14th would be a regular the 21st to study the 28th the regular October is absolutely regular study regular study regular I'm holding these sheets up for you apparently I think you can see these sorry November the first Tuesday is election day and it is a a council election year so I would assume you'd like to cancel that one oh yeah cancel that one you're gonna celebrate mayor regular on the 9th a study on the 16th and then the question is would you like to cancel the 23rd for Thanksgiving week yep and make the 30th a regular yep we're almost done December so December there's a couple I did two options one would be just do your normal schedule study regular study regular cancel the 28th week of Christmas can we just cancel December period actually yeah some of us depending on what we decided to do don't care but let's cancel the 28th so we could um do a regular study regular if you wanted to hold a meeting on the 21st or if you did the same you did this year two regular sessions on the 7th and 14th and then cancel the last two weeks let's count let's let's hold the 22nd in case we need it but can't cancel the last two have a 22nd meeting if we need it 21st I'm sorry the 21st yeah so cancel the 28th for sure okay and you you want to meet on the 21st I guess I'm am I getting my dates wrong December 2021 Tuesdays is 21st maybe my calendar got jacked up but I'm showing the 22nd of Tuesday is it not well I relied on this calendar I downloaded mayor in the wrong year Mr. Mayor I don't think so let me look in I mean January 1st 2021's a Friday and so the December before that no my phone it's the same as well Mayor sorry Google count Google calendar showing me Tuesday December 21st all right well I'm just gonna assume it's the wrong year but yeah the last two weeks cancel so we will go regular regular back to back and then cancel to get your two regular sessions in okay we will I'll throw this back in cleaned up so you can look at it as an information item so that everybody has that clean copy thank you all right great okay let's move on to mayor and council comments any council comments councilor Christensen um well tomorrow is veterans day and we won't get to have a parade and that's really sorry about that but I hope all the veterans out there know how much everyone appreciates their service so thank you all right I don't see anybody else but what I would like to say is just uh I'm an unaffiliated former Republican and as mayor of a small town in in Longmont Colorado I just want to stress how important is that we continue to recognize and and support our democratic process for selecting presidents and other elected leaders and I know I'm just a mayor in Longmont but I'd like to congratulate President elect Biden for his victory and I would encourage our current president to accept the apparent will of the people and I know my comments are going to upset a lot of people a lot of my friends but um it was a close election it was hard fought but in our country when you lose you concede and there is no even if even if there were sporadic instances of voter fraud which there may very well have been you legally cannot overturn an election based on individuals acting alone without evidence you have no case and uh without uh and I would just not only congratulate uh President elect Biden would admonish our current president to concede move on and let what has happened continue to happen a transition of presidential power so that we don't get stuck in a situation where we're confused and hurting so congratulations President elect Biden councilmember peck thank you mayor bagley for those comments I echo them but I also am very proud to be an american to be live in the united states because it is one of the few places where we can turn our government in a peaceful democratic manner without a coup without and have everybody's voices heard and I think that is uh that is a privilege and we should never forget that that we are very fortunate to have the opportunity to voice our opinion so thank you very much anybody else council member martin yes uh I'd also like to commend you mr mayor um for very well chosen words um I concur uh and I think in the coming year um I would like us all to work on having a consensus of fact if not a consensus of opinion because um it it's been frightening to me uh to watch people argue about what the state of the election is based on completely inconsistent premises um if you will separate sets of facts um we have um research and and news outlets such as the associated press in this country that um are nonpartisan and indisputably uh trustworthy and I I hope that all of the american public will remember that all right anyone else all right that concludes mayor and council comments city manager remarks no comments mayor council all right Eugene may the attorney comments here mayor beautiful all right guys do have a motion to adjourn so moved I'll second that all in favor say aye aye all right say may all right that's a name so uh that's a that's a that's not a name that's a big eye we're out of here it's late all right guys I'll see you next week thanks everybody


To add learning content to your Moodle course page, you use Moodle's Activity Chooser, which you can access by going to the Turn Editing On button on the right, or by scrolling down on the Administration block, clicking the link Turn Editing On. And then in the section where you want to add your learning content, you click Add an Activity or Resource, which will bring up the Activity Chooser. If you don't see this link, but instead you see two drop-down menus, then the first thing to check is to go in your Administration block to see if you have the link Activity Chooser on or off. If you don't see this, then check with your Moodle administrator about your Moodle version browser settings and site admin settings. What we're going to do now is click this link to take a look at the Activity Chooser, what it does. On the left is the list of activities, and if we scroll down, we see that underneath is a list of resources. A resource in Moodle is static content, which students would just read or look at. So for instance, if you were uploading documents, presentations, you'd use File or Folder. To present information directly, you'd use a page, you'd use URL if you had a link to a website or uploaded file. Whereas activities require the students to interact with Moodle. They might, for instance, submit work to you using an assignment, or they might contribute to a forum discussion. The list can also include resources and activities which aren't standard, but which your Moodle admin has added as extras. The Learn Moodle site, for instance, has big blue button for web conferencing, which isn't a standard module, but has been added. In order to find out about what each of these do, if you click the radio button next to it, information then appears on the right, telling you what it is, how to use it, and useful teaching ideas. And if you click the More Help link, that takes you to Moodle documentation to give you more information on how best to use it. You add an activity or resource by clicking the button and then clicking the Add button at the bottom, or if you don't need to read the information, you can simply click the button twice and that will take you to the setup screen.


Perfect thanks. Thanks for coming back from lunch for my talk So I wanted to start with this and then we'll get into some slides but what you see at the top is Our CLI showing us all the ppf events and then on the bottom we have various recorders Which are recording some things so on the left we're recording all of this shot to 56 digest of the binaries That are running in that pot on the middle. We have The applications that are making connections so you see curl is reaching out to ten two four four zero six and then we see All the BPF programs that are being loaded so we've created two a funk and a test Just for fun. So I'll explain this later, but let's jump in See if I find the right screen There we go, cool So my name is Joan fast man. This talk is actually prepared with Natalia. She's not here today But she she helped do a lot of the slides and the work to get it going. So Let's give her some credit as well What we want to talk about is you and your security profiles All right, so we want to talk about how to get least privileged profiles using BPF implemented in our favorite tools using BPF So the problem statement is how do we secure this right? So you look at your Kubernetes cluster and you have lots of stuff in it Probably some subset of those boxes. Hopefully not every one of those boxes in your cluster, but maybe who knows Right, so we have all these things and we're trying to secure them And we have this sort of guiding principle of least privilege, right? so the idea here is we want to only give the pod the privileges as needs nothing more and And the question is then why is that hard? So the first part of the talk here will set up like why why this is difficult and then what tools we used and then finally like How we solve this problem. So why is it hard, right? Well? Like we said, you had lots of things That previous picture with all the stuff You need to somehow figure out what your behavior should be Right, you don't necessarily know what everything's going to execute inside your pod You don't know every file. It's going to open every network connection is going to make Right, so if you want to sort of create a minimal policy that has just them Connections it needs just the binaries that needs files it needs and so on you need to somehow learn all this stuff to start with You need some notion of identity right like what is it that is doing this? Is it curl? Is it somebody who renamed their program curl and decided to use it? What version of curl is it? And so on Right and so the other reason is is you just have Lots of these things you might have thousands of nodes thousands of pods right you can't manually go in and read You know s trace every application and figure out what it's doing or you can't see it You know you can't be expected as a security person or an ops person to know what every application in your entire cluster is doing And so you have lots of data even about an application, right? If we think about all the stuff that BPF trace can do BPF We can trace networking we can trace Applications this calls all this good stuff right and we saw a few few talks about different types of data. We can see today But then we also have all of the metadata that comes with your network So you have kubernetes labels and pods and namespaces as well, right? So you combine this all together and we just have lots of data And lots of information, okay And then the last one I want to talk about is there's sort of a gap here Right, so your security and your obstacles they care about pods you care about your cluster They probably don't care like you know, I'm a kernel developer They probably don't care about the C group ID of that binary, right?  No, you care about the pod you care about the label you care about sort of the policy at that next level up And so what we do is we need to bridge this gap, right between what BPFC is Just you know an i-node on a system in a container back to what the What you see as an operator or a security person trying to write a policy for this for this system, okay? So that's why it's hard Hopefully you're convinced nobody stood up and said no That's easy yet. Anyways, all right. So what's our tool? Well, it's BPF day So the obvious choice is BPF right and why do we like BPF? I think people have gone into this sort of at length already, but there's lots of reasons why we like BPF, right? It's safe, right? We can't can't break your system easily at least We'll load our program And we can hook anywhere in the kernel we can read the kernels data structures so we can let the kernel do some Of the work for us Right, we don't need to like re-duplicate everything the kernel is doing and It's also quite Feature rich and especially if you think of a 5.5 kernel or a 5.4 upgrade or a 5.10 I think I've even seen some 5.15 kernels run around, right? You have lots of data structures you can use You can build your trees you can build your hash tables Do some looping all that good stuff, right? There's even locks and spin locks now, right? The next thing is it's transparent and atomic so the atomic is important from a security standpoint, right? You want to make sure that when I upgrade I can do that seamlessly Like I don't need to for example restart all my pods or somehow get a hold of the the network admin and tell him Okay, please shut down the network. I'm gonna restart, right? You don't want to have these like world-changing Upgrade processes and so BPF gives you that you can just switch the BPF program on the fly You can do it atomically so it's either on the old program or the new program never in between and definitely never without any BPF program, right? So there's no gap in your security security model Yep, so then If we think about how things that are done today, right? We when we were setting out to do this talk we looked around right? There's a lot of syscall profilers out there That will do syscall tracing and Give you some security on the syscalls so you can build an allow list so open maybe imagine like open and closed or allowed But I'm gonna block Set in s because I know that hey this pod should never do a set in s or set UID It should never change its UID right some of these sort of standard syscall things And this has been around for quite a while se linux can do these kinds of things as well, right? and This is great But the question that we wanted to ask me to talk is like can we do better better than just system calls? All right, and so what we did is we turned to our favorite tool here, which is tetragon I'm the maintainer for tetragon So it was a sort of a natural pick and what does tetragon do? I'll talk to you a bit about in more detail in a couple of its lights But what it does at a high level is you run it on the node and it attaches BPF programs to all these points in your Kernel to collect lots of data about your system All right, so you can attach to the C group create hooks so you know when C groups are created you can attach to the files So you know when files are created access read or write can attach the networking stack and so on and so forth Right all the way down the stack and then provides you an infrastructure to to build those hooks So you can apply these with a CRD in your kubernetes environment and you can get the data back out Through fluent D or through a GRPC tunnel if you need if you want to Right, so it gives you that sort of infrastructure to start building tools on top of And then here's some key points I think for for tetragon like why why do we like tetragon so much? The first one may sound obvious at first, but it's actually quite tricky It's to be able to always know what is running on your system. It sounds very Basic right but now Let's talk about what that actually means It means you need to have some sort of identity and you need to have some sort of location Right because it's not a single node. We're talking about we're talking about an entire cluster possibly multi clusters, right? And so what is an identity, right? It's not just a binary name because I can rename files It's not necessarily a PID because Pids change over time, right? It's includes all the libraries that are loaded. I want to know Not only did I run this binary, but I ran this binary and it loaded this version in open SSL Is that version of open SSL vulnerable or not vulnerable doesn't have my patch in it for my fix Right. It's the args that the binary was run with Build ID. This is something that your compilers will put in to tell you kind of trace it back to where it was compiled And then we do saw 256 digest here To give you kind of exactly what code is running So that'll give you an identity, but that's still not enough. You also need this location So inside Kubernetes. What is the location clusters nodes namespace pods containers and What else did I have in their time time is important, right?  Five minutes ago it matters, right and what you get when you put these two together and you get a unique ID Right now you can put that in a database and you can ask queries on your database Which are quite interesting you can say, you know, when did this this thing execute what time? What executed between these times on this node, you know slice the data anyway and create sort of interesting data sets The other reason it's hard is because the Linux kernel When you execute things, it's not a straight tree like you might think right you might think oh, it's just a tree But actually the kernel itself can do execs it can do clones Which means it can just exec over the top of its program Python libraries do this Java libraries do this a lot Just save space, right? They don't want to create another stack space Just exec right over top of the old image and when you do that you lose this idea of parent-child relationship that you sort of as a user expect But it's not always there in the kernel, right? It also when things exit if a parent exit doesn't necessarily mean that the children exit, right? And in fact, they actually in the kernel get assigned a new parent So there's all these semantics in the kernel that if you sort of naively take just the kernels viewpoint You lose the sort of abstraction that a user wants, right? You always want to know that tree Okay And then there's a lot of other types of execs that we can trace to etc No, not just the straight normal one where you think of you have a bat binary path name Can you execute it? But you can think of all kinds of other things like you open a file name open a file descriptor delete the binary and then run it shared memory mem fd files So on and so forth. There's a whole list of these and if you want to play with this come find me Let's chat. There's probably more ways than that I'm always happy to sort of improve that the tracing of tetra gone here or if we miss something let us know The next thing that that's really important is we can we can hook any kernel function As long as it's a function in the kernel we can hook it this the tetra gone crd is generic Which is great for building tools If I want to hook I think here I said Some function in the kernel I can write a crd and deploy it and then all of a sudden I get this data out on every node in the system You know every node the cluster will now have this new data without having to restart Upgrade change my tooling So sort of new use cases come in easily The advantage of this is we almost never hook system calls for security things right So if you think of a system call wire system calls good, they're good because they're convenient and they're stable but they're not nice because If you hook the with BPF here if you look at the diagram there on the right If you hook this is called and there's a pointer to user memory, and then you read the user memory That's still a user memory, right? So it's entirely possible that the user could then change the memory Okay, at which point your security tool is no longer reading the right set of bytes reading some other data But actually what's even more common is it'll fault right if you run this in a big cluster What you'll see is a bunch of faults happening you'll be like why am I getting fault on my system calls? It's because before that BPF program ran the memory was paged out BPF will just go I don't know how to try to track. I don't know how to track down that memory. So I'm gonna fault on it So for security things we generally try to stay inside the kernel Not on these system call boundaries and if you look at stuff like sd Linux and stuff They'll try to they won't actually trace these right they'll say that's a user pointer memory I know that's not secure. Don't write a policy against this. They'll stop you from doing that The other reason that this is interesting is because we can have virtual types right or slim types in some cases What we call them what this means is like do you really care what the file descriptor of an open call is? Probably not because it doesn't mean anything to you right if I'm in a multi cluster environment And I tell the security operator it open file descriptor 5 Okay, he has no no idea what file descriptor 5 is right So we do a lot of these virtual file virtual types where we take the file descriptor and we put the path name in there So now in your database you have the path name much more useful. Maybe the I know number even more useful It's the same way with C group IDs It's like I can tell the operator that the CI group ID was X But what they really care about they care about the label and they care about the namespace most likely And the same goes for all these other things like if you want to look at a task structure in the kernel It's a bit, you know might be bytes and bytes and bytes of data What do you actually want out of that task structure? You don't want to just print random data You want to print the things you care about right? Saves makes it more performant because you're not copying tons of data around but it also makes it more useful The other thing then we have is to directly address this like firehose problem right if I hooked fd install Which is the kernels version of loading a file? I'm gonna get every file in the system And if you we've done this what'll happen is you will get just lots and lots of data Linux systems like to open files Right. That's what they do So really you need some way to scope this down. You need to say I only want these files Here's a path name or a directory or I only want files that belong to this binary or you know You need to start scoping these things down think of network connections Do I really care about all the network connections that my DNS server is doing? Maybe maybe not right? There's gonna be a lot of DNS requests in there a lot of them are gonna be duplicates You know as you query the the local node local pod node so on and so forth as it goes down the line So what we do here is we try to scope that down for you give you a bunch of CRD selectors here We have match arcs and pads and a few other things So you can start to say like what do I care about you know from a security standpoint? Maybe you just care about things that are privileged. I want to know anybody who has capnet and men Tell me everything they do right these types of things And then the the last thing that really I think is really interesting about tetra going is it does the actions in the kernel? Okay, so it's done in line with the with the call So if you want to kill a process we will kill it from the kernel side What this means is there's not a delay right? You're not looking at a delay from when that events gets pushed from user set from the kernel to user space Through some user space logic, and then maybe later at some point it decides. Okay. That was a bad application I better stop it right it's likely already done the thing that it was you trying to stop right? So tetra gone has this ability to do it inside the kernel So we detect it. It's trying to open a file that we don't like or open a network connection We don't like kill the process right away Okay, so this gives us sort of our tool set and let's go and start implementing least privilege using this All right, I got about 10 minutes. It looks like All right, so what do we want to do? What's our task list to do this using our tools that we have so first we need to test environment So we'll build that up then we're going to collect some stuff and figure out what our pods are doing because we don't actually know What they're doing and then we're going to create a policy We'll apply that policy and then we'll see that it works okay, so The first way we do this is we have set of pods and we have this gRPC collector thing it's basically listening to the output of each each version of tetra gone each node and Creates a list of Events that you that you would want to watch for All right. Oops. Sorry. I'm going backwards knowing you And so I could talk to you about it, but I'm going to try to demo it here So let's do it and see how it goes All right, so this is what I talked about at the beginning of the about the beginning of the talk, right? and so this top thing this is a monitor of our Test pod we called BPF droid And we have this tool Maybe I can scroll up and see the thing for you Unlikely all right Anyways, we have this tool which kind of pretty prints the slimmed-down version of the events Right like this just sort of the relevant information the actual events are quite quite large and they have more data in them And then we have our collectors on the bottom and so I started three collectors here And you can see this top thing is doing stuff. It's basically on a 30-second timer. It runs much of stuff And then on the bottom we have our collectors So the left one like I said is the digest so this is a list of all the binaries It's running so each one of those digest corresponds to a process on the top Okay, the middle box is a curl. It looks like curl tried to reach out to something and then The right side is in our little demo pod. We try to load some programs a function and a test Okay, and so the goal here is to make sure like this is all that happens and then to make it a little more interesting What we're going to do is we're going to decide that we should never load test functions in our production pod Or at least our demo pod right, okay so How do we do that? go over here and Let's talk a little bit about what I have loaded because I've read said a lot about CRDs But here for example is a CRD for TCP connect. This is monitoring TCP sessions Right there On what this basically says is that I want to hook it to TCP connect It's not a syscall like we said we don't want to try to avoid hooking syscalls if we can and it tells us what the argument is It's a sock argument is the index zero There's some other arguments probably in that function call, but we don't care about them Right, we just care about this sock thing because we're trying to figure out what it's connected to And then we care about TCP close and TCP send message so connect Connect what do we have connect send and close and I put them in the wrong order Should put the close above the above the below the send and Then I have a BPF collector and these are just sort of trivial examples to show You might expect it like a production will have a whole list of CRDs and they might be longer But this this hooks the BPF load So when you load a BPF program one of the things the kernel does is it verifies that it's correct This hooks the verify call and then checks to see did it succeed? Did it fail and who did it? All right, three things you want to know and what did they try to load? What was the what was the program name? Pretty useful information if you want to know what's loading BPF programs on your system All right, so there we go and Then we have this data like we said over here We have all the data from the bottom all collected So let's try something Over here. I have this droid thing. I can do clear. This is just a shell into that test pod, right? I can run commands It's not locked down.  So let's do this I'll show you what it looks like let's look at our exec guard This is this is coming from the streaming data. I actually stopped it From streaming This was from a slightly early one because in case I did what I just did there and ran a bunch of commands I didn't want to get plugged into here, but there's some exact digest Let's apply it. All right. So now it's applied Let's go back to our pod. Here's our nice little pod My pods now locked down it would be nice to run clear, but it probably won't work. See everything is locked Can't do much of anything, right? So like maybe I want to try in a center Nothing works. All right, all killed and all synchronously, right It's not like it's not like I did actually got my innocent over to run it failed immediately and here you can see My little CLI is telling me. Yep, that happened in a center killed and tried to do bad things All right, and if you look at the background still running, right because those are on the digest I Can show you here too. Definitely on the digest BPF tool is fine All right Interesting Then we have a connected. Oops. Sorry, then we have a connect guard as well This pulled in data from that middle box I saved it from earlier So hopefully I don't have to regenerate it and I still have the same DNS names But let's give it a try and see. All right, so it's running so we should be able to curl Like we try to curl curl works by the way because it was listed as one of the commands in the digest We can curl other things. Let's see what Google has to say to us today Yeah, Google doesn't work because it's not in the digest sad, right? So we've locked down all the connects The only connect that does work is the thing we let work was the cppf dot IO right up Right up here Or I guess in this case we're doing Alderman base so slightly different one But so it doesn't matter the old the old part that we had used to do ebbf.io And I guess maybe that's an interesting point is I don't actually have to know what this pod's doing because I just collected the data and applied it and Then the last one and then I'll wrap it up here is we'll try to lock down the BPF tool So like if you look here, I have this test function running in my in my production pod My demo pod here, and I want to get rid of that. I don't want people to load test things in my in my pod So let's add one more policy When it tries to run what'll happen is it'll it'll fail it'll do a sick kill on it Or if we get bored I'm an impatient person So let's do this. Let's just run it directly. Just steal the command out of the this thing here and apply it to the pod and I can't even load this program anymore because I tried to load test so I'm pretty well stuck But all my stuff that is running normally in the background keeps running Right because that's part of my part of my list so That's the that's the quick test the demo I'm gonna skip through all these slides that explain the demo because I think we just walked through it, right? So here's the same pretty printer that we just saw And what is telling you here is just that you know this pod does this thing where it connects to the world And we can block it If BPF tool tries to load something we don't expect doesn't load Curl still works though except for when it goes to somewhere. We don't want to So let's wrap up because I think I'm low on time Yeah, two minutes So what this does for us is we get a least privilege We don't have to know what the pod is and sort of we go beyond syscalls, right? We're at least privileged as far as what's executing with this digest and like a full identity we We we sort of Believe that this is usually very hard to do right because you have to somehow collect all this data So if you don't have something like BPF, but you can collect all this data Pull it into your system and then generate these policies that you push back out Gonna be really hard to do. I'm not sure how she would do this, right? And I'm not sure even what tools you might use if BPF Wasn't there to help you So by using this BPF we can then add all these filters add these actions in the kernel and kind of get this least privileged thing That we want right and you saw that when I tried to log in to that shell I can't even execute things that are no longer no longer available to me So I like to end with this if you want to help I Would love it always looking for people to help. There's lots of things you can do There's the github page there silly I'm touch are gone I mean you don't even have to be a coder you can just use the tool file bugs Tell us where our documentation is not great You have a use case that I didn't think about go ahead and file a feature request can't hurt right? The documentation is always needs to be improved You know there's always something that we miss especially when were the users of the tool are writing the documentation a lot of times We forget things if you have a use case that you want go ahead and add it We we have a crd's examples directory where we just keep example directories in the bar of entry there We try to keep it pretty low right you have a you have something you want to trace somebody sent me a an umkiller thing the other day I don't have a use for an umkiller thing But we'll put it in there right and then it'll be with every code and we keep up to date and then we test them Right, so if you have a use case you put it there We'll test it if somebody tries to break it. Well, you know revert their patch nice for makes it nice for you If you have some use case that just doesn't work that's sort of interesting too, let's have a talk And then the other one is like if you have feedback on the crd's ui's that's always interesting for me I'm coming from the kernel side right networking side, and you guys are a lot of people are coming from the kubernetes side Right, so I talked with the kubernetes people. That's where we get a lot of this good stuff about labels and namespace and stuff But you know this room. I think there's a lot of people with expertise that could be quite useful Of course, and if you want to fix bugs more power to you so I'm not gonna stop you With that I Will stop and say thank you Brilliant round of applause for John. I feel like I just want to mention we have a city in project meeting tomorrow morning I don't know if you're gonna be there, but yeah, I'll be there Yes, if anybody does want to come and chat about contributing to tetra gone tomorrow morning the city in project meeting would be good opportunity Maybe Alex could come and start getting ready for the talk and while he's doing that Let's see if there are some questions for John. Good. I see a couple back there. Hey, this is exciting work I just have one question. So you mentioned that you don't want to hook into the system calls for good reasons, but many of the functions that You would like to hook into in the kernel in line and not available. Is there any guarantee that you catch sinks early before anything can happen So so is that is the question that sometimes you want to hook the kernel function But the kernel functions in line so you can actually hook it. Is that really the gist? Yeah, basically If there is a gap or if there's a guarantee that there is not the gap between the system call and the place Where are you actually looking into? Yeah, there's always this challenge right where perhaps it's not in line So you have to go read the kernel code and try to figure out where it's where the hook is And you know in worst case, maybe you have multiple hooks in the kernel that would be just one thing Usually I would argue Typically for a lot of things we want to hook kernel developers like to reuse their code So you can usually find like in the base like fd install for example is like an open one Everything that opens in a file descriptor calls that thing Same way with exec. There's like a hundred different ways to exec But you know the kernel developers don't like to write a hundred different lines of code So there's like one or two function calls that exec things in the kernel So usually you can find them it can require some digging There are a few cases that I know about where it's just not possible and what we do then is we Annotate the kernel so that that function no longer it gets in line and we have a hook there and You know that's sometimes not as very satisfying because it means you got to get a newer kernel But you know that's the worst case I've only hit that case a few times and usually we can find workarounds even if the workarounds are a little you know not Not as pleasant as you'd like them to be Another question here Thank you One of the points you made on the slide about you know the benefits of ebpf from a user perspective You know I was cheering for you the whole slide and then because this is all the stuff that I that I need to use At the end there was a line that you kind of glossed over which is about that it can be made portable Oh, yeah, I'm not I'm not asking you to like give a presentation on portability here But what I was interested in is where are the sticking points you see about portability from that end user perspective like what what are the challenges? to like some building some like tetragon that that you're that you could potentially start to work right so I would say from In users point of view from tetragon we strive to handle all that for you right so like as a user of tetragon You shouldn't have that problem. That's the goal Btf is sort of the catchphrase that solves all your problems You'll get the function names you get the structure offsets of course the if you look at the tetragon code What you'll see is that we pivot on some kernel versions There'll be some sort of duplicate functions that say if it's five four kernel We're gonna load this function if it's 419 will load this and if it's 414 we're gonna load this so from the developer side There is some pain there But I don't think it's that big a deal usually the code is pretty well organized and those functions tend to be pretty small They're like, you know Colonel again kernel developers don't generally Decide to rewrite their guts of the operating system on Dave and day-to-day right like if exec if exec loading is gonna change It's gonna be once and you know We're not gonna do it again for ten years probably right the same way with connect It's like the connect functions been there since to you know three x kernels hasn't Substantially changed the functions change but the BTF handles the function So the only real problem you would have is if a function exists that doesn't exist now Or somebody completely refactors the kernel and it does happen, but you know we deal with it and Try to make it transparent to tetragon users. That's the goal right from those users don't have that pain


What's going on is saying graven here with another video, but in this video They did it how about did it? How ball has done the unthinkable First off he was actually straight up This is crazy. I I I can't get my my head wrapped around this. This is crazy First off he was straight up. It's Wednesday, and he named the starting quarterback already. It's Wednesday He hasn't named the starting quarterback in forever Ever since We haven't known who our starting quarterback was gonna be ever so we haven't known for sure from hardball ever since um The Steelers game the last deal is game right before the bye week That's the last time we knew we knew from hardball who our starting quarterback was gonna be in the game Because he wasn't trying to let nothing out, but this is crazy. It's official now. This is Lamar's team But then That's not even it That's not even it How about you got to be watching the videos, baby? You must be watching the videos hardball. You must be watching them I know y'all be watching them. I know Ravens be watching them When when we went up there for that training camp they had confirmed that but anyway the craziest part about this with hardball naming Lamar Jackson the starter and calling Joe Flacco the backup is That that's this guy and he's willing to back him up He wants his job. He wants his job, but the thing that's the craziest part about all of this that really caught me is What was said? When hardball said Lamar Jackson gives the team the best chance to win When hardball said Lamar Jackson gives the team the best chance to win Thank you He must have watched the video talking about should Ravens fans give Lamar Jackson a chance and Again, none of this is a diss to Flacco at all because I know there are gonna be plenty of people that take it like that And it always is no matter how clear you explain something. It's always gonna be people that stick with what's in their mind Oh, they're just hating on Joe Flacco. It's just a diss to Joe Flacco. They don't appreciate Joe Flacco You couldn't be more wrong Shout out to I think his name is Rob Zen. He said oh he somebody had commented something and then Rob said well He said well this this channel spends much so much time just hating on Joe Flacco And I told him he couldn't be more wrong He couldn't even be more wrong if he tried Because you can't you can't be This is crazy. Oh, this is insane Hobo Hobo I've been saying it this entire offseason that those two are joined at the hip You can't have one without the other There's no way that these two split, but this could be the beginning of a split and A lot there were some people I know my boy I think Rob 21 jet set in the comment section weeks ago and there's other people that said it too But I know my boy Rob 21 Janet specifically, but he said Flacco has played his last down as a Raven He said he's done. There've been a lot of people in the comment section saying oh Flacco's done He's done. He's done. They also of course the people in the comment section say oh when Flacco is healthy He's gonna be the starter for sure.  No, no, no take that back Flacco a backup Healthy quarterback a healthy backup quarterback. This will be the first time ever Where the Ravens will come out on offense and Flacco will be dressed in uniform from head to toe and He'll be on the sideline like that. That's crazy. Oh Annie said Orlando Brown Juniors are starting right tackle to Getting it is hope I'm getting it Is hardball getting it Does this guy get it? I think He may finally it may have taken 11 years But her boss seems like he's getting it now the icing on the cake if her ball was to announce You know what hey in this draft In this draft and free agency this year. Well, if I'm still on a team, but in 2019 I'm bringing out for males back if you outspoken if you loud if you hyped if you are willing to stand up for yourself Stand up for your teammate stand up for your guys. I'm not kicking you out.  You're gonna be one of the leaders on this team y'all speak up That will be the icing on the cake That would be the icing on the cake the icing on the cake.  Well, I don't know about that part But how about definitely a doubt for flakko and For him to actually say that flakko is a backup and that Lamar Jackson gives the team the best chance to win For him to actually say that for him to be straight up. Can we keep this hardball around the hardball that's straight up? No beating around a bush the hardball that is calling it like it is Lamar Jackson gives the team the best chance to win The hardball that that's getting it He's getting it the hardball that did all the cringy dances pregame Can we keep this hardball around? The old hardball now I'm straight but this one Who hasn't been making any bad calls Well, he did have one bad challenge in the in the raiders game, I think but then my boy, uh, oh I think my boy Kisha me gives this a that Lamar Lamar's legs went down yet So maybe it wasn't a bad call, but either way can we keep this version of hardball? I saw somebody just asked me on Twitter. Uh, what what did the Ravens do with the real hardball? Who is this guy? I'll take him though. Looks like we got a clone He's he's getting it He's getting it. I Mean Zeus already. He ain't even had to name him the starter. We already know what time it was the James first was at left God, so we already know what time it was but The fact that he named Lamar and Zeus both starters What so the Lamar Jackson flacco thing because that has just been a debate the Zeus Brown Junior and James first No, that hasn't been a debate at all We already knew what time it was And it should have been that time at the beginning of the season, but that's fine you learn from your mistakes and It took an injury again. This is a season where things are changing Due to injury and that's just the way the NFL works. I had a question from subscriber I forgot who it was from but y'all to see the video within the next couple of days somebody asked If Joe flacco is healthy, does he deserve to have a one last ride? Does he deserve to have a shot at his starting quarterback job? Does he deserve to start again? And I said that it's not a it's not a matter of if he deserves it or not But it's just the way that the NFL works That's the way the NFL works Flacco was in this same situation 11 years ago, he wasn't supposed to be the starter. He's supposed to have his time on the bench or whatever learn grow whatever but Injuries happen choice of Chakao Buller got hurt Troy Smith got sick flacco stepped in boom The rest was history 11 years later Flacco got hurt. Oh Oh, and the also the situation was that we had we drafted a first-round quarterback So we knew we had a future right there with flacco. We knew he was the future But it wasn't supposed to be his time yet, but then 11 years later draft Lamar Jackson in the first round flacco gets hurt Insert Lamar Jackson boom Now it's his team officially Now this now in this game against the Bucks Expect Lamar to go off Passing wise running wise expect him to go off and let me tell you why Because this is his team now now his head coach has backed him over flacco If me or you were Lamar Jackson right now, we would have all the confidence in the world Why because we should now because a guy a head coach the guy who runs the show for your team He has been riding with this quarterback And you know how much of an important position quarterback is but he's been riding with this quarterback for 11 years straight 11 years straight and even when his quarterback got hurt.  I got your back coach. Trust me.  What's he doing wrong now? Oh, what he didn't set his feet on that path for 15 yards I don't like it. What he ran for 29 yards in the big first down and moved the field position No, he could have ran to the left and got about 30 more yards. I don't like it. The receiver dropped the ball Lamar he put in a receiver's hand, but the receiver didn't catch it Lamar. That's on you Now, of course, we know Lamar is gonna still make his mistakes That's a given that's a given but He's been doing this for four games He's been doing this for four games It's gonna happen. He's a rookie He ain't been doing this for long There's some guys that's been doing it for a long time, but just go they going backwards But Lamar he's been progressing Has he been putting up any crazy numbers as a quarterback? No No, but he's been doing enough He's been doing enough And again every week it just gets a little bit better If you look at it on paper, you can't really see that but you can a little bit But paper don't tell this whole story looking at the stat sheet that don't tell the whole story. It never does It never does first game What do you do one interception? I think Second game he threw two interceptions third game. He had three fumbles But throughout those games there were some passes that were just off the mark not even close. Hey, hey, who's that to? But then this game he threw no picks.  Yeah pressure pressure right there pressure right there Oh, and then his receiver slept on one of them too but um So yeah And he didn't Now and even in the falcons game, even though he threw some passes off the mark like the two to john brown He ain't though. He ain't throw it to where the defender could have got it And you notice that in this game too, he ain't throw any passes to where the defender could have got it. So Slow improvements better than no improvements Team keep it clean Appreciate y'all. Oh, I will look forward to y'all in the comments section If you if you watch this whole video, even though it's not even really long Y'all because y'all know I can go on forever, especially about this Just put a number eight in the comments section if you watch this entire thing I really love y'all appreciate y'all Make sure y'all check out the merch too, man Shout out because I know it's some people that orders the merch shout out to sam jackson. Shout out to uh, uh, gonic muse Um shout out to uh somebody else too. I can't think of them off the top of my head But shout out to the people that's been ordering the merch. Thank you so much. I love y'all and I appreciate y'all We out


Coordinators for the annual Goal Lake Frozen 4 have already made major changes to this weekend's schedule of events. The tent party held every year for the past 11 years has been moved back on land to a location about a mile north in Niswa due to the warm weather. With reports of multiple cars falling through ice around Minnesota this week, Goal Lake Event says that this change is for the safety of the people attending the event. This year due to the warm conditions, the rain, the slush, we just figured in for safety of everyone participating we wanted to move it on land. Smith says that despite the move from water to the land the frozen flop on Friday night will still be under the tent only people will be jumping into a pool of ice cold water rather than the lake. If you've enjoyed this segment of Lakeland News please consider making a tax deductible contribution to Lakeland Public Television.


This one's brought to you by DraftKings. Download the sportsbook app, use promo code Johnboy when you do. So Grankey gives his glove a kiss, looks ups, it's who am I facing? Eddie Rosario? Eddie Rosario? Okay, okay, I know what to do with that. Let me give that glove another kiss. Love you, glove, you know what? How about another kiss just for the heck of it because I missed you already? Mwah. Okay, don't wanna throw that pitch. No, I don't wanna throw this, that pitcher I wanna throw this pitch for ball one, doesn't get it, misses a little bit. Now Grankey goes to stretch it, ah, ah, ooh, ah, my shoulder, ah. He's like, you know, I need to throw a warmup over here. Throws one pitch, fires it, says, yeah, yeah, okay, good. Eddie Rosario's like, what, what, what was that? No, really, what just happened? What was that?  He threw a warmup pitch, like, I don't know, it seems like head games, is that legal? I've never seen a pitcher do that. So watch it again.  He's just like, no, I'm gonna throw it, one throw, nods, good. Eddie Rosario wasn't looking up, so he just heard the ball. I'm like, what was that? And I don't know what they would have told him, like, yeah, well, he just threw it to us. Do you guys know why? No, we don't know why either. Guessing he was maybe testing something out, I don't know. Be cool if he just was testing out a new grip right there that he liked, ooh, a little glove kiss, ooh, change up? Granky says, yeah, let's do that. And then that is rolled over to third, and he's out. And Eddie Rosario the whole time is like, I think I got got here, like, huh, I think that he was playing some head games with me. I think he just got me. So the next time he steps into the box, he's like, I'm playing games on my own. I am gonna take this first pitch no matter what.  And he just starts wiggling the bat as Granky's going through the windup. Letting him know, do what you please.  Okay, you're better at the head games than me.  Granky goes with the 60 something mile per hour curveball and Rosario just tosses the bat head out at some time, somehow it's a home run and he's laughing about it. So in the end, who won the battle of wits? Granky, he always does. Granky always does. He's just kissing his glove. He's telling you what pitch is coming. He's sitting on the mound when he's tired and he's gonna throw practice pitches to see if his shoulder hurts whenever he pleases. And you can't do a thing about it, but what you can do is you can go to DraftKings and you can bet on the twins to hit the over, especially if they're in division. The twins have hit the over in division game 75.8% of the time. That's a lot of the time. They're 25 and eight against the over. So go to DraftKings and just hammer the twins a score and give up a billion runs when they play a team in the division.


Yeah, I'm gonna go harvest a little bit more grapes. Okay. While we're here Because I caught up with the chat. I'm gonna pop a watermelon. I hope you're eating something delicious We already filled up this guy Right, why am I wearing a hat because it was cold initially What when it's nice and cozy right now, and I'm recovering from a little bit of flu that's been going around Let's fill up this one now this is getting in the way Let's put this guy here totally tangled up So this is what we ended up getting just from this in front of this entrance here Just above here plus a couple from back there, right? This much is available if and way more Throughout the whole thing Right. There was maybe a little bit more concentration here But there's grapes all around here just coming up like this like so Great vines are very there Well bunch lost on the ground. They're very They provide a lot of food Right, which is fantastic, which is fantastic. So these guys I'm gonna later on today I'm just gonna go wash them and Take them off the The vines so basically just take them all apart Right Just take these guys down and I take off the these guys at the bottom of them too, right? So it's a little bit of work It's a little bit of work.   I Think we have something left in the freezer.  This is what they look like. Let's see the size comparison So about the same size, right? That's nice when you eat them It's like tangy It's like frozen treat Right a little bit of freezer burn, but that's okay And then when you're cooking chicken you just grab a handful of these and go put it in the chicken Or on the chicken cook it with it and it's really refreshing We'll put this back on the freezer Hong Kong What did we get? Mr. Chat lots of chat I'm gonna put this in the freezer come back and catch up with the chat. Okay