The focus group on AI for natural disaster management is an ITU initiative that was established in December 2020 in partnership with two other UN organizations, the World Meteorological Organization and the UN environment. We're an interdisciplinary multi-stakeholder and international community which is exploring the potential and limitations of using AI to improve our understanding of natural hazards, so things like tsunamis or earthquakes. The ability to detect events in real time, our ability to forecast events, and our ability to effectively communicate an impending or ongoing disaster. Using real-life use cases, we're producing technical reports on best practices when it comes to data collection and handling, detraining, testing and implementation of AI-based models, and the integration of AI-based models in emergency communications and tools. It's our hope that these technical reports will form the basis for internationally recognized standards. Furthermore, in the form of complementary educational materials, we will make the content of these technical reports accessible to anyone who can benefit from their content and will be contributing to capacity building. The importance of the World Meteorological Organization to be involved in the focus group on artificial intelligence for natural disaster management is because of different reasons. The first one, because it supports global efforts to improve our understanding and modeling of natural hazards and disasters. The second point is because it pays attention to the needs of vulnerable and resource-constrained regions which are most impacted by natural hazards. The third point is because it distills emerging best practices to develop a roadmap for international action in artificial intelligence for natural hazards management as well in support disaster risk reduction. And the last point is because it is of international and interdisciplinary nature to help countries worldwide to improve communication of risks. The United Nations Environment Program is active in the field of disaster risk reduction. The focus group work on the use of artificial intelligence in natural disaster management. Increasingly, technologies such as artificial intelligence is playing an increasing role in disaster risk reduction as well. At the same time, UNEP is going through a time of digital transformation. So our environment in the focus group achieve our objective to introduce new technologies into disaster risk reduction as well as align with corporate priorities of digital transformation. The focus group on AI for natural disaster management is open to anyone who is willing to contribute. Please visit our homepage to create a free ITU account, to join our mailing list and to register for upcoming workshops and meetings. Hope to see you there.


Hi, welcome today. Today we're going to be talking about continuous delivery of stateful applications using Cinder. But before that, a little bit about our company. So we formed via Merger in 2016. We have offices all over the world in the UK, Romania, Portugal, Ireland, Malta, Gibraltar, USA, and Australia. We have an engineering blog, if you want to check it out, where we talk about various tech that we're using, post various articles on there on a weekly basis. We have over a thousand engineers at the company, and what really makes us different is the amount of transactions that we do. So we do 135 million daily transactions on the platform. We do around 30 billion API calls a day. So these figures are taken from our last Grand National, which is the equivalent of our Black Friday, where we do around three and a half times the traffic that we normally do. In terms of log data as well, we log a lot around 2.5 terabytes a day. And in terms of OpenStack, we are now building a 100K core OpenStack implementation with around two petabytes of storage. So in terms of the continuous delivery challenges, obviously you have two different profiles of application. You have your immutable stateless applications, and then you have stateful applications. So some of the applications that we are deploying at the moment is our Inframix databases for our sports book. We also have MySQL databases that we're deploying immutably, and also stuff like Kafka, where you need to copy the state between the topics. So we have some specific requirements to do continuous delivery of stateful applications. So we provision all flash storage with pure storage. We hook that into Cinder, and that allows us to programmatically control volumes. So in terms of what we do around this, we need to give our development teams the ability to extend volumes if they require and do that all through the OpenStack APIs. We also need to replicate data between volumes, because when we deploy, we have our A and B deployments. So essentially, we'll bring up a cluster A, and then we'll need to federate the state across to the new release on cluster B. And we'll take you through that later on. So really, what we use for this is Ansible, and we had to do quite a few modifications to the box Ansible modules, because we're using an earlier version of the Shade Library. But generally, what we did was we went and just used the vanilla ones that were available through the Ansible 2.0 release. The Shade Library is very important for us, because it gives us backward compatibility. And what we've also done is created some custom volumes that we've contributed back to the Shade Library and the community. So some of them were OS Volume Snapshot. So one of our guys in Porto, Mario Santos, wrote that module and has committed it back. We also have OS Volume Rename, because we required to rename volumes, because when you're dealing with two clusters, you want to persist the state and then attach it. And we'll take you through that workflow. We also had to write some Ansible filters, because we wanted to tag as via metadata the volumes we want to attach to HVM. So we tried to keep it simple. So in the static Ansible inventory file, we have, for example, Volume 1, and then we have those attributes, which are the name of the volume, pre-painted with the host name, the volume size in gigabytes, the volume type, or where the volume should be created. And then finally, the mount point, as mounted on the VM, and the file system type that we want for this volume. So after we spend about VM, we can see that same metadata tagged on the volume. And we'll also look at how we actually consume this. So we wrote a simple filter. This is the implementation of it. I will not go through the code, because it's not relevant. But what it will do is it will parse any case which starts with volume underscore. And then it will give you a dictionary. That dictionary looks like this. So with Ansible, you just call the get volume filter and pass the whole metadata. And it will return you a data structure, like the one showed below the screen. Okay. So bringing that all together, we wanted to implement this in our cell service deployment pipelines. And so really, we work in the principle of using 12-factor applications where essentially, your operating system is kept immutable. And that's every time you deploy, that's blown away and torn down. And then what we do is we treat data as an attachment. So that's what we use sender for. So we attach the state to each of the virtual machines using sender. We're also looking later at using it for bare metal and making sure that those shares are mounted and backed up, obviously, because you don't want to lose your data. So really, this is how it plugs into the cell service framework. So as Vellion went over, as you can see, we have our VM naming standards here, which is the names of our applications. Then what we do is we tag each of the flavors with a particular metadata tag. We use the Nova Xrespex filter, meaning that when you spin up with that particular flavor, it will land on those particular hypervisors that are specified there. This gives us redundancy per DC, because each application is split across to hypervisors. This means that if you lost a hypervisor, you'd only lose a percentage of your application. So bringing it on, we have the Ansible role to install it. And then if teams require persistent volumes, they will specify the volume here. So if they had multiple volumes, it would be volume 1, 2, 3, 4, et cetera. If you wanted different volumes to be specified and not to have that attached to each of those virtual machines, you would just insert a new line item. So rather than having it as a common variable, you would move it into the line item and then you could have a unique one for each of them. In this scenario, each of those virtual machines will have a one-to-one mapping with a unique volume that's specified there. So how does this look in terms of the self-service stateful workflow? So starting off, what we do is we pull down all of our Ansible repositories, which is essentially all the playbooks. The second step, what we'll do is it will create a unique flavor. It will then assemble that host aggregate based on that inventory file that's been specified there. It will tag that host aggregate with the metadata corresponding to the flavor so that when you spin up the virtual machines with that particular flavor, it will land in those particular hosts. The next step is we want to check the capacity. So we do a capacity check against the hypervisors to make sure that you have enough capacity to succeed when you deploy. We also check against the pure storage, meaning there's enough to provision the volumes. We then create our A network. So we also assemble the zone in Nuage Networks. Then what we do is we create the virtual machines and place them on that network so they land in those particular hosts. We then run Ansible or Chef, depending on what the developers want to use. So we have two templates for that. This will install the application on those particular hosts. So when we launch the VMs, we actually tagged those hosts with the metadata, which said the profile of application that would be installed. So the Ansible Playbook just checks that, reads it, and then will use those particular playbooks and roles to install the application. We then create a VIP on the Net Scaler. And then what we do is part of the rolling update process. This is a customizable step for teams. So they can look after how they deal with state for their stateful applications. So for instance, Kafka would not match something like Infamix. But the profiles are quite similar in the common workflow actions. So what they do is they generally will create a little custom Ansible Playbook, which will deal with state for their particular microservice application. So after the volumes have been created, we create a snapshot against them. So this is all part of the rolling update stage. We then mount the sender volume to the first virtual machine, so zero one corresponding to it. We then bring that volume into service on the load balancer. We then do the same for the second volume. And then bring that into service as well. And then what we'll do is we'll check if that, if all the tests have passed before promoting it to the next stage. So that'll be promoted. And then this will go all the way through. This is a prod pipeline, but this would be the same for your quality assurance environment, your integration, your performance testing, and production. So this is where it gets interesting when you're bringing it in and doing the B deployment. So again, same pipeline executes. We basically set up the prerequisite. So if you've got a change in terms of the hypervisors, it will rearrange them. So if you introduce a new host, the next deployment will go to that new hypervisor. This is good for disaster recovery as well, because if you wanted to migrate machines onto a new set of hypervisors, you could just introduce that in the inventory file, check it into source control, and then push it through. Check capacity again to make sure that we have enough to do the deployment. We want to fail fast, so you don't want teams actually provisioning against OpenStack if they don't have enough resources. So then we create the B network. We then launch the virtual machines into that network. Again, we install the application onto those virtual machines. We go to create the VIP. Basically, all of our playbooks are idempotent, so there's no change there. It's basically detected that that VIP is assembled in the correct state and no change is made there. Then we go to the rolling update process again. So what we do is we will create a brand new volume from the existing volume. We then create a snapshot of it. We then drain the connections in volume one. We then rename volume zero one to old. We then mount the new volume, and then we bring that volume into service. Then we move on to the next volume. So again, we create a new brand new volume. We create the snapshot. We then mount that particular volume, drain the connections, rename the volume zero two to zero two old, mount it, and then bring that into service. So that is how we transfer state across. So for instance, this is an example that we've used for infamix databases. Obviously, there's different ways that you can do this. Some applications you would lose too much data from doing this. So you could actually just persist the same volume. But the way infamix application works is essentially it can check the cluster and then basically it will replicate the access data to it. And again, what we do is we test the cluster. If not, we would roll that back to the previous release. And then we clean up the previous. Okay, so what we're going to do at this next stage is basically show this in action in OpenStack. I know animations can only go so far. So over to Billy. So if we can switch to the other laptop, please. Yeah. So here we'll show you a simplified demo with a single MySQL note and how we can migrate the state between the different deployments. As you can see, I was trying to keep MySQL sessions alive during this whole time. So let me walk you through what we currently have. So we have our... Can you guys see this? Okay, should I zoom in a bit? Let's see. Okay. No. Sorry about this. He's got a really long name. So as we were before. So we have our A deployment. That was the old one. And now we have our B deployment that is ready to go into service. At this point in time, we have installed MySQL on the new note. But we haven't attached the volume and MySQL is not running on it. So if we flip back to here, we can see that I have an SH connection to instance A and instance B here. So on this one, if I log into the database and use OSS database and do... Sorry about this. We can see that we have a single table with a couple of entries in it on the first note. And if I try to do the same on the second one, we can see that MySQL is not even running on it. And there are no volumes attached to it. And in this simple example, because it's a simple note, if we have a look at the C name, we can see that it's currently pointing at the A node. So if we try to connect to the database from a remote host by the C name, we'll get to the current A instance which is here. So what I'll do is I will walk you through step by step the Ansible Playbook. So I'll kick this off. And I've introduced pauses in it, but we can see the implementation of the same playbook just above. So currently, we are at the stage where we create the C name volume. So this is the volume name that will be migrated across. And because it already exists, it will just say, okay, all right, good. And if we flip back to OpenStack and filter on app, we can see that we have our volume there and attached to node A. So if we, and then next step, because it's a single note, we have, it's not a zero time deployment. So we stop MariaDB on that instance. And if we try this again, it should no longer work. Yeah. And the next step is to unmount the volume from node A and detach it. The pure driver is more optimized in the new version. So this is quicker. Or so they tell me. So now that the volume has been detached, we can see that it's no longer available here. There is no slash data. And then the next step, the next step would be to create the new volume as a copy of the existing one. So if we take this off and give it a bit of time and flip back to the volumes in OpenStack Horizon and quickly filter, we can see that we have our new volume. So it's a full copy. Yeah. And here we delete the old snapshot because we no longer need it and create a new snapshot. So what we do with the snapshots is if we need it for a particular test environment, we can snap off that and create copies. So that's why we create the snapshots. So our next step would be to attach the new volume to the new instance. Obviously this is a lot quicker if you don't pilot it, it's just good. Yeah. And if we do fdisk, if we can spell fdisk out on the new node, which is a good measure, we can see that we have our volume attached. So the next step would be to check the file system on it and maybe format it. But because the volume already exists, it has been formatted so Ansible will just skip over those steps. So there's nothing we need to do there on our rolling deployments. Yeah. So the way that we've done this, we make sure that you don't have two separate deployment pipelines, one for a one-day deployment and one for a rolling update. We incorporate the two and use the particular filters when conditions. Yeah. So our next step would be to mount the new volume. And if I do dfh, we can see that we have our volume attached. So the next step is where we rename the volume from data to data old and from data new to data. So that's with the new module that we had to write with shade to the rename. So if we go back to horizon. So this was the word we had before. And when I refresh, we should have data old and has already been detached and data attached to instance B. So the next step would be to prepare MariaDB and start it off on the new node. So in here, we can see that MariaDB is running. And if we use a database from before, we can see that we still have our data. So this is the point where we also flip the C name. So you could use a load balancer for this as well. But for the demo, we've just used DNS. So we can also access the new node from the C name record remotely as well. And you also get us there. So the next, so now that the application is running on the new nodes, now we're actually good to go to go and delete the old volume. So we just go ahead and do that. Obviously you've drawn some tests in between before doing that. Which we decided to skip in the interest of time for this demo. And this is then the playbook. And now we have our database running on the new node. And the old node is ready to be cleaned up further down in the pipeline stages. So this was our demo. And I realized I actually didn't go down the playbook as I was doing the demo. Yeah, so just go for it now. Yeah, so we create our C name volumes using our volume. We stop by reusing the service module on the old node. We unmount the volume from the old instance. So this is just using all the box modules, apart from the two that we've created and said before. Then we detach using our server volume, our volume to create the new volume. Manage the snapshots as well, using our volume snapshot. And attach the new volume to the instance. And then obviously do the file system checks and formatting if need be for our day one deployments. So with this model, basically teams can substitute in their specific stateful commands in between to synchronize the data, etc. And then we also mount the new volume again using upstream Ansible modules. Rename the volumes to old and new. So we tag the instances. When we put the instance in service, we tag them as live just to know that they're currently serving traffic. So we should not clean them down. But when we originally spent up an instance, we put their status as in progress. So if the pipeline fails for any reason, we can just kick off a new one and it will automatically clean down any VMs that are in progress or old, which means they're not serving traffic. So we put them into a live status when they're serving traffic. And that's just updating OpenStack metadata. Yeah. So here we set the ownership for the data directory for MySQL. This is mostly for day one provisioning. Start the service. And this is where you put in your custom load balancing solution. In this case, it's a simple C name using the info blocks modules. And obviously you delete the old volumes. And this is pretty much it on the implementation side for this fairly simple demo. Okay. Can we flip back? Thank you. So this is really the benefits of using this kind of methodology with all of our applications. So we do around a thousand code deployments a day to test in production environments. So every time a developer commits into GitLab, it will essentially trigger a deployment pipeline for their application. So that's why we have so much churn in terms of the virtual machines that are created.  And what we do at Paddy Power Betfare is each virtual machine will only last for a maximum of 30 days because we do all our patching at the start of the pipeline, promote those images, and then essentially do immutable deployments for each of our virtual machines. So we have some checks in place that check the age of virtual machines. And then if any team hasn't deployed within 30 days, we get them to redeploy for patching purposes. We've also wore the meantime to recover from failure. So the pipelines that you've seen are the same for each teams with just the customizable steps for the danceable role or the chef recipe to install the application. So the development teams own those roles or recipes because they're in charge of the application and they know it best. And then the customizable rolling update is basically customizable for each of the teams as well. And that's to manage the state. So some of the different applications you could have a rolling update that swaps boxes in and out of a load balancer. We have ones that flip over C names. We have ones that create volumes, as you've seen here. And the traceability factor is very key for us. So each of those pipeline steps is actually hooked up to a Slack channel as well, meaning that if we see any issues with a particular stage at any point. So one of the infrastructure self-service pieces, such as spinning up virtual machines, we will essentially get an alert on Slack where we can check it to see. And we also have a repeatable deployment process. So we don't allow teams to spin up virtual machines in a hundred different ways. We basically govern that centrally and then allow them the flexibility with the templates to substitute in the customizable steps that they need. And so the end state for us, I think we're a bit more than 644 hypervisors now. But the end state is 650 hypervisors per data center, which will take us over 100,000 cores on open stacks and around two petabytes of storage. Okay. And that brings us to the end of the presentation. We have a white paper that kind of documents our reference architecture on our bits and bits blog. This is just for other users if they want to go in the same journey and look at how we selected the tooling, how we selected all the vendors and basically how we put this implementation together. So you can check that out. I guess we've got time for questions if anyone wants to ask, otherwise we're good. Okay. Thanks.


Hey everybody Matt here for late in sports cards ripping 2022 tops museum collection baseball hobby six box half case break number 12 Pick your teams. We have Adam M pirates Andreas a Astros Anthony P. Giants Austin M Brewers Don L Rockies Edgar B twins Eric R Mariners Franklin T. Red Sox Gary a guardians Gregory M. Yankees Royals Hank V Dodgers James H. Nationals Jerry V Mets John W. Tigers Jordan D D. Backs Kevin R. Cardinals Matthew K. Rays Michael K. Angels Mike A. Braves Nathan S. Rangers Steven W. White Sox Suzanne P Reds and A's Troy L. Orioles William O. Cubs Marlins Phillies Padres and Blue Jays All right. Good luck everybody. But Rodriguez sapphire to 150 J. Aaron Durand Myron Buxton sketch reproduction and Red Sox quad jerseys to 99 Chris sale You go Boston next one. So we have White Sox Tigers Royals and Pirates still available for the next break Let's fill it up Pete Alonzo copper Griffey That is White Sox dual relic auto Eloy Jimenez Hey, what's up, Blake? Nice Eloy to 50 that is amethyst to 99 Juan Soto That is Mets jersey to 50 Dominic Smith go Mets and rookie copper Spencer Torkelson Four to go in museum half case number 13 picture teams that is up next with a White Sox who hit a ton in this Tigers Royals and Pirates and we have a frame coming big hurt and black frame to five red Sox Carlton Fisk There you go, Boston beautiful hit. There you go Red Sox That is hunter green Hunter green rookie copper The sketch cards the corners have seen fine. Nothing's really nothing's jumped out at me yet. It was being like bad Oh, did you have Boston in the last one Patrick? I'll take a close look here next time I pull one Yeah, nothing's really grabbed my attention Like corners being damaged or anything. Oh Did you there's Tony Gwyn? Yeah, those black frames are my favorite man. They're so nice There's wander rookie. This is Phillies quad jerseys to 75 Zack Wheeler It's how it's how it works for a lot of us Dean. It's Cal Raleigh rookie copper Bruhan and that is Joey vato sketch reproduction Now corners look great on this Dean Or as I can tell That is Cubs triple jersey auto Patrick wisdom. It's a 399. Oh the original art There's Shane boss sapphire rookie to 150 Yeah, I didn't notice any anything wrong with any of them that I pulled Trout and there's a blue jays Bat relic to 50 Lordus Gurriel, Jr. Well, the two that I've pulled have been on the original sketches are the Yeah, Mike trout and then Jackie Robinson this thing feels like a brick. I think we have a book coming. Yes, we do All right, let's see something awesome here.  I was like There you go. Yeah Do my work my homework know what I'm know what I'm selling. No, I'm working. Yeah, man. The hater was nice I love those books. I could pull three of them now Old Freeman and Merrifield over the last couple days and now here. There's Vlad. That's Ruby to 50. It's a Shane boss That is a cubs dual Jersey Otto Derek Lee 399 Lube a Is that right? All right, we have three to go for the next break white socks Royals and Pirates directly a plenty in these museum Jose Ramirez Guardians quad jerseys to 75 Jose Ramirez Told you I do my homework. I practice. I practice my pronunciations in front of a mirror. I Record them and listen to him on my car on my commute into work. His Royce Lewis rookie copper That Is braves patched at 35 Austin Riley Go Atlanta. So just a few breaks left to fill for tonight Again, you can catch me on the LSE baseball channel most of the time Five days a week So we have three to go for the next museum half case and then two to go for the one after that Two to go on diamond icons one box random hit style. That's number 46 It's Mike Piazza copper Reggie Jackson sketch reproduction and White socks rookie Otto to 299 Gavin sheets Don't tell anybody. I'm gonna very quietly be buying up Gavin sheets rookie Otto's from Tops Chrome this year The dude's got he's got power. He's gonna be a good player And then we have seven and four to go on our elite football half casers numbers 11 and 12 Random team style seven to go on I max football here random teams at the end of the night George Brett copper price and stop This is Dodgers quad relic to 99 Gavin Lux to jerseys two baths Go Dodgers Nobody wants to see that slugger. It's Max Scherzer amethyst and 99 Jeter and Gary. This is nationals dual jersey Otto Patrick Corbin. We go Nats. That's the 275 I wouldn't be opposed to dressing like Dusty Rhodes Ronald Acunha junior Are you talking about the polka dots? There's a Cal Ripken junior sketch reproduction and Cardinals patch to 25 Nolan Aronato Go St. Louis thinking Aronato Jersey might be my next might be my next Jersey purchase Anthony Rizzo copper O'Neill Cruz rookie De La Cruz that is brave sought out to 25 Tom Glavin. We have two more half case pick your team styles Think three and two to go in those yep three and two to go White Sox Royals and Pirates last three teams available for the next break Shane Bieber copper That is Hank Aaron sketch reproduction nice Hank nice angels Archival autographs two of 125 Shohei Otani Nice hit. Congrats angels. There you go angels. Nice show time Nice Patrick. There's Bobby Whit jr. Copper Jiro Soto doesn't yell it's look like he's talking on an old cell phone there or like an old cordless phone So weird That is Mets patch to 35 Francisco Lindor Yo, Rodriguez amethyst rookie to 99 very nice Congrats mariners Beautiful card nice color match. We'll mag that one for you.  What a box man. This has been great. It's the 299 Call him a shot. It's too light for that Alex Bregman. There's CJ Abrams rookie. This is Phillies Quad jerseys to 75 Bryce Harper Reese Hoskins Alec bomb and JT real Muto go Philly Chipper copper copper chipper Still free to go on the next break White Sox Royals and Pirates free to go. Let's get it filled up I'm gonna tweet it out. I hope so Patrick. I hope we get one in this in this half case All right, so let's fill up half case number 13 pick your teams. There's one more thing. We go last box Let's finish strong here Blake Snell to 150 sat fire That is Mike trout sketch reproduction and Yankees quad relic to 99 Josh Donaldson two jerseys two bats Go Yanks Oh, yeah, Willie Mays copper out of Thomas That is Cubs dual jersey Otto Nico Horner go cubbies to 399 Freddie Freeman That's artist proof Ronald Acuna junior sketch reproduction Reggie Shane Bosnett is Astros jersey to 50 Kyle Tucker. That's 50 of 50 Yep, limited to 50 prints on those artist proofs Still free to go on the next break White Sox Royals pirates. Let's get the that break filled up hit recap cross face there There we go Astros jersey to 50 Kyle Tucker That's Yankees quad relic to 99 Josh Donaldson Philly's quad relic to 75 Harper Hoskins bum and real Muto It's Mets patch 35 Francisco Lindore Cardinals patched 25 all in our Nato Dodgers quad relic to 99 Gavin Lux Braves patched 35 Austin Riley Guardians quad jerseys to 75 Jose Ramirez That's blue jays bat relic to 50 Lorda scurriel junior Philly's quad jerseys 75 Zach Wheeler Mets jersey to 50 Dominic Smith That's Red Sox quad jerseys to 99 Chris sale Cubs dual jersey Otto Nico Horner Those to 399 Blue Jays dual jersey Otto Boba chef to 299 Braves Otto to 25 Tom Glavin. That's nationals dual jersey Otto Patrick Corbin to 275 White Sox rookie Otto to 299 Gavin sheets Cubs dual jersey Otto Derek Lee That's the 399 Cubs triple jersey Otto Patrick wisdom 399 and White Sox dual relic Otto Eloy Jimenez to 50 We had the It's 25 Brewers, that's telly a autograph book card Josh Hader. I got a six boxer here. We had mariners Rookie Amethyst to 99 Julio Rodriguez Angels Otto to 125 Shohei Otani and Red Sox black frame Otto Carlton Fisk To five that'll do it for the break. Thank you everybody appreciate it number 13 is up next


The city of Nairobi County, Honorable Sakaja Johnson, the CSD Volition and all the other senior government officials present here, my colleagues and the general public. Mine is very simple, is to welcome the governor of the city to talk to you. But before I do that, I'd like to just make a few comments about today's event. Today's event reflects the final stage in the realization of the new government of the mandate that the people of Nairobi gave us to manage their affairs in this city. And I believe that with today's event, it is now fully incumbent upon us to drive these affairs forward and to make sure that the promises and the expectations of the people of Nairobi are met. We know and we believe that the work that has been done by the NMS has been huge. It's great. I have seen a lot of it and I believe that the work they did is excellent. It is good for our people. It is something that we needed as Nairobians. And I want to thank them very much for that piece of work. But now, it's for us, as the people running the city, along with our employees in the county, to ensure that we create systems, processes, procedures, and corporate governance structures that ensure that the citizens of Nairobi receive the service they so expect. It is our mandate. It is our expectation which must improve the service delivery in this city. We must ensure that people get what they expect from their leadership. We must ensure that we transform the city. We must go to the next level and ensure that people feel we have brought in a different leadership. With those few words, I'd like then to ask all of you to join me as we welcome the governor of Nairobi City County, His Excellency Sakage Kyozoon, to address us. Yes, Lissie. Thank you. That's Andy. Thank you very much, Deputy Governor, Major Buddy, Lieutenant General Buddy. I was told the other day I'd like to go to Twitter, Major General. Thank you so much. Waziri Ujinomalua, the Honorable Attorney General, of course, Status Controller, my good friend, Shibu Akinudia, and everybody who is here. I acknowledge your presence, a KRA, the Intergovernmental Relations Team, Ambassador Mushiri, my good friend as well, and my successor, Atungao, who now is your inaugural partner at the Guyana's Association, and everybody who is here, the people of Nairobi. Good morning. I want to say thank you. I want to say thank you to the NMS. The journey was not easy, and Waziri Ujinomalua has alluded to some of the aspects and some of the things that were happening. When I was a senator, I was involved in coming up with that solution, because Nairobi County Government at that time was unable to execute functions. My predecessor, His Excellency Governor Mike Sonko, at that time was encumbered by a court case, and you remember the ruling was that you cannot execute your functions and you had no deputy, and so we had to find a solution, and I remember spending a lot of time with the former president and the team thinking of what to do, and we came up with the deal of transfer, but I was told on the day of signing that I should not appear, because if I was in there, there would be no signing. We later learned that other forces were used to encourage the signing, other inducements. I want to confirm that this morning I have only served tea, and the one of what only general declined to take tea, I think out of fear, that there would be something I have put in, as Anteni Sano. I want to acknowledge the presence of my MCAs from Nairobi County Assembly, and I will ask one or two just to make brief remarks. I'll start with the MCA for Waidaka. All MCAs, you don't even go on to our own, please recognize the MCAs we have, they are an important part in delivering for the people, so, to our Salimia, La Pia Shagimora. Good morning everybody, your Excellency the Governor, Lieutenant General, and all protocols served. My name is Anteni Karanja, I'm serving MCA in Waidaka Ward, and serving in Nairobi County Assembly. First of all I would like to say thank you to Major General and NMS for a job well done. We have set the bar in providing services and doing projects in Nairobi in terms of quality and in terms of speed, and I want to agree with you that some of the projects would not have been possible if it was done by politicians, like ourselves. I would also like to acknowledge the Nairobi County Assembly that was also in place to provide the necessary legislation to make sure that NMS was a success, and the process of transfer of services went smoothly, so, and I also assure his Excellency the Governor that still as the Assembly, we will still be there to provide the necessary legislation and necessary support to make sure that we achieve what we want to achieve for this city. I would also like to thank you because you are helping our Governor achieve what he promised the people of Kenya and the people of Nairobi that we are going to return the services back to the city as quickly as possible. It may not have taken the one week he had given us, but it is finally here. I would also like to request the staff at NMS and at Nairobi County to make sure that this return of services is smooth, is smooth, and we are going to benefit and it's going to continue serving the people of Nairobi like we vowed or we took out of office to do, so thank you very much the people of Nairobi for electing us and for electing Governor Sakadia, as Santé Nisana. Your Excellency the Governor and all protocols of love, I thank you for giving the MCAs the opportunity to address and just say two things, one the Honourable Minister had alluded to that there is the issue of uncaring the COG into law and IGITC, maybe also to add the same way you've seen it fit for MCAs to address, that the county assemblies forum should also be part of it so that the whole engine of devolution, not one arm is left behind so that we ensure that the all systems of devolution go across board. Secondly Honourable Governor is that we are very happy that we've seen, we've lived to see this day, the issues that and all the functions taken to national government are back. We want to assure Nairobians as the MCAs one of our key roles is oversight and of all the processes, all the activities that were done we'll be very happy to work together in terms of oversighting whatever was done and being able to bring to account and bring to account for every shilling and every value for the shilling for the benefit of Moana Enchi in terms of oversight. I thank you. Thank you very much for those remarks indeed the county assembly and allow me to congratulate you for being sworn in for the MCAs, was sworn in yesterday. Walikua MCAs elect until yesterday, now they are properly constituted. Also to congratulate our new speaker, Moundrabuken Gondi and the deputy speaker Moundrabukados on the election. On top of anchoring the county assembly forum, I have been persuading my colleagues Governors at COG that we want county assemblies to be financially independent, that you can get your budget directly not through the executive and that is a process that I hope together with the Intergovernmental Relations Committee and the State Department of Evolution because it will still exist. You can make sure it happens so that the county assemblies get their funding directly for you to do oversight. I believe in oversight. I have been a legislator for the last 10 years. I know the power of representation and it is not me being oversighted as an individual. It is the county government. We need it and we will support you as you do that. Devolution is an amazing gift to the people. It was a highlight of our constitution 2010. It is a gift that has ensured that parts of this country that have never seen any development have been able to see development. We devolve fiscal responsibilities and political power. Unfortunately, as I have said, there had to be a situation in Nairobi where some of that was moved back to the national government, but today all the functions are back to the people, the people of Nairobi. The lady in Mutwini who is going to the dispensary of the hospital needs to hold to account somebody who she has voted in. So does the young man in Kayole, so does the father in Mihango. That is the power of the evolution. It is based on the principle of subsidiarity that a function is best offered at the lowest level compatible with the benefit area of that service. Of course, it is a relationship. Devolution is all about the national government or about the county government. It is about both working together. And I have been assured from very high sources and let that announcement be made by the right person that there will be a State Department of Devolution to continue with the work that has been done. It is that important. And for us in Kenyakwansa, bottom up means Devolution. You are right, Wazir Eugene. And I am very happy that you also know bottom up, you know, and that you believe in it. Wazir Eugene is my big brother and we joke a lot together. We really missed him on our side. But I am very happy to promote him. I really want to honor the NMS and the staff at NMS. You did a good job despite challenges. I know in the beginning there were a lot of challenges with this side. But I want to encourage you that we still need a lot of your work. I want to urge my staff in Nairobi City County Government and those who are coming back, that you are all now one. There is no for my NMS staff and for my country government staff. You are all staff of the Nairobi County Government and you will work together as equals. So what will happen? We will have space for everybody. I want to assure the nurses, because many of them felt that when NMS goes, that they will go home, we still need you. We need you to serve our people. Ultimately, every action we take, every activity we engage in, is focused on the people of Nairobi and are going to act in their best interest at every time. So Karibunisana to Marubisha City When I came to City Hall, I found amazing people. My first meeting was here. I was not with the directors and the chief officers of the CECs. I met the staff, around 10,000 staff of Nairobi who are the square behind there, listening to me. The first thing they say is that they have never been addressed by a governor. The second thing they say is that whenever they gather there, it is to strike, not to consult. And I told them because it's in your bottom map, I will start with them. And I opened for them suggestion boxes for the staff, where I personally open and receive the letters and I read. I want to thank you, all of those who have written, because you have told me a lot of things. But I've gotten a lot of information about the county and you will see action being taken as we move along. I want us to see ourselves as one family tasked with the gift of stewardship over the people of Nairobi. We made promises. We went to the people. I want to see all of us as partners in delivering to the people of Nairobi. Let's remember the common person in Nairobi. Nairobi is going to be great. This is Africa's capital and we must make sure it shines as a city of order, a city of dignity, a city of hope, and opportunities for all. We want to make it easier for people to do business and not to stifle their business. In fact, in the coming week, we're going to sit down with all the informal traders in Nairobi because I know now that they saw Muti, a bottom map, I mean here, they are everywhere. We will sit with them and agree on how to organize their work because all they are doing is trying to ek out a living for their people. I have said let them not be harassed, but let them be facilitated. Once we agree on the streets that the hokas are going to operate from and the timing they're going to operate from, they shall be left to operate. Then be each given a number and they will do their work. In the last one month, we've been able to try without my MCs and I'm happy they're there, without the new cabinet in Nairobi, but I want to thank those who've partnered with me. We've been able to collect more than 54,000 tons of garbage that had filled the streets. I'm sure when you walk around, you see some changes. Every day we're doing 2,100 tons and now once the MCs pass the budget, we're going to reconfigure the method with which we're going to clean the city. Nairobi must be clean, Nairobi must be sparkling. We've been able to start the recapiting of 22 roads starting with the sunken parking. We have now lit up the CBD. If you walk in the evening, you can see there's a change. The lights are on. Soon you're going to light up Ngong Road and many other of our places, especially the informal settlements. Work has begun and work is moving. I want to thank all of those we've partnered with, especially the military. And I must say, we've had this discussion with the Commander-in-Chief who's the head of state. Together with the CDF, we're going to be entering into an MOU framework where in the areas we will see the military, we will work with the military. And I will give you an example. The Central Garage has really improved. Our vehicles were everywhere in many garages. Something small was being charged with a million shavings. But with the leadership of NMS and the general body, they were able to bring it back together. We shall continue that operation. In fact, I'm glad to announce that what is to be the fueling station at Central Garage is now going to be revived within a month. Our petrol station is going to operate. And we're going to enter into agreements and buy fuel at about five shillings less than commercial rates so that we can save the people of Nairobi millions and millions of shillings. We need that efficiency. We've also agreed that we're going to do a proper tree planting exercise together with the private sector.  There is the green side, then there is the brown side, and there's a side which is almost being a desert. We must plant trees. We must plant trees in the city. I know those outcry about the pruning of a tree down the road. I think it was pruned a bit too much. But we're going to replace. We're going to bring fully grown trees. I know together the Central Bank were bringing a lot of the counties from Malaysia that are going to line up Marambe Avenue. We're going to line up City Hallway. Let us bring back the green city under the sun that we knew as young people. When we were growing up, I grew up just two kilometers from here. The city was green. We still have Camero, connecting garbage, water was flowing. We must return Nairobi to that status and to take it above and beyond what it has been. I'm glad to report also that we're making a lot of progress on the issue of water. You know that every day the pool of Nairobi require 850 million liters of water, but we're only able to get 525.6 million liters. Together with the AFI Water Works and Nairobi Water, we've had a discussion with this excellence of the president to speed up the northern collector tunnel so that it is done before the expected date, which was next year December, so that we can add another 140 million liters of water per day and make sure that water is received by the people of Nairobi. Water is a matter of dignity. They all need to receive it. Additionally to that, we are already in discussions to continue the waste to energy plant. Dandora will not be the same again. We're going to convert our waste into energy and the MRF facilities that nobody has spoken about across the town. And our young people are the ones who are going to do that work of collecting the garbage, sorting it out in the sub counties before it is transmitted to the landfill. I think without going into much more details, let me assure the people of Nairobi. The task I have received is huge, but it is not daunting. There is grace, there is goodwill and I am a hard worker. I will wake up every single morning to serve the people of Nairobi in all the 14 functions given to us in the constitution. We are going to make Nairobi work and we'll make it work together. I need you also to play your part as we transform the city. We are capable and we are grateful that there's a lot of support that is coming to our city. It is not going to be magic. Things will not change in a day or two days. We will be patient, but you will see incremental changes as you move on home and work together on that. I want to assure those that might be worried that there might be victimization or there might be favoritism that everything we do will be based on objectivity, even if you have been stuck on the other side, come back home. If you have something to tell me, my door is always open. You will get to me, but we will serve our people with dignity and with diligence as we move along. The functions are now back. I know the subcommittees are still going to give the facts, but let us move ahead. In the next few days, possibly next week, we shall be naming our cabinet together with the deputy governor and we shall issue the advertisements for chief officer positions. Please, people of Nairobi apply. Come join us in this noble task of making Nairobi work.


Hello everyone, so I appreciate that you are here at that late time. My name is Selits Tachov, and I'm the author of Air Spam Day Open Source Spam Filtering System, and also I'm a FreeBSD developer for more than 10 years. In this talk, I will talk about one particular integration of Air Spam Day, and actually it's about integration of Air Spam Day in FreeBSD email. This talk won't be about performance of Air Spam Day, because this release doesn't process more than one million messages per day, and I consider this volume as very low, so I don't care about performance at all. So the tasks were how to build spam filtering, because nobody likes spam, and especially nobody likes spam in mailing lists. And because mailing lists are the main source of information and you hate to archive spam messages and so on and so forth. So that's quite an important task, and here are some explanations about what was difficult. So let's start this talk about the architecture of FreeBSD mail. So there are a couple of mixes, and I'll draw some sort of flows of mail here. So we have FreeFall, where all developer accounts live, and there are also aliases. So email comes to MX-1, and it integrates with FreeFall to operate with local email. Then we have Mailman, which operates why MX-1 and MX-2 is used for outbound spam. Sorry, for outbound. Yes. Spam as well. Then MX-1 operates with MX-2. MX-2 can send back and deliver notifications via MX-1. FreeFall can send email via MX-2. Mailman can send emails to FreeFall for local users. And that was my opinion about all this system. So luckily, we had some sort of help of the postmasters, in particular from Remkalotgar and Kiril Panamoryov, and they actually built RSPOMD in these complicated mail flows. I did just small adjustments, actually. So the main problems of the email architecture is that we have very complicated mail flows. So there are many relays, many aliases. So lots of users prefer to use something like Gmail instead of using local clients, and actually it complicates the situation. And also email has very non-trivial circuits. So in some cases I could see like 16 received headers for a single message because it constantly ping-ponged between different relays. And there are lots of legacy decisions because FreeBSD mail is almost as old as FreeBSD, so lots of decisions are from 90s when we had something like UTP. So the decision to filter spam and some other stuff was to add RSPOMD because I'm a FreeBSD developer and I'm the author of RSPOMD and I suggested postmasters to try this project because it's free in the open source. And to resolve our issues. So that's something about RSPOMD, so it has web interface. That's not FreeBSD relay, that's just my random relay. And internally it's represented as a complicated system of different layers. It integrates with MTA using MILTER in our case, so we use postfix and hence we use MILTER. In our situation we don't use separate proxy layer, we combine proxy and scan layer, so it operates in self-scan mode and internally it uses different things and actually all of them with exception of bias are used for now, so we use even neural networks. I'll talk about it a bit later because it's a bit tricky topic. So what problems we've tried to resolve with RSPOMD? So the first one is actually spam in the mailing list. We don't like spam, nobody likes spam. Another problem which was also quite important was that we break the Kim signatures when they pass our mailman and we wanted to do some sort of controlling of our mail flows because we had completely no understanding about how mail goes and how to make it better. Well, not this one. So my personal motivation was mainly to reduce amount of spam in my mail client. And actually that's some of samples of messages that I've constantly received from FreeBSD mailing lists. And what's more important I couldn't filter them because my profile of RSPOMD, my own RSPOMD local was so that actually mails from FreeBSD lists are usually trusted. So the vast majority of emails from FreeBSD lists are actually ham and they have very low score, low negative score. And also FreeBSD relays are listed in some of DNS white lists. So basically it's impossible to use any RBLs and other stuff because they're hidden beyond the FreeBSD relay. That's why I constantly asked about let's install RSPOMD, let's install RSPOMD and try to do something better because my filter can filter these emails and your filter cannot. So now I still receive some spam from FreeBSD lists because actually we are currently quite cautious about rejecting email. But what you can see that there is special symbol called spam flag. It means that the relay on FreeBSD marked this message as junk and actually RSPOMD can recognize this and treat this email separately. So this email wasn't my junk folder, luckily. And actually that's quite good. So in future we plan to reduce reject score and to increase probably junk score to filter more emails. Because currently that's the profile of our today's statistics. So the vast majority of emails are ham. But actually these statistics is a bit skewed because basically on mailing lists, on each email that comes to mailing list we have like 200-1000 of emails that are coming out. And actually because of this complicated schema we see these messages many times. And since we send these emails to all our subscribers we actually have a situation when we multiply one ham message and send it many times. Obviously if message has been rejected we don't send it to subscribers. And that's why this profile is a bit difficult to understand because basically it's not true that the vast majority of emails are ham. Because we have lots of spam but due to these multiplication effects from mailing lists we don't see this in this stat. Another problem of this statistic is actually using of neural networks. Because for neural networks they assume that your traffic is somehow balanced. So it learns the model using half of samples spam and half of samples of ham. And in this situation neural network is also not very useful. So this is also quite a complicated topic. So the plans for future are to improve neural network in the way to reduce number of the same training vectors. Because currently it just pushes everything so if a message has high enough negative score it just tells that let's learn neural network from it. Actually that's not quite a good decision especially for this profile of traffic. So we have improved the situation with spam but there are obviously areas to improve it better. I'll talk about it a bit later. Another problem that we result with Rspomday is actually to sign messages. Because in many cases we have the following situation. We have something like Gmail or other sender and this sender signs their messages using their private key. Mailing lists are usually modifying messages. So they are adding some sort of disclaimers or this message has been delivered by some mailing list, blah, blah, blah. And that actually breaks the key signatures. What's worse is actually that Gmail in particular rewrite sender, sorry, sign sender. And sender is the special email header that is always rewritten by Mailman. And actually all messages from Gmail have broken the key signatures. And this situation is not very good because many users don't like when they receive messages that are from some sort of untrusted sources because you don't see anything good from that. So the trivial solution is actually to add another key signature. And actually Rspomday is used for this as well. Obviously there are some other solutions like OpenDikim. But in our case we have Rspomday so why not use it for the key signature, the key signing. And in this case all emails that come from FreeBSD are digitally signed by FreeBSD early. It makes some users happy. Actually there is one thing here. So currently we sign all emails. Even if we decide that this email is junk, we still sign it. I think that should be fixed at some point to not sign messages that are not trusted and that are considered as spam because it doesn't make any sense to sign spam. Another technique is actually to use Arc. So unlike Dikim, Arc provides the way how to organize chains of trust in emails. So in nutshell it looks like that each relay adds special header. Actually there are three headers. And each relay increases special counter. So basically unlike Dikim's signature you don't know when this relay has added this signature. Obviously much something like received headers. But usually the received headers are not signed. But Dikim for obvious reasons because they can be added in any order. For Arc there are some senders that are using Arc, in particular Gmail, then Yahoo. And as far as I remember Microsoft Office 365. And what's more important that all these providers who are using Arc, they also recognize Arc. So basically if you have this Dikim signature broken, a message still can be verified because there is some trusted relay, for instance 3bz relay, that tells that this email was successful before I modified it. So the idea here is that you can have message and you can modify it because you are like trusted relay. And you can tell another relays that the initial message has like valid signature. And another relays if they trust you, obviously they can tell that okay, I trust 3bz and I know that 3bz won't lie about the initial signature and I can improve our sending experience by adding this signature. So that's how it works. That is email that has been passed from my domain to 3bz delist and then it was received by Gmail. So Gmail actually signed it one more time. And in this case you see that the i equal 2 means that there is the third relay on the way. And also there are authentication results. So you can see that the body hash from the originator is not verified because it was broken by mailman. But the ARC verification and Dikim verification afterwards was successful. And actually it helps to interoperate with email services providers and it helps to improve delivery basically. So what are issues with signing? The main problem again is that we can see messages many times. So in some cases we can see a single message on a mix 1 like 3 or 4 times. Yes. And accordingly we need to enable and disable signing and checks because we have seen this message. And that that's not done actually that we should not sign spam.  So that's how it's resolved in RSPOMD. So there is a small snippet. So all configuration is stored in local d-folder so we don't modify any vanilla configurations. That's recommended way how to configure RSPOMD because all the time when I have bug reports in many cases users are just modifying vanilla config and don't know how to deal with the upgrade. And that's the way how it should be done. So here we just define some rules and enable and disable some symbols according to their pass when we see this message. So for instance we don't add multiple Dikim signatures. That's quite important because otherwise if we see this message multiple times if you add multiple signatures from the same domain then one of these signatures won't be valid. That's the idea. That's not true for ARC by the way. Yes. That's not missing the Dikim signature. I mean yes I know but the question here is that from the perspective of ESP it depends because invalid Dikim signature means that your DMARC verification if you have some sort of DMARC rules can be totally failed. And if you have no Dikim signature well I've implemented many DMARC. I've implemented DMARC in RSPOMD and I know that well RFC tells treat it in this way but actually sometimes it shouldn't be treated in this way because basically if you receive message with broken Dikim signature or without the Dikim signature from PayPal oh yeah you're right. So I'm just telling the same thing in other words. Sorry. But in this case it just ensures that you don't have two signatures because one of that signatures will be valid and another will be not valid. ARC works in this situation but Dikim doesn't. So now some words about what we want to do actually because well currently we have very, we have working prototype but there are still ways how to improve it. So first of all we have a big pain point now. So there is a special script on Freefold that sends e-mail for developers and unfortunately this script adds this disclaimer just after body of message and as far as you see it's my message. In my message you cannot do it because in my message you need to insert the signatures inside of mine parts and actually if you have multi-part alternative parts you need to insert the signature into both text and HTML and that's actually not easy because there are many situations when you need to insert the signature in right place and that's why I've decided that it could be a good task first from there because I can modify it from there. So that's again some work in progress project that can modify message and it knows about multi-part messages it can insert signatures for text, for HTML parts it knows how to deal with DSNs, it knows how to deal with 7-bit encoding it knows how to deal with Quoted Printable, UTF and so on and so forth so it's pretty much sophisticated. It also can rewrite subject because in some cases you need to do this so literally it can do things that are typically done in Mailman but this list is special, it's not done in Mailman so that's what we want to do and also we think about including here the Kim signatures as well so every mailing list should be signed so this part is also missing now so we don't use Bayesian statistics and that's actually bad because basically it's good to have personal bias for our users we have lots of developers who are good enough and who are eager to train their spam filter and who can do their spam filtering better unfortunately it won't work for everybody because all people have different preferences and the generic idea is actually quite simple so we plan to add generic bias that will be used for everybody with some sort of generic training corpus and on top of it there should be some sort of personalized statistics it can be implemented in NERSPOMD so it stores everything in Redis and it can actually check first of all one thing and then another and adjust things according to users' preferences so that's one of the biggest plan that we have also we want to present better statistics because this one is from my spam trap, it's not from FreeBSD but we want to have something similar for FreeBSD to view how many messages we receive, to view how many things we are sending to view popularity of mailing lists and so on and so forth so this is done by a project called Clickhouse and this is bought from it called Redash so basically it also works almost out of the box the only specific for BSD is actually that this system is more Linux-oriented so probably it will require some sort of manual modifications it is written in Go but I suppose it should work Clickhouse itself has been ported to FreeBSD so if you want to call an oriented database with lots of analytical features and very high performance in terms of storage, you can check Clickhouse it's ported to FreeBSD also you can do some sort of analytics so it's CQ like so actually that's all it was very short talk about how we integrate R-Spom-D in FreeBSD my goal was not to describe lots of things about R-Spom-D because I can talk about this for a very long time and in this particular presentation I wanted to explain this practical implementation so if you have any questions, please ask so we can just use these aliases as a map in R-Spom-D as a map so it's possible to read it as hash so we can just add additional aliases for learning that's how it's done so basically you can just tell something like learn Spom there's some specific key that is available for developers and we will just accept this message and learn Spom for him just for him yes because that's a complicated question because basically we have false positives all Spom filtering system has false positives and if you reject that you won't see it and in many cases unfortunately there are too many broken senders who won't react to the essence and that's actually real life and the idea is actually to sign it and to leave it on users' consideration probably we do some sort of statistical mistakes we really learn this message as ham and we are done if we reject it we cannot do anything the only alternative to this is somehow currentiness but currentining, that's when we support currentining but postfix requires additional daemons as far as I remember to do currentining so that's why we just add flag and tell our users that just use this flag to mark these messages as Spom in your C rules that's all the servers which receive that's possible, yes that's possible but we plan to reduce reject score but we don't plan to reduce it to grey level so there will be definitely some sort of grey zone obviously we are trying to reduce this grey zone as well but currently we have too high reject threshold if we reduce reject threshold this problem should be resolved because nobody would reduce reputation for grey mail yes, that's great yes does it deal with being the string you actually put in name and the encoding of the mind part? so what it does so internally in Spom this text is decoded so this code is operating with decoded parts and actually for text parts it's recommended to use quoted printable in any case so that's general recommendation and that's from the JSON codes encoded printable forgetting about the original encoding why do so? because first of all if we have 8-bit encoding it doesn't make any sense because many relays doesn't support 8-bit encoding by default so they don't announce it and what should we do actually with 8-bit encoding sending it via these relays so 8-bit is not an option Bay 64 is done by some... well I would have said broken ESPs but actually many people are sending text in Bay 64 but actually it adds lots of overhead so the only sane solution from my point of view is just to encode everything in quoted printable and furthermore it encodes everything in F8 so if the original encoding was like something like Koi 8 that dash R it should recode at UTF-8 that's limitation but unfortunately I don't have to support all these zoo of encodings because some of encodings are absolutely brain damaged to tell the truth yes it will recode at UTF-8 but it works for UTF-8 so that's the point here actually in GB something and ChivGIS you can encode Kirillic letters as well so they are full-unicode compatible but again that's what I'm talking about brain damage encoding right Danian? and the second has policy of known if you break a signature with policy of known there are no implications and adding another decaying signature for your domain which says it does not compensate for breaking the other signature? well it depends but the only solution for this problem for this particular problem is actually ARC I don't see any resolution about how to fix broken DMARC when you have to do it because of like standards for instance you need to write this GDPR node I think everybody knows about that but you have to do it and you have to break from address? change a sender yes that's another option but sender writing is actually something that also quite difficult to implement properly from doable doable but 8 seconds yes thank you very much