So, way better, I think. Yep. Thank you. All right, so, my name's Kareem Citerli. I'm a former operations engineer. Now I work as a developer advocate at HashiCorp, where I get to tell people about best practices, how to implement them. Generally, I don't get paid when stuff breaks in production. It's kind of like platform engineering, love it. You tell people what to do, don't actually have to do it. Well, past life, I worked on high performance ad tech, serving the stuff that everyone uses app lockers for, appreciate you all for killing my job. After that, switched to the Amsterdam airport, worked in their industrial IoT team, where we made a lot of security conscious choices. Was a lot of learning on the job, if you want to call it that way. I'm at KCiterli pretty much everywhere. So, if you have thoughts about this talk, let me know. If you want to talk about chocolate cakes, definitely let me know. Very big into that. So, let's start with something fun. Get everyone excited about this. We've been here for three days, some of us even longer. It's been amazing, 16 tracks, and the conclusion really is OSS has won. It was in the competition, but OSS definitely killed it. And that makes me happy. It makes me happy because it means that we validated an approach to engineering, where we can bring in engineering skills from other teams that donate their time to make our applications, or whatever else we do with code, be better. The apps you run on your phone, your dark images, the software you use on your PlayStation, even the cars navigation interface, all of that has open source in there. Pretty much amazing. 98% of applications have OSS dependencies, and if you let that sink in for a second, it's like, cool, there's no way back. You simply can't go any other way. And it's great, except now, every one of those teams is in your repositories and in your source code. We stand on the shoulders of giants who themselves stand on the shoulders of Titans, and we gotta trust a whole lot of people. It's beautiful, it's magical, and mostly worrisome to me.  So, quick level setting. Let's talk about software development at software lifecycle. We'll start with the most simple one. Building, usually on your local machine, these days, maybe GitHub code spaces. If you've never tried that before, I suggest grabbing a tablet and seeing how much you can get done without the distraction of your computer. It's magical. I'll go with that. Compiling, of course. Used to happen on your machine. Hopefully now it happens on a build server, and the reason for that is really that you have more control. Control is important, especially if you're talking about supply chain security and delivering value that is reproducible. Next up, you build artifacts. You gotta put them somewhere. Used to be that the build server was also the server that ran our stuff. Maybe it was your machine with some Ngrok in front of it. That's great for a hackathon, not great for your environment, not great for your auditors. Formal security aspect is two choices you can make. Either you can help your auditors be happy right now, or you can help them be happy once the incident has been triaged. I prefer to go with make them happy now. And of course, running. Kubernetes, Nomad, whatever you use to run your applications in production, the patterns are pretty much the same. And then one thing that I like to add in there, if we're talking about confidential workloads, if we're talking about making sure we know what's running, we also need to figure out a way of making things go away. So revoking. Revoking access, revoking access credentials, but also revoking access to specific images, outdated images, vulnerable images, vulnerable binaries, and have a process around that. And the way I think we can do this is we split it into four parts, but they all come down to a single thing. It's all about building trust. Each part in this life cycle is very strongly this. Trusting people all the time. Trusting is hard. If you've worked with people, if you're an IT that usually happens, you've had to trust people. You've had to trust your seniors to tell you the right information for you to be able to work. As a junior, you have to trust that what you're doing is useful for the product. As your product manager or project manager, you have to trust that your engineering team does the right thing. There's a lot of that going around. Lots of entities that build on each other that require each other. So, level setting out of the way, let's talk about some of the patterns that we can use to protect the process, the build process in our case. Quick show of hands, who here works for a company that has more than 1,000 employees? 5,000? I'm sorry for you. If you work in an organization that has a corporate IP, sorry, IT department, not IP, you might, if 5,000 people, you might have a corporate IP department as well. Any device you have usually gets encumbered or enhanced depending on whose side you're on by some corporate malware. And that's great. I work at a company that locks down laptops. It's beautiful because I can leave this device here and I don't have to worry. It also means that when I actually want to work, this is not the best place to be. These apps make it harder for you as a developer to create things and to deliver value. But they help other teams deliver their value. Important layers of protection. I like to joke about it, but it is important that your endpoints are protected. If you work at a startup, you likely have none of these problems. I envy you. It's beautiful. But for those of us that don't, you know this is kind of like Jurassic Park. Life and engineers find a way to make problems go away. And the way we do that is real simple. Somehow you always find a way to be in the root user group. And as long as I have root access to my machine, this is no longer a trusted endpoint. Or it shouldn't be. No matter what the auditor thinks. You might hit a couple of green check marks in whichever system your company uses, but if you have root access, that means somebody else can use this as an attack vector. And we don't want that. Our corporate IT department has asked me to tell everyone that endpoint protection is important. Your laptop, your phone, anything that can talk to corporate IT infrastructure is worth protecting. Please let people know of that. So there you go. These are true words. Controlled environments are important. If you're building safety software, safety critical systems, if you're working on software that makes the light go on when I push a button, I'd like for you to have a workstation that is secure and trustable. I also realize as a developer that that is not very easy and usually not very fun for you. But I also pay a monthly subscription for my utility so I really don't care. Ultimately, laptops not controlled environments. So from a software building perspective, if we're talking about hermetic builds, reproducible builds, supply chain security, you can't really trust a developer's machine. I've got root access on here. Any malware you install, I will certainly help to be sandboxed away and not impacting me. So for all intents and purposes, and this is an important one, for the safety of your applications, assume hostile intent for everything that comes from a development environment. You can't build enough protection onto a machine where your engineers have root access. That's okay. You can't hit 100% of protection on that device anyway. I'd say why bother at that point? Corporate IT has thoughts on that. The reason is if you don't have that protection, you can't trust it. So we gotta shift the trust to somewhere else. Somewhere where I can't skip checks, where I can't work around the system and come up with my own shadow IT. Which is important.  We all know that built pipelines usually have that little escape hatch where if you set the right variable, all those checks that usually take 45 minutes to run they automatically pass. Calls the folks want to test. That's okay. As somebody love because you know what I'm talking about. Appreciate that. I usually say in my intro, it used to be a failed stand up comedian which is why I now work in IT. The one person laughing was why it's a failed part. So let's talk about some of the patterns we can use to protect the compilation process. And when I talk about compiling, it doesn't matter if you're using a web application where you're just web packing everything. It doesn't matter if you're assembling containers, zipping files, actually compiling things for different operating systems. We're just gonna use it as an umbrella term. We talked about hostile intent. Very important. This means that the code that ends up on our build server is not something we can trust. Which puts our build server in a very, very weird position. Something comes in, it's not sanitary. I worked at the airport where we had the split between the clean group of people and the dirty group of people. It's not a race thing. It's more who got checked by security and who didn't. If you were checked by security, you would consider clean and you could access different parts of the airport. Do the same thing with your build server. Any code that comes in should not be able to have a direct path to your application environment. If it does, any other boundary that you come up with is worthless, no matter how much energy you put in there. Not just on a network level, on every level. Ceiling things off from each other is a good thing. Ceiling things off from people and having silos between teams, not a good thing. Silo's between your code and your place where you built the code and the place where you run the code. Definitely a good thing. Gotta verify everything automatically. Run all the tests. And for this trust to be established, it really comes down to, we can talk about signing. We have to talk about storing things the correct way. Talk about verification. No matter if you're using Salsa or a different approach. So the supply chain levels for software artifacts. Or you're just running simple, very simple stripped down software composition analysis. You need to automate these steps. I think it was mentioned in the keynote either yesterday or the day before. You can't scale security if you don't automate it. And you can't scale supply chain security if you don't automate it. If you're an application developer, if you're an operations engineer, you deal with secrets all the time. We finally figured out that we don't need to have hard-coded secrets. We can request them at runtime. Turns out all these patterns also actually work for a lot of other approaches, such as signing our software. I'm a huge fan of GitHub Actions for a simple reason that I wasted too much of my life on getting a certain Java-based build server to run. And GitHub Actions, despite the down times, is a magical platform. 80 bucks a year, gets you 3,000 minutes a month. I mean, if your builds take longer for your personal accounts, then you know what? They deserve more money, which probably gets all of us more uptime. You might substitute the patterns that I'm gonna show you with legacy build servers, such as Jenkins or more cloud-native ones like Spinnaker. It's not important which tool you use. It's important that you understand the pattern. And for this, what I'll do is ignore the title. Code slides are hard, but definitely look at the code. For this, I'll use Terraform to configure my GitHub organization. I'm an operations engineer.  I like to do things once properly. And my preferred way of doing that is to codify it and express it as code. Because then, once I've done it, I can apply this to all the GitHub organizations I work in. Codification makes sense because when you look at the code, you know what's happening. This is the first layer of transparency. You don't have to question what things did he click in the UI? What things did he maybe not click in the UI? It's just explained here. So, quick step back to Salsa. We talk a lot about level one, two, three. We have scorecards that help us figure out where we are in the journey. It's all great. It sucks when we don't talk about level minus one, level zero, whichever one you want to start counting at. Basically, the foundational level of is our build infrastructure secure? Is that server where we run our builds trustworthy? Or is it just basically another developer's laptop? Put differently, how do you establish trust between what you're doing and what's happening on your build server in a reliable way so that you can trust that what the build server tells you is true is actually not something that was tampered with? It's a hard question. It's not a question that you can answer in 30 minutes. It's a question that requires multiple teams to work together and it's a question that requires you to very likely re-architect part of your pipeline. And whenever you run build servers, most of us work in the cloud. You've got a shared responsibility model. AWS tells you, look, this is what you're liable for. This is what we're liable for. It's great. We all click yes because I mean, it's an end user license agreement. Of course, you're gonna click yes. It only becomes a problem when stuff leaks and you end up on a new site and then have to crawl back and see what you actually said yes to. The long and short of it is you must carry out certain actions to protect your infrastructure and the cloud provider agrees to do the same for fee, of course. That being said, proving that your infrastructure has not been tampered with is a whole different talk. It's a talk worth having. So if you're interested about that, definitely let's talk about it later. Especially if you're in a controlled industry, anything healthcare, anything financial. There's a lot of fun that happens there and I say fun very ironically. But it's fun engineering challenges. So, back to our code. Let me quickly have a look at the preview here. We start by defining which tasks we want to run. I'm using GitHub Actions, but again, if you want to run this through Jenkins, the same pattern applies. I've got an allow list of actions that I want to run. And this is important. These are human readable. You can look at this. You can see that I'm using version 1.37 of the action slinter, making sure that my workflow files are good. And from that, I can do something important. v1.37 is great for humans to read, right? It is not very secure. If you've ever created a tag with Git, you know that those tags can be recreated.  I've certainly done that. 15 years in IT, I still do that at least once a month, which is why I like to have tooling that now does it for me. Because when it's attached to a service account, nobody knows it was my fault. This is good. Transparency is very important unless it makes me look bad. So we define a lot of these. Quick scroll down. There's about 15 different actions in here. All of them human readable. Any new engineer, even if you've never written Terraform before, should be able to figure this out. We're defining a GitHub repository, an action, maybe a path if needed, and in a human readable way. And this is where it gets fun. Because GitHub has APIs for everything, we can create a GitHub API with those releases and get the commit-ish string. Commit-ish is a very weird word, but that is how the API calls it. The git hash that will uniquely identify your result. We can do that based on a tag. And the reason this is important is put a few of those lines together, probably like 20 lines. We're able to get all of that and use that to configure our allow list inside the project. Kind of looks like this. We're explaining to GitHub, in codification, I want only GitHub-owned actions to work. All of them have to be verified. It has to apply to all repositories. And that's important. There is no cheating.    And in our UI, let me highlight this, this is what you get. These are not human-readable strings. These are not, I mean, you can read them, they're just not gonna be fun to read.  The reason is that these are unique content addresses. They're relevant for computers. They do not have value for you and me in a conversation, but they have value for our supply chain security. Because with this, and with this pattern, we can uniquely identify which action is running. The 137, 1.37.0 on the first line, that address you're seeing there, you cannot tamper with. You cannot bypass this because my build server, my GitHub actions are required to go through that. You can't even fork that action and run it in your own organization because it's not on the allowed list. And so the first pattern is make sure you always have multiple layers that enforce the same thing. Sounds like duplication, it is. It's like having a front door and the door to your house right behind it. Two different keys and slightly more work to get in, but not just for you, also for the others. It's one step in a chain of steps that you have to take and it gets to somewhere. This pattern, you can apply to everything that ends up being a GitHub release. This works with Spinnaker. Spinnaker in this case also has a Terraform provider where you could almost copy, paste the same code, just change the GitHub references to Spinnaker and generate your job files this way. When you generate stuff like this in a predictable way, based on content hashes, you're increasing your security. And you're increasing your security in a way that is not upsetting to users. If my security team makes me type things like that, I will focus my life on something else. This is not fun. I understand the value of it. I don't wanna be bothered by having to actually do it. So, now that we've figured out that we can trust developer machines and we figured out a way to make sure our builds run through a predictable process, as long as GitHub Actions is online, let's talk about storing and what we can do there. So, if you talk to any public official who's tasked with protecting structures, no matter if that's an airport or a school or anything, they will tell you that safety and security are byproduct of consistent behavior. It's not just holds true for not burning things down, it holds true for the integrity of your software artifacts. That's beautiful. Doing the right thing should be easy because when you're doing the right thing and you don't have to think about it, you'll do it more often. And if you, for the people that raised a hand for the 5,000 people plus companies, you know your corporate security is hard. It's usually stuff involved that makes it not fun. And that's usually because those workflows and processes are not built with the end user in mind. Architecture will sell you amazing stuff, they make great products. It's not always frictionless. And any time there's friction in the security process, people will find ways around it.  But when we have dynamic secrets and we have applications that know how to retrieve those secrets from a system, where all you have to do is set it up once and then can forget it while still knowing that it works safely and securely. We've increased security, we've lowered the maintenance and we've made more joyful code. I like joyful code. So before we can't get to that part of having actually joyful code, we need to talk about what we can do before we can store something. Doesn't matter if you use Git commit, signing directly, something like Git sign, which is actually pretty cool, which provides signing based on your open ID provided identity, usually your Google account, your Azure, AD, username, or, sorry, oh, sorry, heard a sound. It gives you ways to sign code and make sure you are attached to it. This can be both a burden and joyful. Burden when the code is bad, at least it's signed to you, not to me. And so when we sign things, when we build things, we get build logs. Logs are important, especially if you're in a controlled environment, we need to make sure those logs are trustworthy. Reproducible builds are great, but for actually understanding why an incident happened, we need to be able to go back and look at our logs. The way to do that, in my opinion, is when you have build logs, store them in a safe place, get a checksum, store that in a secrets management solution. One simple reason for that, when you have a checksum that will tell you this file has not been altered, then you know that log is good. Then you know your attackers can't mess with that. It also brings in a different barrier that your attacker has to go through, no matter if that's an internal attacker or an external one. And really what we're doing here in IT is what the Romans figured out 1700 years ago. Defense and depth means that you have to have more than one layer. You can't just have a single door. You have to have a mode. You have to have fields. You have to have much more that makes life harder for the attacker. So use the API of your build server, extract the log, get the checksum for it, and store that somewhere. Don't store the full log encrypted. One, it's a lot of stuff to encrypt. Two, you can't use any good tooling to look through it because either you have to keep everything in memory and then it's not encrypted. Sorry, unencrypted in memory and which one is not encrypted or you're just wasting your time. And when we do that, when we have a checksum that we can trust, what we're really talking about is authenticateable. Doesn't sound like a word. Trustworthy metadata for an artifact to which we can attest its origin. And that's important. When I hand you a file that you can independently verify that it comes from me it has not been tampered with or my build server and I was the actor that kicked off that build, you have something you can trust which brings us all the way back to the first part. We're creating trust not because I tell you this is good but because you can independently verify it. If you've ever installed a package on Linux, it kind of works the same way. We have keys that we can trust and we're now finally bringing that to more of our infrastructure. So it doesn't matter if you're using S-bombs, software build materials or any other approach. This pattern scales for all of them. You're just taking the metadata encrypting that because that will tell you if something has been tampered with.  And of course, while you're at it, a test to all the stuff that's in there. If you have known CDEs in your code and they're within the risk management profile that you've associated with that application and you're okay with having that in there, a test to that, sign a log with your username that helps people figure out we knew this was in there, this is intentional and it's in there for this and this reason. In automated processes, this burden goes down by a lot because when you're signed into your build server, your identity is known, attestation gets really, really easy. So we have the hard part mostly done. We've got sort of trustworthy builds. We know how to inspect them when organic matter hits the fan afterwards. So the next step is really figuring out how to go towards hermetic builds. So artifacts that are not stored on the application server. And I mentioned this before, it is very important to have that boundary. Your build server may not be as open as your development machine, but it's still not the most trustworthy place. You definitely don't want to be running production environments on that or even have build agents that connect to production environments. So let's talk about the orchestration process for that. When we create a hermetic build, the first thing we're doing is making sure all the dependencies are in that single artifact that we deliver. Your application server doesn't need to go out and download things at runtime. It's cool as some of those demos look like. If I'm starting up my note app and at that point I have to do NPM install in production, that means I'm not running the same code that I was running before. You might get a new version, you might get a fudged update, maybe something that got broken. And you're no longer able to attest that this is actually trustworthy. When you inject build dependencies at runtime, it's a bad time. It's key to prevent this mistake because it is the only way you can trust what runs in production. And trusting when you run in production is hard. We have stopgap measures for all of this. Every orchestrator these days has ways to figure this out. But we're at that stage where we can do that and where we can't figure this out. We have code that we can trust. We've got build logs that have them verified. So how do we run it? The software factory has done its job, right? So really it comes down to one simple thing. This is a pattern I personally enjoy a lot, pre-start and post-start hooks and post-stop hooks that allow you to interact and do cleanups or preparatory work before your application runs. We have an image that we think is okay. But there's a disconnect between what the build server knows and what our machine knows. Humanities, Nomad, they're great at caching images, which means the image you might be running might not be the image that you should be running in the sense that our security team could have revoked something. But because the image is cached, there's still the problem that, well, it's there, the binary is there. We could be running this. So for our pattern here, we use a pre-start task. This is a Nomad job description. You can express this as YAML and run it through Kubernetes in almost the same way, though at that point I would probably see if I could inject it as a sidecar as well. It works with every modern orchestrator. And what we do is we define an artifact that has gone through the same pipeline. In this case, it runs a pre-flight check. It has access to everything the primary artifact has access to the actual workload. And our pre-flight check will check against a revocation list. Is this image good? Does this image meet the right scores? Is this image actually supposed to run in this geographic region? Your registries don't care. As long as you authenticate, they will give you the right image. We need to make sure our orchestrators know ways to verify what's going to be running, even if it's locally cached. In this case, the pre-flight check, very simple. It checks a couple of variables and then bales if the image is on a deny list. Specifically, even if that image's version has been deny listed. Every organization approaches this slightly differently. So it's not so much worth it to show you the code of the pre-flight app. Just think of it as an HEP API that gives you either 200 or 41 in terms of should I run this or should I not. It is a very binary output, and that's exactly how it should be. I had somebody ask about this yesterday, which is why I wanted to highlight this specific part. All the code that I'll share with you later is using content addresses and never human readable versions. And the reason for that is it's all generated code. I use templating for everything. So content addresses show up there as they should, because that's the only way to be actually secure with that, but paired with the comfort of a human readable string right after as a comment. And so ultimately the pre-flight check, well, it just checks your boarding pass. Is this passenger good to go? And if you get the night boarding, well, it's actually a good thing here. From a safety perspective, this gives you a fail secure approach. Instead of failing safely, which means, well, there's an emergency, all the doors unlocked so everyone can leave or come in, we're failing securely. If we're not able to check with a verification server, this fails. If we're not seeing that version listed, it fails. We want all of this to fail before we're even starting up the image because once an unapproved and unverified workload is running, it's too late. And we would like to generally avoid that. So we shifted some parts of our supply chain security left. We talked about some patterns that make sense. Where do we go from here? These patterns are patterns that work from an infrastructure perspective. They work mostly from an applications perspective, but they're not gonna be 100% applicable to everyone in here. Every organization has different needs. So take it as inspiration. Take it as a way to think differently about the way you approach supply chain security and think about which things you can tag on to make it even harder for your teams. Talk with your engineers, front end, back end, security, networking. Talk about other stakeholders, talk, don't talk about other stakeholders, talk with other stakeholders and figure out how to make this process less leaky for your organization. Security is never just a you thing and very much in the spirit of Zelda. It's dangerous to go alone. So do it as a team. You can definitely show leadership by advancing your applications or your team security stance, but it doesn't mean that you have to be the only one that cares about this. It shouldn't be just you. Defending against attacks, both from the inside and the outside, is hard. It's tiresome and it's easy to make mistakes. If you're curious about these patterns, check out github.com slash workloads. Well, we've got some of this in best practice implementations with a focus on Ashikorp tooling. Ultimately, all code is over documented. So even if you're not using Ashikorp tools, you're still gonna be able to figure out the patterns. The github API is a github API. The GitLab API works in almost a similar way. There's a lot of search and replace you could be doing and bring this to other version control systems. And with that, we're right on time. So thank you for your time. You've been amazing. Thanks. Thank you.


Always be conscious of the fact that Allah is aware, that Allah is there, that He's watching. When Allah subhanahu wa ta'ala commanded Musa and Harun to go to Firaun, go and invite someone to faith who believes He's God. You think you have difficulty with interfaith? Imagine you're talking to someone who thinks He's God. Who is very stressful for Musa and Harun. What does Allah say? What does Allah tell them to help them manage their stress?  I am with you, I see and I hear everything. Know that Allah is there. Imam al-Husayn alaihi s-salam on the day of Ashura, what does he say? When his family members were being slaughtered. I mean, talk about emotional trauma. One of the things that Imam al-Husayn says is, what makes the one thing that consoles me on this day, the day when Abbas is being mutilated, the day when Ali al-Akbar is being killed, the day when the noble companions are being slaughtered before his eyes, the Imam says the one thing that gives me comfort is that Allah is watching. Hawwana alaih ma nazala bi annahu bi a'in illa. Know that Allah is there. He knows. He sees. Number two, remember that Allah is merciful. Allah in the Qur'an in Surah An-Nisa verse 29, Allah says, la taqtulu anfusakum.  There's an ayah about suicide in the Qur'an. Allah says, do not take your life.  I know life can be difficult. There's a lot of stress. You feel like there's no light at the end of the tunnel. But what does Allah say? Inna allaha bi kum rahima.  Don't allow shaytan to convince you that there is nothing to live for, that Allah has not blessed you, that there's no mercy.  And the reason why Allah says don't kill, because I'm merciful, don't do this to yourself. Don't become blind to my ni'ma. Don't become blind to my grace.  Number three, we have to keep in mind that life is riddled with hardships. As you and I, we have this expectation that I have to have a comfortable life, stress-free life. That's an unrealistic expectation. Shaykh, why is this happening to me? It's happening to you because we're in dunya. That's the nature of dunya. Allah says, laqad khalaqna l-insana fi kabbad. We created man to endure hardship. This life is about developing your soul. Your soul will only grow and mature if you struggle. If you experience hardships, when a baby is born, what does a baby who's born do? What do they do? They cry. They enter this world crying, which is a sign that this is a place of suffering and trial. And finally, we have to keep in mind that no matter if you're comfortable or you're suffering, no matter if you're at ease or you're stressed, no matter if you feel joyful or you feel depressed or sad, remember the impermanence of this life. It's all going to end. The good days are going to end. The bad days are also going to end. Sometimes we have bad days and we think that we're having a bad life. You're having a bad day. Don't exaggerate. It's going to end. It's temporary. The Qur'an tells us in Surah Al-Hadeed, verse 23, Don't get too excited about what you get in dunya because you're going to depart it. You're going to leave it. And don't grieve too much about what you miss because we're all leaving. We're all leaving this world. Don't get too attached. It's temporary. You know, just like when you take a child to get a shot, what does the doctor say? It's just going to hurt for a moment. It's just going to hurt for a moment. That's dunya. Allah is the doctor. And He's giving us the shot of dunya and He's telling us it's just going to hurt for a second. Be patient. It's going to end.


In this video I'm going to give you the keys to the kingdom, the keys to self-discipline also known as self-mastery. And the tool we're going to use to get us there is mindfulness. But before we get into all that, what is self-discipline first of all? Let's define it a little bit. Self-discipline is the capacity to do what you know you have to do, which is in your best interest despite how you feel about it in the moment. So self-discipline is sticking to your diet. Self-discipline is going to school when you don't want to go to school. Self-discipline is exercising when you don't want to exercise. It's doing things that are going to improve you regardless about what you feel in the moment.  Your brain wants what's easy for it. As long as you're able to survive, as long as you're able to survive and reproduce your brain is cool.  So this is where your self-discipline comes in. You've got a brain that's not on your side but you've got these high level goals of a human being. So how are you going to achieve them? Well that's where mindfulness comes in. Mindfulness is the ability to become aware of your own thoughts, your own emotions and life in general, just becoming more aware. Now you might be thinking that's easy. I'm aware. I know about my thoughts. I know about life. I'm living life. How can you not be aware? Wrong. When you walk somewhere, let's say you're walking to your car, oftentimes more often than not, you're going to be thinking about next week about the family dinner you got going on. You're going to be thinking about a few years back about the time Tommy called you that mean name in preschool. You're going to be thinking about the new boat you want to buy. You're going to be thinking about all kinds of things you're going to miss out on life entirely. You're going to miss out on the sensations of the grass underneath your feet. You're going to miss out on the birds flying above.  This is not being aware. This is not being mindful. This brings back the awareness. So how does this relate to self-discipline or self-master anyway? Sure, paying attention is great, but what does that have to do with achieving your goals of going against the evolutionary burden? Well, here's the thing. To go against the evolutionary mismatch, you need to be aware of your own thoughts and your own emotions. Becoming aware of life in general also helps you become aware of your own thoughts, your own emotions.  Let's say you're angry. Let's say for some reason something's angered you. There's a few things that happen. Perhaps your scalp starts heating up. Perhaps your hands start sweating. Maybe your elbows start twitching. The average person, once they start feeling these sensations, they react. They fulfill the habit loop that's been ingrained in them. They feel the sensations of anger. If they get angry, they snap. They do something perhaps that they didn't want to do or they wouldn't have done if they were in a different mindset. The mindful person has got a buffer. They've got a gap. They've got the opportunity to decide their reaction. They're able to pick up on these sensations. They're able to dive deep into them, to feel them fully, to embrace these sensations of life. And the funny thing about diving deep into these sensations, paying attention to them, is that you gain a sense of power over them. So the mindful person dives deep into these sensations and they realize that they don't have to react. They realize that they are not one with these sensations, that they're just observing, that these things are rising up beside them. These things are not them. They're just rising up beside them, so they don't have to react. They say that to escape the trap, you have to analyze it. And that's what you're doing with your emotions. You have to analyze your emotions. You have to analyze how your brain works to be able to gain that self-mastery we were talking about. Let's say you were trapped by some mechanism, rope tied around your foot. You're not just going to try to escape. You're going to look at it, see what's wrong, and then work from there. Analyze the trap and escape. There's the same thing with your life. And that's how mindfulness is going to help you. Mindfulness is a way and means to be able to analyze these traps. Bringing more attention to your life is going to help you with the self-mastery, because you're going to be able to see things that you normally wouldn't see, things that would normally become habitual that you would take for granted. You're going to be able to pay attention to them and then decide. So how can you exercise your mindfulness? Well, the best way is mindfulness meditation, but you don't have to do this. Any time you're just aware of what's happening, you being mindful. Any time you are aware of your anxiety, you're being mindful. Any time you're aware of your weird thoughts, you're being mindful. Any time you're aware of the strange sensations, you being mindful. Any time you're aware of the grasp underneath your feet, you're being mindful. Awareness is mindful. The more times you can do this throughout the day, the easier it will be for you. So build up this skill set because it is the keys to the kingdom.


We've known for decades that beans have an exceptionally low glycemic index. You give someone cooked beans, peas, or lentils, and you don't even get half the blood sugar spike you get with the same amount of carbs in the form of bread, pasta, or potatoes. So if you're going to eat some high-glycemic food like white rice, consider having some beans with it, and the more beans, the better. Check it out. As your bean to rice ratio increases from left to right, to more rice with some beans, to more like beans with some rice, you can see these trends towards improving cardiometabolic risk factors. Substituting one serving of beans for one serving of white rice was associated with a 35% lower risk of metabolic syndrome or pre-diabetes. Why do beans have such a low glycemic index? Maybe it's because they got so much fiber, the absorption is just slower or something, but it was this next study that blew people's minds. Did it out same as before? Give some bread for breakfast and get a big spike in blood sugar and insulin levels, but give the same amount of carbs in lentil form and you blunt the effect. But now let's follow through to lunch. At breakfast, same as before, big spike with the bread, small spike with lentils, but then for lunch, both groups got the same meal, both got bread. And those that had lentils four hours earlier with breakfast had less of a glycemic reaction to the bread. At the time they called it the lentil effect. But chickpeas appear to work just as well, so it has since been dubbed the second meal effect. Eat lentils for dinner, and then for breakfast, even if forced to drink sugar water, you have better glycemic control. Beans moderating your blood sugar, not just at the meal you eat them, but hours later, even the next day. How is that even possible? The mystery has since been solved. Remember what our gazillions of gut bacteria do with fiber? They produce compounds like propionate with it, which gets absorbed into our system and slows down gastric emptying, slows the rate at which food leaves our stomach, so we don't get as much of a sugar rush. It's like symbiosis. We feed our good bacteria, they feed us back. So you have a bean burrito for supper, and by the next morning it's time for your gut bacteria to eat that same burrito, and the byproducts they create with it may affect how our breakfast the next morning is digested. They figured this out by giving people rectal infusions of the amount of propionate your good bacteria might make from a good burrito, and you can see the stomach relax within minutes of the rectal infusion. So I guess if you forgot to eat any kind of beans, peas or lentils for supper and need to blunt the effects of your breakfast doughnut, it's theoretically not too late, but in general I encourage people to administer their food orally.


Well, great to see all of you. Let me add my belated welcome to Stanford. I think you're going to find that you're going to have a fabulous time here. This is a place that encourages interaction, collaboration, entrepreneurship.  So welcome to Stanford. As Sally said, my purpose today is to give you a little bit of window into the School of Earth Energy and Environmental Sciences. And as the name indicates, energy are us. This is one of the main themes that has been dominant in this school for actually since its inception in 1949. And so I'm eager to give you some window into what we do. So first a little bit of background about the school. We are in fact the key player here in the university and we in the energy arena and we partner up with all the other units here in the university that are deeply involved in energy, pre-court, obviously, slack as well. The Woods Institute for the Environment and that may not be immediately obvious to some of you why that would be the case. But we'll get to that in a moment and certainly the School of Engineering as well as others. We focus principally but not exclusively on what you would call the upstream aspects of energy. That is, things associated with the resources themselves as well as the engineering of those resources as I'll show you here in a bit. So our school is structured in the following way. We have four departments, Earth System Science, Energy Resources Engineering. So that is an engineering department that is not in the School of Engineering. It's actually in the School of Earth Energy and Environmental Resources. Geological Sciences and Geophysics. We have several interdisciplinary programs. One is an undergraduate program. It was essentially the first of its kind in this country and it's been widely emulated since called the Earth Systems Program. And we have two graduate interdisciplinary programs and I think maybe some of you are associated with one of these here. One is the Emmett Interdisciplinary Program in Environment and Resources. And Energy enters into that both in the environmental side and the resource side. This is a program that has a PhD track, but it also has an interesting joint degree aspect between the law school and the business school and potentially other schools. So for instance, it's possible to get an MBA in environmental or energy sciences and get a master's at the same time in our school. Focusing on the science or engineering aspects of the resource. And then we have a brand new master's program called the Sustainability Science and Practice Program that again, if you think about energy and the needs of energy as being issues that involve sustainability, has a natural home in this particular program as well. And the bottom line is that every single one of these units is somehow or another involved in energy research and teaching. So we cover the waterfront in terms of upstream aspects of energy. And so that includes things like the identification, the assessment and modeling of natural resources of a variety of kinds. Oil and gas, obviously, and we've been doing this for a long time. Steam and hot water, geothermal, in other words. We're also concerned about the elements that drive modern technology, rare earth elements, lithium, battery storage, and gas hydrates currently untapped, but potential vast source of natural gas that you may not have heard about before. So we're concerned with the fundamental characterization of earth energy materials, so for instance, in the case of natural gas reservoirs, the very physical properties of those reservoirs and how they get modified over the course of gas production. We're also concerned about the optimization, the engineering practice associated with extraction of energy resources. As you know, the kinds of conventional resources we've been relying on, the burning of fossil fuels produces CO2, which in turn is a big problem for us in terms of global warming. And so we have a big effort involved in CO2 sequestration back into the earth. Although we overlap extensively with the School of Engineering in this regard, we also have efforts now in just the past few years in battery storage. We're concerned about the economics of energy resources. And then finally, we're deeply involved with the interrelationship between energy and the environment, and they're essentially inextricably linked. So I want to show you a little bit about what all these programs entail. So we'll start at the far upstream end, and that's the Departments of Geological Sciences and Geophysics, which are largely involved in the identification of natural resources that have energy significance to us. These are sort of the big five areas that we're involved in. One is the idea of exploration. Where do these energy resources occur? How did they get there? Why did they form? How do we characterize them? How do we model them as well? Geophysics is one of the tools that we use to identify natural resources. For instance, all the oil and gas that we look for in offshore domains lies beneath the ocean and beneath the subsurface. How do you know it's there? That's basically the realm of geophysics. A lot of what we do involves the chemistry of earth materials and their interaction with energy resources like oil and gas. So there's a great deal of work in geochemistry. We're concerned about the very material characteristics of, for instance, gas reservoirs, that is their physical properties. And then finally, all that we do here in these first four categories generates a lot of data, big data. And so there's a great deal of what we do that's involved in computational modeling and on the management of big data sets. So just to briefly go through some of these things, and obviously there's more detail here than many of you are familiar with, on the upstream end with regard to things like the reservoirs that contain natural gas and oil, we're concerned about those that are occurring within calcium carbonate reservoirs. That is limestone. And it turns out limestone is a very reactive substance. It's highly subject to modification by acids. And so we're concerned about the geochemistry of these kinds of reservoirs. As I just indicated, lots of the natural gas and oil that we find and produce today lies in deep water offshore. And it's essentially a detective game of trying to understand what the nature of those reservoirs are, where in fact they are. And so there's a large effort in our school involved in the identification characterization of deep water reservoirs. And as you know, for instance, from the Malkanda incident, this is a big risk item. These are things that we need to understand well. Again, much of what we do beyond the basic characterization of geologic materials, associated with energy, is to model them. And so we have a computational modeling group that is geared towards understanding and predicting where oil and gas might be given certain geologic parameters so that we can forecast risk, so we can forecast economics. As I mentioned, we do a lot with the chemistry of energy substances. And so that involves understanding the chemistry of, for instance, gas reservoirs themselves and also the liquids that are contained within them and how those change over time, both with geologic evolution, but also with the production of fluids. And anything that we might introduce into the reservoir that might modify it. For instance, as you are all aware, because it's in the news frequently and it's controversial, we inject a lot of artificial fluids into reservoirs associated with fracking. And those fluids inevitably have some impact on the character, the chemistry of the reservoir. And these are things we need to understand and plan for. Similarly, rocks have strength, but they don't have infinite strength. In fact, that's exactly what fracking is about. You can exceed the elastic strength of a rock and create a natural fracture, therefore promoting better fluid flow of gas and oil into a wellbore. We need to understand those processes, know their limits, their risks, and so forth. And so geomechanics, or rock mechanics, as it's called, is another important facet of what we do in SE3. And again, all these things have import for the environment. For instance, you're all aware, I think, because of news articles about it, that fracking in certain instances can induce seismicity, can create earthquakes. There have been earthquakes of increasing magnitude happening in places like Kansas and Oklahoma, where they had not happened before. And many of these have to do with practices associated with fracking, not necessarily the fracking itself, but potentially the injection of wastewater after fracking. And these are all things that we're concerned about. They basically are lumped together under the category of environmental geophysics. Related to that, for instance, also then is the mechanics of fracture itself, the in-situ stresses involved, and again, how we engineer for those and do these wisely. Geochemistry appears in multiple ways for us. They, for instance, occur in instances where we inject CO2, as with sequestration of CO2, into reservoirs that formerly contained oil and gas, or maybe in the process of moving an oil and gas by using CO2 as a fluid to move the gas. What effect does that have on the reservoirs themselves? CO2 in high pressure, high temperature environments can be quite reactive with rock materials, and these are things that we have to understand to mitigate things like CO2 leakage. And also, it turns out that there are a variety of ways in which CO2 can be injected back into the earth in innovative ways nobody had thought about before that can actually recombine with minerals and provide yet another place where we can sequester CO2 in the long run if the economics and the engineering feasibility exist. As I mentioned before, we use a lot of water in fracking. A lot of that water is problematic, and so we need to understand how fracking water reacts in the subsurface, where it goes, how it affects water quality, particularly staying, keeping it away from freshwater drinking sources. That's all geochemistry as well. As I mentioned before, we're deeply concerned about the very physical properties of rocks, their strength, how it can be compromised, or how it might be compromised. And also, as it turns out, ways in novel ways in which hydrocarbons that we might be interested in could be sequestered in some such substances. So, for instance, I mentioned gas hydrates earlier, and this may be something you're not aware of, but under high confining pressures and cold temperatures as in the deep sea, it's actually possible to freeze water in the shallow subsurface in, let's say, 2,000 meters of water depth and lock up methane in the crystal structure of ice. This is what's called methane hydrate, or gas hydrate. It turns out this occurs in the deep ocean all over the world and represents a vast reservoir of methane, which, as you all appreciate, is essentially viewed as a transitional fuel for us to get to sort of a carbon-free energy system. So it's very important to us, and at present, no one really knows exactly how to economically extract this particular material, how to do it safely, environmentally responsibly, and so that starts with understanding the very physical properties of gas hydrates, and so that's another thing that we do in our school. And again, all of this involves a lot of things like high-resolution imaging, state-of-the-art imaging down at nanoscale, and so we're doing a lot of that with regard to rock materials, and that's done in part in the geophysics and geology departments and in part in energy resources engineering, Sally's home department. And then finally, as I've mentioned before, we're extensively involved in data analysis, and it's not generally appreciated, I think, by the public, but short of the defense world. It was Earth Sciences that first used supercomputers, first used the craze, and so we've been deeply involved in data analysis for a very long time, and it plays out in all kinds of different ways. It has to do with things like seismic imaging. It has to do with modeling the history of oil maturation and trapping. It has to do with understanding the complex structure at nanoscale of Earth materials, long, long menu here, as you can see, so we're deeply involved in computational modeling as well. Now, as we move from the upstream energy sector, the things that we do in geology and geophysics, we move to the issues associated with extraction of natural resources, the wise and efficient engineering of those practices, and that's again where Sally's department is mainly involved. And so on one hand, it includes the obvious element of simply the engineering, which has applicability to all of these energy resources, but it also has to be done in a responsible way, a way that's going to produce the cleanest energy sources possible, both in terms of their actual utilization in the end game, but also in terms of the processes along the way, leakage issues that might occur, avoiding malconda kinds of incidents, all of those. And those too have applications to essentially all of the energy sector, including these strategic minerals that are associated with high-tech devices, but wind, solar, as well as the conventional things you think of like oil and gas, and that's basically what this department does. There are many different aspects to this, from optimization to the actual simulation, the modeling of, for instance, gas flow through a reservoir, the environmental assessment. Uncertainty is a really big deal because it plays out in risks with ultimately affects economics, monitoring practices for things like leaks of methane and so forth. And so that particular department, as you can see, is involved in a wide range of kinds of issues, including things like where we store energy, how we now produce resources from shale, which is, as I'm sure you're aware, absolutely revolutionized the oil and gas situation for this country, putting us essentially now as a lead importer and producer, or exporter and producer of oil and gas in the world, and the optimization of that, and again the sequestration of unwanted materials, specifically CO2, back into the earth in depleted reservoirs. And so again, we do this computationally, we do it observationally, we do it in the laboratory with a variety of kinds of experiments and simulations that are basically done at the nanoscale to pore scale, all the way up to the size of full oil and gas fields like this that are kilometers on a side, all scales, again, very data intensive, again, bringing us back to the idea of modeling and computational data analysis. And then finally, it has been a big subject in our school for quite some time, with this issue of how do we deal with the CO2 that we're already producing in great excess, as you're all aware, we're headed towards levels of CO2 in the atmosphere that haven't been seen since 50 million years ago, when there were crocodiles living in North Dakota, for instance, and we don't want to go there again, what can we do to mitigate? And we're considering all kinds of possibilities, right? You know, for instance, in this case, alternative scenarios involving, for instance, solar sources for first thermal generation, as opposed to gas fired ones, a variety of kinds of pathways and outcomes yielding ultimately to affecting what kind of gas prices we have and the cost for clean electricity. And then finally, our fourth department is called Earth System Science. It's principally involved with issues of the environment, and inevitably that intersects right away with regard to what we do in the energy sector.  We do a great deal with regard to predicting climate change, and also with regard to monitoring current energy systems with regard to issues like leakage. And so there's one particular faculty member who's just been heavily involved in cooperation with pre-court and with ERE towards understanding where methane leaks occur and how, once we know where they are, we can mitigate against those. Now, almost everything that I've described in our school is funded by either federal sources such as Department of Energy or from industrial affiliates programs. And you all being new may not be so familiar with these, but these are essentially consortia of companies that are deeply involved with one or more facets of engineering and science in energy, as I just spoken of. And of course, these are all, in our particular case, mostly associated with the petroleum industry. And so they may be interested in funding research with regard to geophysical imaging of the earth, or maybe with some aspects of geochemistry, but they're very sector specific. Beyond that, though, there's a relatively new industrial affiliates program that one might consider a super program, and that it finally gets towards what we're trying to do in the university as a whole. And that is to span across all aspects of energy here at Stanford, from the science and engineering to the economics, in one under one umbrella. And this program, which has been in place for a few years now, involves faculty from essentially all the schools in the university, as well as the institutes, it's called the Natural Gas Initiative. As I mentioned earlier, natural gas is widely viewed as a very important transition fuel for us to get to a carbon-free future. And this particular program then embodies really what we want to do at Stanford as a whole in terms of full integrated views of the energy system. I'll just show a couple of slides to give you a little window into this. The goals of the Natural Gas Initiative are, as I've just indicated, to create original research and new knowledge about every aspect of natural gas. So that includes, again, the most upstream of where natural gas occurs to the most downstream of the energy economics of the resource. And this, of course, does give us an opportunity to interact with these private sector groups and hopefully quickly get into practice with them some of the learnings that we've developed here at Stanford, as well as obviously to give a chance for our students to become interactive with them and potentially seek employment in those sectors. And we're trying to do this in a way that produces the most reproducible, solid factual data that we can. We're in an era of alternative or facts.  So this is probably a bit small, but at least it gives you some idea of the range of kinds of general areas that are being covered in the Natural Gas Initiative that include, like I mentioned before, things like emissions issues, conversions of methane to other kinds of useful products, unconventional resources that we haven't really thought of. I mentioned gas hydrates earlier, technologies and engineering. And what you'll notice here in the membership roster that this particular industrial affiliates program is supported by all kinds of different private sector elements. It includes naturally oil and gas companies, but it also includes generators, electrical generators. It includes some groups that are involved with the downstream economics and this group, this particular program is thriving and expanding and it's really bringing together a lot of different sectors here in the university that had previously not necessarily been in full contact with one another. So again, this particular initiative is involved with both the science and the engineering, but also the commercial and economic aspects, and ultimately how those play out in terms of policy regulation and how that ultimately enters into the political arena. And so again, unconventional resources, these are things that are there and available for use with regard to natural gas, but have generally not been tapped into because of lack of understanding of the science and engineering practice or because of the economics. Obviously again, this involves a lot of data generation and so there's a very important computational side of this. There's the environmental side with regard to the issue of emissions and monitoring them, detecting them and mitigating them and then downstream ultimately for those of you from the business school how this plays out in terms of the economic arena. Now all of these areas are areas that we in our school are working on as well, but this represents as I mentioned an opportunity to branch out beyond the blinders and confines of our particular school and interact with a more broad community that's really deeply concerned with the holistic view of energy and methane conversion into other kinds of products that have potential use in society. So that's what I want to leave you with. I'd hope that during the course of your time here at Stanford you take the opportunity to come over and sample some of what we have to offer. Again, those of you all are obviously deeply interested in this or you wouldn't be here today. We offer a certain perspective. It's an important perspective, but just a piece, but one nevertheless that I hope that you will take advantage of. And so thank you very much. I'll be happy to entertain any questions. So can I ask one that you could have, could you just say like two minutes about the long-range planning process? Has anything been mentioned about here? All right. So a year and a half ago we got a new president and soon thereafter we got a new provost. The president came from outside of Stanford. The new provost was formerly dean of school of engineering and then before that had been director of Slack. Like usually happens when there's an administration change, the new president provost want to chart the way forward for Stanford for the next couple of decades. And so they impaneled a, well, they created a process that I think is unusual if not unique among universities. They basically went to crowdsourcing. We're in Silicon Valley, why not? Well, what does that mean in this context? They basically invited the faculty, staff, and students and alums to submit ideas about Stanford for the next couple of decades. Any subject, everything's fair game. So as you might imagine, we got all kinds of results. Some are inspired and brilliant and some are just plain stupid, truth be told, and many conflict with one another. There were about 3,000 of these submitted to us. And so they impaneled a group of committees of responsible university citizens to sort through all of these and bend them into categories. The categories were education, research, the Stanford community, and beyond Stanford. And they found that in all of these 3,000 ideas, a number of things kept popping in each one of these categories.  And so a number of those cross cuts in fact deeply involve the energy sector. There are issues about computation. There are issues about big data. There are issues about the natural world, which includes things like the fundamental properties of materials. And I've already mentioned their importance here. They include sustainability and a variety of other things, as you might imagine, including human health issues and curricular issues and so forth. And so we're at the point. So what happened was these committees worked for six months, produced a bunch of white papers. And then the executive cabinet of the university, which is the president provost, the vice provost and the deans, spent another four or five months basically trying to shape these into a vision. And that happened as of the end of June, this past June, when the president made his first public disclosure about the results of the process. So now we're to the point where we're going to start implementing these processes. And so we're in the process now of creating a bunch of design teams that are actually going to put flesh on the bones that I just described and move us towards a bunch of these kinds of areas. My particularly responsibility as dean is to move along the issue of sustainability, which again is a very important thing in our school, but clearly it's very important for the university and for the world as a whole, right? We can't keep living the way we've been living without doing some things differently. And the energy arena is one of those. So now that you're here, you're going to be hearing in this coming year more and more news coming out about this initiative, which is called the long range planning process. There may well be opportunities for you to be involved in this as well through focus groups and so forth. If those opportunities do present themselves, I'd encourage you to participate and speak up. We have so many creative minds here at Stanford. You obviously the newest of those creative minds and all ideas and certainly all the energies of thought are most welcome in this. And so that's pretty much what the long range planning process is about right now. We expect to see some great things happen. I'll just give you two previews very quickly. The president was in June in his announcement was mostly operating at a very high level, but he did say a couple of things that were very specific about sustainability and one is that we intend by 2025 to get to 80% reduction over a 2011 level of carbon footprint and Stanford's already ahead of every other university in the country with regard to that right now. And you will see the SESI plant they haven't yet had. That's part of this process. We're going to go even further. We won't be doing that with carbon offsets. We'll be doing it the real way. Similarly, he announced that not casting his versions in any East Coast universities there. And we intend to get to 100% or to zero waste by 2025 as well. So really ambitious goals, but very important goals. And to the extent that Stanford in doing this can become a demonstration for other places to do that. That's certainly the hope for outcome. All right. Thank you.