I find it fascinating that in a world where so much is so new, we welcome new years by singing a very old song. The chorus starts out, for Ald Langzein, my Joe, for Ald Langzein, I'll take a cup of kindness yet for Ald Langzein. Joe is a Scots word that can be straightforwardly translated to deer, but Ald Langzein is more complicated. It literally means something like old long since, but it's idiomatically similar to the old times. We have a phrase in English somewhat similar to for old Langzein. The phrase is for old times sake. Here's a bit of my old long since. In the summer of 2001, the writer Amy Kraus Rosenthal emailed Booklist magazine to inquire about a review. At the time, I was working for Booklist as a publishing assistant. Most of my job was data entry, but I also answered many of the low priority emails that came in. So I responded to Amy with an update on the status of the review, and I also mentioned that on a personal note, I had loved her zine-like column in Might magazine. I told her I often thought about one bit she'd written, which went. Every time I'm flying and the captain announces the beginning of our descent, the same thing goes through my mind. While we're still pretty high above the city, I'll think, if the plane went down now, we would definitely not be okay. A bit lower, and no, we still wouldn't be okay. But as we get real close to the ground, I'll relax. Okay, we're low enough now. If it crashed now, we might be okay. She wrote me back the next day and asked if I was a writer, and I said I was trying to be, and she asked if I had anything that was two minutes long that might work on the radio. We don't really know when all the langzine was written. The first verse goes, should old acquaintance be forgot and never brought to mind? Should old acquaintance be forgot an old langzine? Versions of that date back at least 400 years. But we owe the current song to the great Scottish poet Robert Burns. In December of 1788, he wrote to his friend Francis Dunlop, is not the scotch phrase old langzine exceedingly expressive? There's an old song in tune, which is often thrilled through my soul. Light be the turf on the breast of the heaven-inspired poet who composed this glorious fragment. And on the back of the letter, Burns wrote the first known draft of all langzine. At least three of the verses were probably his own, although he would later say of the song that he quote, took it down from an old man. Part of what makes dating various lines within the song difficult is the song's eternality. It's about drinking together and remembering old times. And almost every idea within it, from picking daisies to wandering through fields to toasting old friends over a beer, could have been written 500, a thousand, or even 3,000 years ago. It's also a rousing ode to splitting the check, incidentally, with part of the second verse going, and surely you'll buy your pint cup, and surely all buy mine. But mostly, the song is just an unapologetic celebration of the good old days and of looking back upon them. I guess I should tell you that Amy is dead. Otherwise, her death within this review might seem like some kind of narrative device, which I don't want. So okay, she is dead. The rare present tense sentence that, once it becomes true, stays true forever. But we aren't there yet. We were still in the past, I think. She asked me if I had anything for the radio, and I sent her three little essays, and she liked one of them, and asked me to come in and record it for her show on Chicago's public radio station, WBEZ. In the broadcast, you could hear the nerves in my voice. It was the first time I'd ever reached such a large audience. After that, Amy invited me to be on her show more often. And within a year, I was recording frequent commentaries for WBEZ, and then for NPR's All Things Considered. Sometimes Amy took me out to lunch. She was everything I wanted to be, happily married, a committed and loving parent, and a successful writer. She was also incredibly good at gift-giving. At her first lunch, I told her that when I moved to Chicago, my mom asked me to carry $40 with me in my left pants pocket whenever I went outside, so I would have something to give anyone who might want to mug me. And I told Amy that I still always kept $40 in my left pocket, and that I tried never to spend my mugging money, except in cases of real need. The next time we met, Amy surprised me with two gifts. One was a money clip engraved with my initials, J-M-G, and the other was a money clip engraved with M-M mugging money. In April of 2002, Amy convened some of her writer and musician friends for an event at the Chopin Theater in Chicago called Writers' Block Party. She asked me to read for it, and I did, and people laughed at my dumb jokes. And Amy hired someone to walk around the theater giving everyone compliments, and the complimenter said they liked my shoes, which were these brand new Adidas sneakers. And that is why I have worn Adidas sneakers almost every day for the last 17 years. Robert Burns originally had a different tune in mind for all Langsine than the one most of us know, and although he himself realized the air was quote, mediocre, you will still sometimes hear that original arrangement. It is used, for example, in the noted 2008 film Sex in the City, but the melody most of us know first appeared in 1799, in George Thompson's Select Songs of Scotland. By then, Robert Burns was gone. He was only 37 when he died of a heart condition, possibly exacerbated by his habit of raising many a pint glass to old acquaintances. In his last letter, he wrote to Francis Dunlop, an illness which has long hung about me, in all probability will speedily send me beyond that borne once no traveler returns. But the song was just getting started. Within decades, it became a popular part of New Year's Eve celebrations in Scotland, a holiday known as Hogmanay that can trace its history back to winter solstice rituals. By 1818, Beethoven had written an arrangement of it, and it was beginning to travel throughout Europe and the English-speaking world. Today, Ald Langsine is often played at Japanese department stores just before they close. Between 1945 and 1948, the tune was used in South Korea's National Anthem. In the Netherlands, its melody inspired one of the country's most famous football chants, but it's a staple of film soundtracks, from Charlie Chaplin's 1925 movie The Gold Rush to It's a Wonderful Life in 1946 to Minions in 2015. I think Ald Langsine is popular in Hollywood not just because it's in the public domain and therefore cheap, but also because it's the rare song that is genuinely wistful. It acknowledges human longing without romanticizing it, and it captures how each New Year is a product of all the old ones. When I sing Ald Langsine on New Year's Eve, I forget the words like everyone does until I get to the fourth verse, which I do have memorized. We too have paddled in the stream from Morning Sun till Dine, but seas between us broad have roared since Ald Langsine. And I think about the many broad seas that have roared between me and the past, seas of neglect, seas of time, seas of death. I'll never speak again to many of the people who loved me into this moment, just as you will never speak to many of the people who loved you into your now.  In her strange and beautiful interactive memoir textbook Amy Kraus Rosenthal, Amy wrote, If one is generously contracted 80 years, that amounts to 29,220 days on Earth. Playing that out, how many times then really do I get to look at a tree? 12,395? There has to be an exact number. Let's just say it's 12,395. Absolutely, that is a lot. But it is not infinite. And anything less than infinite seems too measly a number and is not satisfactory. In her writing, Amy often sought to reconcile the infinite nature of consciousness and love and yearning with the finite nature of the universe and all that inhabits it. Toward the end of textbook, she wrote a multiple choice question. In the alley, there is a bright pink flower peeking out through the asphalt. A, it looks like futility. B, it looks like hope. For me at least, Aldlangzine captures exactly what it feels like to see a bright pink flower peeking out through the asphalt. And how it feels to know that you have 12,395 times to look at a tree. In 2005, Amy published a memoir in the form of an encyclopedia called Encyclopedia of an Ordinary Life. That book ends, I was here you see, I was. Another sentence that, once it becomes true, never stops being true. That book came out just a few months before my first novel, Looking for Alaska. Soon thereafter, my wife Sarah got into graduate school at Columbia and so we moved to New York. Amy and I stayed in touch and collaborated occasionally over the next decade. I played a bit part in an experience she curated for hundreds of people on August 8th, 2008 in Chicago's Millennium Park, but it was never again like it had been in those early days. She found out she had cancer not long after finishing textbook Amy Cross Rosenthal and she called me. She knew that in the years after The Fault in Our Stars was published, I'd come to know many young people who were gravely ill and she wanted to know if I had advice for her. I told her what I think is true, that love survives death, but she wanted to know how young people react to death, how her kids would. She wanted to know if her kids and her husband would be okay, or how she could make it okay for them. And that ripped me up, although I'm usually quite comfortable talking with sick people. With my friend, I found myself stumbling over words, overwhelmed with my own sadness and worry. They won't be okay, of course, but they will go on and the love you poured into them will go on. That's what I should have said, but what I actually said while crying was, how can this be happening? You do so much yoga. In my experience, dying people often have wonderful stories of the horrible things that healthy people say to them, but I've never heard of anybody saying anything close to as stupid as you do so much yoga. I hope that Amy got some narrative mileage out of me saying something so profoundly idiotic in her hour of need. But I also know I failed her after she was there for me so many times. I know she forgives me, but still I desperately wish I could have said something useful, or perhaps not said anything at all. When people we love are suffering, we want to make it better. But sometimes, often, in fact, you can't make it better. I'm reminded of something my supervisor said to me when I was a student chaplain at a children's hospital. Don't just do something. Stand there. Ald Langzein was a popular song in World War I. Versions of it were sung in trenches not just by British soldiers, but by French and German and Austrian ones as well. And the song even played a small role in one of the strangest and most beautiful moments in world history, the Christmas truce of 1914. On Christmas Eve that year, in part of the war's Western front in what is now Belgium, around 100,000 British and German soldiers emerged from their trenches and met each other in the so-called no-man's land between their front lines. One 19-year-old British soldier wrote his mother, Yesterday, the British and Germans met and shook hands in the ground between the trenches and exchanged souvenirs. Marvelous, isn't it? A German soldier remembered that a British soldier, quote, brought a soccer ball from their trenches and pretty soon a lively game ensued. How marvelously wonderful, yet how strange it was. Elsewhere on the front, Captain Sir Edward Hulse recalled a Christmas sing-along that, quote, ended up with all Langzein, which we all, English, Scots, Irish, Prussians, Luttenburgers, etc., joined in. It was absolutely astounding, and if I had seen it on cinematograph film, I should have sworn it was faked. Hulse, who was 25 years old at the time, would be killed on the Western Front less than four months later. At least 17 million people would die as a direct result of the war, more than half the current population of Canada. By Christmas of 1916, soldiers didn't want truces. The devastating losses of the war and the growing use of poison gas had embittered the combatants. But many also had no idea why they were fighting and dying for tiny patches of ground so far from home. And in the British trenches, soldiers began to sing the tune of all Langzein with different words. We're here because we're here because we're here because we're here. Here was a world without whys, where life was meaninglessness all the way down. Modernity had come to war and the rest of life. The art critic Robert Hughes once referred to the quote peculiarly modernist hell of repetition, and the trenches of World War One were hell indeed. Although she was a playful and optimistic writer, Amy was not deluded about the nature of suffering or about its centrality in human life. Her work, whether picture book or memoir, always finds a way to acknowledge misery without giving into it. One of the last lines she ever wrote was, death may be knocking on my door, but I'm not getting out of this glorious bath to answer it. In her public appearances, Amy would sometimes use that recursive lament of British soldiers and transform it without ever changing the tune or the words. She would ask an audience to sing that song with her. We're here because we're here because we're here because we're here. And although it is of course a profoundly nihilistic song written about the modernist hell of repetition, singing that song with Amy, I could always see the hope in it. It became a statement that we are here, meaning that we are together and not alone. And it's also a statement that we are, that we exist, and it's a statement that we are here, that a series of astonishing unlikelihoods has made us possible and here possible. We might never know why we are here, but we can still proclaim in hope that we are here. I don't think such hope is foolish or idealistic or misguided. I believe that hope is, for lack of a better word, true. We live in hope that life will get better and more importantly that it will go on, that love will survive even though we will not. As Emily Dickinson put it, hope is the thing with feathers that perches in the soul and sings the tune without the words and never stops at all. And we are here because we are here because we're here because we're here. Sing it with me, wherever you are. Think of those across the broad and roaring seas and sing with me. You won't be more off tune than I am. We're here because we're here because we're here because we're here we're here because we're here because we're here because we're here


Hey, everybody, it's Greg Bout to hear it in this video. I wanna start off by asking you a question. Have you ever found yourself somewhere without your main camera, with just your phone in your pocket, and wished that you had a wider angle of view or that you were more zoomed in without having to do the digital zoom? Well, in this video, we're gonna be talking about lenses made specifically for the iPhone that will give you a wider angle of view or a more zoomed in look. So let's get started. All right, so I've got some lenses here by Sandmark. Now I've got the wide angle lens and I also have the zoom lens. Now the wide angle lens gives you roughly a 16 millimeter viewpoint and the zoom lens, the telephoto, gives you about a 60 millimeter. So that's what it would be in full frame terms. So they're basically two times wider or two times more zoomed in. Now when you get this lens for your camera or for your phone camera, you get an iPhone case. So you get the iPhone case, you get the lens that screws onto the case like you see here. You also get a clip on. So if you have an iPhone case that you really love and you don't wanna use this case, you can use this clip on to clip the lens onto your iPhone. And it also comes with a carrying case.  So this one here is the wide angle lens. Now I'm using this on the iPhone XS Max which has two cameras. So there's two different mounting points on this case. If you're using one for the iPhone 7 or 8, you probably don't need this. But if you do have the iPhone XS Max with the two cameras, the wide angle fits at the top and the telephoto fits at the bottom. So we're gonna head to the computer. We're gonna have a look at some images and I shot some images with just the standard iPhone camera and then I mounted the wide angle and then I mounted the telephoto. So we'll head to the computer and we'll have a look at those images. All right, first up is just the regular iPhone. This is video shot on the iPhone. Now this is with the Sandmark wider angle lens so it's two times wide. Now here's the still shot on the iPhone. Now the Sandmark gives you a 16 millimeter type of viewpoint. So we'll have another look here at video. This is just a standard iPhone video and then this is with the Sandmark two times wide angle lens attached. So again, here's a still with just the iPhone and then here's the wide angle with the Sandmark. Two times wide attached. Now here's some video shot on the iPhone. Now this is with the telephoto lens so you have a two time zoom look. We'll have another look at that. This is just the iPhone. This is the two time zoom lens attached. And here's a still image with just the iPhone and then here's the two time zoom. So I'm not gonna win any awards for these photos but I just want to show you what they look like straight out of camera. And now I just want to show you slow motion because it's not a YouTube video without your wife, your dog and some slow motion. You can also get some lens flare effects with the coding. All right, thanks for watching this video. If you have any questions about these lenses you can ask them in the comments section below. Also give me a thumbs up if you found this video helpful. And if you're not already a subscriber just hit that subscribe button and make sure you hit that bell notification so you'll get email updates of my next video. And again, I'll put a link to Sandmark's website just below this video if you want to find out more about those lenses. I'll also put a link to my Amazon store where you can check out all the gear that I use in all of my videos. Anyway, thanks again for watching. Give me a thumbs up and I'll see you in the next video.


This video is supposed to help you do your assignment on simulating the checkout stand using MS Excel, Microsoft Excel. We're going to talk a little bit more in depth later on in the course about the software that we can use for simulation. And we're going to use a few different software products in this course. You can you can see that we're starting off with something relatively simple that we're all kind of born knowing today and certainly it's available everywhere. But we need to use some sort of software. We don't want to continue doing these things by hand. We're going to be playing in this video with the same program, same problem, the checkout stand that we used in the lecture called simulating by hand where we did it manually with pencil and paper. But just in general, we could use specialized simulation software and we will look at some of them during the semester. We could write simulations in general purpose languages and we will look at at least Python later in the semester. Or we can use Excel. We can use a spreadsheet tool and we're going to see how to do that. You can there's a page on the course website called software and it would be instructive to look at that when you want to learn more about different kinds of software to use for simulation. This problem is on the assignments page of the course website and it's also in the simulating by hand lecture that you presumably already looked at. It's a checkout stand in a small store let's say a hotel gift shop or an airport gift shop. It's a single server, a single cashier. It's not large enough for more than that. And we're not looking at the time customers spend browsing, but only when they're ready to pay. And that's what we consider them service or waiting for service if there's another customer there and they have to wait in order to pay. The measures of effectiveness that we're interested in the average time that a customer spends in the system, including both waiting and in service. And the percentage of time that the checkout clerk is idle. The input parameters of the time between arrivals of the customers is uniformly distributed between one and 10 minutes. Those are integers. And what we did before was we used poker chips labeled 1 to 10 and thrown in a hat. The other input would be the service time also uniformly distributed this time between 1 and 6 minutes. And so it was a simple thing to say we're going to take a die six sided the numbers 1 to 6 and that'll be the device to model the randomness that we need. Piece of what we had before just for the first eight customers in the system. You can see the the time since last arrival that was generated by the chips, the service time that was generated by the die. The clock time, the first customer comes in and we call it time zero. The first customer service time is one so service ends at one. The customer goes into service at time zero and so on. At the end of the whole thing we get the required averages, the measures of effectiveness, the average time the customer spent in the system on the average three and a half minutes. Percent of time cashier is idle 48% of the time in this particular replication. This is only for eight customers and only one replication. Here are some hints to help you get started with your program in Excel, your model. How do we model randomness? We're going to be using the random function that's part of Excel and when you want to generate variants from a uniform distribution between certain limits A and B, you can generate them by using the RAND function and you can see the formula right here on the slide. RAND times in prens B minus A plus A. That'll give you a random number. The RAND function gives you a random number on a zero one distribution, but if you want one between A and B, you manipulate it that way. The best way to do this, the only way you can really do this in Excel, you take the first customer row, input it manually. You can see how the first customer comes in at time zero. You generate the service time. You can do all of that manually. And then in the second row, you apply the formulas that you want to based on the first row. And then you just drag down in order to generate as many customers as you want. How do you know how many customers you want? How do you know when to stop? Well, when you look at the assignment, I believe that I'm asking, I'm pretty sure I'm asking you, to do it two ways. A certain number of customers, whatever it says there, I don't remember, 20, 50, whatever. And also for a certain amount of time, two hours, five hours, eight hours would be, you know, a full day, let's say.  You can see how you already know how to do the first. The second might be, might give you a little more trouble. Here you see the first 10 customers in the simulation in Excel, the checkout stand using Excel. We've got all the same columns, the same labels as before. Nothing really has changed. The only thing that has changed is that we're making use of Excel to do the calculations. As we saw previously, the suggestions in the last slide, most of the first customer you put in manually. Because there's no previous customer to boot up on. The first customer is the one you boot the system up on. You still have, even with the first customer, you can figure out when service ends, that service begins plus service. You can figure out how long the customer is in the system, right? Service ends minus the arrival, the end time minus the arrival time. But the others have to be put in manually. Except for the random, obviously, the first two columns are done using the ran function. The first one is the inter-arrival times, the second one is service times per customer. And then on customer two line, there are three cells highlighted. Think about those, you have to think about those and how you're going to model it in the simulation. The arrival one is the easiest, really. How do I get the customer's arrival time? Well, you already have the inter-arrival time, which means the time since the last arrival. How do I know when customer time begins? That's not so simple. Because customers only go into service right away if there isn't already a customer in service. You have to think about that one a little bit. You may want to do this yourself manually for five customers, six customers, and see what you look at and what you do and what formula you can use for that. And the same thing is true of Clerk Idle. How do I know how many minutes the clerk has been idle since the last time he was idle? If you've completed your simulation run, you're not finished. You still need replications. It's a statistical experiment. You're not going to be able to get a good estimate of the parameters, the average time in system, and the average checkout utilization. If you only have a sample of one, we never work with a sample of size one, as you know. So we have to look into replications. It turns out there's a really cool way to do that in Excel. If you've used an Excel data table already, perhaps for what-if analysis, you're a little bit ahead of the game, but it's not difficult to learn. And I have two instructional videos listed there, links to YouTube. They're not mine, but they're so good that it really doesn't pay for me to do my own. As long as these still remain up, I'm going to be linking to them for your benefit. The first one is by someone called Danny Rocks, and it's in general just about using a data table and not for simulation, although what-if analysis is a type of simulation, according to many. And the next one is by, I don't have a name, it's by the YouTube handle, Space Over Time. And it specifically shows you how to use a data table to generate replications in simulation. So that's going to be very valuable for you. As you will see, Excel works very well for certain things when you're doing a simulation, especially a discrete event simulation, and not so well for others. So why do we start out with Excel in this course? We will need something that's more directly applicable to the kinds of simulation models we want to work with. It's a good way to get started quickly. We all know Excel. Everybody's now, if you're in a quant program, you're practically born knowing Excel. It's ubiquitous. It's everywhere. Everyone has a version of it on their laptop and tablet. We use it all the time anyway, so we might as well get started using Excel in order to build our first simulation model. Well, maybe the second, if you count simulating by hand. What have we learned here? We've learned that Excel is a quick and easy way to get started doing simulation models. We've also learned that, well, it may not be the best. You may not have learned it yet, but you will as soon as you do your assignment. But it's still usable. It's in certain situations, it might be the way to go. It's easily available, and I hope that you gained from this. I hope you will be able to easily and quickly program the checkout stand so that it runs in Excel and report on your observations. And submit it, if you're in my class, submit it through Blackboard in the assignment section. Thank you for attending this lecture.


So today Alex and Bobby are flying the Rotoriot Cinemate. This is built on the Chendron's thick frame. It's a coaxial octacopter. So we got eight motors spinning seven inch blades. This can lift quite a heavy payload. You can get a workout lifting this thing. You can see on top of it we've got a really nice camera. Alex has volunteered his red Komodo. This is a really next level camera capable of some beautiful shots. And that is exactly what this drone is built to do. We have it available on Rotoriot.com. I mean you should probably know what you're doing though because this is like the next very pro grade cinema flying. We did in a previous episode a flight with this where you flew a dummy weight and I was kind of giving you some tips and tricks on flying heavy Cinelifters because they fly a lot different than your normal FPV drone. They do. I'm going to get to see how you fly the Komodo and we're going to talk about different lens choices, framing up the pair motors, tips and tricks for flying the Komodo. I think by the end of today you're going to be nailing a putt but today I actually started off a lot longer ago. Way earlier. We've been up for a long time. This is what it's like to be on a filming set man. I've been telling you this. It's not like just getting up at like eight in the morning and doing a normal day job. This is the real behind the scenes of an FPV pilot. You flew a dummy weight which you're holding right there with the GoPro on it rather. Pretty light. Which is pretty light. Yeah. I want you to feel with the Komodo with the lens and payload. Quick. Weather a lot heavier. Right. So remember how you were kind of like flipping it around and then doing all these crazy tricks. Can't do that with this camera. You can do it but it's going to be a lot heavier and you're going to drain the battery a lot quicker as well. So just kind of keep that in mind when you're flying this thing it is heavier. Now if you have the camera angles pretty much dialed in with each other and I'll go into the DJI headset. I'm going to turn on the framing lines because the height on the lens is a lot shorter than that of the DJI camera. Also it's a lot less wide. So we're going to create some little framing lines and we'll match them up visually as well as in the goggles. That way as long as you keep the paramotor inside the framing lines you'll be framed up on the Komodo. It's a golden light. It's my turn. I'm so ready. It's going to fly heavier. Okay. So really small movements. Don't even touch the sticks. Don't even touch the sticks. Don't even touch the sticks. I'll watch your flight time for about three minutes. All right. You got this? Also you're going to notice more prop wash too. So try and not. When you notice more prop wash. Oh yeah because it's heavier. So heavier collages always have more prop wash. If it's the pins aren't compensating yeah. Okay. But the pins are really good right here. It's just it's heavier. The prop can't spin up as fast. Not kids. Where are they at? They are to your right. They're straight above us almost Bobby. There you go. You just flew through their weight. Beautiful. All right. He's on them. Remember really small corrections. This is difficult. I don't know why. Remember small movements. Small, small, small movements. Yeah. Everything shows up on camera. Real smooth. Make those small movements really tiny. Beautiful. My heart is like counting out of my chest. That is good. You got about another minute and a half. Real small movements. I'm having trouble keeping the throttle consistent. You see all three? Yeah. Yeah. He's got all three in sight. About 30 seconds, Bobby. They're turning right. All right, Bobby, turn around. Look at that. Just cruise it back. Your batteries. The hardest thing is keeping the throttle at a consistent speed. Yeah. Weird. No. Yeah. It's a lot different with the heavier weight. Where's the arms? Right here? Yep. It's right here. I'm going to help you with it once you're done. You want to arm it? I'll disarm it. Okay. Cool. All right. Good job, Bobby. That was scary. Like... It is scary. It is scary. Yeah. Yeah. Wow. How did it feel flying a Komodo? Just, you know, a $15,000 drone in the air. I was probably more scared, like even if it was with my five inch quad. I'd probably have the same feeling, but like it just feels like a quad. So like once I'm up there, it's so normal. So it's really funny because watching you fly, you did a really great job, but it made me so nervous just watching you around the paramotor. And the guys I work with, they always get so nervous when I fly. I'm like, guys, what's the big deal? I know what I'm doing. Just like, you know what you're doing. You're in control. But when you're watching it, especially when you just know the payload and how it can pose a big risk, it makes you so nervous. Like when I'm flying, I'm not nervous at all. And I'm sure you felt the same, but like, man, when I was watching, I was so nervous. What made me nervous was multiple subjects and having to keep like my bearings of where they are was really difficult. So what you have to do when there's two in the air is you need to always know where the other one is. Start by having both of them framed up and then maybe focus on one, but at least when you're doing that, you know roughly where that other one was and is. Not sure. And then try and look back every now and then, just to make sure. Yeah, real smooth and cinematic. Beautiful. Keep them in the center there. Beautiful, Bobby. Nice. Real smooth. So when he turns around like that, he's going to see the way he accelerates. Oh, yeah. That's what's like killer. So like right now, you're not in his way because of the way he's going. Real small movements. Real small movements. Flow with him. Real gentle. He's going to come like right, yeah. His movements are like interesting.  Yeah. Yeah, once he gets to us, you're going to have to laugh because I don't want to put any more on there. Okay. Actually come on, come on, come on, come on. Where are we? Right, right, right.  Yeah. Yeah, I got you. Good job, Bobby. Straight for the pavement. Nice smooth landing. I'll help you with the disarm. So you just get nice and stop. Don't land it fast as we have props in the mall coming down. And nice job, Bobby. Nice job, man. Really good. When he's descending like that too, it's easy to fly in that prop wash. So try and don't try and just stick like right behind him. Try and go a little bit out. Okay. And then really small corrections still. You're still making big movements. Yeah, still some tricky stuff. Yeah, just don't even let it flow. So you're switching to the nine millimeter lens. Yes, this is a really wide angle. So this would be more like the GoPro though. Oh, big time. It's also a lot lighter, like 500 grams lighter. Really? So the drone's going to fly a little bit longer and be a little bit more responsive. So much fun, guys. Being able to share this guys with you guys is next level. When you're flying along, AJ and I and Dave are all stacked up and all of a sudden I got this giant three octacopter soaring past me. It's like, ah, there's a camera. Yeah, they're awesome.  One thing that I was telling you was you needed to be smoother on the sticks. This heavy drone has a lot more prop wash than the smaller drones do. So when you're descending, as they're doing their aerobatics, you're starting to fly in all that prop wash and you're kind of jerking on the controls. So you started to smooth it out and then you went up the second time and you were much, much smoother. You also had them framed up a little bit better. You were kind of hunting for them across the screen. So we put the framing lines in our goggles. Now it's telling Bobby, keep it right in the center and they're going to be perfectly center-framed. And then your second flight was just really, really good. Cool, thanks, man. I really appreciate all the tips you've been giving me. I will say this is like the most challenging thing I've ever done, hands down. Just being in 3D space and you guys go, whoa, whoa, whoa, it's like, where are you guys going? And like, for me, with a new drone and doing something new is really challenging. And I'm talking to Reese after just five seconds watching you guys fly. I'm like, how much does it cost to learn to fly a pair of motor? It looks like a lot of fun. It's about like buying a motorcycle. You guys can do it too. Contact us at aviatorppg.com, youtube.com. Sashaveter, hashtag fly all the things. But we really appreciate you guys watching this video.  We appreciate all you guys watching. Be sure to subscribe, hit that bell. Be sure to check out our store too. You can buy this drone that we flew today and you have this whole tutorial series to even help you. Thank you so much for watching, guys. And we'll catch you on the next one.


What's going on everyone? Sam here at Layton Sports Garden, trip in 22, 23, PD Crown Royal, basketball hobby, 16 box, full case break, number 23, tiered random team style. There's a look again at your random results as always. You can find those on the website under the results tab, as well as the link that's in chat. So good luck everybody. Yeah, Joe laughing in the background too. Good God. All right, let's do some crown. Stuff's been good, man. All right, kaboom predictions, kaboom predictions. Steph, all right. I'm gonna go another rookie this. I'm gonna go Keegan Murray on this one. Keegan Murray, I think Yeager who came in the shop today, I think he's got good mojo, Keegan Murray, kabooms. No, 16 boxes, that's about 16. Okay, let's start with this one. T-Mac, T-Mac would be fire. It's Raptor's T-Mac in this, right? We pulled out of the first pack, the first box this time, lovely. Hero, Holliday, Walker, Kessler, got a shade on sharp, 249. Crystal, J-Dub, rookie. And Otto, Gil Goodrich, 83 of 99 for the Lakers. And Shea Gilgis Alexander, nice little round table, Jersey Guard, game used for the Thunder. Ronson's got the Kings and Hawks. Kings and Hawks, David. So he's got two kaboom shots with Keegan Murray and with Treyum, both of them do have kabooms in this. David Roddy, RJ Barrett, got Iowa to soon move to 75. Hey, Bradley Beale Crystals, the new son. Hey, purple, Michael Porter Jr., 23 of 25. Michael, Never Swing the Rock, Porter Jr. Highs on there for the Nuggets. Got a ring. And OG and Unabee, Knights of the Round Table, game used for the Raptors. True. No, no, you're good. David, no worries, man. No worries. No, if you ever have a question on what team you have, always feel free to ask, always. Always. It is Michael, Never Swing the Rock, Porter Jr. Jaden Hardy, 99. LeBron, Crystals, nice one there for the Lakers. Otto, Max Christie, 24 of 25 for the Lakers. Lakers doing well here. Nice one there. And Tyler Hero, Knights of the Round Table, game used Jersey for the... That's my end. Sean also dropped you guys that link to the Cosmic Chrome Half-Caser. Again, that is gonna have nine to go, breaking at the end of the night. Thanks again, everybody. Osemane Jalen Brunson. Yeah, that's a PYT, though, Grayson. That's gonna be Diate Murray to 99. Johnny Davis Rookie. Redemption is Andrew Nemhard. Rookie Silhouettes, going to the Pacers. Nice one there, congrats. Indiana Patrick P. Go to the results page. And Bradley Beale, Code of Arms. Does that look like potentially a city connector? Yes, it might be. Who's this? Pacers, Andrew Nemhard, Pacers.  It should tell you what team. That hasn't gone yet. Oh, it's a, okay, okay, okay. D-Book, Keegan Murray, Rookie. Yovitch and Lamella. You've got a Rookie-Rose, Andrew Nemhard to 75. He's gonna be a gold, Donovan Mitchell for the Cavs, to 10. Nice one there. Otto, Isaiah Thomas, Zeke. Nice one there for the Pistons. Majestic signatures, congrats. Detroit, that'll be going to Brent W. Congrats, Brent. That's a Zeke action there. Isaiah. Airstor Throne, Trevor Keels. I feel like I fit the criteria needed to make the team, but I was left off the team. Yeah, see, they're... Oh, that's so funny. That was from the last dance and they were interviewing Isaiah Thomas. He was like, he did his day. We'll still think, ooh, Kaboom in here, everybody. To this day that he was left off because Jordan hated him. And there's a part where he's like, I feel like that I met all of the qualifications to be selected, but I still wasn't selected. So like that's a big meme now, that's funny. Shaq to 75. We've got Bradley Peele. We've got Will Barton, 19 of 99 for the Wizards. My guy, Will Barton. His uncle. Yes, sir. LeBron, Game Use Monarch Jersey. Nice one there. All right, Kaboom time. Zion Williamson. There you go, Pelicans. Gonna Brent W on the tier two hit on the Zion. Rats, buddy. Kaboom Zion. Oh, so many fun memes from the last dance, dude. And I took that personally. That's a big one. I sent that to UC in Wahoos because Wahoos picked us and UC picked Kyle and Caleb to win. And I was like, I just wanna thank Wahoos for being the only ones to believe in me and Sean. And to UC, and I sent that meme. And I took that personally. Shayla Derren, Kelda Johnson, Malcolm Brogan. Terros here. What's up? What are you talking about? When we play golf against Caleb and Kyle, yeah. There's Test of Time, Kyle Lowry to 99. That was an easy win. It was. I would assume it really was. We've got a E.J. Liddell on the Future Kings die cut auto for the Pelicans. Nice one there in New Orleans. 40 of 49. And Pellow, heirs to the throne. Nice one there. I'm gonna tell you something after the break. Shayla Sharpe.  I don't know why I remembered this, but there's a Mark Williams to 75. Clay Thompson crystals. Red Auto, Moses Moody, 31 of 35. Second year for the Warriors. And Code of Arms, Karl-Anthony Towns. Game used Jersey for the Timberlands.  Bam out of Bile. Chris Ops for his name, it's James Tartan. That is Shaydon Sharpe, 48 of 49. Oh, he's good. Pink, Malik Monk, 40 of 49 for the Kings. Nice one there. Pulled together, man. Tryin', dude. And Code of Arms, Shailen Brown. Game used Jersey for the Celtics.  Right? That's what I'm sayin', Vaughn. I can, dude. It's funny. Pulled together. You might have some sort of silhouette or something. Sean beat me to it. Postman, Jane, Jailin Brunson, Luke Adonish. It's gonna be Magic Johnson, 28 of 99. Great minds think alike, man. Yeah. 74 or 75, Pelicans, Brandon Ingram. We've got Jeremy Sohan. Nice one there for the Spurs on the silhouette. It's going to Minsu. Here you go, Minsu, congrats, buddy. Minsu. Let's go Minsu. Nice Sohan silhouette. And Code of Arms, Annaporty Simons. Please, great minds, really. Put those, let's put that in quotation marks, please. Okay. Great minds. Jabari Smith, Rookie. Iowa DeSummo. Kevin Porter and Tye Tye Washington. It's 47 of 49. One. The Pistons is J-90. Buddy Heald, 15 of 75 for the Pacers. Otto Paukasal, 56 of 99 for the Lakers. That's sick, man. Rats on that LA, going to Alexandros. And Aristothrone is Andrew Nemhard. Jayne Nivey, that's what I'm saying, Steve. Colin Sexton, Patrick Baldwin. See, Steve's got my back. Oh, someone just made a list. 14 of 49, Jamal Murray. Crystal Zach Levine, got silhouette. J-Dub, Jalen Williams, 49 of 99, going to Keith B. in the Thunder. Congrats, Keith. Nice one there, buddy. J-Dub and Peyton Watson. Aristothrone, Rookie at Jersey, four at Denver. The exact last Miss Slander. It's ridiculous. Oh, it's pretty legit. Sohan Rookie. Zion Williamson, Chris Paul, Dallin Terry. Jalen Brown to 49 for the Celtics. That's Anthony Simon's crystals. Otto Johnny Davis, Rookie Otto for the Wizards, 58 of 99. And we've got Deandre Aten, Knights of the Round Table for the Suns, Game U-Jers. See, one more big hit coming out of this. Two very nice silhouettes, I have to say. Probably like top 10, I would say both. For Rookie's, at least. Mobley, Paolo Rookie, nice one there. Brandon Ingram and Rudy Gobert. We've got David Roddy, 299 for the Grizzlies. Hey, Jalen Brown. Pink is Jerry Stackhouse, 10 of 49 to Stack, let's go. That's one there for Dallas, Maverick Stackhouse. And Donovan Mitchell, Knights of the Round Table, Game used for the Cavaliers. Marjanbo Champ Rookie. Jaden Hardy Rookie. Chris Middleton and Darius Garland. Got Oseman Zhang, 275, Blue for the Thunder. Hey, Jake Loravia, Crystal's Rookie. Blue Auto, Lenny Wilkins, going to the Hawks, 37 of 75. There you go, Atlanta, nice one there. I think that's, yeah, Ronson, Congrats, buddy. And Dramon Green, Knights of the Round Table, Game used Jersey for the Warriors. When will he end up? Bases loaded, bottom seven. Two outs. How many innings does he have? Nine, okay, all right. D-Book, Keegan Murray Rookie. Nicola Jovic and Lamella Ball. Got Ja Marant, 299. Crystal, Jabari Smith, Jr. for the Rockets. Pink Auto, Ty Ty, Washington, 45 of 49. Nice one there, or no, yeah, for Houston, for the Rockets. And Cote of Arms, Lamella Ball. Game used Jersey for the Charlotte Hornets. Do a quick recap here, everybody. We've got jerseys, are going to be Dramon Green. That's Donovan Mitchell, Deandre Aten, Peyton Watson, Andrew Nemhardt. We had the Lamella Ball. Anthony Simons, Jalen Brown. Carl Anthony Towns, Paolo Bancaro. LeBron, Game used, nice one there. Trevor Keels, Bradley Beal. Tyler Hero, Eugene Anabee, and Shay Gildres Alexander. We had Autos, are going to be Ty Ty, Washington. Lenny Wilkins, Jerry Stackhouse, Johnny Davis, Jalen Williams, Hal Gasol, Jeremy Sohan, Leak Monk, Moses Moody, EJ Liddell, Will Barton, Isaiah Thomas, Max Christie, Michael Porter Jr., Gail Goodrich, Andrew Nemhardt for the Pacers. And we had the Kabooms. Zion Williamson, going to the Pelicans. Going to do it for the break. Thank you guys again for the filth. Up next is 10 Box Tuesday.


So we're just doing a little agenda-making while we wait for people to arrive. If you're new, please check out the meeting notes. If you're online, I'll put them in again because I don't think the chat's persistent. Add yourself into the attendee list and would love to have two volunteers as scribes. That just means you write down whatever you're here. We have two people so that, you know, if you miss something, you don't have to stress about it. And then you can feel free to talk and somebody else will write stuff down, although everyone is welcome to help out scribing. We just want to make sure that we have at least two people who can capture notes so that people can review them later. And so that we're not completely biased to people who are awake at this time because we have people in quite a few time zones across the world. So I saw that the discussion of the supply chain proposal was proposed on the agenda. Is there a person who has proposed that? I didn't check to make sure Santiago is here. I'm here. Can you hear me? Yes. Great. I don't know if you propose that, but we can chat about it. I didn't propose it, but I volunteered myself to be the voice of that here today. I think people wanted it to be discussed, but I think nobody could make it from the people that wanted it to be discussed. So is there, maybe I just ask, is there anybody who wanted it to be discussed who's on the call today? We could just move that to next week. Okay. Next week? Yes. Great. So I'll just move that to next week. Oops. I just deleted something. And I'm going to put this one actually last so that, because Michael might be here towards the end of this meeting. He had to miss the beginning, depending on how things go. So thank you, Gareth, for joining. If anybody can be second-scribed for the last 30 minutes, that would be awesome. Otherwise, we'll bring it. But let's just start with check-ins. My name is Sarah Allen. I am one of the co-chairs of Six Security. And I have been, I've been catching up on the OPA assessment and chiming in there on kind of wordsmithing like our summary and kind of trying to suggest ways it could be more concrete. And that's our number two, our second assessment that the team has done. And then in my non-SIG security life, I've been thinking about how do we do streaming video over the internet and know that it's not coming from random people on the internet. So that's kind of been fun. It's sort of security-related, but not necessarily cloud, I don't know. And we met with our TOC liaisons this morning. It was more of a kickoff. It wasn't like a big decidary meeting, but generally it was positive. And they really liked the momentum of this group and the enthusiasm, how folks are scrubbing in and adding value and having a spirit of making security something that should be for everyone and openly and freely available. And Joe made the comment that there's some vendors where security is something you pay for. You really like the idea that we were contributing to a common so that security could be something that everybody gets to have. So that's my little check-in. Sorry that went on a little long. Brandon, you're up next. Yeah, so recently I've been kind of just doing the tree edge stuff.  No one has screamed at me yet, so I'm assuming that it's not good. I was looking at some of the PRs around the identity categories as well. I guess if we have time to talk about that a little bit later. Besides that, outside that, we are continuing to work on the image encryption stuff. Container image encryption, which we have our PRLGTMs in container D. So hopefully we also have a KAT which we're going to present the signal next week as well. So hopefully that goes well and then at some point we can also share it with you. That'd be fabulous. Great work. And again, I've been seeing you close things and every time I'm like, oh, good thinking there. So I appreciate that. And we should have time because I think we juggled the agenda around to talk about identity and access control. Next, Gareth. Yeah, hi, everyone. It's the first time joining the call.  So I guess potter's history. I used to work for the UK government doing a bunch of architecture and information security and automation things. I landed at Puppet for a while. I was at Docker most recently. I had a few months off, which is very nice. I've more recently just joined Sneak.  I know like Michael's I'm catching up with him tomorrow in London and I know just in a few other people involved. It felt like a useful thing that aligned with things I like doing, but also now what I'm doing for work is all just handy. Great. Thanks for coming and joining us. And maybe we'll add if we have time, the new member proposal of like where we're working on a guide for new members and that might be a good thing to point out. Yeah, I will happily test that out. That'd be great. Roger, are you have four Wi-Fi, but can you speak? We'll see. I can speak. We'll see if you can hear. So I'm, as you know, p.m. on our Kubernetes distro at Sousa. I am here in Nuremberg, mainly conspiring about integrating and containerizing our OpenStack cloud and CEF distributions on top of our Kubernetes and figuring out how not to turn our networks into a giant swamp of crosstalk and insecurity and fun things like trying to convince people that maybe we shouldn't be running user work on the same Kubernetes that we're running the control planes. And I know I've said this before about having more time, but it looks like we're really in the home stretch of releasing stuff. So it looks like I will have more time. My next thing is going to be cube-huntering our release radically before it gets out this time instead of six months after. And as I told people at the face-to-face in Barcelona, I would love to start at the very least writing along on assessments. Great. I think chiming in on that issue is the way to volunteer the first five assessments issue. Yeah, okay. I shall. Excellent. Thanks for that check-in. And next up is Martin. Hello. Hello for me. I'm Martin and it's my first time here. Welcome. Hello. Thank you. I am working at Viewware and I'm in the open source team in the security sub-team in the open source. And so I will have to listen more currently. I have many things to read and to get familiar with. With what guys you're doing. It would be exciting time for me and hopefully I want to help you and contribute in future. Good. Thank you. Welcome. Then Christian. Hi, I'm Christian. I work on cloud security at Google. One of the things I'm interested in is this notion of how some of our customers have these platform teams and I'm still trying to work on that. I'll probably get access to some of our customers so I can actually ask them. So I will be part of customer visits so that will make it easier to answer that question. So no progress on that for me besides me, you know, trying to make progress in the long run. Thanks, Christian. Um, TK. Yeah, so I did have an opportunity to join a future network roadmap, which I reported quite a few months ago, I guess, and it's going very slow. They do have a security sync group. I mean, security group basically under them focusing on the 5G, those of you that maybe just not familiar with that. So the positive side of it is that there is a lot of, you know, it's a very large scope that they are actually trying to address the security but so it has everything literally. But that's also the negative side of it because my, from my own observation, I am a little frustrated because it's not focused well in the sense of I don't see anything tangible that would be coming out anytime soon, even though it's a long roadmap. It's a 10 year roadmap for security as well as edge automation application services, everything relates to the 5G. So the, any newcomer that will come in there, probably will get confused thinking that I'll go, this too much, you know, where do we start, where does it end, and how do we get a handle on it. So that's one of the concerns that I express. Let's see what happens. That's all I have to report. Okay. I know we sort of owe each other a conversation about edge and how it relates to cloud native and where that fits. So hopefully can follow up on that next week. Dan Shaw. Dan, fellow co-chair. I'm on mute. Sorry, I'll mute. Yes, one of the co-chairs. I've been tied up with some work obligations last few weeks. So I haven't been as active as I usually am. But, you know, in that, I've been, you know, working with our Tuesday liaisons and the other stuff that Sarah mentioned that the chairs are doing to help continue shifting everything forward. Thanks, Dan. Aaron. Likewise have not done too much in the past week on this. On some other data security stuff, but I did see the comments on the landscape and it looks like we're scheduled to discuss those a little bit later during this meeting so Brandon looking forward to that conversation. And then next up is Svi. Svi, do we have audio? Maybe. Hi, everybody. Great. All right. I'm sorry, I couldn't find the unmute button. Hi, I'm Svi from Aqua. I've been on and off in these meetings a little bit, but now it's really getting interesting as we start to talk about identity management authorization and stuff like that because that's my background. I'm really curious to see what we can contribute to that area of Kubernetes. Super. Thanks, Svi. Santiago. Hey. So, yeah, I've been missing from the meetings for a while. I thought that it was a somewhat of a conflict of interest to be here while I was being having to review for the Intota project, which it's finally done, I think. We used it on the presentation for the CNCF last week. So that that was, I think, a great milestone here. And well now I'm looking forward to like future projects. I'm very excited about this software supply chain catalog and resources have been actually taking up through papers because I think we can also add the elements of like academic literature and theoretical background and link to it too. But yeah, I think that's a discussion that we can have next week when everybody that's also excited can chime in. Thanks, Santiago. Carlos. Hey, this is Carlos and working as a researcher in some internal projects that we want to implement the Kubernetes and also on the CI CD pipeline, different testing different security tools. That's too much. The last week. Hi, I'm Ash. I work on the Open Policy Agent. I'm just reviewing any comments you guys may have on the OPA security status documentation and also looking at interesting integrations for OPA this week. Sarah, you're on mute. Thank you. So in wrapping up our check ins, I wanted to note Santiago, if you have a chance to link to the in total security assessment for the newcomers, it might be interesting for them to see that recently completed from the group. I'll link to the right away. Where's the best place in the in the notes or if you put in the chat, maybe one of the note carriers can move it over. Here are the notes. The chat doesn't seem to be preserved in history. Come in. So, so I wanted to do a quick shout out to I'll just take care of some quick items. First, the the new member page. I personally like the proposal that there's buddies for people who are new. And I forgot who said that they were new and was willing to try out our new member page. I think. I'd be happy to take a look and provide some feedback. If you could look at it, it's an issue state with like, you know, some some ideas in there. And I wanted to just see if there was anybody who's enthusiastic about trying out this buddy idea. Wait, on which side is like a someone who's been part of the project for a while or as a new person. Somebody I'm a new person so nobody knows who I am or my voice. Hello, new person. Hi. What's your. So, did you see the notes that I just put into the chat. Yeah, I have the. Did you. You're not that new. I've talked to you, Sarah. Like you were in San Francisco and then like we had a spare meeting room or something at the river hotel. I can't even remember it. Yeah. So, well, you have been to the meeting before we have some people who this is their very first meeting. So, yeah, so I think that last time we just mentioned this in passing. And I said anybody who wants in order to have a buddy program. We must have the newcomers must have people who've been here for a little while who are willing to volunteer to be buddies to be the more experienced person in a buddy set. So, I don't want to put anybody on the spot. I'll just put it out there that if you're willing to be a buddy. Add yourself to the issue and say you're volunteering to be in the first set of buddies. If we don't get any volunteers, then we will not be doing a buddy program until we have more volunteers. So, so I can volunteer myself on the experience side but I wonder if I am experienced enough. I think you're as experienced as anybody. So, you'll just try it out. And you'll have questions and then we'll figure it out. Okay. So, Santiago will be guest buddy. And you'll try out a buddy program and then if we have if we have any other. I don't want to take up too much space for this buddy matchup thing.  I think we had like a big upsurge of people. So if you've been like around enough to kind of have a sense of like you've done a PR and contributed in some way and just volunteer to be a buddy. You can shout out on chat people can match up or and add yourself to the issue so that we kind of know that we have a few people willing to do this. Thanks everyone. And also like feel free to shout out. Well, like let's figure out we that we have some experienced buddies and then we'll, we'll volunteer for new people to have buddies. All right, so now I'm going to actually turn it over to Brandon are you volunteering to lead to facilitate a discussion about identity and access control categories. Yeah, sure. So I don't know if Aaron here right. Yeah, I am sure. Yeah, okay. So yeah, I think so this will space around this issue. I think I think the PR but I didn't think the issue. So Sarah you open this issue talking about called landscape identity access control categories. It seems like the main kind of part of contention here is that some people kind of see identity and access control or something a component of which every project meets and so it creates some ambiguity that so Thank you, sir. I think the wrong. Yeah, I think the wrong issue sorry. I'm trying to find the right one. Is this not the right issue. No, this isn't the right issue. I'm sorry. It's it's the one before that's a pull request. Yeah, I was just linking that. This is the. Yeah. So Aaron, Aaron proposed some changes, which I thought pretty interesting. But I think a lot of it. A lot of the discussions I feel like the open to a broader group. Aaron, do you want to talk a little bit about kind of the changes that you're proposing. Yeah. Sorry, once the thing went full screen, I lost my ability to be mute. Um, yeah, so I guess I was trying to clarify the different things that might be involved in might be identity and access specific projects that we would want to guide people about as they're sort of exploring, you know, building their own cloud native projects. And so looking at the overall CNCF landscape, which is like, I guess 900 different projects just started thinking about how to maybe categorize this section. And so I kind of approach it from the perspective of someone who has had to implement consistent identity for companies as a as a defender, where there's a whole bunch of people who built a whole bunch of services with not a lot of compliance. Not or sorry, not a lot of consistency. And just trying to break out like what are the functions that what are the functions that we want to break this category down further into and I chose to give some exemplars of specific projects or protocols or technologies. And so my effort to help sort of clarify what I meant by these things, but we don't have to include them or not. And so I specifically, because the term identity is so used I specifically added the word lifecycle. Certainly I know that's up for debate. But the idea here is that having sort of an official understanding of what a principle is a principle being a specific user or a specific service and its life cycle creation, and transition granting of entitlements removing of entitlements, granting of attributes removing of attributes that there's a specific I feel like there's a specific focus set of tools around that activity alone and that it's worth categorizing that specific set of what is an identity and what do we know about it tools as one specific subcategory of identity and access management. So I'll pause there and say you know Brandon. Does that make sense is it one category is it multiple categories like how do you want to approach that. Did we did we break it down in a sensible way here. Yeah, I think definitely the clarification so you're either giving some examples what type of identity functions and access control functions. Projects may have definitely helps. The thing that I want to kind of hear more opinion turn was for this specific roadmap document. What's what's our thoughts on including specific specific examples of projects on this. I know initially we we mentioned specifically and things like that but I wasn't sure for this specific document whether there are examples to a different document and if there's more for definitions or do we want to add the examples here as well. So I'm thinking that there is. What we model up here so so one of the things I'm seeing is there's an entity provisioning and identity consumption. What you typically call authentication is actually the consumption of identity right it gets provided by somebody, and I can clearly see that we want to have the provisioning and management of these identities to be be a separate thing. And active directory versus why DC validation step right now you know active directory is kind of the management and provisioning of identities and then the IDC validation is kind of the authentication step. So I think that would be a bit that makes sense to me. I generally agree with this, like that the separation is important. I want to just clarify that there are exist systems where author, where the, the authentication step is not a consumption of identity, where the you can. Your, your identity can be decoupled from like the credential that allows you to come back and and do not be identified by your authentication. Like particularly in government where you're worried about the privacy of the individual, you may sign up for an account using your identity right like if you're like say a veteran, and you're getting health services that the VA might.  So it's just like a, I don't know, maybe that was in the weeds. No, I don't, I don't think so I think that is actually interesting and I don't think we capture that at all. Right, because that becomes interesting if people start thinking about privacy issues. I have a few questions at some QCorn about GDPR at the time, and this this split helps you think about that and reason about that. Yeah, for me the word lifecycle I actually find very helpful here right because it's sort of like it explains that like this is whole thing about like creating an identity and like it's its own kind of set of expertise and stuff. So when it is one question I guess for Christian and that makes a lot of sense the separation of provisioning and consumption and that definitely you're right right like that those are those are definitely typically different activities and provision is particular provisioning is particularly important in larger organizations. So if you had to split those into two, and we were looking at something like an LDAP server right like a free radio radio system consumption but something like specifically an LDAP server, which is both used as a directory and an agent for provisioning, but it's often used as the place where you know attributes are consumed and even passwords verified. Like where would that fit or do we just accept that some things are, you know, some systems are multifunctional and so, you know, an LDAP server would live in both identity lifecycle provisioning and identity consumption. I think there are some so if you if you use some open standards you have an easier way of separating those two. I think especially for password verification there are options to do some of that. But I think a lot of times when you think about one of these identity problems you tend to cover both aspects right you tend to cover you know I need to provision this identity and I also need to allow people to consume them. Easily further down the road right so I think Spiffy does some of that as well. So I don't think you can ever completely separate them but if you if you follow a standard you could right you can provide a directory that vends or IDC tokens right so the validations that can be completely separate from what you do. No, I think that's that makes sense, although for the purpose of decomposing the landscape of projects is that is helpful because there are so many projects as you know it right. If I if I compare this to the CNCF landscape document and say we're trying to create a specific CNCF landscape specific CNCF security landscape that it's not just about new standards it's also about helping people trying to engage with cloud security understand what their options are. Yeah, and I think that that's that's actually exactly what what we need to do because the the idea that that every project or or even an application is going to store its own users doesn't really happen anymore. Everybody's going towards actually centralized user information where the identity is owned, usually by the person and they trust some entity to to provision aspects of that record to certain providers under the consent of the person that owns the data which is usually the individual. So the idea is that that for most projects you will need to rely on a service and there are protocols you know SAML and open ID and all those kind of things that do to do identity Federation and and I don't think that anybody in the right mind would now actually take on. Housing and protecting and and and destroying the talking about GDPR identity information that's tied into an individual. So one question I had that that this discussion sparked is like, is this consumption of identity synonymous with credentials. Like I like it we just kind of back to Aaron's question of like, are these different services or are they always coupled and then we might as well make them one category because we don't want to have everything in two categories. Yes, there is reasons to decouple them these days right so one of them is that these these identity validations are typically costly. Because they involve so it's a purely technical argument right so so you try to exchange them for something that you that can use symmetric encryption. Right and then also then serves as this secondary credential that is decoupled from your actual identity. And are we seeing I'm, I'm not as familiar with all the different things in this space like are they are we seeing an emergence of different projects that the do the different parts of it. I think we, I mean I certainly think we are right we're seeing different ways of managing the attributes that go to identity. I see different libraries and plugins for consuming different kinds of access tokens. You know, spiffy. When I look at spiffy it seems much more about the issuance of credentials, and while it provides some very loose guidelines about how to consume them. I think most of the work in the consumption space is actually be done being done by like their commercial partners so so I would say that distinction definitely resonates with me. Exactly how to communicate it clearly I'm maybe noodling on a little bit to just a question will we classify a project and the multiple categories. We basically have used as a guiding light that our landscape would be perfect if everything fell into a single category. We don't expect that to actually be reality, partly because we're in this emerging space and early offerings early projects often had to build something that now is a broken out and there's things you can use for so just kind of because of history will have projects that do a lot of things right and then therefore they would be in multiple categories, but we believe that a lens for the landscape to be useful. We want the categories to divide the products into projects into buckets right and so we were that's kind of where we've been in previous conversations. There is probably also a another aspect of the identity that is the that affects the whole security aspect that's the identity spoofing. So, and that, of course, the identity directly maps to your credentials to credentials to your authorization and all those things so even if you put them into separate categories. There is clear obvious relationship among them that affects the actual security preservation. So if someone spoofed the identity that affects the whole thing down the chain line.  So, I like the idea of separating them, but at the same time we have to keep in mind that they're related and they're very relevant and one affects the others. That makes sense. I think actually, so the question that we have to understand is do we want to take the ownership of being the identity provider, or are there's going to be a set of services that you're going to trust. And if you get a valid token with the right encryption with the right timestamp and so on you're actually going to trust that an identity is not spoofed that it's been correctly validated. And then really all you need to do is based on the attributes that you get in an assertion, for instance, you would then authorize it for the permitted actions. Because I think that that's what's been going on, you know, over the last, you know, 15 years is that that applications aren't aren't don't want to own the entire user record don't want to worry about spoofing don't want to worry about housing passwords and the authentication and and the advanced authentication and all those mechanisms for two factor authentication and so on. So there are the those mechanisms that do all that. And then if we if we if you trust that that service is providing you an assertion with the right identity identifier then you really don't need to worry if it's spoofed or not that that service has done that. Well, it seems like I think what he was saying is that the interface between these two services of is a bit more complex than a regular integration of a service because you know you have to maintain more than just a call out you have to make sure that the correct trust is established as well as you know, maintaining certain replication this and certain information about key hierarchy as well. It's like a pretty tightly coupled integration rather than just for example like calling out the database or something like that. I was also thinking about, you know, somewhat probably in the futuristic manner, but it's more like the dynamic nature of this spoofing. And let's not underestimate that part because just because you have an identity confirmed at one event at one trigger point, and then you have an application that is triggered. Because in the process and then the identity may have been spoofed right in the middle and someone else is also having access to the same applications as such. How do you maintain that integrity. Those things need to be taught about even though they seem like a little bit far fetched right at this moment but it's not too far fetched I believe I'm struggling to figure out how that. I think you're right that we do need to reason about those things and figure out whether we have you know where we have gaps and whether there's you know tools or processes or whatever it is to address those type of vulnerabilities. The question is when it comes to the landscape where the purpose is to categorize for different projects. I'm struggling to see like how does that, that area that body like open questions apply to this, the set of categories, because there is there a different category or there might be, I guess, under consumption of identity, some category around what RSA calls like adaptive authentication or like identity intelligence, something along those lines. There might be a category there around people who are nominally threat intelligence providers but also help you, you know, help you consume logs of identities help you consume the context of and make better decisions about whether a particular particular authentication event might be fraudulent so so I think it's a reasonable thing to add I can't name other than like RSA adaptive off off the top of my head. Particular I guess cloudflare might have something in that space. I was thinking. Go ahead. Sorry, what I was thinking about a little simpler version like you still have a separate category just like everybody said there is enough justification to have those separate categorized in the landscape, but at the same time if we could create a matrix that shows the relationship between these categories and perhaps even we can identify a little more specific relationship in there. I would hate to use the word API it's not API but it's somewhat of relationship how one affects the other. So that way, if we are doing something on the management of specific category, then we are cognizant of the fact that it might have some effect on the other one. And if we can keep track of that in the landscape like a two dimensional map or even three dimensional, but I think two dimensional is good enough. Perhaps it will keep us astray at least not to forget that the implications there might be even if we did not resolve it for this very moment. That makes sense. I actually really liked that idea. And we could go a bit further as well right we could also say that the network stuff or the storage stuff should also call out to central access management or access control service. And we could get people to start thinking about making that a consumer rather than implementing it. Right and that might also actually help with this this whole cat like the whole category of identity access management kind of stemmed from like well okay well if you have storage that that needs to do access management. In the access management category and we can say like no it's not because everything like this is how they're I struggle to actually imagine how it would be visually described. But I love the idea because it's sort of this end dimensional thing in my head. When it gets to 2D I'm like, I don't know. Yeah, it gets complicated when when resources are also identities right you need. If you're a person trying to start or stop a workload and the workload is a resource however that workload is also an identity that might have access to other resources or other workloads so things to tend to play a dual role especially especially when you start to talk about machine IDs versus people IDs. Yeah, I think that we actually need to call out that there's people IDs and machine IDs. It's sort of implied with I think at identity Federation single sign on to me that implies user identities human identities I should say. Well maybe they're not humans, always. But I think that that it would be worth sketching out that there are these different kinds of identities. This is in the chat there's this discussion around the term machine identity versus service identity. Are they the same thing are they different things. Do we even have machines in the cloud. Yeah, I think we want to separate you know human entities and non human entities because human entities. They have a different path of authentication usually it's usually some kind of password or proving your identity, while non human entities usually have something that's assigned, and, and everything is sort of inherent. And also the attributes, if you're talking about attribute based access controls which is a lot of information on the chat. Also, the, you know, the non human ideas have different attributes in the human. So I find what you typically have is you have a service identity is the one that you're really interested in, and that gets established by some form of trust chain and at the bottom of the trust chain somewhere is the machine. I didn't get the service identity. There's a whole other set of people who like work at the, you know, the application layer who don't necessarily get to make decisions about service identities right. And so depending on which layer of the stack you're examining. It'll have different concerns, but I think that it's a good point. So actually have a question maybe I'm a little bit behind the discussion but if we, if we move this from the identity aspect into the resource aspect but what are, what are we authorizing access to. It, it will help us determine, you know, what, what information we would need to obtain in order to assert that access. So you're saying that this is a distinction between resources and identity. Well, certainly between authorization identity, I think is the point. I think you always authorize a request and then you can use different attributes of the request and one of them could be the resource name. Right. This policy could be determined on resource name or it's just a service right service measures typically only argue in terms of service to service authorization right or even just authorization. I just say you know service a is allowed to contact service be to do something. The space one gig is kind of a level above that where you say okay maybe service a can only access resource see in service be and not resource D. Yeah, and that level of granularity also depends on your enforcement point it can actually do that and block access. Yeah, not all policies have that level of granularity. Yeah. Right. Yeah, the verb is kind of the other one can you only read or can you read it right so so those can be different. Again, different attributes of the request, right. In rest of the APIs, it's the HTTP work that you can reason about. Well, not everything is a peer request right. Yeah, yeah, sure. Yeah, but actually so so you know the error of then did access management is definitely not not you there's a lot of established practice in that. And I think you know there are there are tools, different protocols different standards that that we can use and, and we need to find the right tools for for the job. So if, and if it's, if it's extremely generalized as in we don't know what the resources are, then it won't be one set of tools and if we are more confident in what the resources are and what the level of granularity. is really hard and maybe we can look at other subset of tools that are more good towards that particular use case. But especially in the, in the context of CNC F we have Kubernetes that gives us kind of a resource framework to think about right of course as the the arbitrary problem of, of dealing in authorization but there's also the problem of dealing in authorization the CNC F context, which is really what what what we are discussing here right so at least for the control plane, you have reasonably well established standards here. Data plane is a different question right and then that is that is something we are currently grappling with a lot, because we don't know how to, how to transfer that. There are some some APIs like in the world right don't have necessarily a resource model. But like, I don't know whether under the hood, you know, at some point resources a very general term. In any case, I find this claim that I find the edit as written to be a helpful clarification and separating, you know, rather than bundling together authentication and authorization. And some concrete examples of what would require an authorization path. So, I don't, and I actually would love input from the group here which is, we've talked a lot about this notion that like resources need to make their own decisions. But it does seem like that really is very much left up to the application teams without a lot of guidance as to how to do that. I think intuitively we all know that like to read and write are different operations. There might be major buckets of resources that you would want to authorize differently. I haven't found, you know, I can't off the top of my head think of any framework that lives outside of a given application for separating out or like what what resources would be that is, you know, robust enough to talk about API access, robust storage access at the, you know, object level and, you know, that would be robust to both kinds of like resource stuff so if there are the folks are aware of any good frameworks for like application developers to put in to help them reason about these things that those would be examples I'd love to, I'd love to include. Isn't there a, isn't there some help from the OPA, for example, the policy doesn't the policy decide as to what type of roles or if you are back or a back doesn't matter the credential based access. Yes, but it's the main reason for the OPA type of project right. It's the main reason for the type of OPA project and definitely as they build out their examples. You know, ash. You may have something to add here. That would definitely be referencing and we already we already talk about that a little bit elsewhere and so I'm just wondering if there's anything. Anything else for more traditional are back like systems that would serve as a good entry point. I would like it to include our back and a back as examples here under resource authorization authorization. I find it helpful to the edit that includes having policy engines in that section because like it sort of seats it. But yeah, I would love to hear from Ash or whoever was about to speak about. Sorry. Yeah, just a quick comment on Aaron's point so OPA is pretty general purpose like you know where you can do our back a back anything with OPA it's depends on how you author your policies is there something specific that you think OPA does not meet all we need to kind of include. I'm not understanding that point. It's not very clear to me right now. I'm not thinking of anything specifically and just if they're common patterns. You guys have some common patterns for how to do like admission control now it's it's very it's it's loose to me at the moment so I don't have a good I don't have a good. Not relying on Kubernetes right if you do a kind of a CRD style control plane for your service. Right you can you can use the services of the Kubernetes API server to do both our bag and admission control. Right, so I was just pointing out that like we we have this edit which is resource authorization and I think what I interpret the question to be. Are there things that aren't resources. Do we want to describe it in a way that doesn't use the term resource because that feels very specific. Or is you know, or maybe it's not right like we do have the Kubernetes example as Christian mentions that is like the CRD and it's a very formalized sense of what is a resource and how do you interact with it. But they're you know there are other models and maybe from the open experience you have a good way of describing like what are the things that we authorize and should is the resource term appropriate when we have a category that maybe may maybe we want to leave open for other types of framing. So if you follow kind of a if you try to simplify everything to an object oriented model, you can literally describe the whole universe in different objects right. So then you can consider that okay well resources and object. So any type of access to the resources and object access to that object. So literally, you know from that perspective I think you can probably bring everything in that model as an object type of things and then you provide the grant or not granting access to that particular object which may be just an action. So I'm actually very familiar with the resource based model and I am a big fan of calling everything resource. I also have been in API religious wars with people who are like. My thing is not a resource and so I'm in your camp, but I know that there are other people not in that camp. So in just naming the category. That's what I was like saying is that do we want to have some. I don't know examples of the non resource authentication that is hanging out if there is any. I can't think of another name was there one that they recommended other than resource. No, I mean I think we could just call it authorization. But I don't know, and maybe nobody cares and resource. I wouldn't object to the PR as is. So this is Mark, I could see us getting into a longer conversation about this but the fire standard has multiple sub standards around provenance the, the authorization layer the infrastructure for transporting authorization, the resources and the RDF triple store associated with the domain models. I think because they're dealing with HIPAA and safety that the fire standard does a better job of any of the cloud native security projects that I've seen. Now getting into that is a bit of a deep dive so that's kind of the risk of going into this territory but you know if we had the time I would think that's worth our time now. Well we did with this in the NIST big data working group was trying to do a crosswalk to some of their existing standards. I don't, it looks to me like that is not going to suit the more modest thing we have in mind for the landscape but we might want to just put a placeholder here to go back and revisit the work that's been done in that standards organization. Thanks for the, I'm going to like thanks for raising that I want to close this thing because we've got just two minutes till the end of the hour. And, and like let's put a pin in that because we did have very early on discussions of wanting to sort of gather the relevant standards right and that could also be a lens on the categories right where there are existing standards right like maybe that means something to the categories, or logging what we collectively know as standards that are out there that are in wide use, or that we recommend for whatever reasons to as a service to the community. So I'm going to pause there, I'll give Brandon and Aaron the homework of like figuring out whether we need to, whether we ought to resume this next week and finish the conversation or whether you feel like this can be taken forward. And I want to have one extra call out for volunteers for the microsite we have all we have we had selected six presentations, maybe eight, six day presentations from the last year and a half. That seemed to be helpful to the group that were a presentation format. And those have all been uploaded to YouTube and with transcripts. So we want to, like, basically they need to be like sort of, when do the when does the actual presentation start and end of the meeting, and like just sort of sweeping through the transcript to be like, do we want to clean it up when we publish it on a page will probably still keep the transcript right of the meeting but you know like if we were going to have something that goes with the presentation. You know, if you're if you're interested in listening to an old meeting, and you know maybe pulling out some a summary of it would definitely love to have a volunteer's willing to do that. All right, Brandon any last words on the identity and access control. Welcome to chatting with Aaron about this. I think that definitely like some things that we can just push in there that pull in directly and some things require to discuss a bit more. Yeah. Okay, super. Thanks everybody. See y'all on Slack till next week. Thank you.


I don't need well I got good news for you more you don't have to worry about that kind of religion You don't have to worry about that kind of faith matter of fact, you don't have to worry about meeting God You will meet him one time. You're gonna have to prepare But when you put your money in the church bucket, what do you get back? Hope in a future after you die in my position on that if I have to die to experience heaven I don't need that religion. We don't give money to get anything We only give to expand the kingdom the Bible says whoever wish to save his life will lose his life And whoever wish to lose his life will save his life that is to do it for my sake What will the Prophet for man gains a whole wide world and lose his soul? We're not on this side of eternity to be rich on this earth No, our goal is to be with him. That's the kind of faith that we want But again, you don't have to worry about that kind of religion or that kind of faith as a matter of fact You don't have to worry about that kind of God, but you will meet him one day