Good morning. You're so very welcome to awaken the heart and I have a very special guest with me this morning Mystic David Hofmeister. Thank you David for joining us. Yeah, it feels so lovely to have a studio and walk down the hall and Come in and just be in presence with us. And I have no set agenda for today I can see all of these Wonderful Devoted ones who've been joining us showing up on screen here. We welcome to everybody on LM virtual. Welcome to everybody on David's Periscope We're just covering all bases here because it always feels like a delight to have you in the house with us. Oh, it's beautiful Yeah, I agree. I love this interactive feel. We've got on the show It's like having the Brady Bunch at home with you. I Love it. Hmm. So you just come back from a really spontaneous tour of California and I've just been watching and it just felt like it was you were just so well received and So spontaneous almost like there were whispers on the wind or a feeling of those just Arriving from all kinds of avenues as well as those that have been following and devoted for years and listening to you Yeah, it's interesting because It's it felt like it's a spontaneous year coming in and then that is something that early on back in the 1990s That I just was doing a lot of spontaneous travel There were still be things being arranged, but they would be arranged pretty short notice I'd call like a friend up Ruth Hanna in St. Louis and And I'd say I think I'm ready to come out that way to do a gathering from Cincinnati St. Louis And she'd say okay, how many days do I have and I say maybe Two days or one day and she'd have 50 people Over at John Hutkins house and we you could just hear a pin drop. We would have these deep Gatherings and so that's kind of the way this went. I was down in Mexico. I was feeling like a swing through California called Makita up. She said she'd been praying out loud for Something and then yeah, it just sprung into action. So it's beautiful It feels so natural that way because it feels like whoever is available and ready to answer the call then it's very deep It is a miraculous that you've land into their life in that moment and therefore Everything is facilitated because I watched it. It was like everything started to land on a Friday And you guys were were there by Wednesday and Everything just filtered in and there was no sense even from this home team here who puts things out or shares There was just this feeling of if I lifted up a photo that was ready to go It was someone took it from my hand and it felt very joyful and it felt Again like that vibrancy that that truly is the immediacy of what you're offering and I feel that's very important too That it's not some time in the future sometime next year might be good. I'll work it in. It's like it's now. Yeah. Yeah Yeah, I've been reading from the course section from the text and a workbook lesson and And actually I just I think was yesterday was the immediacy of salvation. That was the The title of the subsection of the course and so vibrant be not content with future happiness for you have caused for freedom now and And that you only feel this sense of guilt and fear when you put Salvation or forgiveness off in the future. So it's a very immediate experience It's interesting too that I've come here and then I was just On there and I glanced down at the calendar. I saw February 29th. So leap year. This is We're already out of time. This is the leap year day Where the an extra day is added, but I like the leap part That's the part that jumped out not the day or the years or whatever But the leap part and I feel like that's all the spirits doing is it's calling into a leap into the holy instant And and everything else, you know starts to just fade away as Is unimportant all the things that you thought you did in your lives that you accomplished Doesn't matter the things that you didn't accomplish Doesn't matter the things that were left on your bucket lists that you never Got to do doesn't matter. It's the holy instant is Is really all matters living in this joy and this happiness in this innocence and We're invited like little children and and I think too on the travels. I had we were well received but You know having a lunch there four and a half hour lunch with Judy scutch and William witson Witt was talking he's 87 now and he his bright white hair Sparkly white hair and his sparkly eyes twinkling reminded me of my grandfather A bit with uh in his 80s and twinkly eyes And he was saying to me um Yeah, he had this dear friend that of judy and his that Who was a course of miracle student from sweden? And when the swedish translation finally came out the man had read it in english But when the swedish translation finally came out they sent him a copy And in his later years right before he died before he passed away Um, he would read the swedish edition and he would keep it with him. So he would hold it And his he started to forget His memory started to fade all about this world He would hold on to this swedish book and He could he couldn't even speak in senses anymore And so uh by the time that witt got to him Basically, he could barely string together a few words and the three words that he could string together When someone would point to what's that in your hands that he was clutching He'd go voice of god voice of god Three words he could pull together out of losing all his memories of the world voice of god voice of god and then um His wife who saw he was becoming more childlike and more innocent as he was You know going into this state that some people talk about his like alzheimer's or dementia basically She he wanted to play and so she Bought him ahead bought and had installed a a big sandbox.  He said I somehow I think the real world and true perception is closer To my friend Who seemed to be diagnosed with with alzheimer's? So that's important because um, I was talking to nakita when we were coming back and I was saying It's kind of like in uh in the united states. We have horse racing and there's the triple crown and uh Preakness and belmont steaks and the the kentucky derby and when a horse wins all three of the top races It's called winning the triple crown And there's a very famous racehorse called secretariat who breezed to victories easily in the top three Races and then then what the people go what happens when when you win the triple crown Then you go out to pasture And basically you get to just graze You you get the green grass and you go out to graze. So So we've thought for years, you know, we have the first course of miracles monastery. I've always thought it's kind of like pasture It's like grazing even though there's not often a lot of grass out there It's still good for horses and and it's good for those that have run their race But actually feel more drawn into the mystical Still aspects of the mind because that's how god is experienced is in the stillness and So when the racing is done Then the stillness is what calls and and that's where it's all headed Yeah, and I think you've been a wonderful demonstration of even those seeming those seeming tears of what is involved And it's not before you go into mysticism But that the course has been this deep consistent Baseline from which the mind can leap take that leap And and and yet the invitation is to take the leap Not to stay in studying but very much to absorb and come in and then take the leap Into that. Yeah. Yeah, it's not it's not like you Segment your life up. It's more like you just deepen into the the presence of god's love And then when you do what comes out of your mouth will seem I think sublime it will be a blessing to the whole universe and so Jesus was a very public mystic And we've had some public mystics along the way and the way the life of david the parable of david's played out That's been more of a public mystic although there were aspects like the jesus of Going off to hermitage. You're going off to the mount and and reclining from You know participating In things and activities, but but actually it's a state of mind That's you know not tied into form at all. So it's not the matter of being active or inactive It's really having a still mind. That's what it's all about Right, and I've really always appreciated that with you even with my own functions seemingly here You're going, you know what pr stands for serenicide peace reigns, you know It's like so that um, even I would be constantly reminded of what the invitation was for even what the backdrops were for You know and it's so generous because Even though we have conversations or we have meetings like the invitation is very clear And it's just that it has to be to the foremost of the tickle of my heart so I can accept just and take that leap Yeah Yeah, that's it just remembering the purpose regardless of what Seems to be happening because the ego temptation is just to get lost into the form and the actions or lost in the roles And that's just the temptation and so it takes mind training. It takes vigilance initially to to pull your mind up to that Still realm that expensive realm and just to stay there and not feel the need to react and respond to the world anymore Well, and also on a practical note I've been having this experience as we've been preparing what is the the next book that we're going to bring out which is actually the mystical teachings of jesus and We're going to be launching that in the next week and I've just been having this experience that it is It is literally being a demonstration even in trying to bring it forth of It's out of pattern nature of its call into that experience and of its Devotion to the presence. It's there isn't even a way in which we're able to Do our usual way of doing anything with it. It's happening in its own way And even the covers is just such that deep presence that you're talking about like of stillness with jesus on the cover It's so beautiful that I just feel like It's it's demanded The call of my own heart like I've had to come into an experience just to even even make the website with Eric anything it's just It's got this and I just I feel it's such a beautiful book and it's been such You know, it's it's bringing you into that mysticism that that you're speaking about and it is What is left singing in the heart when you would be out to pasture in this? Yeah, yeah, I think it's I think mysticism and presence in order to Be what it is In terms of its relationship to the world of images is is that it's extremely practical so Everything comes from practicing the presence. I would say that's that's an everything is an outflow of practicing the presence So even the origins of this book um I remember as far as content goes back probably around 1994 Or perhaps even a little bit earlier than that. I I was working with a small group of students and They'd been raised in the western world the western civilization. We caught the judeo christian uh upbringing And so they they were working with the course, but they found the course A bit steep almost daunting in its languaging and its unwavering teachings that seem to be otherworldly way beyond their daily experiences and so the first Idea the seed of this book that is now going to be published as the mystical teachings of of jesus started off as a request Just like the course started off as a request where bill fedford Said there there just has to be a better way of living compared to what they were Living in their professional lives at the columbia presbyterian medical center and he thought Helen might laugh at him when he said there has to be a better way But she said no you're right bill and i'll join you in finding it and with the group of students They were saying there is there anything that can help us Jump from our training with the bible To the course because it seems like jumping across the grand canyon talk about leap year. This was the leap from uh of consciousness and awareness from their everyday experiences with the bible and its teachings to the course And so i said oh yes, i'll get right on it and when i prayed i received instructions from jesus You know to come up with these questions and then An answer to the questions would be passages from the bible followed by passages from the course And so that book was called the bible course companion And that that was essentially the same content and then My meaning in scripture as it was opened up more for Beyond the students for those that we were reaching and your painting of an angel Going on the cover that was i guess healing in mind healing in mind, but my meaning is scripture We i guess we didn't have any we had a big big burst of light burst of light Right going to the light with that one and then um it it came Apparent to us that perhaps it would have even a little bit broader circulation And years had passed and to the point where there was a readiness for These ideas for people that were familiar with the bible Maybe had a sense that there was some clarity needed or Some focus or some deeper insights and then this book emerged so even like the course it was it emerged from something that From a call for the practical And i think that's the way our our daily lives have to be too we have to To have them be a response through the guidance of a call for the practical I mean i definitely felt a call for it i was given to support in the um Bringing together and just making sure our quote Numbers were right and everything for it and i remember sitting down and even though i've been raised a catholic I remember feeling i don't know enough about the bible I don't know what i need to know and i was sitting in the peace house in ireland And i went i need to learn about the bible and went ding dong And i went downstairs and the jehovah's witnesses are at the door saying we want to talk to you about the bible I said come riding come in and and so for me it was a practical call into an experience that i needed to have Like there was a healing and a forgiveness opportunity For passages from the bible or from ideas of jesus that i'd had or anything that needed to be just Just allowed to dissolve really it's even the healing isn't So active it's just In this juxtaposition of the way the passages are put together it just clarifies something in the mind that allows you to go Yeah, i can just as a an outfit. Yeah, you can sure feel it. I think it's too. It's a miracle as i look at it it's a miracle that this book is getting published actually because Anybody who knows anything about typical publishing knows that If you want to quote something from another book Sometimes you're allowed a small percentage Of a quote From another book as as long as it's a percentage of the book you're writing as long as you annotate it Correctly and properly and everything but i don't know if if our viewers know that that with So much of the book coming directly from the published course of miracles that we had to get permission But again, that's where Judy and wit and debba came through and said yes Go ahead. Yeah, they really felt it. That was like a miraculous really and it was a a great vote of confidence in in in what you had initially wanted to do for those initial students and then for everyone Was just share and clarify And we're using the king james version of the bible which is the same version that the course uses as well And so it's so easy to see that the same voice has been speaking for eternity And and now just just clarity and in being able to have the years to hear. Yeah, yeah And also it was interesting during this lunch That I had with judy and wit People some people know the history of the course where There's now four published versions of the course and the the copyright Uh proceeding that there was like seven lawsuits going at one point and and judge suite You know putting the chriswell edition saying no it was out in the public domain, but in talking with judy um It was kind of interesting because I had heard Uh a while back that that there was still a lawsuit running and I was like what there's still a lawsuit running it was over in germany, right and uh They told us that six months Judy was saying after ken passed the The court in germany ruled In favor of the original copyright, but the ruling was was this That that When you have a copyright on something you have it for life Their their ruling was that the copyright cannot ever be overturned So that therefore everything that was copyrighted previously is now under copyright Again and they said in those crazy american courts that I think they can just Overturn and rule on things so it was I thought well, this is kind of interesting now. This is like a full circle around That was quite fascinating to me because to me you know when when helen Had her books and and they decided to publish it on a broader scale They did try to you know go and submit the copyright originally But anybody who knows anything about copyright law knows if you can't have A book or anything published by a divine being That's copyrighted so you can imagine going into the united states copyright office and saying uh here We want we have a book that we would like copyrighted and And who's the author um jesus christ They say no No It's not allowed We can copyright things in this planet But not that and so then they had to go back and and and they were going to put anonymous And can we put anonymous Uh on there. It's quite interesting. That's like almost from the 12 step program We put anonymous on there. They said you can't put anonymous, but you still have to put a name of a person A person After that so they might don't put anonymous and jesus christ don't try to pull this stuff on this so anonymous helen schuchman and then It was it was sent in and it was copyrighted and so to me What's up behind all that was is just to keep The the consistency of the thought system in a world where everything Seems to be broken apart in the cosmos where everything is fragmented into pieces There was an intention to Keep this, you know divine scripture. You could call it, you know intact So to me that's beautiful and also I I like that line in the course where Jesus says this course has everything that you need That was particularly helpful for me because I was you know Prolific reading all kinds of different things and it really was just like a little symbol like relax And study and practice and apply this and it'll take you where you really want to go And so those are all very important symbols in terms of waking up. I think those have a have an importance Yeah, and we felt very happy to honor that integrity I was I watched again recently part of the the story of the course in miracles Which is so beautiful of them making that commitment out front and looking around the room and realizing Oh, it's us. It's us that will keep it all together, you know and such love and devotion I just my heart swelled when I saw those photographs of the lunch and and heard some of your talks and Just that and and I just feel we have that same integrity and devotion to bringing forth this message and the the honor Of it the honor of it of saying, you know, and also this whittling away of Undoing of at least that I've been experiencing is so that the discernment is not of me that I can just be following Like they would this prayer of what now what's helpful How can I truly serve and I just feel like there's this huge openness with all of us here and this kind of excitement Of what it is now and and how to bring it forth just to share it for ourselves It's for this experience. Yeah, yeah I think it's the presence of love is behind everything orchestrating the use of all the symbols and I really feel that with judy with witt with With those that have been part of the first generation of bringing the course here and then As judy's 84 and witt is 87 there was a sense of a little bit of a feeling of passing the torch And the last time I was in the bay area. I had lunch with tamra her daughter and And also bob rosenthal. I've had some nice email exchanges He sent me his book To kind of review one time and so tamra and bob will be taking over for those As far as running things. They've done such a great job Namely judy and then her husband witt and then bob scotch who's 90 I believe So so it was like a passing the torch and and really that's the feeling is that that we're keeping The integrity of the presence and the message and the depth of the message. It's not so much about trying to control anything in form because Everyone's aware that that when you try to control anything in form Then you can't forgive and control at the same time So there's a great allowance to just watching the world and letting all things work together for good as the spirit is using them But also the presence That's behind the message is just felt so strong and that's that's definitely what I feel Hmm It just had coming to my mind that scene in the book of Eli It's one of my favorite scenes of any movie where he's been taking this book and taking it across the coast And he seems to have to defend it and everything and there's this moment where there's a girl and there's there's some way in which he can Save her it seems And he seems to throw the book to one side and she's shocked because she's aware of He's been teaching her what it's about and how important it is And how he's given his life for it And then and she's after she goes I can't believe you what were you thinking? He goes well the thing is I've been reading what the book has been saying and I've been taking it into my heart You know and at this point we were not aware that he's absorbed the entire book So if he's carrying it's within his heart, but then the demonstration like he said What of what was you know and just wonderful. Yeah Yeah, that's it. We're called to be the demonstration of love And really that means to not judge anything in form but to join with the With the atonement principle to join with the you might say the judgment of the holy spirit Which is really the guidance of the holy spirit unwinding the mind from the belief of all judgments And then opening up to the last judgment Which growing up christian that always had kind of a negative connotation But it's not uh god judging at all. It's really It's really this the spirits judgment of or it's the judgment of truth on illusion It is not real And does not exist So if anybody says, you know, they're not in favor of judgment Well, the the judgment of truth on illusion it is not real and does not exist Is what you're going for and that is a very loving joyful. That's like a cause of celebration That has no negative connotations in it. It has no destruction It just means the truth is true and only the truth is true and that's good Nothing real can be threatened. Nothing unreal exists herein lies the peace of god That's marvelous. That's spectacular. That's that's the the happiest Statements you could ever make but it's not a personal statement. There are no persons that make that statement And so that's what we're opening and and truly living is that that presence That's the blessing Would you like to sing a song for us? Sure I could sit with the theme I should say that the last stop on the tour The woman Diane had invited us to stay at her home. Never had done anything like that before but received an email from Eric And just I heard that part of this.  Thank you letter. Just how what a wonderful experience was So that's how the miracles work. That's Diane. That was Diane. Yeah I had met her when we went up and I think to do something up Was it Petaluma area or something would and it was a one-on-one that you had helped arrange for me Yeah, and then this was over a year later. I think yeah, yeah Yeah, that was in center for all those Yeah, that's beautiful. She she contacted me many times after that too just Just going through a lot of stuff with her daughter This song is called only loved The past is gone and I have been so mistaken In everything I saw nothing was real The past is gone and all has been forgiven It all has been imagination Only love Oh the past is gone. No more future Time and space Disappeared it was just a dream Hero there It's all the same Yeah, when you think about We've been talking about the meeting with Judy But the translation is kind of interesting because it seems to be a translation of words from one language to another And everyone knows that a good translation would be one in which The meaning that Is conveyed by one set of words is conveyed by another set of words So the the meaning stays the same even though the words Are changing and really that's very parallel to how the Holy Spirit works that the Holy Spirit Is just the presence of love the remembrance of love in our mind And then that's why it has to come out in seemingly different ways As there's different people places circumstances situations The presence of love stays the same But the words are changed in order to to convey the meaning And so You might say that that's really the whole point of a course of miracles It's not necessarily to become a scholar or You know to be able to recite the course But it's just to let your mind go into that presence of love whereby You're a conduit for that love to pour through And it can come in so many different forms and will need to come in different forms because of the different situations that appear so I think That's going to be like a theme as we move forward this year It's something that's been very important to me because in traveling to 44 countries and meeting so many people It's not about hanging on to concepts. It's not about Even blowing the horn about certain people places things events in this world It's more about that flexibility that fluidity of Of being in alignment spirit and letting the spirit come through like a clear pure conduit And then it's felt the presence is felt through that and When I landed The first movie I saw was something like which Which country to invade oh, yeah, we're to invade where to invade next was michael more movie where to invade next such an unusual title for a movie but But it was very very helpful because you could feel the the presence of love the the lightness the humor and you could see So to speak love in action Where there was a strong devotion Among the places that michael more visited to putting the love into practice Not just talking about love as as a theology or as a high ideal but actually living that experience and and he went to government he went to prisons school in in france and He just was going around to many many different settings where you could feel the love in action and really that's what we're doing is we're letting love come through us as a demonstration so that it we convince our own mind our own psyche our own consciousness of of that love That we are love And when judy and I were talking that she was saying yeah, it goes beyond what we would call Collaboration into we are literally the same self. We are all the same self And treating everyone with the same love and respect And reverence that you would have for yourself As the christ as the living christ as the presence of love So to me that's what this is all about and And the forms are just backdrops, you know, no form is better than another form no Place no person no situation is any better than another Uh and once you have an experience of that then you will no longer be seeking for a better form That's pretty much the curse of the ego Is things would be better if they were different in form So if you could took the entire ego philosophy is just this pursuit of an imaginary Better form and there isn't a better form So you can call off the search you can end the seeking you can Can rest In a divine sense you can really rest in a state of acceptance Without having to spin the hamster wheel round and round and round As if there's more there's better As if you need to prove something, you know, we're really realizing that's just a game And the game is over Yeah, it's beautiful. I've been having this experience of in the song The word that stood out the most was no barriers and that are just saying and just that feeling of Coming into a softness and that that the function is really just seeing anywhere I would keep up a barrier because they're falling Anywhere I would keep it up like they're just falling themselves And just and that's why that even that film is so sweet with the idea of invading, you know invading it's like I do I don't know since I've been very small more than understanding anything It's just that feeling of not wanting there to be all this division between things and And and now there's like I have this practical way to allow my mind to soften into it And I just feel really grateful Just feel very grateful. Yeah Yeah Yeah, it's very joyful. I I was thinking the other day that it's this old very mental of songs but and The spirit likes it's always serenading me taking all these songs from because I've listened to so many songs in my lifetime But I'm tweaking a few of the words but This one was why don't we live together? Taking the spirits ride side by side Sailing through stormy weather And that just went on and on and and that's the feeling In my heart Is why don't we live together?   She was so happy Dorothy was so happy to go back to Kansas To the farm in Kansas, but but this why don't we live together that I'm feeling is like living together in this divine sense of divine mind or living together in the heart Home is where the heart is and so You know, wherever it seems to be and the body of David has been traveling for a quarter of a century And I was noticing that even the spirit was saying here you are back in california seemingly looping From where I first took off and was in california 25 years ago. So it was just like Truman show on The forms are on a loop. I'm looping back around but this home feeling Feeling taken in to people's homes. Oh, why don't you stay with us? We have an extra couch or oh, we have a bed We have an extra room. Please come and stay Me casa su casa Oh come back any time our home is your home. We love you You know when you hear that over and over and over and over it It really helps instill and and give you a certainty That you have a home anywhere you go because you're like you bringing the love and you're receiving that love and it's a feeling of connectedness and home and And that happened to the last time I went to northern california because I met tamra for the first time i'd I Read a bit of her book double vision That uh when I would mention it to her she her eyes would roll when I mentioned it to Judy her eyes would roll There's a mother daughter book And they were raw both were very raw and putting this put together in fact There was so many stories and miracles around this book, but And had a great lunch with her and then at the end Tour for through her house.  You can just come and enjoy it. It was the same thing And to me that's that song. Why don't we live together? We are just Encouraging this sense of feeling relaxed feeling connected feeling at home Wherever the body seems to be whatever the circumstance seems to be It's very still when you go into that because there's not any kind of uh Trying to look for something better Not the sense that you have to move on any kind of um Sense of restlessness is always of the ego because the spirit is always perfect still rest And so you can be aware if you start to feel a little restless like Like oh something needs to change or something needs to be different. You can just say peace Be still peace to my mind be still There's no need to seek outside. There's no need to seek for something better That's very relaxing I almost feel that's exactly the point of this show I feel like everyone who comes comes for this hour of pure devotion that there is nowhere else They're supposed to be there's nothing else. They're supposed to be doing Even if discomfort arises they don't there's nothing they need to do to fix it and I I've told them again again how at home. I feel just with them all in this in this moment It's not a place. Yes, obviously And I It's it's everything and it's everything I I I thought I needed to seek for You know and that recognition It's just so powerful because it's it's it's like a lover saying it's always been these arms And they're right here just lean into it. And you know, and that's why I think that's shania twain song yesterday I was I played it for hours. That's shania twain. I played for a song I didn't do notice calling that but there was something about I'm I'm keeping you in my arms forever And it was like that feeling you said let's just live together like this just Always and always be in this experience because because there isn't anything else.   Yeah shows Virtual eyes and you can see your faces And I can wave And I can see the little everyone waving back It's like we're living together. We're all in one digital We're in like a A quantum room together And our little digital selves are smiling and waving at each other It is beautiful And and I think that's the way it continues on. It's like when we have um We could call them retreats or Festivals or whatever, you know, you're all invited to to come And it's that it's again that same feeling where it's no different than this nothing's any different And we have no clue what's coming or how things will play out But but we just love the the joy of it all and the spontaneity of it all and I like that interactive Feel of being able to do a little eye gazing in the middle of the show It's very intimate and they're very receptive like I can I feel my heart strings like constantly in Harmony with everyone. Yeah. Yeah, I know it's fun They're all like strings on the instrument. We can see all the strings Is there any Yeah, just anybody that has any uh questions or comments or Anything you want to share put your question. It was chatted in chatted in question Victoria She was wondering kind of like the bodhisattvas in the buddhism tradition who Stay in the illusion to help others. She wondered if you've made the decision to stay in the illusion like the bodhisattvas in buddhism Well, it's kind of harkens back to that thing teaching from the bible about be in the world But not of it, but I never related to that at all Honestly, I don't feel like I'm here Uh, I feel like I'm watching us. It's a surreal dream And I'm I'm just aware of dreaming and I'm very happy to be dreaming But um, it also is awareness of of illusion just because that's where you stay Defenseless, that's where you stay happy. That's where you stay joyful is is not being invested In any images or appearances You're not invested in outcomes And we all know that's how the ego works, you know, the ego is like bigger better faster more The ego is always interested in outcomes and numbers, you know, even with the tv show, how many people are Are tuning in what are your ratings? Well, we what are we we don't have nielsen ratings. We rate between like 20 and 30 Or something like that But they aren't is that million no thousand No, it's 20 or 30. Yeah 20 or 30. That's That's what we've got But see it doesn't matter because it could be 20 million or 200 million or or 200 trillion. It wouldn't really matter Uh zero times any number is zero and and it's the love That counts. It's the love not the the numbers And isn't it delightful to live your life? Be be transcending numbers Wouldn't it be just think how much fun it would be if the numbers in your bank account Uh didn't matter if it was uh zero or 100 or however many zeros or or even with uh debts, you know people go oh debts and Where the numbers all matter? It it's just a light. It's a very light way to live where you're focused on your purpose You're focused on your happiness and joy and not on numbers So I think it's I I would say more I haven't chosen to stay in the illusion for the benefit of my brothers and sisters I have chosen to stay aware of dreaming And seeing the false is false And not taking illusions as the truth That's uh my my uh Purpose and my decision Any other decision or decisions any other decisions out there questions Go ahead candy Oh, hi everybody. Hello, David. Hi Hello, Sarah Um, so wonderful to be able to talk like this because I'm new to this whole lm situation And I'm very grateful for it. So thank you for this opportunity to ask questions um, one of the things that I'm trying to figure out in my mind is the how to reconcile Working like I'm a bit over halfway through the workbook lessons and um I think uh, I'm starting to um Hear more the guidance the voice of god um, but I get into situations where I feel a bit conflicted inside because There are these, you know responsibilities obligations from this world that we live in Say for instance work that that's one of the things that I have a bit of an issue with um And several things are happening there. They're obviously I have deadlines that I have to meet Um, I have to email my students because I'm I teach at the college level Um, I have to do my coursework and then there are moments when I feel like oh I should Maybe listen to this prompt that I'm getting that I believe is coming from from the holy spirit And yet I have this deadline that I have to meet or I have these things that I have to do for my work so There's a conflict there inside of me and and and I go back and forth back and forth and sometimes I I decide okay I'll just go with the prompt and somehow the rest loves will clear itself Uh, I will be guided to resolve whatever needs to be resolved But then there are other times where I'm so scared of doing the wrong thing that I I feel so immobilized almost So so that's one part of saying and the other part is that What I teach is business And the more I delve into the course the more I do the lessons the more I notice That's not what I want to be doing teaching business. It's so contrary to what I'm learning in the course And yet a part of me Feels like okay. Maybe that's what I need to learn to accept the fact that that's what it is right now but I don't know if that's the right approach so There's a lot of conflict and confusion in my mind right now. So Any any insight, uh, I would appreciate really really very much Yeah, thank you Well, I think I'm glad you raised that because As you keep going deeper with the course You will see jesus things like you may notice how different the goal of this course is from the goal of the world All of the goals that we have as as a self concept as a substitute identity Are all based on time They're based on a productivity. That's based in time not on being happy Not on being peaceful, but on being productive earning attaining possessing accumulating Those are all ego goals every last one of them. There's not a single spiritual goal in the things I just mentioned Uh and peace of mind beautiful inner peace A piece that passes the understanding of the world that the bible talks about That's that is the goal of the course In fact jesus actually makes it clear in one of his review lessons in the workbook Where it says the peace of god is my one goal The aim of all my living here the end I seek my purpose and my function and my life While I abide where I am not at home meaning that In in eternity peace isn't even a goal. It's just it's a state of mind It's a state. It's the state of reality of Of the kingdom of heaven or this of nirvana But in this world it becomes a goal because the mind is so scattered and it believes in so many things so When you were talking i'm glad you brought up that example of work because uh Yeah, I think most all of us have had work experiences whether it's working for money or working in an exchange for Staying someplace or whatever There's we all have had this experience of work And when you were talking I was I was remembering this beautiful book by khalil jibran called the prophet And uh, it was a tiny little book that I read years ago and he said when you work work with love And uh, meaning to me if if there's something that's going to come through you even as a channel Uh, that seems like work work with love. Let let love be the inspiration behind it And for most of us initially when we think of that we go well I don't know if everything i'm doing all all day as far as work is loving If i'm teaching business Then and business is about you know making money Making a profit And and jesus is saying what profit is the man if he if he you know Lose the whole world or gain the whole world and lose his soul You know you sense there's a different motive in there for Forgiving and for living this life so What I have discovered is when I kept listening to the holy spirit Uh, I was prepared to be called out of the world when I was told jesus said i'm calling you out of the world I said i don't know what that's going to look like, but I'm certainly willing to go in that direction And it really was coming to see that they're Coming to a state of mind where there's no conflict in your mind and therefore This the world is a reflection Of your mind then there's no conflict. You don't see conflict in the world anymore either It's just coming to that piece piece of mind Now as an example, I've taken these the course very very sincerely So I've followed and done exactly what it's said to do And and then at some point I was so guided by the holy spirit that that the course itself was just another prop On the stage and nothing more than another prop And as I look around i'm i'm in a studio talking to you that That I know the story behind the studio. This was a garage. This used to be a garage door And and and I see the padding the sound proofing on the wall and the green screen behind the curtain and all this and that and I watched All this come and I look around me and I look at I look at sarah and Sarah is sitting right here with me. This is her work. This is this is what she does for a living I look over there's nicolas young man What is it 22 years old and he kept writing to me you were in university. I think up in canada And he's sitting here smiling. That's his work And I see loose and she's come from holland and She's sitting there and her knees up. She's holding her knee and holding her leg and she said that's her work And I go around the room with everyone who's here from every place that they've come And this is their life's work They're in their life's calling Uh And they're in happiness doing it and they're in harmony because the form of their life is just a reflection Of them answering the call And this is no different than 2000 years ago. I mean when jesus walked around and called the apostles All he said to them was follow me Most of them were fishermen so they fished for a living and then we know uh that uh matthew was a tax collector Uh That he was in the business world a little bit more than just grabbing fish getting fish, you know He was like collecting currency from people for the government and and so forth and and they people had their different professions, but But he was basically calling them out of the world. He was calling them back into a harmony with the holy spirit So that everything you think and say and do teaches all the world so that there's no contradiction in your life And I would say too that that's that's a big training because this whole world is based on exchange and reciprocity And We do have examples throughout history of st. Francis and mother Teresa of course jesus Of those that lived in divine providence where They they just didn't have that question How will I be provided for they trusted god to provide? uh When I would share that with certain people they would say but But okay now, but that's fine. But how do you make a living? You know, they They don't actually see that the divine providence is the living And there is nothing else outside of that. You know, it's the flow So i'm glad you're bringing this up because because this course will undo every bit of ego thinking and it will take you into a A sense of being sourced moment by moment just sourced by this divine light and love And it's so much joy and there's so much happiness with that and and you will actually forget your previous states of mind Where you were concerned or conflictual And you had lots of questions, you know, those will start to fade and fade and disappear until They're just not thoughts in your mind at all. You know, you you have just a total transformation of mind And and that will be gone So for me Yeah, the question of more never enters the questions of how will this happen It doesn't even enter my mind. It just it's like a a symphony is playing And everything is working out perfectly always And there's not a part of my mind that's trying to Even understand that anymore. I've just Accepted oh, this is the way it is I don't have to Try to figure it out. It's it's just there. It's always there So I think you've asked a very tube very practical questions in there because When you give yourself over to this and you keep following those prompts as little nudges and prompts And I can certainly relate with what you're talking about because I had the same thing and all of us here can relate to what you're talking about because You're just describing your daily life your daily experiences as you perceive it right now And as you keep releasing those beliefs That are sponsored by the ego your perception of yourself and of everyone will will change completely In the most glorious way possible So when um Like I I experience moments Where I lose track of time for instance not In a different way not the way it used to be Or sometimes it's more like I think I have thoughts, but I don't have thoughts Very strange things in my mind going on sometimes or sometimes I'm just sitting there Maybe after after this show or after having done the movie night and then the discussion I'm just sitting there And I I don't feel sad or anything But tears are just coming up and pouring out and I'm just saying to myself Not to myself. I'm just saying thank you god. Thank you. Thank you. Thank you I guess my mind is trying to understand what is happening. Are those moments were I'm connected. I don't even know how to describe it. Are those kind of like Small peaks that I get into What actually is Reality Is that what that is? Yes, that's that's exactly it and and you're able to describe it and articulate it so well now But a lot of us had a lot of those moments when we were children when we were playing And we'd go out in the sunshine and we'd be playing with our friends and and we would lose track of time We would we would lose track. It was so much fun It was so much joy and love and laughter that we we weren't articulate maybe to to be Pondering and talking about you know, we're letting go of time or anything. It was just we you know Oh, yeah, I I yeah, I didn't even think of what time it was And and it does it does go that way. Uh It's like that chicago song Time does anybody really know what time it is? Care does anybody really care about time? You know, it's a famous chicago song Where where even in the song it's it's noticing about More being carefree about time And not wound into it and and linear time is at the bottom of the whole ego belief system It's the bottom the bottom of business. It's the bottom of competition It's the bottom of comparison Uh, I just saw a clip to uh recently from the golden globes where jim carrey was getting up and And he got up to the podium and he was poking fun at the whole Award system Uh, he was poking fun at at this identity of being you know Jim carrey two-time golden globe award winner And you can see denzel washington and all the actors and actresses Laughing hilariously because it was like he was playing the emperor has no clothes on Right in the middle of a broadly telecasts Uh tv showed a millions of people He was poking fun at the whole thing And of course jim has had some really powerful mystical Experiences and and he's not afraid to uh Share him and the spirit will come through right on live Television now to poke fun at the whole thing So we live in a glorious time where we are called as part of the wake up The people i've worked with for the for a lot of these last 25 years I mean i've traveled a lot so i would meet people in their homes and living rooms and backyards and basements But the people that i've i live with and work with so to speak in community Uh, they've all been going through this undoing and unwinding And i did a website many years ago called teacher of teachers in honor of the holy spirit at miracles home.org and then eventually We turned that into a book which is Unwind your mind back to god experiencing a course in miracles and now i get to travel around the country and the world and There's online unwind your mind groups There's people that come up and they've got the book in their hand like the the guy swedish man I was talking about And there's twinkling and they're so happy and they're saying This book has helped me so much to practically trace back My thoughts into my mind and let them go To to just let go of everything and it's it's helping me Work it all out. Nicholas has brought a Even a little spiral it's a little spiral came to us about it like an unwinding Uh, so we're all right in the full swing of of this great awakening where We don't have to think like we thought in the past. We are not locked into These old ego goals, which we felt kind of trapped with anyway You know, they never felt completely our heart was never totally in it But now I feel my heart is in sharing this joy and the people around me are Are very much into not just reading the book but to actually Having these insights and experiences in their mind in which They feel like they're sourced. They're continually sourced by the spirit not by By the past and by ego demands It's amazing yeah I mean personally I've been feeling this need to To do something like what you do Right, uh, all of you But there is that fear that oh my god. I I I have this issue like I have had health issues now Everything is Developing very very nicely very well. And I think it has to do with the fact that I'm Studying of course in miracles Um Because I started getting better when I started doing the course for me. It's like, okay That's proof enough for me But then this fear because of all the Well, you know, I have that as a result of all the medical expenses I have before Um, and then I have work and I need my work to be able to pay off the debt And then Jason was telling me yesterday because Jason's here in in Vancouver In canada and he was saying well, you know the concept of Saving money and having debt. It's all the same but my mind doesn't get that yet, but So there are all these fears in terms of Following that call because I think it is a calling To give up the business side of things and start doing something on this end And sometimes I think well, maybe I need to unwind more before I can start doing something like that. And yet that is Timeline thinking right so Yeah, it's uh I don't know what I'm trying to ask here. I guess I'm just trying to say that confusion Do you need to be clear in your mind before you take that step or Or do you just if the prompt is really coming over and over and over again? Do you just say yes to the prompt and then wait for the Holy Spirit to guide you? What do you do? I'd always ask the question. What do you do? Maybe it's the wrong question Yeah, I think you're you're definitely on the right track because if it's a prompt a prompt a nudge keeps coming and coming There's something to it but also just just like when Students are working with teachers in their education, you know, and they have a curiosity or a question They'll they'll join with somebody that they resonate with or they respect or someone who seems to be A demonstration of it, you know Like we would never ask all of our teachers our questions But the ones that we were really respectful Of where we could we could see that they they were really demonstrating a integrity then I always felt Uh good about asking questions and my professors who felt very integrous And so we're very much into joining and praying together and and You may have a nudge or a prompt and then you may have some Some doubt about some aspect of it But when you join with somebody you love and respect and you pray together Very much like two dear friends going out to lunch And one friend saying, you know, I'm I'm starting to feel Like there's something that I want to do but I'm not sure about it And I've got some hesitations and you pour your heart out To your good friend there at the lunch and then your friend says well I know you and this and this and this but they may you know spirits and speak through People it can come to us in so many ways But if there's a sense of trust and honesty and respect Then we we can take that step And it helps to just run it by to talk about it So I know that that's been important for me and um In my life too, I I just was so devoted to the course that that I like Helen Shuckman I had Jesus in my mind speaking to me. So that's my friend I would wouldn't do it at breakfast and lunch. I did it all day long Well, what about this? Well, what about this? Well money doesn't grow on trees You know, and I would say all kinds of things to Jesus as if I was just sitting across from him at the table And and not hold anything back just tell it to him straight And then he would have the most wise things to say He would say oh, yes, I yeah, I know you believe that like money doesn't grow on trees I would say to him he says I know you believe that but if you follow me then I will provide for you in very practical ways And not that you'll necessarily be going and picking money off trees But he you know, I will it will come sometimes in unconventional ways. So you have to be prepared To open to receive and I thought that was a good answer. I said, okay, I can do that So that's the way my life went and I I feel yeah, it's a blessing if you have Jason and Emily up there. I know they've got a big weekend retreat coming and to go there ask your questions And Everyone that's part of the ministry is just so transparent You know wears their heart on their sleeve and their life's an open book And and it's transparent because they see how valuable And helpful that is to releasing guilt And so just take full advantage of that And then I think, you know, we still have these kind of interactions and Skype and phone and As you move along Your the answers will come and you'll you'll have the support you need Every single step of the way as you go along Thank you so much Thank you, candy Thank you so much Words cannot describe how grateful I am Thank you. It's beautiful. We feel it It's beautiful Thank you This has been just wonderful, David. Thank you. It's just always a joy. There's no expectation We don't know what will come and I just sit here just open Eared And heartened to listen So it was lovely. Did you want to give us a song out or do you feel We feel just full of the the joy. Yeah, the two of us. So thank you very much for joining me today Yeah, we never know you might slip in sometime during the week again. We'll just watch this space Yeah, and so for anyone new who's just joined us today, um, you are watching LM virtual which is part of living miracles.org if you go to living miracles.org and click the LM virtual button You'll see all of the different shows that we have running in the week This one's called awake in the heart and it's um at 10 a.m. Every morning Monday to Friday And then we have frances zoo 5 p.m. On fridays where she goes deep into the mind and you can write to her at frances zoo at living miracles.org And you can pour out your heartfelt question or the theme you'd like her to speak upon So we've got um movies and different things coming during the week, but we'll tell you about those later So so lovely you could join us on periscope whether on LM virtual on our on david's periscope And to all of our zoomers much love. Thank you. Bye You


Hi, okay. My name is Danny Nevencel from, I'm the CTO of Scribe Security. Scribe Security is focused on securing supply chains and through our work in Scribe, I had the chance to work with design partners and so on implementing the ideas of Salsa and other frameworks. And this is what I want to share with you in this lecture. This is my book only available for the Hebrew speaking audience, but you can see the translation of its name. And this book, I make ideas of cybersecurity available through stories and I wish to use this method also here today. So instead of telling you about this setting and that setting and this design customer and whatever, I'll wrap up all the lessons we have learned in a fictional setting. And first I will set up the story and then discuss why automating evaluation could be useful and why it is important and then take you through our implementation journey along the Salsa levels and then take a few minutes to discuss the takeaways. What I want you to learn from this lecture is how one would go implementing Salsa in a large organization and how this could be evaluated. Okay, so I put on my DevSecOps hat, so name then is DevSecOps and I work in Imaginary.org and you know DevSecOps gets the worst of all the world. He's the DevOps guy, so he gets waken up in the middle of the night and he has also the sec in his name so he can't be too friendly with the developers. So one day I get a call from my CISO, supply chain attacks are on the rise. We are getting customer questions.  So after I pass the shock, so I put on my hacker hat and try to consider our pipelines. We have many diverse pipelines, thousands of programmers and numerous attack vectors, so I would never be able to sign off every build. So I return with my answer to my CISO, but you know these guys are experienced and he gives me the CISO answer. Okay, you don't want to go on the risk trial, go on the compliance, go do salsa. So I said what's the salsa thing? He said I don't know, it's good for Google, it's also good for us. So go ahead and do it. Okay, so I roll up my sleeves and try to understand what this salsa is. So salsa in like two minutes is a framework that originated at Google and is intended to prevent tampering, secure artifacts and is focusing on the integrity of the artifacts build. What's that? I don't know. Okay, the way salsa works is you implement controls checklist, a checklist of security controls that you should do in your pipelines. And these controls are in some domains like the source control systems and the sources, the build system and the dependencies that are brought into your software project. As many other frameworks, salsa lays down four levels of compliance. You could go on a salsa level one, which would be the easiest but of course less security value and try to get to level four which would be highest security but of course would require much more, you would have a longer list of requirements. One of the important ideas in this philosophy of salsa is the idea of provenance. So provenance is a document which is a sort of evidence to the build of the artifact. We are using many other provenance documents like the food label we see on our food. We know who built it. We know what ingredients went in and so the salsa provenance document also requires to note who the builder is and I should use artifacts only from trusted builders, what recipe was used, what ingredients were used and so on. Since it's evidence so it should be treated as evidence and as you go up the salsa levels you need to better protect the evidence itself. Each level of salsa puts more requirements on the generation and protection of the provenance document. After understanding a little bit about salsa, I started to consider our pipelines. As a large organization, our organization has many diverse pipeline technologies. We have source control management of various kinds, Jure DevOps, SVN, whoever remembers the jazz and that's only a partial list. As a build systems, we have many build systems, Jenkins over Kubernetes as a main tool but we still have Jenkins over in-house servers and other pipeline technologies, either old projects or came to our company through acquiring other companies that came along with other technology stack and of course also legacy projects with NoCI. So as a DevSecOps guy that got a project, the first step was to focus and I decided to focus on two main pipelines. Looking forward, Jenkins over Kubernetes is our main heavy duty tool in-house and we use GitHub and GitHub workflows as an emerging technology and as a technology that is convenient for us to let subcontractors and for small projects to handle themselves before we integrate them into our Jenkins over Kubernetes main pipelines and as source control, I would focus on GitHub and also focus on Dockerized applications as they are more and more common in our imaginary company. When I consider how I would sign off in the future the assurance of the artifacts build, I remember that our pipelines are dynamic. Pipelines are not static, you know, build them once and they stay, they change, they're changed by the programmers, by the DevOps guys due to features that are needed, due to new settings and new technologies that are incorporated or the need for temporary bypassing tests and whatever making things easier just to get things out. So how would I go if I would need to sign off every artifact, I would need to track all these changes and make sure that I can handle it and I knew I couldn't. So the answer was to evaluate the automation, I would not evaluate the compliance, I would not take a pipeline and make it compliant but I would like to measure if the pipeline is compliant and such a measurement would give the value of a gap report and then the gap report could be used to go ahead and fix, manually fix whatever needed. So with these ideas of focusing on two main pipelines and automating the evaluation, I set up on my way on the journey of the salsa levels. Okay, so the first steps of course are salsa level one. So salsa level one is easy to adopt, great, create some visibility, so let's jump into it. So two requirements for salsa level one, it should be a scripted build and the provenance should be available. So when I think about implementing it, so nothing to implement since the pipelines I've chosen are pipelines and so they are scripted, nothing to do over there. Of course it could have value for the legacy non-scripted pipelines but that's not the mainstream of projects in our company. And when I look into the salsa standard and look into the exact requirements of the provenance document, so I see that the required fields, it boils down to two fields, the builder ID and the build type and this of course is available from the build systems themselves, so the provenance is available, it's over there, we know it's Jenkins and we can also know the pipeline run, like the job run or it's equivalent in get type work flows. So the provenance is available, so if it's so easy, I can jump right into salsa level two. Salsa level two adds additional requirements, the sars should be version controlled, build should be done by a service and the provenance now should be authenticated and service generated. So before jumping into implementing this, I put back my hacker hat and tried to understand what is the value of these requirements and I think it boils down to separating the build from the programmer's environment. So if the sources are version controlled, sources reside somewhere not on the developer machine and this would serve as a forensic tool, it would serve as a deterring mechanism like if you're an attacker and you know everything is recorded in version control, you need to be more careful, so it should deter the programmer or attacker who caught the builder, the programmer's machine. Also building by a service takes the power from me as the programmer and puts it in some other service and when the provenance is service generated, again it's not me as a programmer writing down some provenance document, it's generated somewhere else and so it's supposed to be better than giving this authority to the programmer himself. Okay, so let's move to implementing it. So the source version control, again once we're talking about modern projects, sources are version controlled, not much to do. Also modern projects would be built by a service, so we're left with a provenance that should be authenticated and service generated. So the natural answer of the security expert to what is authenticated is signed, you sign and verify the signature, but if we open up the salsa documents, so they wrote and truthfully so that it should be authenticated, but it should be signed and using, you know, public cryptography, but it could be authenticated also in other ways. So in my opinion, there were two options to the provenance authenticity, two implemented provenance authenticity, one is to consider the build service data as authenticated and there is logic behind it because I trust the build system for doing the build and also salsa assumes that the build system is trusted, so even if I would give the build system the ability to sign, again, I would trust on the build system for doing the signing, so I don't get much from the signing and the other option could be to go ahead and implement provenance signing. So my decision was going on both, but I'm not sure in the way that the salsa guys meant at the beginning. So first, in this case, I have like two hats, the hats of the consumer, I will need to sign off, so I need to trust artifacts that come to me, but we might need to prove to other people that our artifacts are trusted, so I would, I myself, I would accept the build service logs, the build service data, like logs and API data as trusted and I would sign myself as a DevSecOps guy, I could use any signing technology and what I would gain is that it would be easy, I would do it myself in my station when I need to sign off something and I would not need to go and integrate this signing into all the pipelines or at least all the pipeline mechanisms and the value would be long-term provenance protection once it's signed, so I don't have to worry about someone tampering with this piece of evidence and it would be, it would go more smooth to other customers, which I would not have to convince why I trust the build systems, they would go for the default answer of authenticity signing. So how would I go automating the evaluation of the salsa compliance, so we can collect data from the log files, if we want we can optionally convert this data to a provenance document in the format that salsa suggests and we can actually, as I said, sign the provenance document, so when we give a look, we don't have to read all these lines here, but if we give a look at the log files, we have most of the data, at least the minimal data required we have there, of course, and even much more, but care should be taken, like not all logs are created equal, if we look at the GitHub UX log and at the GitHub CLI tool logs, we get different results and what is missing is the most important part, the yellow part, and the above will be displayed on the GitHub app through the UX, but would not be displayed when you, would not be recorded when you use the CLI tool and there, what's written there is what was the build script that was used and so on, so care should be taken here. Also, a similar anecdote is the mutable reference, so when we said that the salsa should be version controlled, the exact requirement is we should use immutable references, a reference that would point exactly to the artifact and not a tag, you know, when we tag a version, it's a tag, it can be passed to any artifact and that's what usually happens, that we have the tag of the main branch and it every day would point to something else, so caution should be taken to take the right data, but the data is there, like if we can't get the data from the GitHub workflow log, we can get it from the GitHub API, workflow API and know exactly the immutable reference needed. Okay, so evaluation automated, automation is really easy, collect data from log files in API files, as we said before, so I was really happy and updated my CISO that we accomplished salsa level one and level two. What we have learned from this until now that it's in modern environments, it's given once you use a version control and build system, you are in fact salsa level two. Another lesson learned is that when things are done compliance driven, we should expect the minimal result and that's why I went on with the minimal provenance document with only the builder ID and the build type, why is it so? Because if I have DevSec ops guy and I have a lot of tests on my plate, I would not have the time to excel in protecting my supply chain, I would do whatever was required if I measured on compliance and if I am a consumer of software, so I must assume that that's what my supplier has done until he proved otherwise. So when we go on a framework that is compliance, when we do compliance driven implementation of a framework, we should be aware that we might get a minimal value and we should take care, maybe negotiate with our suppliers and so on. As you saw, I went on building the provenance and doing everything from APIs and log files because in a larger organization with many pipelines, it's not legitimate to go ahead and say, for this salsa thing, I need to open up all the pipelines, that would not work. Signing, so signing is still an issue, is still an issue and that's why I went on looking into the authenticity of the build system logs themselves. It is true that one can use SixTor, Inspire and so on and that's what I would use if I would sign myself on my station these provenance documents, but going ahead and installing it in many places and handling the ramification of key systems such as revocation and dealing with key leakage and all the prices that come with key systems, it's still an issue. Of course SixTor is a big promise here. So after describing all this to my seesaw, we answered with obvious questions. So what did we get from all this work about this salsa? So I understood the hint and went to the next step in my salsa journey. Okay, so level three promises much more. Let's see what are the requirements. So here we got a long bunch of requirements, like seven requirements. Before diving into them, again, when I put on my hacker hat and asked myself what do we gain from here, so the protection from the developer workstation gets better, it's a little larger, and we get the protection from adjacent build systems, build runs, or from the history of the build runs, like the ephemeral requirement would save us from attacks that left something on the build system that would influence the next build run and isolated would prevent two pipelines from influencing each other. And the provenance here is non-fossil valuable, we want better evidence, better protected evidence. Okay, so source verified. What exactly is the requirement? Every change in the vivid history has to be as at least one strongly authenticated actor, and along the salsa requirements, strongly authenticated means two-factor or multifactor authentication. So as a modern organization, we would have multifactor authentication deployed across the organization, but the exact requirement, every change is quite a total requirement, and it would be tough to comply to this requirement, like imagine that one day some subcontractor lost his phone and he needs to work, and we in the natural solution would be to let him work one day with single-factor authentication, and it would be in risk management view, reasonable solution, it's not he's working his whole life with single-factor authentication only like a few hours, and it would be okay, but I would lose my salsa accreditation. Another challenge is strong authentication and the get reality, so the natural solution for verifying source is using signed commits, but signed commits are not two-factor authenticated, they are based on SSH keys that is stored on your machine, and if we use like other tools of automating code changes that use API, so API keys also are not multifactor authentication. Let's go to the next requirement. So the next source requirement is that the sources should be retained indefinitely, and again, it's quite a total requirement, but should be noted that here the salsa guys gave a solution, but this solution is hard to implement. You could change the history, but this change should have two-party approval, like a multi-sig solution, and this is not really a feature, a tool that is available, so if I want to implement it, again, what would happen is that I would lose my accreditation because I had to do some history rewrite, and I would not have the tools in place for the two-party approval of the leading of the history. Why should I delete the history? Sometimes it's just to clean up things, and sometimes, like if someone committed by mistake a secret, so, of course, the formal solution for a secret leakage is to go ahead and make this secret not useful again, but it could take time, it could be a secret that other systems also use, so the quick solution, maybe the not the best solution, but the quick solution would be to delete it from the repo as fast as I can. So, again, this is also a total requirement that could be a problem when implementing Salsa. So, what are my options to implementing and also, in sense, automating the evaluation of these requirements? So, I could use signed commits, and it would not be two-factor authenticated, or I could continuously evaluate that, verify the two-factor authentication is enforced while the project is built during the time of the commit, at least, and so, happily, in the discussions around the Salsa community, signed commits are appearing to be a legitimate solution for this requirement, so this would be the easy track for implementation, and, again, using retained history, also, I could evaluate the branch protection rules and through the APIs or monitor the commit history and verify that it's continuous. Now, to see that, once I saw a hash of a commit, I can always see it in the future. For that, for such reasons, we just released, at the last week, a GitHub project named, an open source project named GitGut, which is aimed as, it generates a report about your security posture of your GitHub account, and running it continuously could bring us close to these requirements. Okay, so, we have two more challenges in front of us for Salsa level three, build requirements and provenance. Okay, so, hold up for these three requirements. So, as we said before, ephemeral and isolation requirements are supposed to make sure that pipelines don't influence each other, but there are natural shared resources between pipelines that we cannot disconnect. It's the build system itself, which could be accessed by the build runs, like if we want the build run to be part of the version labeling of the software itself. When you do vendor version to the software you want to know, you might want to know it's build run. Bumping could, which is a technique in which the build system would push up the version number of the build software. Image repositories are a shared resource because they would be used also for base images, parent images of the images built by the organization itself, or build images, images using as build machines. And these are also like shared resources. So, how would I go ahead and approach this challenge? Okay, so let's go one by one. So, regarding the source control, what I could do is verify that isolation was not exploited. I would not verify that it is isolated. I would verify that even if it's not isolated, isolation was not exploited, and that's quite easy. I would go review the git commits and see that no commit was done during the period of the build. The build service, we said before, we need to trust someone, and this someone is the build system itself, so we assume the build system itself trusted. There is also the build infrastructure. Like, suppose I do trust Jenkins, but if I run Jenkins over Kubernetes and I let the runners high permissions access to the build machine, so, of course, builds could influence each other. And this would require an internal checkup. Like, if in our organization we are aware of high permission risks and not running the Docker inside Docker and so on, so we would have in place our policies and we would need to check them up. And regarding the image repository, we could also verify its configuration, like, make sure that only the build images, everyone may have read access to the parent images and build images, but only certain pipelines would have write access. So, using this configuration, we would not care that it's a shared resource because only one could write to there. And regarding other resources, usually these fall into the category of dependencies, and, happily, dependencies are a requirement only of salsa level four, so I could leave it for the next stage. So, how would I go on evaluating it? So, I could verify that builds are done on fresh pods and that's, you can see it in the Jenkins logs. On GitHub workflows, I would verify that I'm working on hosted runners and once it's a hosted runner, GitHub promises that it's a fresh machine. And I would need to verify implementation of our security practices that no high permission dockers are run on the build and so on. And this would be tailored solution for our pipelines and not a generic evaluation method. Another thing that I would need to take into account is to make sure that no caching is used, like there are also in GitHub and Jenkins, the techniques to cache and I would verify that cache is not used in these cases. Okay, so we're left with the non-falsifiable provenance. The requirement is that the provenance cannot be falsified by the build services users. I remind you what was in the mind of the salsa creators is to protect from the developers that could either influence what's built or the other builds that could then further influence this artifact on hand. So since I wanted to rely on log files are the log files falsifiable. So here I went on to make a quick experiment. So I created my version of Git. That's it. These pipelines over there. I just print the Git version to 18 bad version. And I tried to combine it in a standard GitHub workflow where I'm using the official GitHub checkout action as you see at the bottom line over there. And what happens when we run this build? So we see we can get quite far down the run of the pipeline. Of course, you can't get too far with the implementation of Git that only prints out on Git. But if I would do a hack on Git, I could go down the whole pipeline, implement whatever was needed by Git, and also bad actions and report whatever I want. So here I report that I'm Git version to 18 so I can get past a large part of the pipeline. So what we see here is that we should again be cautious on which data we are willing to use from the pipeline. So for unphosphor prevalence the what we understand that we should use only service-generated data and logs are not should not be considered that the whole log file is service-generated. Of course, the log files are a combination of data that is generated by the service and data that is generated by tools that programmers or developer decided to operate and maybe he could also inject them and pull them into the pipeline like in the example you saw a minute ago. And again we could also sign it if needed. Now it was much more tough but I could report accomplished to my CISO. And what did we learn here? So SASA level 3 is achievable on some platform setting but not all and if the infrastructure security is not handled I would not be able to declare that the pipelines are isolated for example. Losing the SASA accreditation due to the total requirements is a challenge and I think it's a limitation and there is a need of some exception handling through which someone could be authorized to sign off and say okay even though the federal check is not checked it's okay. Some of the when we come to implement such requirements at another organization and we explain that SASA level 3 will protect you better from the programmer one of the questions that is asked is okay but we do a lot of effort in protecting the programmer's environment. We give him many tools on his machine and we have security systems that track everything so are you sure that we need to do the additional requirements? Again SASA does not give the space to do this risk management practice and that's I think we all know it the world of standards has two flavors one is the checklist flavor and one is the risk management flavor so this is one of the downsides of choosing the checklist okay and we saw non-phosphoryl provenance should rely solely on on service generated data and care should be given about it okay so okay so after reporting this I got the natural answer from my CISO if you accomplish level 3 go ahead and do level 4 so I open up level 4 I have many more requirements but again what's new here we get better protection from the programmer from the developer like the two person reviewed requires human eyes that would go and see the code so we know that the programmer is not pushing malicious code and the build is better protected from other builds and we see a first addressing of the dependencies so since the build requirements of salsa level 3 were the hard part so I jump straight into the build requirements of the salsa level 4 so here's a requirement the tough one is hermetic all transitive build steps sources and dependencies were fully declared upfront for the mutable references which means that you cannot use like in your packet JSON you cannot write of course you cannot use any hat so if you don't care about the version or any minor version you need to say I want to use I don't know colors and this is the hash of its commit so here I was defeated it would require re-engineering of all the pipelines we would need to go into every pipeline and to pin all the dependencies and to find somewhere their mutable references and the tools so it may be implemented for specific projects if we have a customer that is willing to pay for the additional cost needed to do such a thing we would craft him a specialized pipeline but to go ahead and as an organization to push forward and better protect our supply chain we would not go for salsa level 4 okay so a few words about what we have learned here so salsa an emerging interesting standard and as an emerging standard it on one hand puts many requirements on the table that we could go and implement and on the other hand there are still things that need to be improved some concerns were that many depends on the developer and his decisions and as a consumer we must pay attention on what we are getting other concerns were the totality of some requirements and the lack of some tools and we saw that most of the many parts can be evaluated from salsa level 3 on evaluation depends needs to be tailored to the organization thank you do we have time for questions one question who's second thank you very much so what you would need to do with logs is you would need to hand pick what part of the logs you are willing to take at the beginning of if you look at Jenkins log it's quite clear what was created by Jenkins and what are the logs of the tools that were run by Jenkins that would be the starting point to approach it okay do you have time for another one I'm sorry I didn't get it so the question was like in the threat modeling view did the salsa address the threats that I would anticipate needed to be handled and I would say not all of them and the emphasis would be that we should listen to the salsa language which speaks about integrities requirements about vulnerability management and the dependencies wait only for level 4 so I'm not sure that this prioritization is right in the broader view salsa states that it's focused on integrity so you would get integrity okay okay so thank you very much goodbye


A neotropic is a substance that enhances cognition and memory and facilitates learning. Here are five neotropic nutraceuticals that are proven to enhance your brain power. Acetyl-L carnitine. Ven-pissitine. Hooperazine-A. Alpha-GPC. Phosphotidal serine. As a neotropic, the primary benefit that acetyl-L carnitine offers is in its effects on acetylcholine, an important neurotransmitter responsible for memory, learning, analysis, perception, computation, and many more cognitive processes. Ven-pissitine is a powerful natural neotropic that passes the blood-brain barrier and boosts cerebral blood flow to the brain. Ven-pissitine has been reported to improve concentration abilities and enhance auditory and visual perception. Hooperazine-A is an intellectual enhancer that inhibits the acetylcholine-stereis enzyme from breaking down acetylcholine, a learning neurotransmitter, thus increasing both its level and duration of action and may be useful in fighting cognitive decline in the elderly. Alpha-GPC has significant neotropic properties including memory enhancement, protection against brain aging, and further treatment of anxiety. Extensive research has shown Alpha-GPC to be an effective treatment for a variety of disorders including Alzheimer's disease, vascular dementia, and stroke. Phosphatidylserine is a phospholipid compound that is able to cross the blood-brain barrier and enter into the central nervous system. It is vital to the health and efficient functioning of your brain cells and has numerous benefits related to memory, learning, attention, and mood. Most importantly, phosphatidylserine helps the brain metabolize glucose and release and bind with a number of neurotransmitters. Neuroplasticity, your ability to reshape your nervous system and brain, is proven to exist and we even know how to increase it. Whether you're looking to boost your brain power or simply maintain it, the Professional Subliminal Center offers an array of high-quality, neotropic nutraceuticals. Please visit our website and feel free to email or nurse with any questions you may have.