All right, I think we can start now. Welcome everyone. I'd like to thank you for joining us today. Today is a CMCF webinar, watched new in Kubernetes 1.17. My name is David McKay. I was the lead on the communications team. And I'd like to welcome our enhanced lead, Mr. Bill Cullen and our release lead, Guinevere Sender. So thank you very much for joining me today. Before we get started, we do have a few housekeeping items. So first, there is no speaking during this webinar. So please use the Q&A box at the bottom of your screen. We will try and get to as many of those questions throughout the webinar and cover off anything we can at the end as well. So ask them as we go and we'll do our best to get that covered. This is an official webinar of the CMCF. So because of that, we are subject to the CMCF code of conduct. So please do not add anything to the Q&A or the chat box that would be in violation of that code of conduct. So please be respectful of each other and of the panelists. And today we're going to get started. So I'll hand over to Bob. Kick this off actually with the Guine. Hi everyone. Good morning, good day, good afternoon, wherever you are. May I introduce you to Kubernetes 1.17 with the subtitle of the chillest release because we only have one holiday season release a year and Q4 is it. With that, we have our fantastic Kappie Bara mascot who is one of the chillest animals of in existence. And I got the fantastic Alison Doudney and her partner Tyler to do a really cool logo for us. So she is extremely talented and I'm so excited she made this artwork for us. Can we do the next slide? All right, David, did you want to go over the agenda? Of course. So we've each selected one feature that we're really happy with in the 1.17 release. We're going to talk about the stability changes that have happened in this release moving on to snapshot and restore volume support ending with topology aware routine. After that, we will travel through all the other SIG updates with the 1.17 release followed again by the Q&A at the end. Okay, this is where I'll kick in and take over for a little bit. For this release, we had 22 total enhancements. That's much less than we've had in previous releases but we sort of see this cyclical nature where towards the end of the year fewer and fewer enhancements, especially with the holidays and the shorter cycle will make it in there. What they make up for it in the beginning, we'll probably have significantly more for the 1.18 release. Of those, we had 14 that were going to stable or GA and most of those are like smaller feature things that just help the project as a whole. They aren't like necessarily huge features. Four that were graduating to beta and four that were new as alpha. Yeah, so I think I'm going to address one of the biggest themes that was part of this release, a stability release. Really? Yes, really. In fact, this is something that SIG release has been tossing around for quite a while. Hey, maybe especially given the fact that there are a fair number of folks who are concerned with the overall stability and the quickness with which the project is moving, that it might actually make sense to have one release a year be dedicated to just making sure that the project is stable, that all features are moving forward, becoming more usable and becoming more stable. But it never really quite became reality and that has sort of been true for this release as well but it kind of shook out naturally that as Bob already mentioned, most of our features are graduating either from alpha to beta or from beta to stable. We are hoping that this will turn into a real formal stability release going forward and yeah, that's generally the direction that we're hoping this will take. So of the 22, 14 went to stable. We'll dive right in and cover two of them here in a sec. But for a quick rundown, the ones that were promoted were taint node by the condition, configure a pod process, name story sharing, schedule daemon set pods by the Kube scheduler, dynamic maximum volume count, community CSI topology support, environment variable expansion subpath mount, defaulting of custom resources. If you are here for the 116 release, that might actually look familiar. That one was sort of a second part, second half of one that went to stable in the last release. Move the frequency of the Kube heart beats to the new lease API, break apart the race test tar ball, watch performance support, behavior driven conformance testing, finalizer prediction or protection for service load balancers and a important little thing of avoiding serializing the same object independently for every watcher. So that I will dive into sort of our first big featured enhancement snapshot and restore volume support. So this is a report that my audio is breaking up. Can you hear me okay? Okay, cool. This is a beta feature. It was actually introduced as alpha in Kubernetes 1.12. And during the alpha, it actually got rewritten from the ground up twice. And it's now moving to beta. So many more people will get a chance to actually use it. So Kubernetes itself has proven to be like a great abstraction for describing workloads programmatically. However, this has been a bit more difficult with the array of options for managing stateful data. Many of these storage drivers out there actually provide some level of like snapshot and or backup mechanism. So like, you know, when you're working in AWS or Google or something like that, you can take a snapshot of a volume and possibly restore it later. But there hasn't been any sort of like integration with Kubernetes itself. So you sort of had to manage that sort of thing out of band. And what this enhancement does is actually brings those primitives back in to Kubernetes. So you no longer necessarily have to, you know, go to like another console or something like that to script that backup and restore. Now, just to make something clear is you can't use this directly out of the box with the 1.17 cluster. It requires a bit more plumbing and the installation of the external snapshot controller. This is sort of similar to how you would install any sort of CSI based storage driver. And you'll probably be able to expect a lot of the cloud fighters to just do this automatically for you. So the external snapshot controller adds a few new CRDs but the two big ones are the volume snapshot class and volume snapshot. The volume snapshot class is sort of similar to a storage class. It defines which CSI driver is used, how the snapshots are made, and their retention policy. And then the volume snapshot itself is sort of an instance of the volume snapshot class for a provided persistent volume. And this might be a lot to take in, but if this is something that is of interest to you, I highly encourage you to check out the blog post link at the bottom. It came out, I think it was December 9th and it does a really good job of summarizing all the functionality with this and how to use it yourself. Next is the ApologyWare routing of services and this is a alpha feature, which means it must manually be enabled if you want to use it. But currently, when you use a Kubernetes service, it will sort of map to random pods within a cluster. And this isn't, you know, this is ideal for a number of reasons. Let's say you have a pod that's serving that service that's like right next to another pod that's requesting it. Why go out to like another host or something like that when you don't necessarily need to? So what ApologyWare Routing of Services does is it allows you to specify sort of a list of preferences via a new keyword of Apology Keys. So you can say like, you know, if it shares the same, if it's on the same host, go to that one. If it's not on the same host, prefer one that's in the same zone. If it's not in the same zone, prefer going to one that's in the same region. And if none of those are true, go to any of them. And that way that should, you know, minimize the latency and sort of randomness that you can sort of see when spinning up a service. So if you don't mind me interjecting there, Bob, we do have a question on the routing. The mark is asking, can you require routing? Can you go through another layer before it hits a service? It's essentially the, as far as I know when it comes to how it works, is it just changes the like IP tables rules in the order in which it's hitting it? I don't know if that directly answers your question. We can follow up after in the chat, that's fine, thank you. So that I will kick over to SIG updates. And we will start with API machinery. So touching on what was said before, this enhancement was sort of two separate ones, pruning and defaulting. Pruning was promoted to GA, and defaulting was promoted to beta in the 116 release. This wraps it up by bringing defaulting to stable the 117 release. So CRD or custom resource definition, they're like sort of user-created extensions of Kubernetes, and you went up sort of registering them as their own API objects, and they'll have their own like API version in kind. So before defaulting was possible, users had to sort of provide a value for like every field in the CRD that you were adding, or the developer had to bake in some extra logic by means of like a utility admission webhook to provide some defaults. And managing this actually became quite a bit more complicated when you start thinking about like having to handle the various like upgrade, downgrade conditions where you might add or remove a new field. And so now with the defaulting being sort of baked in by default, this issue is mostly gone and you can now just easily provide defaults in your own CRD spec. The big thing is that to do that, you must use the new API version, apiextensions.case.io slash v1. You can follow the link to sort of defaulting once this presentation is published, to read a bit more about that. Because of defaulting was like, these defaulting is such a big thing, I honestly expect that 117 will become a minimum requirement for a lot of CRDs and applications going forward. So this one and the next one sort of work together and they aren't really user facing, but it's a watch bookmarks and this improves the performance of the QBAPI server. So when a client initiates a watch and by client I mean a programmatic client. So something both like client go or one of the Python libraries, something like that. And they're watching a set of objects to get notified when something changes. It gets a list with a resource version number and that maps to sort of a set of changes or diffs from the previous version or previous revision. And if the client happens to disconnect and tries to reestablish that watch, the QBAPI server and client would have to sort of play back all the resource versions to then get back to where it was. And this caused unnecessary load on the server, especially if you can sort of, you might have a whole slew of things watching those objects. Just cascade into a, obviously a bit of a nightmare. So now you can actually sort of like bookmark where it was and that way when it reestablishes the connection it doesn't have to go back and replay all those changes it can just sort of like pick up where it left off. The less object serialization. So if you have multiple watches watching the same set of things previously, for each client the QBAPI server would have to like serialize that object for each one. Now there's a little bit of like caching in play. So if you have multiple things watching the same thing and they'd be notified of the same sort of updates they'd be cached. And we saw like significant problems with the like scalability tests where we'd go up to like 5,000 nodes where this would start to cause some performance issues. But after these changes there's now a general 5% improvement in CPU usage and a 15% less memory used when you're dealing in this scenario where you're having multiple watchers watching the same thing. We'll kick off to architecture now. So behavior driven conformance testing. This is a non-traditional enhancement but it's sort of a larger plan where we've agreed to tackle some better like conformance testing project-wide. So essentially this is defining how our conformance tests should be built and documented. Right now there isn't a sort of single like explicit list of behaviors or assertive truth out there. These are scattered amongst design docs, enhancement proposals, user docs and a subset of the E2E tests as well as the code itself. So this makes it like near impossible to identify if the conformance suite provides a meaningful test for a cluster's operation. And this cap actually went like right to stable by it was just merely deciding the plan how this is going to be tackled. So if conformance is something that interests you, I would highly recommend following the links and reaching out to the teams working on this under SIG architecture. And any help is greatly appreciated. This last one is the removal of the project-wide usage of the node role labels. This might impact people. So this was actually sort of an accident over time. The node role labels, node-role.curian.io slash star late node role namespace was not intended for widespread use by the project itself but several things actually started referencing it. These were introduced by QBDM to help them manage the provisioning and manage the lifecycle of the QBDM provision nodes. And they were not intended for use beyond that. However, like, sorry, this is because there are many sort of like tools and provisioners that are not QBDM based, which means, if nodes are missing those labels and certain things would probably have issues if they try and reference them. And certain parts of the project itself, if I recall correctly, there was a service load balance or a few ETB tests that were referencing them. But because they were referencing that, it means like they wouldn't function in any sort of conforming cluster that wasn't provisioned by QBDM. So it's been decided that these labels will stop being used project-wide. They may continue to be used by QBDM but they may not be used for any conformance-related activities. And this kept simply outlines the plan to start the removal and deprecate them from the other places in the project. Kick over to Cloud Provider with another fun label thing. So for quite some time now, we've had the beta labels used by the cloud providers to sort of signify what instance type it is, what zone or region it is. And it's time to bring those to GA. So as you can see in the list here, like failure-domain.beta.corrace.io slash zone will become topology.corrace.io slash zone and so on for the other ones. And the general deprecation plan for these is both labels will be applied to nodes through the 1.20 release. And in 1.21, they'll stop being referenced or applying them, but they will not remove them from objects that already have them applied. If you are relying on these things, I would encourage you to check out this cap and think about updating anything that you have that might reference them. That was the only one for the Cloud Provider this time. And we'll go right to Cluster Lifecycle. This is a really short one, honestly. It's structured output from Qubate ADM. So as Qubate ADM is sort of becoming the underlying substrate or underlying tool for many other things, it'd be really nice to actually have machine-consumable logs or other things that can be bubbled up easily or parsed easily. So this is adding essentially Qubate ADM logs that can be output in JSON instead of just simply unbuffered text. Now it's time for some of the fun stuff. We're back to topology-aware routing of services. I covered this a little bit more in detail earlier, but essentially you can set a predefined list of preferences via the topology keys parameter and service definition, and that will be the sort of preferred way services or pods will, services will route two items. Next is an interesting one. So the IPv4, IPv6 dual stack support was graduated to alpha in the 116 release. However, since there has been a significant amount of effort across many parts of the project, we are continuing to track it in this release. Anytime there's very large changes like this where tests and other things that impact other parts of the project might be updated, we opted to track it. It just means it's not graduating, but we track it as an enhancement. So some of the major changes that happened with the IPv4, IPv6 dual stack enhancement is dual stack support was added to the cube proxy in IP tables mode, as well as support for dual stack in the downward API. So now if you're doing a reference with the downward API, you'll have both the IPv4 and IPv6 address and they're separated by a comma. The other thing were some changes made to the cube controller manager where before when you had to specify the like node seeder max size and the configuration parameter, like it only had one option. Now you can actually specify it for both IPv4 and IPv6 via the like dash dash node dash seeder dash mask size dash IPv4 and dash dash node seeder mask size IPv6. And those can strictly only be used in dual stack mode. The other thing with sort of all this effort going on right now the plan is for them to push to beta in 1.18 which means that clusters will fully support dual stack mode sort of out of the gate. Next is the new endpoint API or endpoint slice. You've may have heard of this just around a little bit or a schedule all over the place. This is sort of the long-term replacement for the current core V1 endpoints API. The current API actually has a lot of performance and scalability problems for that like impact multiple sort of components like control plane. The sort of just of it is if you instead of like recomputing an entire list of endpoints and notifying all the watchers when one is updated they are now sort of broken down into groups I believe of 100 and only the group that had an updated endpoint will be updated recomputed and updated. And you can like small clusters didn't like have too many problems with this in the past once you got to very, very large clusters with potentially hundreds of thousands of pods it becomes a significant performance problem. And you can imagine soon with potential for pods to have two endpoints IPv4 and IPv6 that will be magnified endpoint slice has actually been like a requirement before IPv4 IPv6 dual stack mode could be supported. Another fun one finalized protection for service load balancers. So service type load balancer requires Kubernetes in an external entity usually a cloud provider to work together to ensure the proper management of their life cycle. So in the past there have been a couple of conditions where the Kubernetes service could be deleted before the actual external load balancer was deleted. So if you can imagine now you deleted that but you still have an AWS load balancer provision that's not so great. So now essentially the deletion of the service will be blocking until the external load balancers removed. Functionally this enhancement hasn't changed too much since Alpha outside of being flipped down by default it's just been sort of like closely watched to make sure like the TI can soak and we haven't seen any sort of problems with it. That we'll move on to node. So configurable pod process namespace sharing. So the default container behavior and this is the same thing that you're like working with Docker locally or anything like that is that each container will exist and run in its own process ID namespace with the entry point process serving as PID 1. So when you're in a pod and you have multiple containers and that they can't see each other's processes there've been certain ways to do it in the past but like it's been a little hacky. Now with share process namespace enabled you can actually remove that boundary and let them share one sort of PID namespace. So this might seem like it removes some of the inherent security or isolation mechanisms that we see with containers but it also opens the door to sort of more complex workflows and enables things like a debug container being attached to another container where you might have a singular goaling binary. I also know like several groups are looking into this as a means for better CI runners. So this means that you could have your sidecar container sort of function as the init and that manages the job execution in another container and with the various like build dependencies. It also means that like that container could perform other actions say when being a container main process that was watching terminated it could do some cleanup actions before fully terminating the pod. Move the frequency of the Kibla heartbeats to lease API. So this is another backend thing that end users generally won't interact too much with but it will serve both as a performance boost and remove some of the scalability limits encountered with clusters with more than 2000 nodes. So on an interval, Kiblet will check back in and update sort of its records with a bunch of information about the current state of the node. This includes things like what images it has on there what volumes are mounted as well as a slew of other things and these individual updates can be like upwards of 15 kilobytes in size for a single update. And when you think about that's a lot for just a simple node status. So now you multiply that by a few thousand nodes and those nodes checking in every 40 seconds you can start to get an idea of the load in which that puts on both the API server and like the backing that's already database. So now instead of including like that full update there'll be much smaller update as a sort of ready signal that is used as the node lease object. And then a full update will be sent on a much sort of longer interval or if there's any recognized meaningful change. And the biggest thing that you will actually probably see as most end users is if you use kubectl and like look at the namespaces you will see a new names system namespace called kube-node-lease. And this is where all those lease objects are going to exist. So hey, Bob before we jump into scheduling we had a question there related to the hot process name sharing. Sure. Is there any security configuration to enable or disable the sharing the process ID or the process table? Give me one sec. My slides are frozen for a sec. This was happening earlier. You have to explicitly enable this on a pod to do it. Come on. This is going is really going so sorry about that. That's all right. I mean, I think you've answered that question. Do you think you'd be able to get back for the current slide or is it proper frozen? I'm trying. Let us know if you need one of us to share and we can advance through the slides for you. Okay. I might need to at least restart the screen share or something and give me one sec. Should I sing a song this night? Maybe some intermission music. There we go. Okay. Now we'll dive into scheduling. So the first one is taint-node-by-condition. The Kubernetes scheduler itself doesn't actually check node conditions. So these are things like, I forget to actually like specific wording, but there's like memory or a disk pressure or like out of disk. And that doesn't directly impact scheduling. So instead the node lifecycle controller would automatically set the like no schedule or no execute taints on the node based on those conditions. And this has sort of been in place directly since 112, but now it's just essentially graduating to stable and some other like cleanup things have been done. The main reason for doing this via the taints and tolerations is that way a cluster admin can sort of actually force a pod to run in a node even under one of those conditions. Next one, the schedule daemons and pods by Kube scheduler. So this one isn't a huge change for a lot of users. It's already in effect, but the sort of history behind it is that before this was graduated to beta in 112, daemons sets were not scheduled by the Kubernetes scheduler. The daemons set controller actually handled that itself. And this was because, and previously caused some weirdness with the scheduler since the like spec.noName was already present when the daemons set was created. And being scheduled separately by this other process was causing some other problems where certain things weren't being respected. So this is most notably when nodes are flagged as unschedulable. Now that they are being managed by the Kube scheduler, all those restrictions, everything like that will be handled properly. Storage is where I think we have four or five. We'll quickly revisit the big one, the snapshot and restore volume support. Essentially, you'll now be able to manage snapshots and things like that within the cluster. So it's covered at the beginning.  This is here mostly for completeness sake and there's some useful links at the bottom that you can use to go see the docs on them. We do have a question if you're wanting to take that now. Sure. But Phil asks, does the snapshot controller support scheduled snapshots? I don't believe so, but you could basically set up as a crown job. Perfect. So dynamic max volume count. So with the various like entry volume providers, so this is things like the GCP disks, AWS disks and a few others, there were some specific hard coding scheduling predicates in there for the maximum number of volumes that could be attached to a node. And this is mostly mapped to the, whatever elements they were for the cloud provider. Let's say for example, in Android OS, you are limited to sort of 40 EBS volumes per instance. And Kubernetes, you wouldn't want something to possibly be scheduled on there where it already has like 40 disks attached and cause a problem. And so by moving to a dynamic design, these various like cluster wide settings or like hard coded settings have been deprecated and are now tied specifically to like the CSI driver or volume type that are associated with that node itself. So now you can sort of like mix and match if you happen to have like nodes running different storage drivers. This probably won't matter too much in the cloud providers, but if you're bare metal and you have say like Cep and some of the other ones, that sort of thing would be pretty important. CSI topology support, sort of similar to the preferences we saw with the service topology preferences, you can now have preferences for scheduling of storage. So you can sort of define, labels and their acceptable values for use in volume placement. This is very useful for like, if you want to make sure that your pod is consuming storage within a specific region or zone versus an area where you don't have that. Next is environment variable expansions via sub path mount. This was introduced almost a year ago in the 114 release and was started to help some of the legacy workloads where you may need to write to a specific place on the host. The intention for this is to sort of work in a combination with the downward API so that you may, you say like, for example, pod names within a mount. This came out specifically because if two or more pods running on the same host happen to reference the same host location and start writing to the same file name, they're going to clash and you're not gonna have a good time. So you can work around this by using the sort of sub path directive, all sub path expression directive that has been introduced. If you tried to use the sub path one previously and it being hard coded, yeah, bad things are gonna happen. It can enforce uniqueness. So this has been a very large one for the project itself and migrating the entry storage plugins to a CSI driver based. Many of the entry based volume types that were built before the CSI or container storage interface were implemented. There's been a long term effort to get those out of tree so that they may be managed separately. But unfortunately, like right now is sort of this middle ground. This has led to having to support them both entry and as the non CSI version and out of tree as the CSI version. And as you can imagine, there's been a large duplication of effort. So this enhancement aims to move the remaining internal logic out of tree while maintaining the original API compatibility to minimize other code changes. Right now the plan is to do some minimal changes to 118 and then push to graduate to stable in 119. The only one from testing is to break apart the test tarball. This is again like another internal facing link cap where previously we had this large Mondo tarball that had all the testing suites for like every platform baked into it. So if you were on AMD ARM, RPC, it didn't matter. They were all baked into there. Now they are on their own separate artifact and it's improved the testing times and testing quite a bit. Moving on to Windows, run as username for Windows. So in the 116 team release, we saw two very big Windows improvements. This, the run as username and a similar enhancement for GMSA or group management service account support. The work in GMSA was allowed to soak for the 117. Oh, I think it might be freaking out again. The work for GMSA was allowed to soak in the 117 release and as expected to pick up again with 118. For the most part, this just adds similar functionality to the run as user directive that we see in Linux containers just for Windows ones. And as this is very sort of tightly scoped with minimal code or API changes from when it was built in alpha, it was moved to beta and turned on by default for the 117 release for Windows containers. That's all the enhancements we had for 117 release. I guess with that, we can go over to some of the questions. All right, thank you very much for that both, that was awesome. I think what I'll do is I'll tackle some of the ones from the end that were related to the CSI as soon as we've just covered that. So the first question we have is, the CSI alert topologies parameter can it be configured as a default? I believe that it is configured on, let me jump back. Actually jumping back's a bad idea. Yeah, yeah, I think it just broke it again. Yep. So I believe that is set up on the storage class. I'm not 100% certain on that. So anything being provision of that storage class should be in the right zone or at least preference should be in the right zone or region. All right, we have one more for regards to CSI. Is there an end of life date for the entry storage drivers? What's going to happen if an upstream doesn't participate in the migration? As it stands, all of them are participating in it. But the, it should be like completely, it shouldn't impact end users at all. The right now, essentially there's like a shim being built so that way any requests internally will just essentially use the CSI behind the scenes. The big thing would be like, you might need to spin up the CSI driver for the specific cloud provider in addition to what you would normally spin up in a new Kubernetes cluster. Okay, okay. Okay, now we're going all the way back to SIG network. Okay, that's quite a hard question. What I might suggest is you've asked that in SIG network on Slack, but I will throw it to Bob in case you feel unbraved. But can you elaborate on how the IP rules are changed with regards to the topology aware routine? So when you create a service, it gives you like, you basically have a IP on the, IP tables role on the host that will point to the current end points for a particular service behind the scenes. What this does is it just shuffles it in the order of the IPs. And this is, again, if memory serves me correct. All right, next question. As the key topology seems to be a good way, host name and region, can it be enabled by the fault on each service? You can't do it. Yeah, you'd have to use something like a mutating admission web book or something like that so that any time a service is created, automatically add those preferences for you. All right, perfect. All right, we just have a couple more and then we'll have to wrap up. But is there any reason why the application for the node specification of Kubernetes cloud providers, i.e. node.coupernevies.com? I can take- Why are we deprecating? I can take that if you want. Yeah, so basically it's, as Bob mentioned earlier, there isn't really an official definition of control plane or what makes a control plane node and every cloud provider sort of has their own take on it. So in order to avoid having actual internal dependencies on these specific labels, we are just, it's basically just a cleanup thing and to encourage people to create their own labels and their own behaviors. Okay, perfect, thank you. And we have another question with regards to the cloud provider labels. When will the node name not be dependent from the cloud provider and move to just being labels and then in brackets and unify the host name overwrite option of the Kubelet? And we've got anything to see with that. So I'm rereading the question. The node name will not be dependent from cloud provider and move these specifically to just the label. I'm kind of unsure on that question. Yeah, again, I think you can use whatever labels you like as of right now. So again, I think this is mostly just so that we don't encourage internal dependencies on something that is really cloud provider specific. Okay, thank you for that. And the final question is about ingress. With many projects bringing in new privatives essentially for ingress such as STL using ingress root. Is there going to be any unification of these within the next few versions? I don't know, but there is a cap for that. But they're discussing it. I can see about digging up the link and dropping it in the... I feel like I need to do the meme picture. All right, so that could be followed up with later. That's great. All right, thank you, Bob. Thank you, Gwen. That was great. Thank you everyone for joining us today. This webinar will be was recorded and will be available online with the slides later today. And we look forward to seeing you at a future CNCF webinar. So have a great day. Thank you once again to Bob and Gwen for joining us. And I'll see you all later. Thank you, David. Thanks for hosting. Thanks everyone.


Hello, everyone. Welcome to the Keeps coverage of AWS Startup Showcase. This is the closing panel session on AI Machine Learning, the top start-up generating AI on AWS. It's a great panel. This is going to be the experts talking about riding the wave in GenRiv AI. We've got Ankur Mejwitra, who's the Director and General Manager of AI and Machine Learning at AWS, and Klem Delan, Co-Founder and CEO of Huggingface, and Ori Ghosian, who's the Co-Founder and CEO of AI21 Labs. Ori, from Tel Aviv, dialing in and the rest coming in here on theCUBE. Appreciate you coming on for this closing session for the Startup Showcase. Thanks for having us. Thank you for having us. I'm super excited to have you all on. Huggingface was recently in the news with the AWS relationships. So congratulations, open source, open science, really driving the machine learning. And we got AI21 Labs access to the LLMs, generating huge-scale live applications, commercial applications coming to the market, all powered by AWS. So everyone, congratulations on all your success, and thank you for headlining this panel. Let's get right into it. AWS is powering this wave here. We're seeing a lot of push here from applications. Ankur, set the table for us on the AI machine learning. It's not new. It's been going on for a while. Past three years, there's been significant advancements, but there's been a lot of work done in AI machine learning. Now it's released to the public. Everybody's super excited. And now says, oh, the future's here. It's kind of been going on for a while. And baking is now it's kind of coming out. What's your view here? Let's get it started. Yes, thank you. So yeah, as you may be aware, Amazon has been investing in machine learning research and development since quite some time now. And we've used machine learning to innovate and improve user experiences across different Amazon products, whether it's Alexa or Amazon.com. But we've also brought in our expertise to extend what we're doing in the space and add more generative AI technology to our AWS product services, starting with Code Whisperer, which is an AWS service that we announced a few months ago, which is you can think of it as a coding companion as a service, which uses generative AI models underneath. And so this is a service that customers who have no machine learning expertise can just use. And we also are talking to customers and we see a lot of excitement about generative AI and customers who want to build these models themselves who have the talent and the expertise and resources. For them, AWS has a number of different options and capabilities they can leverage, such as our custom silicon, such as training, training and infringer, as well as distributed machine learning capabilities that we offer as part of SageMaker, which is an end-to-end a machine learning development service. At the same time, many of our customers tell us that they're interested in not training and building these generative AI models from scratch, given they can be expensive and can require specialized talent and skills to build. And so for those customers, we're also making it super easy to bring in existing generative AI models into their machine learning development environment within SageMaker for them to use. So we recently announced our partnership with HungPace, where we're making it super easy for customers to bring in those models into their SageMaker development environment for fine-tuning and deployment. And then we're also partnering with, you know, other proprietary model providers such as AI21 and others where we're making these generative AI models available within SageMaker for our customers to use. So our approach here is to really provide customers options and choices and help them accelerate their generative AI journey. Thank you for saying the table there, Clem and Ori, I want to get your take because the riding the waves, the theme of this session. And to me, you know, being in California, I imagine they're the big surf, the big waves, the big talent out there. This is like alpha geeks, alpha coders, developers are really leaning into this. You're seeing massive uptake from the smartest people, whether they're young or around, they're coming in with their surfboards, if you will. These early adopters, they've been on this for a while, now the waves are hitting. This is a big wave, everyone sees it. What are some of those early adopter devs doing? What are some of the use cases you're seeing right out of the gate? And what does this mean for the folks that are going to come in and get on this wave? Can you guys share your perspective on this? Because you're seeing the best talent now leaning into this. Yeah, absolutely. I mean, from hugging face vantage points, it's not even a wave, it's a tidal wave or maybe even the tide itself, right? Because actually what we're seeing is that AI and machine learning is not something that you add to your products. It's very much a new paradigm to do all technology, right? It's this idea that we had in the past 15, 20 years, one way to build software and to build technology, which was writing a million ninths of code, very rule-based, and then you get your product. Now what we're seeing is that every single product every single feature, every single company is starting to adopt AI to build the next generation of technology, right? And that works both to make the existing use cases better. If you think of search, if you think of social network, if you think of SaaS, but also it's creating completely new capabilities that weren't possible with the previous paradigm, right? Now AI can generate text, it can generate image, it can describe your image, it can do so many new things that weren't possible before. And it's going to really make the developer it's going to really productive, right? I mean, you're seeing the developer uptake strong, right? Yes, we have over 15,000 companies using HuggingPace now, and it keeps accelerating. I really think that maybe in like three, five years, there's not going to be any company not using AI. It's going to be really complex default to build all technology. Ori, weigh in on this, API is the cloud. Now I'm a developer, I want to have live applications. I want the commercial applications on this. What's your take? What's weigh in on here, weigh in here? Yeah, first, I absolutely agree. I mean, we're in the midst of technology shift here. I think a lot of people realize how this big this is going to be just the number of possibilities is handless and I think hard to imagine. And it's, I don't think it's just the use cases. I think we can think of it as two separate categories. We'll see companies and products enhancing their offerings with these new AI capabilities. We'll also see new companies that are AI first that kind of reimagine certain experiences. They build something that wasn't possible before. And that's why I think it's actually extremely exciting times and maybe more philosophically. I think now these large language models and large transformer based models are helping us people to express our thoughts and kind of making the bridge from our thinking to a creative digital asset in a speed we've never imagined before. Right, I can write something down and get a piece of text or an image or a code. So I think it's really, I started by saying it's hard to imagine all the possibilities right now, but it's certainly big. And if I had to bet, I would say it's probably at least as big as the mobile revolution we've seen in the last one years. Yeah, I mean, this is the biggest. I mean, it's been compared to the Enlightenment age. I saw the Wall Street Journal had a recent story on this. We've been saying that this is probably going to be bigger than all inflection points combined in the tech industry. Given what transformation is coming, I guess I want to ask you guys on the early adopters we've been hearing on these interviews and throughout the industry that there's already a set of big companies, a set of companies out there that have a lot of data and they're already there, they're kind of tinkering. Kind of reminds me of the old hyperscaler days where they were building their own scale and they're eating glass, spitting nails out, they're hardcore. Then you got everybody else kind of saying, board level, hey team, how do I leverage this? How do you see those two things coming together? You got the fast followers coming in behind the early adopters. What's it like for the second wave coming in? What are those conversations for those developers like? I mean, I think for me, the important switch for companies is to change their mindset from being kind of like a traditional software company to being an AI or machine learning company. And that means investing, hiring, machine learning engineers, machine learning scientists, infrastructure team members who are working on how to put these models in production, team members who are able to optimize models, specialize models, customize models for the company specific use cases. So it's really changing this mindset of how you build technology and optimize your company building around that. Things are moving so fast that I think now it's kind of like too late for low-ending foods or like small, small adjustments. I think it's important to realize that if you want to be good at that and if you really want to serve this wave, you need massive investments, right? Like if there are like some surfers listening with this analogy of the wave, right? When there are waves, it's not enough just to stand and make a little bit of adjustments. You need to position yourself aggressively, battle like crazy, and that's how you get into the wave. So that's what companies, in my opinion, need to do right now. Or what's your take on the generative models out there that we hear a lot about foundation models? What's your experience running end-to-end applications for large foundation models? Any insights you can share with the app developers out there who are looking to get in? Yeah, I think first of all, it started creating an economy where it probably doesn't make sense for every company to create their own foundation models. I mean, you can basically start by using an existing foundation model either open source or proprietary one and start deploying it for your needs. And then comes the second round when you're starting the optimization process, right? You bootstrap whether it's a demo or a small feature or introducing a new capability within your product and then start collecting data. That data, particularly the human feedback data helps you to constantly improve the model. So you create these data flywheel. And I think we're now entering an era where customers have a lot of different choice of how they want to start their generative AI endeavor. And it's good thing that there's a variety of choices. And the really amazing thing here is that every industry, any company to speak with, it could be something very traditional, like industrial or financial, medical, really any company, I think people's now starts to imagine what are the possibilities and seriously think what's their strategy for adopting this generative AI technology. And I think in that sense, the foundation model actually enabled this to become scalable. So the barrier to entry became lower. Now the adoption could actually accelerate. There's a lot of integration aspects here in this new way that's a little bit different before. It's like very monolithic, hardcore, very brittle, lot more integration. You see a lot more data coming together.  I mean, I got a degree in computer science and software engineer, that's all you did, code, right? You did code it. Now, I mean, isn't it like everyone's a machine learning engineer at this point because like that will be ultimately the science. So, you got open source, you got open software, you got the communities, Swamy called you guys the GitHub of machine learning, hugging faces that get GitHub of machine learning, mainly because that's where people are going to code. So, this is essentially machine learning is computer science. Is that, what do you guys, what's your reaction to that? Yes, my co-founder Julien, a tugging face, have been having this thing for quite a while now for over three years, which was saying that actually software engineering as we know it today is a subset of machine learning instead of the other way around, right? People would call us kind of like crazy a few years ago when we were seeing that, but now we're realizing that you can actually code with machine learning, right? So machine learning is generating code. And we're starting to see that every software engineer can leverage machine learning to open models through APIs, through different technology stack. So, it's not crazy anymore to think that maybe in a few years there's going to be more people doing AI and machine learning. However you call it, right? Maybe you'll still call them software engineers. Maybe you'll call them machine learning engineers. But there might be more of these people in a couple of years than there is like software engineers today. I bring this up as more tongue and cheek as well because infrastructure is code is what made cloud great, right? That's kind of the DevOps movement. But here, the shift is so massive there will be a game changing philosophy around coding. Machine learning is code. You're starting to see code whisperer. You guys have had coding companions for a while on AWS. So this is a paradigm shift. How is the cloud playing into this for you guys? Because to me, I've been riffing on some interviews where it's like, okay, you got the cloud going next level. This is an example of that where there is a DevOps like moment happening with machine learning whether you call it coding or whatever it's writing code on its own. Can you guys comment on what this means from top of the cloud? What comes out of the scale? What comes out of the benefit here? Absolutely. It's so good. Yeah, so I was, I think as far as scale is concerned I think customers are really relying on cloud to make sure that the applications that they build can scale along with the needs of their business. But there's another aspect to it, which is that until a few years ago, John Ward we saw was that machine learning was a data scientist heavy activity. There were data scientists who were taking the data and training models. And then as machine learning found its way more and more into production and actual usage, we saw the MLops become a thing and MLops engineers become more involved into the process. And then we now are seeing, as machine learning is being used to solve more critical business critical problems, we're seeing even legal and compliance teams get involved. We're seeing business stakeholders more engaged. So more and more machine learning is becoming an activity that's not just performed by data scientists, but is performed by a team and a group of people with different skills. And for them we as AWS are focused on providing the best tools and services for these different personas to be able to do their job and really complete that end-to-end machine learning story. So that's where whether it's tools for related to MLops or even for folks who don't know any, cannot code or don't know any machine learning. For example, we launched SageMaker Canvas as a tool last year, which you can just use. It's a UI based tool, which data analysts and business analysts can use to build machine learning models. So overall the spectrum in terms of persona and who can get involved in the machine learning process is expanding and the cloud is playing a big role in that process. Ori Klein, can you guys weigh in too? Cause this is just another abstraction layer of scale. What's it mean for you guys as you look forward to your customers and the use cases that you're enabling? Yes, I think it's what's important is that AI companies and providers and the cloud can work together, right? That's how you make a seamless experience and you actually reduce the barrier to entry for this technology. So that's what we've been super happy to do with AWS for the past few years. We actually announced not too long ago that we're doubling down on our partnership with AWS. We're excited to have many, many customers on our shared product, the Hugging phase deep learning container on SageMaker. And we're working really closely with the with the InfernoShare team and the Trinium team to release some more exciting stuff in the coming weeks and coming months. So I think when you have an ecosystem where the AWS and the AI providers, AI startups can work hand in hand, it's to the benefit of the customers and the companies because it makes it like orders of magnitude easier for them to adopt this new paradigm to build technology AI. Or this is a scale on reasoning too. You got the data is out there and making sense out of it. Making it reason, making getting comprehension, having it make decisions is next, isn't it? And you need scale for that. Yes. Just a comment about the infrastructure side. So I think really the purpose is to streamline and make these technologies much more accessible. And I think we'll see, I predict that we'll see in the next few years, more and more tooling that make this technology much more simple to consume. And I think it plays a very important role. There's so many aspects like the monitoring the models and their kind of outputs they produce and kind of containing and running them, you know, in production environment, there's so much there to build the infrastructure side will play a very significant role. All right, that's awesome stuff. And I love to change gears a little bit and get a little philosophy here around AI and how it's going to transform. If you guys don't mind, there's been a lot of conversations around on theCUBE here as well as in some industry areas where it's like, okay, all the heavy lifting is automated away with machine learning and AI, the complexity, there's some efficiencies, it's horizontal and scalable across all industries and at a good point there. Everyone's going to use it for something and a lot of stuff gets brought to the table with large language models and other things. But the key ingredient will be proprietary data or human input or some sort of AI whisperer kind of role or prompt engineering people are saying. So with that being said, some are saying it's automating intelligence and that creativity will be unleashed from this. If the heavy lifting goes away and AI can fill the void, that shifts the value to the intellect or the input. And so that means data's going to come together, interact, fuse and understand each other. This is kind of new. I mean, old school AI was, okay, I got a big model, I provisioned it a long time, very expensive, now it's all free flowing. Can you guys comment on where you see this going with this free form, data flowing everywhere, heavy lifting and then specialization or? Yeah, I think. Good. Yeah, I think so what we're seeing with these large language models or generative models is that they're really good at creative stuff. But they, I think it's also important to recognize their limitations. They're not as good at reasoning and logic. And I think now we're seeing, we're seeing great enthusiasm, I think which is justified. And the next phase would be how to make these systems more reliable, how to inject more reasoning capabilities into these models or augment with other mechanisms that actually perform more reasoning so we can achieve more reliable results. And we can count on these models to perform in, for critical tasks, whether it's medical tasks, legal tasks, we really want to kind of offload a lot of the intelligence to these systems. And then we'll have to get back, we'll have to make sure these are reliable, we'll have to make sure we get some sort of explainability that we can understand the process behind the generated results that we've received. So, I think this is kind of the next phase of systems that are based on these generated models. Clen, what's your view on this? Obviously you're at open community, open source has been around, it's been a great track record proven model. I'm assuming creativity is going to come out of the woodwork and if it can automate open source contribution and relationships and onboarding more developers, there's going to be unleashing of creativity. Yes, it's been so exciting on the open source front, right? Like we all know birds, you know, bloom, GPTJ, T5, stable diffusion that work out like the previous sort of, the current generation of open source models that are on hooking face. It has been accelerating in the past few months, right? So like I'm super excited about control net, right now that is really having a lot of impacts, which is kind of like a way to control the generation of images, super excited about FlanUL2, which is like a new model that has been recently released and is open source. So, yeah, it's really fun to see the ecosystem coming together. Open source has been the basis for traditional software, right? With like open source programming languages, of course, but also all the great open source that we've gotten over the years. So we're happy to see that the same thing is happening for machine learning and AI and hopefully it can kind of like help a lot of companies reduce a little bit the barrier to entry. So, yeah, it's going to be exciting to see how it evolves in the next few years in that respect. I think the developer productivity angle that's been talked about a lot in the industry will be accelerated significantly. I think security will be enhanced by this. I think in general applications are going to transform at a radical rate, accelerating incredible rates. So I think it's not a big wave or it's the water, right? I mean, it's the new thing. My final question for you guys, if you don't mind, I'd love to get each of you to answer the question I'm going to ask you, which is, a lot of conversations around data, data infrastructure is also involved in this. And the common thread that I'm hearing is that every company that looks at this is asking themselves, if we don't rebuild our company, start thinking about rebuilding our business model around AI, we might be dinosaurs, we might be extinct. And it reminds me of that scene in Moneyball when at the end it's like, we're not building the model around your model, every company will be out of business. What's your advice to companies out there that are having those kind of like moments where it's like, okay, this is real, this is next gen, this is happening. I better start thinking and putting into motion plans to refactor my business because it's happening, business transformation is happening on the cloud. This kind of puts an exclamation point on with the AI as a next step function, big increase in value. So it's an opportunity for leaders. Anka, we'll start with you. What's your advice folks out there thinking about this? Do they put their toe in the water? Do they jump right into the deep end? What's your advice? Yeah, John. So we talked to a lot of customers and customers are excited about what's happening in the space, but they often ask us like, hey, where do we start? So we always advise our customers to do a lot of proof of concepts, understand where they can drive the biggest ROI. And then also leverage existing tools and services to move fast in scale and try and not reinvent the wheel where it doesn't need to be. So that's basically the advice to customers. Okay, then, Ori, what's your advice to folks who are scratching their head going, I better jump in here. How do I get started? What's your advice? So I actually think that, I need to be thinking about it really economically. So, often the opportunity side and the challenges. So there's a lot of opportunities for many companies to actually gain revenue upside by building these new generative features and capabilities. On the other hand, of course, this would probably affect the COGS and incorporating these capabilities could probably affect the COGS. So I think we really need to think carefully about both of these sides and also understand clearly if this is a project or an effort towards cost reduction, then the ROI is pretty clear or revenue amplifier, where there's again, a lot of different opportunities. So I think once you think about this in a structured way, I think, and map the different initiatives, then it's probably a good way to start and a good way to start thinking about these endeavors. Awesome, Clem, what's your take on this? What's your advice, folks out there? Yes, all of these are very, very good advice already. Something that you said before, John, that I disagreed with you. A lot of people are talking about the data mode and proprietary data. Actually, when you look at some of the organizations that are building the best models, they don't have a specialized or like unique access to data. So I'm not sure that's so important today. I think what's important for companies and it's been the same for the previous generation of technology is their ability to build better technology faster than others, right? In this new paradigm, that means being able to build machine learning faster than others and better. So that's how, in my opinion, you should approach this, right? In kind of like, how can you evolve your company, your teams, your products so that you're able in the long run to build machine learning better and faster than your competitors. And if you manage to put yourself in that situation, then that's when you'll be able to differentiate yourself to really be impactful and get results. That's really hard to do, right? It's something really different because machine learning and AI is a different paradigm than traditional software. So this is going to be challenging, but I think if you manage to nail that, then the future is going to be very interesting for your company. That's a great point. Thanks for calling that out. I think it all reminds me of the cloud days early on. If you went to the cloud early, you took advantage of when the pandemic hit, if you weren't native in the cloud, you got hamstrung by that, you were flat-footed. So just get in there, get in the cloud, get into AI, you're going to be good. Thanks for calling that. Final parting comments. What's your most exciting thing going on right now for you guys, Ori Klem? What's the most exciting thing on your plate right now that you'd like to share with folks? I mean, for me, it's just the diversity of use cases and really creative ways of companies leveraging this technology. Every day I speak with about two, three customers and I'm continuously being surprised by the creative ideas and the future is really exciting what can be achieved here. And also I'm amazed by the pace that things move in this industry. It's just, there's not a dull moment. So definitely exciting times. Klem, what are you most excited about right now? For me, it's like all the new open source models that have been released in the past few weeks and that they'll keep being released in the next few weeks. I'm also super excited about more and more companies getting into this capability of changing different models and different APIs. I think that's a very, very interesting development because it creates new capabilities, new functionalities that weren't possible before. You can plug an API with an open source embedding model with a no-geo transcription model. So that's also very exciting, this capability of having more interoperable machine learning will also, I think, open a lot of interesting things in the future. Klem, congratulations on your success at Huggingface. Please pass it on to your team or congratulations on your success and continue to just day one. I mean, it's just the beginning. It's not even scratching the surface. Ankar, I'll give you the last word. What are you excited for there at AWS? More cloud goodness coming here with AI. Give you the final word. Yeah, so, you know, as both Klem and Ori said, I think that the research in the space is moving really fast and we are excited about that. But we, you know, we're also excited to see the speed at which enterprises and other AWS customers are applying machine learning to solve real business problems and the kind of results they're seeing. So when they, you know, come back to us and tell us the kind of improvement in their business metrics and overall customer experience that they're driving and they're seeing real business results, that's what keeps us going and inspires us to, you know, to continue inventing on the behalf. Gentlemen, thank you so much for this awesome high-impact panel. Ankar, Klem, Ori, congratulations on all your success. We'll see you around. Thanks for coming on. Generative AI, riding the wave. It's a tidal wave. It's the water. It's all happening. All great stuff. This is season three, episode one of 80 of a startup showcase closing panel. This is the AI ML episode, the top startups building generative AI on AWS. I'm John Furrier, your host. Thanks for watching.


Well, you bring up what I see too as almost like a current that runs through largely the quote, anti-vax side, which for me is this idea of body autonomy, right? And I see it a lot in the literature, this idea of my body, my choice on the signs, consent. Some people bring out the Nuremberg trial of, I guess it's like do no harm in the medical practice. And again, a lot of largely people say, oh, that's a false equivalency. That's not what's going on here. But for me, I'm curious about that. What is it in this quote, anti-vax side that has this real adherence to this sense of body autonomy as like the, the fulcrum? Because I think it speaks a little bit to what you're saying. It's almost this idea of I'm free from being co-opted by this technocratic agenda, right? There's this idea of like personal liberation from that system. And yet at the same time, sometimes I also see these, again, these shades of, well, is freedom simply the freedom to not being of consequence to other people? Because the quote pro-side says, well, look, your freedom is infringing upon my safety, right?  So I'm just curious where does that come from? And you're understanding this, this adherence or curiosity around that. And Zemir, you want to join me? I just want to add to that, that we can't not take note that we live in a time sort of post-MeToo movement. I mean, there's this deeper sense of what you don't have to, you know, buy into an, you know, the quote unquote anti-vax narrative to now stand in the power of, well, you know what, consent is something that we have socially accepted as something that is very, very important. It's being discussed in a wide scale, right, around the autonomy of our bodies, right? It's something that has permeated the social consciousness, right, right to consent. And even the way in which we're thinking, approaching abortion and the outcries that we have when women's bodies are not offered that freedom, right? I mean, this is something that I feel like it also has a deeper undercurrent. Yeah. OK, you could imagine a society and may not be a bad society where individual freedom is not the highest priority in which it's generally accepted that your body is not your own, that it belongs to the collective. And the collective has the right to tell you what to do with your body for the good of all.  And it's just, it's like, well, it is actually a religion. Not every society has freedom of religion or even holds that as an ideal. And there is no law of the universe that says that our society has to have that. Really, what we're talking about here is freedom of religion. When you understand medical paradigms as part of the mythology, then, then, and you notice, like, how congruent medical procedures are with ritual practices.   And that's, that's, like, that's, that's why people are so offended by the unvaccinated. It's not because they are actually rationally afraid that they're going to be at greater risk. That is becoming more and more obvious as the evidence accumulates that the vaccines are working very well, that, you know, the vaccinated are, the vaccines wear off after a few months, you know, you have to get one booster after another, what, like, Israel is now experiencing like the highest COVID rates in the world. And they have the highest vaccination rates. I mean, there's all kinds of cracks in the facade of the fact, you know, get the vaccine to protect everybody. It's not entirely rational. There's something else going on here. So really the question is, but, but see, that's your, in a way irrelevant, like, like, I could say, okay, you're not actually protecting others by getting vaccinated, but what if you were?


Hello everyone, welcome to a special CUBE conversation here in the CUBE studio in Palo Alto, California. I'm John Furrier, the co-founder of SiliconANGLE Media and also the co-host of theCUBE. We're here with Junay Vizlan, who's the president and CTO of a company called Vitter. Also supports the public sector and the defense community. Teases a class on cyber intelligence and cyber warfare. Junay, thank you for coming in. Well, thanks for having me, it's great to be here. Okay, I'll see, you know, we've been doing a lot of coverage of cyber in context to, one, the global landscape, obviously. In our area of enterprise and emerging tech, you see the enterprises are all shaking in their boots, but you now have new tools like IoT, which increases the service area of attacks. You're seeing AI being weaponized for bad actors, but in general, it's just really a mess right now and security is changing. So I'd like to get your thoughts on it and also talk about some of the implications around the cyber warfare that's going on. Certainly the elections on everyone's mind, you see fake news, but really it's a complete new generational shift that's happening with all the good stuff going on, blockchain and everything else and AI, he's also bad actors.  Yeah, you're 100% right. And I think what you have hinted on is something that is only now people are getting awareness of that is as America becomes a more connected society, we become more vulnerable to cyber attacks. For the past few years, really cyber attacks were driven by people looking to make 20 bucks or whatever, but now you really have state actors moving into the cyber attack business and actually subsidizing attackers with free information and hoping to make them more lethal attackers against the United States. And this really is completely new territory. When we think about cyber threats, almost all of the existing models don't capture the risks involved here and it affects every American, everybody should be worried about what's going on. And certainly the landscape has changed in security and tech with the cloud computing, but more importantly we have Trump in the office and it's always the brouhaha over just that and itself, but in concert to that, you're seeing the Russians, we're seeing them involved in the election, you're seeing China putting blocks and everything and changing how the rules are getting, it's a whole global economy. So I got to ask you the question that's on everyone's mind is cyber war is real, we do not have a West Point Navy SEALs for cyber yet, I know there's some stuff at Berkeley that's pretty interesting to me, that Michael Grimes at Morgan Stanley is involved in amongst other folks as well, where a new generation of attacks is happening in the US of A right now. Could you comment and share your thoughts and reaction to what's happening now that's different in the US from a cyber attack standpoint and why the government is trying to move quickly, why companies are moving quickly, what's different now, why is the attacks so rampant, what's changed? I think the biggest difference we have now is what I would call direct state sponsorship of cyber attack tools. Great example of that is the vault seven disclosure on WikiLeaks. Typically, when you've had intelligence agencies steal one thing from another country, they would keep it a secret and basically use those vulnerabilities during a time of attack or different operation. In this case we saw something completely different. We think the Russians might have stolen it, but we don't know, but whoever stole it immediately puts it back into the public domain and why do they do that? They want those vulnerabilities to be known by as many attackers as possible who then in turn will attack the United States at across not only public sector organizations but as private. And one of the interesting outcomes you've seen is the malware attacks or the cyber attacks we saw this year were much more lethal than ever before. If you look at the WannaCry attack and then the NotPety attack. NotPety attacks started with the Russians attacking the Ukraine, but because of the way they did the attack, they basically created malware that moved by itself. Within three days, computers in China that were 20 companies away from the original target were losing their data. And this level of lethality we've never seen and it is a direct result of these state actors moving into the cyber warfare domain, creating weapons that basically spread through the internet at very high velocity. And the reason this is so concerning for the United States is we are a truly connected society. All American companies have supply chain partners. All American companies have people working in Asia. So we can't undo this. And what we've got to do very quickly is develop countermeasures against this. Otherwise the impacts will just get worse and worse. It's the old days, if I get this right, hey, I attack you, I get to seek a back door to the US and spy on spy kind of thing, right? So now you're saying is there's a forced multiplier out there with the crowd. So they're essentially democratizing the tools, not we used to call it kiddie scripts. Now they're not kiddie scripts anymore. They're real weapons of cyber weaponry that's open to people who want to attack or motivated to attack the US. Is that going to, am I getting that right? That's right. I mean, if you look at what happened in WannaCry, you had people looking for $200 payout, but they were using tools that could have easily wiped out a country. Now the reason this works for America's enemies, as it were, or adversaries is in the short run, they get to test out weapons. In the long run, they're really learning about how these attacks propagated and make no mistake. If there's a political event and it's in their interest to be able to shut down US computers, it's just something I think we need to worry about and be very conscious of, specifically these new type of attack vectors. Now to put my fear-mongering hat on, because as a computer scientist myself, back on the day, I can only imagine how interesting this is to attack the United States. What is the government doing? What's the conversations that you're hearing? What are some of the things going on in the industry around, okay, we're seeing something so sophisticated, so orchestrated at many levels. State actors democratizing the tools for the bad guys, if you will, but we've seen fraud and cyber theft be highly mafia-driven or sophisticated. Groups of organized under the black market companies. Forms, I mean, really well-funded, well-staffed. I mean, so the HBO hack just a couple weeks ago, I mean, shaking them down with ransomware. Again, there's many, many different things. This has got to scare the cyber security forces of the United States, what are they doing? So I think, one thing I think Americans should feel happy about is, within the defense and intelligence community, this has become one of the top priorities. So they are implementing a huge set of resources and programs to mitigate this. Unfortunately, you know, they will, they need to take care of themselves first. I think it's still up to enterprises to secure their own systems against these new types of attacks. I mean, I think we can certainly get direction from the US government. And they've already begun outreach programs. For example, the FBI actually has a cyber security branch and they actually assign officers to American companies who are targets. And typically that's actually, I think started last year, but they'll actually come meet you ahead of the attack and introduce themselves. So that's actually pretty good. And that's a fantastic program. I know some of the people there. But you still have to become aware. You still have to look at the big risks in your company and figure out how to protect them. That is something that no law enforcement person can help you at, because that has to be proactive. Everyone who watches my Silicon Valley podcast knows that I've been very much talk a lot about Trump. And no one knows if I voted for him or not. Actually didn't vote for him, but that's a different point. We've been critical of Trump, but also at the same time, you know, the whole wall thing is kind of funny in itself, me building walls ridiculous. But let's take that to the firewall problem. Let's talk about tech. The old days, you have a firewall, right? The United States really has no firewall because the perimeters or the borders, if you will, are not clear. So in the industry, they call it perimeter list. There's no more mode, there's no more front doors. There's a lot of access points into networks and companies. This is changing the security paradigm, not only at the government level, but the companies who are creating value, but also losing money on these attacks. So what is the security paradigm today? Is it people putting their head in the sand? Are there new approaches? Is it a do over? Is there a reset? Security is the number one thing. What are companies and governments doing? So I think, well, first of all, there's a lot of thinking going on, but I think there's two things that need to happen. I think one, we certainly need new policies and laws. I think just on the legal side, whether if you look at the most recent Equifax breach, we need to update laws on people holding assets that they need to become liable. We also need more policies that people need to lock down national critical infrastructure like power systems. And then the third thing is the technical aspect. I'd bring it. We actually, in the United States, actually do have technologies that are countermeasures to all of these attacks, and we need to bring those online. And I think as daunting as it looks like protecting the country, actually it's a solvable problem. For example, there's been a lot of press that, foreign governments are scanning U.S. power infrastructure. And from my perspective as a humble networking person, I've always wondered why do we allow basically connectivity from outside the United States to power plants which are inside the United States? I mean, you could easily filter those at the peering points. And I know some people might say that's controversial. Are we going to spy on it? And porch too, like porch of New Orleans. I always thought of the CTO there. I'd be saying maritime's accessing the core network. Yeah, so from my perspective as a technical, I'm not a politician. That's good, thank God. We need more of you out there. Yeah, and I've worked on this problem a little bit. I would certainly block inbound flows from outside the United States to critical infrastructure. There is no value or reason, logical reason, you would give of why someone from an external country should be allowed to scan a US asset. And that is technically quite simple for us to do. It is something that I and others have talked about, publicly and privately. I think that's a very simple step we could do. Another very simple step we could do across the board is basically authenticated access. That is, if you are accessing a US government website, you need to sign in and there will be an MFA step up. And I think this makes- What's the MFA step up? Well, like some kind of secondary. So say you're accessing the IRS portal and you want to just check on something that you're going to sign in and we're going to send a message to your phone to make sure you are you. I know a lot of people will feel, hey, this is an invasion of privacy, but I'll tell you what's an invasion of privacy. Someone's stealing 140 million IDs or your backgrounds and having everything. Which just happened for MFA multi-factor authentication. So I think again- Now let's say hack your cell phone, which the Bitcoin guys have already done. But it's easy for hackers to hack one system. It's hard for hackers to hack multiple systems. So I think at the national security level, there are a number of simple things we can do that are actually not expensive that I think we as a society have to really think about doing because having governments which are very anti-American, destabilizing us by taking all of our data out doesn't really help anyone. So that's the biggest law. And there's no risk for the destabilizing America enemies out there. What's the disincentive they're going to get put in jail? There's no real enforcement. I mean, cyber is a great leverage. So one of the things that I think most people don't understand is the international laws on cyber attacks just don't exist anymore. They have a long way to catch up. Let me give a counter example, which is drugs. There are already multilateral agreements on chasing drug traffickers as they go from country to country. And there's a number of institutions that monitor that and enforce that. That actually works quite well. We also have new groups focusing on human trafficking. You know, it's slowly happening. But in the area of cyber, we haven't even started a legal framework on what would constitute a cyber attack. And sadly, one of the reasons it's not happening is America's enemies don't want it to happen. But this is where I think as a nation, first you have to take care of yourself. And then on a multilateral perspective, the US should start pushing a cybersecurity framework worldwide so that if you start getting emails from that friendly prince who's actually a friend of mine about putting in some, we can actually go back to that country and say, hey, we don't want to send you any more money anymore. Yeah, yeah, exactly. Everyone's going to make $18 million. They get their username, password, social security number. All right, final question on the segment around the cybersecurity piece. What's the action going forward? I'll say it's early days and hardcore days right now. It's really the underbelly of the internet globally is attacking. We see that the government is, doesn't have a legal framework yet in place. They need to do that. But there's a lot of momentum around creating a Navy SEALs and the version of land, air and sea or multidisciplinary combat efforts out there. This has been conversation certainly in some of our networks that we talk about. What's the young generation? I mean, you've got a lot of gamers out there that would love to be part of a new game, if you will, called cyber defense. What's going on? I mean, is there any vision around how to train young people? Is there an armed forces concept? Is there something like this happening? What's the next step? What do we need to do as a government? So you've actually touched on a very difficult issue because if you think about security in the United States, it's really been driven by a compliance model, which is here's these set of things to memorize and this is what you do to become secure. And all of our cybersecurity training courses are based on models. If there's one thing we've learned about cyber attackers is these people are creative and do something new every time and go around the model. So I think one of the most difficult things is actually to develop training courses that almost don't have any boundaries because the attackers don't confine themselves to a set of attack vectors, yet we in our training do, we say, well, this is what you need to do. And time and time again, people just do something that's completely different. So that's one thing we have to understand. The other thing we have to understand, which is related to that, is that all of US's cybersecurity plans are public in conferences. All of our universities are open. So we actually have, there's been- The playbook is out there. We actually, so one of the things that does happen is if you go to any large security conference, you see a lot of people from the countries that are attacking us showing up everywhere, actually going to the same university, going to universities and learning the course. So I think there's two things. One, we really need to think deeper about just how attacks are being done, which are unbounded. And two, which is going to be a little bit more difficult, we have to rethink how we share information on a worldwide basis of our solutions. And so probably not the easy answer you wanted, but I think- Well, it's complex and it requires unstructured thinking that's not tied up. I mean, it's like the classic, the frog in boiling water dies and you put a frog in boiling water and it jumps out. We are in this false sense of security with these rules thinking we're secure and we're bitten, people are killing us with this security. Yeah, and like I say, it's even worse when we figure out a solution. The first thing we do is we tell everybody, including our enemies, giving them a lot of chance to figure out how to attack us. So I think we do have some hard challenges. So don't telegraph, don't be so open. Be somewhat secretive in a way. It's actually helpful. I think sadly, I think we've come to the very unfortunate position now where I think we need to, especially in the area of cyber, rethink our strategies because as an open society, we just love telling everybody what we do. And- Well, so the final question, final, final question is just for the end, again, in this segment. So cyber security is real or not real? I mean, how real is this? Can you just share some color for the folks watching who might say, hey, you know, I think it's all smoke and mirrors. I don't believe the New York Times, I don't believe this. I'm Trump saying this and is this real problem and how big is it? I think it is real. I think we have this calendar year, 2017. We have moved from the classic kind of like cyber attack, you know, like someone's being fished to really the beginning of a cyber warfare. And unlike kinetic warfare where somebody blows something up, this is a new face that's long and drawn out. And I think one of the things that makes us very vulnerable as a society is we are an open society. We are interlinked with every other global economy. And I think we have to think about this seriously because unfortunately there's a lot of people who don't want to see America succeed. They're just like that, even though we're nice people. But so it's pretty important. It requires some harmony and requires some data sharing. Junay is the long president and CTO of Vidder talking about the cybersecurity, cyber warfare dynamic that's happening. It's real, it's dangerous, and our country and other countries need to get their act together. Certainly I think a digital West Point, a digital Navy SEALs needs to happen. And I think there's a great opportunity for us to kind of do some good here and keep an open society while maintaining security. Junay, thanks for sharing your thoughts. I'm John Furrier with theCUBE here at Palo Alto. Thanks for watching.


When I back my horse up, I just think of like I'm pushing my chair back. And that's interesting because when I go forward, it's similar, I sit up, but now I bring my seat forward a little bit like I'm pushing a swing. I would like to make it his idea to trot. I would like to make my idea the horse's idea. Have you ever heard that phrase? Make your idea their idea? What does that mean? Well, fix it up so good, the horse thinks they came up with the idea. If you're a good salesman, you can do this, right? We call it planting a seed. So here we go.  He goes, holy smokes, Jack, I can't walk this fast. I said, I'll just keep on going. So notice how fast my body's moving and he starts to go, holy smokes, this is hard for me to do this. And I say, just keep going. And he asked me the question. He says, can I trot? And I say, yep, and I sit up. So I say, yes. To walk, I squeeze release my seat, my thigh, my hands, my shoulders all together. Squeeze, release, squeeze, release. See the effect on the horse. To go, I sit up and I walk him fast and I get wife, energy, energy, energy. And then I sit up and my horse goes, cool, I get to trot. If I trot really slow, his ears will start to come back on me and he'll ask me a question. He'll say, this is pretty painfully slow, Jack. Could I walk? And so watch these ears. Those ears will start to come back a little bit on me. See, you see that? And he goes, can I walk? And then what I do is I go back to swing, back to front, back to front, back to front. Walk motion. So I say, ride with the body feel of a walking motion. This is it. Body feel of walk. I shorten up the rain. I walk faster. I sit up like I'm being lifted up to the ceiling and he trots. I'm not going back to front, I'm going up, down. Now, when I post the trot, do you see me rise and sit? You see that, right? I'm posting a rising trot, as we say. So I'm working this rising trot and it's very much up and down. Very much up and down, up, down, up, down. See, there's no back to front to this whatsoever. It's all up and down, okay? If I wanna walk, I exhale, I breathe into the saddle and I swing. I'm gonna play with this and make some transitions. Here we go. I'm gonna work them. I'm gonna make sure that we're walking. I'm gonna get his life up. His energy level up. I'm gonna get him lively, sit up and we trot. And I'm gonna walk. And watch how I do. And we trot and we'll walk. And we'll trot. And I'll just work some movements just to get him thinking and warmed up. And I'll walk. And I can halt, squeeze release, squeeze release. I can trot. We'll work this a little bit more. It'll get smoother. And we'll walk back to front, back to front, back to front. Lift up. Trot. Lift up more. Rising. Whoa, that's a canner. That comes later. Rising, move, lifting, lifting. The rising trot is really important because you're able to ride a rising trot all day long. You could do that all day if you know how to do it. So the rising trot is really a big deal.  And you sort of are.  And we call that a three points, three points of contact. But here's the deal.  I don't want you to think about sitting down. This is what I want you to think about.  Let me show you what I mean. If I'm rising, you clearly see me up down, all right? Well, if I just post lower and slower, pretty soon I'm sitting, but I'm still thinking up in my head. I'm still thinking up, up, up, up. I'm not sitting down. I'm sitting up, up, up, up.  But if I want to go faster or more life, I go up, up, up, up. And he comes up, down, down, down. Up, up, up, down, down, down. And walk, swing, following, following. So the walk is very different, front to back, front to back. The trot is very much up, down. The lope or the canter, well that is what we call an offset. Pelvis, sit bones. So instead of my sit bones being square, they're offset. I'm going to exaggerate it just so you see it, but don't do this normally.  And so pretty soon we work this. And so what I'll do is I'll teach my horse, I'll get him a little lively, and we'll walk, and we'll trot, and I'll walk, and I'll go back and forth, and just get him real smooth back and forth.   And I'll work this for a little bit. We won't canter a lot here, but I'll work this a little bit. So now I think about taking a right lead in my right sit bone sort of up and forward.  So cantering, I slightly take the lead myself. So my seat and my hips are what we call offset. The German term Creutz aids, invisible aids. It's very interesting. When I use my hands, y'all see it, don't you? When I use my hands, and I do, you see me, don't you? You see me use my hands. When I use my leg, you see me, right? So when I use my seat to halt or to rein back, or to turn, or to depart, or to come back, it's not as noticeable, is it?    Well, when I back my horse up, I just think of like I'm pushing my chair back.  Remember, pushing a swing on a swing set.   I always wondered when people say ride with your weight. It took me a while to figure out what does that mean? And then I realized what they meant. It's where you position your weight. So the way I sit for a right lead is very different than the way I sit for a left lead, which is very different than a walk or a trot.