I was gonna go say something and then I didn't think of anything cool to say We are here And all we're all going to haunt right? We're so early. How much longer do we have? Two hours actually it's an hour 58 minutes. Okay. Well, we're about to go do our tradition. So our tradition as a group which You know about Jake knows about Jacob knows about you never heard about it. We go to popular pizza in between Damn it. What's the thing called? Damn me. I mean me at popular pizza. We're here 30 minutes early and here's the line to get in already I got like some sort of weird line in nature Look hello Okay Haunt just started and already you can tell there's a crap ton more actors this year.  Wow, I see Fifty followers. Hi followers. Hi. Hey, well, it looks like they opened dark ride early Why are you so scared? I don't like jump scares. I don't care I Go check out dark ride immediately. It's the new maze for 2023. I heard it's a lot of animatronics Yeah, so we'll go check it out and we'll see what it's like This one's from not very far so it's gonna be good. You know, it's gonna be good when it's coming from not very far Oh, here's more front gate instruction. I should film I Why are you so scared because animatronics are literally the worst I used to have like it's not I don't like this stuff Okay, but you're afraid of roller coasters. Are you afraid of this? He has never been all you worked for a yeah, I know this one's supposed to be really good It's from not what if I get happens like the bite of 87 and I my head gets by bit and all Yeah Apparently it's really short though, that's what I've heard. Yeah, but but if it's short it could still be scary like the short of the scary I wish I could record here cuz I know you're gonna be it's your first one my first ever Are you serious swear away for corn stalkers? Yeah, wait, but kid, but it's Caden but it's Caden Okay, but I screamed here, but only if there's a lot of noises Yeah, don't Okay, feel his heartbeat does he actually have one That's shocking It's like Okay, I have some good news everyone there's no conga lines this year They're actually said did I speak too soon? Yeah, I spoke just I think wait. Yeah, there's conga lines Okay, they've that must have been seeing if they can get ready. Oh Okay, good, they're separating the separate that's different So they're sending people in groups now instead of a giant conga line through haunted houses, which is an improvement But I'd like to see how that works When the park is absolutely slammed also how scared of you in a one scale one to ten Seven point five that's bull how scared is he Amanda? It's gonna get we're gonna enter the house and it's gonna cut scene to him. Are you scared of these things? That's bullshit Ice cream, I know I'll be ice cream, but you guys won't be able to hear it cuz I wonder when you can't film Like this is like how I felt when I got on the bike for the first time in my life Like I wish I could film in here, but I can't you're gonna die. I will do it. We'll do an after shot You're a liar that was good That was really good that might be their best means they've ever had here Yeah, yeah, that was Amanda was like, oh, and then the ugliest guy just jumps out Oh that was good Okay, I'm not very far and blessed Yeah, I think we should go that way Hey, that's their best maze ever Honestly They are not like that's gonna be good job wonderland that was so good Yeah Well, we're those strings That's impressive Okay, I could I could rant about that ray maze all day That's like the coolest thing as the costumes this year Are so cool. Oh my god. Yeah. Oh Oh If all the mazes are like that this year then it's gonna be really No, we're going we're going to we're going all the ones on this side of the park Anyone else okay, whatever I think what do you think Oh Shit That's not even funny because I see your face and oh my god The store yeah There's a nice photo of shows in an hour. Oh my god. What is the bar look at the bar? Amanda, you know where we're gonna hang out Okay, so we have the Halloween boutique skeleton crews gonna be there look at this bar Oh This is real cute. Oh my god a man. I need it all Me I guess my name That's so cool. Oh look at the skulls this year. I have the one in the back. We're gonna leave from here. This is so cool Whoa look at the hot merch look at the hot merch Oh, that is cool Keep it. Where's their park one? I oh there it is. It's cool It's real cool That's sick. Oh, that's cool. Oh even another one.  That's something you would you have a bite. Oh These are returning Okay, the squishmallows are adorable Oh look at the dead of the day Day of the dead sorry Don't know if it's because I just miss haunt but I'm already be on this alone away The set pieces are honestly so much better than previous seasons Like dark ride is probably one of the best haunted houses. I've seen at this park I'm so I'm super super excited to see what the upgrades are at the other one I think we're how do you say this one correctly? Yeah, so we're about to do this one I've heard really good things about this one. It's an upgrade to the the one that was here Yeah, the skier zone here. It's it's an upgrade. So we'll go check that out You know else we need to check out the fall food menu. Yes And then I man and I are gonna drink later Press of That's so impressive We'll get the costume design Wow Walk behind this Wonderland wonderland we need to talk okay. We need to talk wonderland Cuz that was a huge upgrade you guys remember the scare zone last year. Oh the the flight deck scare zone. That's that I You know what? Maybe I'll be able to find it in old YouTube video. I'm gonna clip the difference Wonderland literally was like set pieces. What we thought you that was good That's gonna be incredible at night and I'm not looking forward to it anyone else notice that the actors are all Really good at what they're doing Up there Yes, there's passion there's like a story going on too. Yeah, that's so cool All the zombie one, oh, yeah, I know this one I don't know. Let's scary a day. I'm being forced to Amanda I'm Zombies 4d whatever this is what is this one called streets of the undead Okay, here we go sledgehammers down Here we go streets of the undead Me every time a new area gets a construction marking There's a lot of actors Okay, so a piece of advice Don't go towards Leviathan at haunt first come towards behemoth area and do all the haunt attractions back here We're literally like Alone which is making it scarier Yeah Oh, we're about to do trick-or-treat street. Here we go. Oh, you hear corn stalkers I hear corn stalkers is like the famous one. Yeah, I don't spirit manners really done. Well Like scary or like the spirit manner is almost universal studios quality. Okay trick-or-treat street Here we go. Okay. This is cute The other person to look the decorations are Oh Is so much better done than I thought Location oh That's cool. That was good And they're not even they haven't turned the fog machine on back here yet Okay, we're about to do spirit manner and corn stalkers. You're scared We heard from people that just did it that it's better to this year and your eyes will trick you Yeah, whatever that means but I'm not like looking around everywhere now. No matter like where I am. I could I Don't know that Yeah Corn stalkers or spear manners What are we doing first spirit manner? That one's better like Okay, here we go cameras gotta go away. We're gonna do spirit manner than corn stalkers Wait, we were in there for ten minutes. No, there's no way. Okay. What'd you think about that one? You were scared worse than dark ride really because they were worse. He means better Yeah, like worse as in like scarier But now they're doing it in small groups like now you don't know because when it's dark ride You can kind of see like when people are getting to this you have no clue and it's like a house So it's like you don't know where to go. It's not like a direct path. So yeah So it's the same as last year, but more actors. Yeah, there's so much actors Really yes, oh that I'm excited for this one wait Cornstalkers like worse. Yeah. Yeah, what is that the wicked witch of the west Amanda do you ever Okay, look for construction marking Okay, okay, here we go we're gonna do cornstalkers Okay, but it's real scary. What'd you think of that one? That's good. It's really good I really like like the sound that like is produced whatever pretty I don't know. I don't even know what you call But it's good, it's really good. I still personally like spirit man or more. Yeah That one the actors were really good in there Yeah, and there's a lot of them Like and they they're all trained super well, yeah, they're all really good so So far I'm gonna say the event is a solid compared to last year a solid like nine out of ten so far nine out of ten When the cranes are small Yeah So we'll see we're gonna go do the cranes the ruins ruins Yeah, and then we got to check out the fall food for you Oh, yeah, that's true like one But yeah, okay, here we go.  Oh Okay, um, hello, this is It doesn't look done it's our new RMC How does vortex have a line Let's go do ruins ruin This one's good this one's universal quality always forget about this one's universal quality In terms of set the time so I got put the camera away, but we're gonna go do ruins. We'll get your reaction. Oh my god Yo, there's all the evening back there. Oh my god Yeah That was so good it got you Oh That one is that one was good that one was good It was even better than previous years nothing changed that there's a lot of actors and they're there's there's so much more excited invested in their roles It was good. I'm out of breath. I'm sorry that second last scare. Yeah, I've been sweating What did it look like behind us? Jacob was like all up on me at one point. I literally had to be like you liked it A lot of people pay for that Amanda Pay for that I'm out of breath. I'm that one was so good. That's the worst. That's the scariest one. Oh, that's the scariest That scared just from the employee. All right.  It's I need to calm down.  Okay, here we go. Let's look at the fall menu This woman Hate on her send her hate. You know how most people get done. Send hate. Send hate. What did you just say about pumpkin cheesecake? Disgusting. Yeah. Oh, what is wrong with you? Pumpkin spices grows pumpkin everything Am I the only one that thinks that What I believe in this type of system the democracy has ruled you're the broken one, okay Yeah, it'll miss Star Wars hairstyle Okay, what is everyone getting food you are sweating have you been scared? No, it's just hot No, I don't think I think hi, I'm getting burnt in sandwich with sweet potato fries Bite into it I Sounds like my ex kidding. I'm kidding. Who the eats the tomato first It's literally just the meat. There's no like no Okay, yeah, I'm like one of those little like influences. Yeah, so how is it? Yeah, there's a nice change from the regular menu They have sweet potato fries. I wanted to try them But they don't have them today Oh, yeah, that's it. Yeah So Yukon's been down for haunts so far and we just noticed there's maintenance workers up there with a little uh headlamp on a What do you call those thing construction hat? Yeah, they're up there working on a sensor for the looks of it cool to see Haunt is so good that I'm I'm eager to go But these little skinny bitches over here are taking their sweetest time eating their goddamn food I haven't even had one beverage.  I need to wash my hands You should have washed your hands like This is carnival This is carnival, yeah, it's a freezing chamber We're about to do the crips. I don't know anything about it But I hear it's very Look at the line for it already. This is the busiest opening weekend they've had In my in my opinion scared. It's a good one. It's a good one So, where's the line? Whoa What's going on here? It's off it's busy like it's busy busy There's like one or two people in that path. Yeah, but it is a full queue for the vibe This is a really like enclosed maze. So it's gonna be scary.  I go on this holy Okay, here we go the crypt about to do the last maze the crypt I Don't feel scared This one like no one I haven't heard bad things about this one. It's like spirit man. I don't like I'm not scared anymore Did he not get scared? Yeah, and I was scared for this one. I feel like I don't know it's gonna be like the same thing Oh, they're gonna drop out here. There's gonna be straw bites Cut to him screaming. Yeah, right I'll get him in the scare zones We did them during the day. Yeah, but now they're fine. Oh, yeah. Oh, just wait cut scene.  Say you see it on television at my mouth So stop you're entering the trip of the day and it's a tribute to the catacombs you say I would assume so the Paris catacombs Oh He heard me It's not scared No one my favorite is that's hard fair maze fair maze damn, this is a different differing opinions Okay, but like what did you think upon it was really good. Was this your first time? No, oh, okay Best year best year though that I've been to yeah for sure best year. Yeah Best year, that's my only year Best year. Yeah, it was really good. It was really good. Yeah, everything seemed enhanced The food I didn't get to try it all but I tried some things. I'll try some more tomorrow. Um I'll be here again tomorrow. But yeah This is what and sunday and there's no hot sunday. Oh, there isn't.    All right. What else can I ask? Um Can you imagine Oh my god. Yeah, I was a good take. This is my favorite hunt ever Okay, um, I can't wait. I can't wait to see next year right now Oh, yeah, the fact that we're keep getting noxious farm mazes. Yes, bring them on Oh, okay, everyone's coming back tomorrow. Yeah, that's just a lot these two weren't supposed to come I was we both live in the same city and we took separate cars to get here They're not very friendly. We didn't know each other. We're going I looked on snap maps.  You know what I say as a store manager. What? What caused that is poor miscommunication Two hours and 30 minutes of traffic man. It was not I took the toll room. So I would go back When that comes out of his bank account at the end of the year You guys could see inside the maces.  Yeah, you screamed like a brendon Like a brendon. Let's not forget the brendon falling foreign stalkers Did I fall?    Anything else to talk about? The actors were amazing. Yes. Yes. They're honest is so well trained Okay, we got endless my arms hurting from holding the camera and vlogging ages Actors are doing great Keep staying in character when you're moving around the park. Yeah, it was great. Actors like from break the thing They were always in character. That was cool to see Honestly, like a really good energy And it was busy for the first time ever in history for haunt's opening weekend Um, so the park must love that.  You see well Yeah, it's well. Okay. Let's film the exit There's one man standing We're all here now


Another angle on modern power. It's very meta. It may look pretty simple. It's like like Trump uses third-grade language and repeats himself all the time and can't seem to find his words. Really, you want to encourage him to like use his words properly. But he's busy using mainstream media and new media all sort of synergistically together. The GOP built an echo chamber over the last 30 years actually invested in AM radio AM talk radio and and basically creating think tanks in a series of ways in which they can take and amplify any kind of message. And Trump understands this dynamic. Now the press and the left and everybody else seems to take Trump at face value. They take seriously everything he says. Selena Zito put it beautifully in her article in The Atlantic. The press takes Trump literally but not seriously. His followers take him seriously but not literally. That's super interesting. Trump is in a meta dialogue with his followers. There is an inside joke going on where every time Trump pokes at somebody those people froth up and go into a rage at justifiable rage. They've just been provoked, insulted, targeted, beaten a whole series of things in full public view now by the president back then by a clownish competitor to become president but now by the president. So Trump understands that he provokes them. His followers understand that this provocation is completely intentional and that frothing of the recipient of the abuse disables them, neutralizes them, makes them incapable of actually being in the arena and participating in what is going on at the time. This is really interesting. This is subtle, new, different. So Hillary needed to go meta some. Now Hillary was the wrong candidate for the Democrats to field. That's a whole different, longer discussion but in the second debate when Trump is busy stalking her, instead of training up on the topics and issues that would win a debate, Hillary should have trained up on bully interventions and she should have stopped, turned to Donald and said, Donald, you're a bully and we all know you're a bully and then taken steps through what you do with bullies and gone meta and talked to the room, talked to the audience and said, is this what we actually want? Do we want to be subject to a bully? Might have helped. But Hillary was incapable of going meta. She was taking this whole process as a serious political campaign, not Calvin ball, not a game that could be invented and reinvented, shredding the overton window of what is acceptable to do in all different directions. Many people had super useful analyses of Trump's behavior in the run up to the election of 2016. One of them was Scott Adams, the author of Dilbert, the comic. Adams was really perceptive on this. He looked, he did a piece analyzing Trump from the persuasion or seduction community perspective. And this is a community you can find all over the place online, on YouTube, on wherever. Basically, men trying to get laid, of men trying to figure out, how do I use neuro linguistic programming or other kinds of strategies short of drugging somebody? How do I actually make myself so appealing that somebody will go home with me? If you look at what Trump was saying and how he was saying it from those perspectives, from comes out looking like a genius, the constant repetition, very simple language. My friend Al, a week after the election in 2016, asked me so. So Jerry, what was Hillary going to do on inauguration day? And I looked back at him and I kind of had a bit of a glazed look in my eyes, I'm pretty sure. And I said, I don't know, make sure Pell grants don't go away. Double down on the Kyoto protocol, I'm not sure. And he said, so tell me what's Donald Trump going to do on an inauguration day, which at that point was still a couple weeks in the future, mercifully. And I said, well, he's going to build a big, beautiful wall, he's going to block Muslims from it. Oh my God, I have memorized his program. So from the persuasion community's perspective, Trump comes out looking pretty good. All of this conversation about modern power and meta dialogues and inside jokes brings me to a point about Trump supporters.  They're not.  And he happily wears those badges because it causes everybody else to go into such a froth. But a lot of people are the same people who voted for Bernie Sanders or would have voted for him had he been the candidate. There are people who agreed that the system is broken and rigged against them. They really wanted the system broken. If you've heard of the jobs to be done framework, people hire things, people, objects like milkshakes for a purpose. They're trying to find something that will sustain them through the morning that is slow to drink, for example. And while they're in their car going from job site to job site, they can kind of slurp on that's that's why McDonald's suddenly realized they were selling a lot of milkshakes. Well, what job did people hire Donald Trump to do? I think they hired him to shatter the existing government. And far as I can tell, he's doing a pretty reasonable job of it. He's doing a reasonable job of breaking it. He's also doing a reasonable job for conservatives. Donald Trump is the best conservative president in memory. Can't remember one that pushed through as many things did as much for the conservative cause. Certainly the Supreme Court, the idea that Merrick Garland was postponed into the next administration never made it onto the Supreme Court, which ought to be punishable as a crime, but it's not because we have norms, not laws on these sorts of things, which galls me. But we're basically in a completely different game at this point. And to Trump's supporters, if he happens to enrich himself in the process of breaking the government, that's fine. I don't think they particularly care. It's kind of cute they know Trump in a weird way is like Las Vegas. In air guitar, there's the first chapter is a pay in to Las Vegas, which the author claims is the most honest city in America, because what you see is what you get. And Trump in a weird way is like that. The things he says are kind of how he goes about things, even though there's this dual dialogue going on. But what he's presenting, if you understand the full the full loop of it, is like, well, okay, guess I'll let him go ahead and go ahead with that program. It's really a horrible thing to behold. And a fascinating thing to behold much like watching a train wreck, except it involves our actual real lives.


ac nid yw'n gwybod i'n meddwl i'r hynny. Gwylwch yn ddod. Rwy'n gwybod i'r stori y gallu gwneud hynny o'n gwybod i'r parysan GYMAN ac yn fwy o'r Arion Rabiot, sy'n ei wneud, yn ymddiol, ac yn ymddiol busnes, mae'n gwybod i'n gwybod i'r parysan. Mae'n gwybod i'r parysan, mae'n gwybod i'r parysan, mae'n gwybod i'r parysan. Mae'n gwybod i'r parysan. Yn deall, mae'n gydig o'wbeti'ch ymddangos y pцы i wneud am un neslud eithaf a gwneud di gwaith, Anything. Un nes mums being very public about this she's done an interview with Liqueyp in France. Liqueyp? Liqueyp? Liqueyp liquid. Your not really telling me off to say something that this is incredible. Incredible moments, phrase this, play it back. She's done an interview with them and in it she says Aryan was punished or criticised for Mae'n gweithio i gyd, ond ymglwch hefyd, rhai i'n elements yng Ngwyllprif, mae'n gweld rhai yn ymlaen i'r bod i'n rai wahanol, mae maen nhw'n ddweud gyda'r rai oherwydd ond yr wynau gallai ratio'r rai oherwydd yn hwnnw, mae rai o bobl yw rhaeth beth, mae'n cael cyfan hanesol yn y tiynau yn y cyfech chi'n fddai'n gweithio yn y braf Brexit, mae'n gweithio'n diogelion hwnnw, mae'n gweld o'n pawb gyrach... Mae'n gweithio'n digwyddol, Llanig haf yn ystod yn y gallu cyflym o'r hanesol yma Allan. Mae ffobr iawn i'n edrych na wahanol mae'n hoffa. Maen nhw'n gallu y dychwil a wedi ffobr sgol. Mae yw'n meddwl llawer o'i gallu sylwag. Mae yw'n meddwl i lŵr yn digwydd y ffobr cwrdd. Emory, Emory's already mentioned it hasn't he's already said that the power of the club was all with one same player rather than the manager and you know if the plays are affected as well It looks like another one might be up the door as well But if the plays are affected as well, the plays won't be asking the question won't they, they'll be saying you know what do we do here, where's the team and then how's there going to be a team spirit and there'll be a split in the dressing room And how's that ever going to be conducive to winning you know a champions league, a top prize like a champions league so if he's coming out and it's being said publicly in interviews then that's a big problem and the problem being though is Parasandre might not probably just write it off, well you're leaving the club, you're this, you're that but I still think at the highest level you still need to have that team spirit, that camaraderie to get through situations which they don't seem to be able to get through They don't seem to be able to get past the stage they've just gone out in or say they've not passed the quarter finals so I mean is there a case for as club rules Neymars injured so therefore he's no use to us at the minute so we can go off and do what he's doing but Rabio you are still part of this squad and we have rules that you have to beat this team meeting at 12 o'clock so that's your job you are waiting for this club so why should you turn up 6 minutes like But if you're a player and you see a player obviously you must be getting special dispensation to be half way round the world then that is going to frustrate you isn't it? Listen that's not going to be the only thing is it, that's the tangible thingy of each one of the things that he sees every day in training and that must leave a you know what I mean listen Barcelona is a fantastic opportunity for the lad but why doesn't he want to press on Why doesn't he want to? Does he not believe in the project enough? Listen I know it's Barcelona and I'm just saying no but to become a team like Barcelona you've got to be able to keep your plays that you can't be losing it You're never going to get as good as another club side if you're losing your players to you so this is what we've seen this in this country with Arsenal


What's that? That's right guys. Finally official. Alright guys, what is going on? A lecture for an empty journey helping you succeed on your medical journey with less stress. Now as you can see from the introduction, I am finally a medical resident and that actually inspired the title and topic for this video which is what does that even mean? And not only did it inspire this video, but it inspired a whole new series that I'm doing for you guys which is called Ask a Resident. And this series is going to be dedicated to help answer your most commonly asked questions to help you understand what it means to be a residency. But as a quick introduction because I know a lot of you guys may be new to this channel, my name is Luxe. I am just starting my first year as an internal medicine resident and I just finished medical school about two months ago. But I've been doing this channel which is the empty journey and my blog for almost the last three years helping students just like you learn how they can succeed throughout their medical journey and not to survive. So if that message is attracted to you then go ahead and hit that subscribe button and while you're at it make sure you smash that like button too and make sure you stay till the end because I'll be announcing a giveaway and how you can enter. So let's get into this video which is what is a resident doctor? What does that even mean? What do I do? And with that I'm also going to help you answer some other questions you may have which is what's an intern? What's a fellow? What's an attending? What's the hierarchy? How long does this go? So many questions I had it to but you may avoid asking your classmates in the fear of looking stupid. So I promise you'll answer those questions and then you'll look like an expert. So let's get into the video. Let me first start by explaining kind of the structure of the team and the hierarchy because every job has and it's no different in medicine. So in residency you begin with a hierarchy which usually begins at the bottom of the totem pole being the med students and it starts with a third year med student and then the fourth year med student. Right above them and at the start of residency a first year resident is called an intern. So that would be me since I'm just starting. Above that would be just called a resident or an upper level and then if you finish residency you choose to do more training in a specific field.  So for example, let's say I did my internal medicine residency and I said I really like cardiology. Maybe I want to do that for the rest of my life. I can't just become a cardiologist or a willy nilly. I have to do more training just in cardiology. That's an extra three years after residency and so that's what it means to be a fellow. You are training just to be cardiology oncology. There's a lot of different fellowships you can do. So again, medical student, intern, resident, fellow and then above all that supervising everybody is the attending. These are people that have been in the field practicing medicine for several years if not decades and they're brilliant at what they do and they're supervising everything that the fellow is doing, that the resident is doing, the intern is doing, definitely the med student is doing. So that is the basic structure to help you understand. So the first year of residency is called your intern year. Still residency but you're called an intern and the next year I'll be called upper level or resident. No one claims you're silly but basically that's what that means. So let's get into the second part of the question which is is a resident doctor even a real doctor? The answer is yes. You know I am a medical doctor. I have my MD when I finish medical school and I can practice medicine. You know I can prescribe medications, I can do procedures, I can diagnose, I can manage, I can discharge you. I just need supervision during residency because during medical school I learned a little bit of everything. I kind of dipped my toes in pediatrics, neurology, OB-GYN, internal medicine. Every student does that but once I decided that internal medicine is what I wanted to do now I'm basically learning just internal medicine and so I get to practice as a doctor but I get to do with the supervision of my attending. So while I get to sign the order for somebody to get a specific medication the attending is making sure that that patient is not getting the incorrect medication because I just don't have enough experience here and there. So am I a natural doctor in residency and the answer is absolutely. You're doing everything a doctor does.  Now hopefully that helps any of you guys asking what in the world is a medical resident anyways but I know you probably have more questions and so that's where the giveaway comes in. So I'm getting away my top three selling books which you guys can go ahead and check out the link right here. I'll put a picture right here too. For free for anyone that comments and just puts a question for the future videos in this series. So remember it could be anything simple complicated but anything that'll help me give me ideas on what you'd like to know and as I go through residency you know I'll be more experienced to be able to answer some of the basic questions. I have a list of videos I'll be making for you guys anyways but definitely drop your questions in the comment section and if you enjoyed it make sure you give that video a like. Go ahead and subscribe because the videos are coming out at least on a weekly basis if not more but thank you guys so much for being part of my journey. Hopefully I've been a little help to you on yours and I'll see you guys in the next one. Take care my friends.


David, a win with the black pieces against Nuand. Tell us what happened. Okay, it was a tough game because after the opening I was slightly worse and then I equalized but it was hard to play such a position for the win and my young opponent played quite well until a certain moment but he was spending a bit too much time and in the end he got into a time trouble and his position deteriorated. He lost the point for some compensation and his position was probably still alright but having too little time he felt to find an adequate defense and I managed to win. Right now in an open tournament playing with the black pieces it's always a bit of a challenge to create chances. Yes it is but I'm used to playing with black pieces for the win. I mean sometimes it works, sometimes it doesn't but it's just normal for me. Now two out of two, a good start? Yes it is a good start particularly compared to the previous year when I lost in the second round. Right well we wish you all the best for the coming rounds and we look forward to seeing you here again. Thank you very much, goodbye.


All right, we're going to get this started. This is a panel of Keystone experts that are going to talk about their experiences with Keystone. Vess and, well, except for you, Jesse, their experiences with public and private cloud. And so the first thing I'm going to do is quickly give them just a very brief amount of time to introduce themselves, their role, and how they deploy Keystone. So the first person I'm going to look to is Matt Fisher from Time Warner. Matt, why don't you talk to us about your role and how you deal with Keystone? I'm an engineer at Time Warner Cable. I started working on Keystone because we needed someone to work on Keystone. It's not a lifelong passion for identity or anything, like some of the guys. But basically, we run a private cloud for internal use at Time Warner Cable for software projects, basically. And we currently deploy Keystone in Docker containers and run it on top of Uwiski. But I've gone through several iterations of that to get to that point. OK. Please, Morgan. Monti, if you could take the mic and tell us your role with Keystone. Hello. So hi. My name is Monti Taylor. I deploy Keystone between 10,000 and 20,000 times a day because I'm involved in running the OpenStack infrastructure gating system. I also work for IBM where they have strangely titled me Distinguished Engineer. I have no idea what that's all about. And I'm there involved with the public cloud deployment effort. And I'm also a consumer of Keystone in that I work on client library things to talk to OpenStack, including the Shade Library and the Ansible modules that use that. And also weirdly, I'm a core on Keystone Auth, which clearly is a mistake. Our next panelist is Jesse Keating from Bluebox and IBM Company. That's right. So yeah, I'm Jesse. We're still Bluebox for the next couple of weeks, I think. Congrats. Bluebox, comma, an IBM company, seemed to just be IBM. I am the OpenStack lead for our private cloud as a service product that Bluebox brought to the table. And in that product, we utilize Keystone. So I don't install it as many times as Monty does, but we do install it quite a few times.  So yeah. Excellent. Next, we have Dolph Matthews from Rackspace. Hi. I work in, I guess I've been working on Keystone for about five years, spent most of that time working in the private cloud group at Rackspace. So I get poked and prodded and stabbed with questions and problems from our support team all the time. And I've spent just a little bit of time in the public cloud side of the house, which is now all under one big umbrella. OK. Next, we have Steve Martinelli. He's Keystone PTL. Yeah, as Brad said, I've been working on upstream development in Keystone for about three years now, maybe a little bit more. And I'm the current, I was the Keystone project lead last release and for this release. So I'm here for more of trying to defend Keystone from all the shanking that's going to go on between these guys. Yeah. OK. Yeah. Excellent. So I do have a large number of questions and I could easily keep us afloat here for an extended session of three to four minutes. But before I do that, it had been advised to us that we really wanted to open it up first to questions from the audience because we want to hear those questions first. I do have a list that we can go to if we need them. So we do have microphones. And as motivation, we've got three free books. The first three people who ask a question, each person gets a book. And then for the rest of you, you can get them at the IBM booth. And they're signed. We will sign them after the session for you, sure. Some of these guys that do do an author can sign it as well. So please do not be shy. In all seriousness, we have a lot of Keystone experts here and this is the time. Oh, right. Go ahead. OK, you want to take this one? But I might be on now. I think it's all right now. Try it. Yeah. So my question is less specific on Keystone and more specific on management of Keystone, I guess the question I'd ask. So Keystone lets you define users somehow, right? And I don't really care how, whether it's a directory or you have them in the local database. And you define roles. But how are folks managing who gets into that? Who gets into those roles? Are you using an external IDE management system? Is there some poor admin running on a wheel just adding users as requests come in? Is there a need for an audit trail? Stuff like that. So I'll take this one. I think this answer is going to vary across because we all are doing vastly different things with our clouds. So in our case at Bluebox, what we provide to our customer is the entire private cloud. Our customer gets the whole thing and they get a certain level of administrative rights on it. They don't get full admin because we don't want them to do silly things like delete a compute service and pay just in the middle of the night or create networks that loop each other and take down parts of the data center. So they get some level of rights and that does include the right to create tenant projects and users and assign them roles within Keystone. We don't allow them to create the admin role or assign the admin role to their users. But beyond that, we sort of wash our hands of it and say, it's your cloud. Do what you want. Some of our customers do want to back it by an LDAP and have us assign that to a domain for them, in which case that's all managed by them. The vast majority of our customers though are doing whatever it is that they need to do to stuff the users that they want into the localized Keystone database. So you're saying that it's more ad hoc. You're not running into customers trying to use like Oracle Identity Manager or something to that effect to try and manage who has the access. It's more admins pushing users into roles rather than some kind of automated process. Right. We guide them. A lot of ours are first time cloud users and so we guide them on what to do. And our product hasn't necessarily had the feature that they would allow for some of the deeper integrations. But that has been a request from many of our customers to, as we grow into the enterprise space, to be able to tie into their existing identity. And the direction we're going with that is you slap an open ID exposure on your identity service. We'll tie into that through Federation and off you go. But the point being that they manage that side and we just manage the trust and beyond that. That's it. Anyone else want to answer? Yeah. I'm going to, the way that I, the model that I like, so one of my roles is that I go and I beat up on all the public clouds that are out there. And there's a bunch of different models that people provide me as a user and consumer. And the model that I like the most for this is similar to what Jesse was just talking about, which is that as a customer of a cloud, what I want to get is I want to get a domain admin account. And then I want to be able to create as many users and projects and map those users to roles as possible. Then personally, the way that I do that is to manage those users and roles and projects using Ansible. That might have something to do with the fact that Shrew's here and I are the maintainers of all of the Ansible modules to manage opens at clouds. So I'm going to probably use those. But being able to have a playbook for my cloud that says, I want these users and these projects and I want these users to have these roles and these projects is really useful. In my particular case, in this, if I have that domain admin ability to do that, rather than it being about me managing for all of the users, say, in my organization at work or something like that, each of these are more likely project specific. Here's the project I'm creating in Keystone that I'm going to stick my control plane services in. Here's the project that I'm going to stick this dynamic pool of nodes in. Here's the project that I'm going to stick my mirrors. Things where I want to make sure that there's some service level privilege separation. But it's actually I'm the human that's actually operating all of those users and roles. So there's a, it's not exactly the thing, but yeah, that's sort of my thing on it. Anyone else want that? I'll go ahead. Ours is similar to Jesse's, except I think you're doing yours for separate companies, right? So ours is separate project teams. So one project team might be running a website and the other project team might be doing some kind of support function. And so originally when we started, and no one's really using it, we just tell people just file a ticket with us and we'll make you an account. That didn't scale very well because the first thing we found out is they got an account and then they would say well now what am I supposed to do?  You know just like basic bootstrap.  And we were doing a lot of Gira tickets. So we introduced a concept, I think it's called a project owner. So the tech lead on your team might be granted project owner and it's a special role and we have special code in Horizon actually so that if we have a new team member join that team they don't have to talk to us, they need to talk to someone on their team and say hey add me in here, give me an account. And then that person gets a limited ability to control what that person can do. For example we control who can use our LBAS service. Or we wanna know who can use it. So by default you can't but if your tech lead on your team says yes you can use that or you can use heat. They deal with it themselves and they don't call us and they don't file tickets. It's way more scalable but those are all sort of it's basically custom Horizon code that handles that. And we still have all the bootstrapping stuff in place for times when we need it but we've tried to outsource that away from us. Doesn't make sense to have a ticketing system involved in getting started with OpenStack. You're good? Okay. Cool, thank you. Come up and get your book. I actually already grabbed one from the idea. We'll just recycle it. Next question. I'll just check over here. Go ahead. Hi my name is Krishna, I work for Cisco and thank you so much for your contributions. It's been useful in every day of my life with Keystone. I have questions specifically on Federation. I have been trying out Federation ephemeral user based authentication and I have been successful in that. I have three, four questions on that. The first one is, when is the CLI based support for ephemeral users are gonna come? Thanks. So the CLI support for Federation is tricky because they are primarily browser based. It does exist in some fashion. It's just specifically the problem lies on OpenStack client needs to migrate off of the Keystone client code and start using the Keystone off library now. Once that happens, which is targeted in just a few weeks, we have prototypes of it, but once that happens it should, there are plugins for both OpenID Connect and SAML and ADFS and you just have to configure your identity provider to expose certain features that'll allow for the redirect to happen. Sometimes in Newton? What was that? Newton, you wanna know if it's Newton time frame? Oh yeah, yeah, for sure. Okay, cool. Second question is, why groups in the mapping instead of direct projects? I mean, if you needed a group to map the identity provider, you could have a group and then I can directly map the projects. Thank you, because I was so happy that someone would ask a question that Dolph would have to answer, so thank you. That's a book, that's a book. Yeah, that was basically a technical design limitation that we dealt with. So shadow users, which we implemented over the past release and we'll continue to work on in Newton, we'll totally alleviate that. So I told kind of level side everyone, if you set up a identity provider today and are federating users into Keystone, the only way you can assign them authorization is to map them into groups and you do all your authorization management on the groups, not on the users themselves. So the way we're changing that in past release and next release is we're going to be shadowing all of your federated users into the local identity database so they can treat all users exactly the same. They're all effectively local users. It's just a matter of where you authenticated to get into the cloud in the first place. So you'll be able to assign roles directly to federated users, put users into arbitrary groups after they've already started using the cloud and so on, so changing. Would that help with auditing in any way, having the shadow identities or? That's actually something I want to talk about at the summit. Excellent, well we'll all wait with beta breadth then. Okay, I must have probably regarding the groups might have bumped into a bug basically is if you have multiple groups, it works through the Keystone Manage by actually checking the mapping but when I do the actual federation, the list of the groups that you're unicode you, it's actually, it becomes a part of the list. So when it tries to iterate through the groups, it gets both the groups or multiple groups together and that's it. Maybe I can show you that after this thing. Yeah, file a bug. I did actually file a bug on that. My last question is, why is- It's still hasn't turned out yet. Why SSO redirect HTML at the last stage to give downscope token back? Isn't there a better way to do that? Can you repeat the question one more time? During the federation flow, the last stage you have an HTML file which actually puts downscope token to give it back to Horizon. Why is that? That was really the only way we could get it to work between Keystone and Horizon and that's what the CERN guys were using as a workaround in their deployment. Is that secure? That's probably my question. Is it secure? Yeah. They're all bearer tokens. It is just the ID. It is a bearer token. It is a- The fact that it's HTML will make it less secure. Yeah, no. All right, that's all I had. Okay, now have you already gotten a book? Yeah, I did. Okay. See, I knew I would need three. Oh, well. Okay, it'd be our pleasure afterwards. Okay. Do we have another? Yeah, sure, so it's on federation again. Sure. I'd maybe like to get the view of the operators, how they see deploying a federated Keystone at scale, perhaps, if there's any sort of, if they have any experience of that or plans to do that. So we're not at scale. What is at scale is my bar tab from trying to implement federation. It's a bit rough to get all the pieces together. So in particular, our method of operation is to automate everything. If we can't put it in an Ansible Playbook, we don't put it in the product. And trying to automate the dance that has to happen with federation is difficult. We started and managed to be part of the demo at Vancouver for a Keystone to Keystone Federation where we just acted as a consumer from somebody else's identity. And that was pretty handcrafted to make the demo work. And we scrapped the, adding it to the product, partly because a lot of the user-land tooling wasn't ready yet. It was raw HTTP calls that we're throwing at Curl to get things set up. The landscape is better now, and that's why we're looking at it again, but it is still quite a lot of moving parts to try and automate a thing that we can just stamp out over and over and over again, provided the right input from the particular client. So I don't have much of a better answer for you than that, except that in six months, we should have a much more detailed answer there. The IBM's public open stack that we're in the process of sort of rolling out and getting up is going to be both at scale and using federated identity. So there's a team working on that literally right now. So I don't have a great sort of succinct answer for how that's working out, but in six months, if you join us in Barcelona or in 12 months, if you don't want to go to Barcelona in six months, which is a mistake, they have lovely food in Barcelona, but in 12 months in Boston, there should be some really good feedback from that at scale and some lessons learned from that. Okay, hold on. I can totally add to that. So one of the problems that you're going to run into trying to operate, say, a lot of identity providers at scale, like I'm assuming that's what you mean by scale, is actually managing those. Currently, we assume that you are going to use Shibboleth because that's kind of our recommended the fastest path to federation that we had. If you're doing that, and so you're doing that in a public cloud or something, that means you're bouncing all your keystone nodes every time you need to manage IDPs and certs and things, change Shibboleth configuration, and that's obviously a no-go. So one of the things we're prototyping right now, there's a spec that was originally put out around the Tokyo summit, is to kind of reimplement Shibboleth and get it all into Python, so that we can do everything through the API. So that dance that you're doing right now, hopefully we can ease that and make it all pure HTTP. Yeah, no more bouncing. Nice. That's great. Thank you. Oh. We have a taker. Yay. You have made my day. That and if I only had a chair. Who is our next? Anyone else? There's somebody at the mic. Yep, me. Go ahead. So as public cloud operators, do you guys see a need for having, I guess, headless users, like API users or kind of what Amazon has with their instance users? Because I mean, it just doesn't really make sense for some automation scripts to have users that are associated to a human being do some automation. Maybe you'd wanna restrict the roles that those users have or something, right, to do just fetch stuff from Swift or something or those kind of restricted headless users purely for automation. Yeah, so I 100% agree with you. I think that all of the public clouds that are out there, regardless of their intent, should absolutely give you, as the customer, the ability to have one or more users, right? And then you can manage what you want to do with those, right? I think that's like for, in fact, for the applications that I run in the public clouds that I'm consuming right now, in a couple of them, I have the ability to create the headless users that I need. And in some of them, I have to go and create multiple separate accounts each with their own credit card and everything like that, which is ridiculous, right? Like that's absurd and shouldn't be the case. But it's, many of those public clouds have been around since before there was really good support in Heason. So I'm not really picking on them. It's just the state of a growing and fast-moving project. But that is definitely the shape of it. There's also a session tomorrow, I think it is, the instance user session. After this. It's after this, great. Yeah, I think those are also a really, so I've in fact experienced that exact problem that we have in the OpenStock's build infrastructure. We, at the end of jobs, currently, well, some of our build logs go to just a file server, but we've been migrating to uploading them to Swift. But that means that those build logs that we're running on ephemeral nodes need to be able to authenticate to Swift to upload the logs. Obviously, I do not want to give my credentials to ephemeral things that are running code that somebody submitted over the internet into a code review system. The credentials to delete all of my servers, that would be really terrible, but that is one of the only choices that I've got other than there's, you can use Swift, temp URL, middleware stuff, and that gets really strange.  So, I, oh, I'll go first. So, Private Cloud is the exact same use case because our users actually primarily authenticate with their LDAP username and password, which is also controls like where your paycheck goes. So, when you tell them, we have some users that say, hey, I want to use Jenkins to do something really cool, but I don't like my employee ID and password in there. So, we'll create what we call service accounts, and it actually works great for the users. We don't do any role restriction really, but the downside is then when the security guys say, okay, we have these audit logs, but who is this user? What person is behind this? And then it's kind of a complicated question. So, we've tried to tie it back to the project owner, which I mentioned before, and then we also have the same problems with enforcing like password rotation policies, which LDAP does for us, but MySQL doesn't, and you want your MySQL service user password to be one, two, three, four, five. There's nothing currently to stop you from doing that. So, it's caused some security challenges that we haven't quite figured out, but it's definitely something we use all the time. Well, it seems like the instance users is the solution to that part anyway, right? Partially, it depends on what you're meaning by instance users and whether or not they're just short-lived for the moment and then blown away. The AWS way, whereas when you create your instance, you basically say, I want to create a user associated to this instance, which has these rights and it lives on the instance and that's it, right? But those are, that is a thing, but you've got to be able to create that instance in the first place, and so you've sort of got a chicken, so if it's only instance users, like in my case, I'm externally to the cloud running automation that is creating and deleting instances, but I've got to have something that is the user that's doing that, and I don't want that to be me, the human, I want that to be the automation role, and I probably don't want to put my billing account credit card password stuff into the Jenkins, don't put any passwords into Jenkins. And we also might leave the company, and that's running all your CI for your team, so what do we do? If it's tied to your LDAP ID, no one knows your password and that ID is not going to work anymore anyway, so I don't think instance users solves the complete problem for me. Not necessarily, but you can't have it tied to human users, clearly, so there's got to be something that we can, the flip side to that also is that the services themselves need to support some concept of, okay, you are a user that exists, but you don't have rights, and in one of the previous design sessions, it was apparent that a lot of the services just use the are you part of a, do you exist in this project and that automatically gives you some level of right access? So the concept of read only doesn't really exist or read only in some projects and write to a specific. So in Monti's case, he's going to want read only for everything except for Swift. And for Swift, you want to be able to do that thing and that doesn't exist in the policies that the services have right now, but that's a thing that we're trying to fix. But that brings us back to, I was just at the previous session where Adam Young was saying that, yeah, he once had a proposal for dynamic policy creation, right? That would be managed by Keystone or whatever, but point is you could dynamically create policy that would be stored in the DB and that was rejected by the operators, apparently, but what I'm hearing this summit is a lot of operators saying, well, we need a way to create dynamic policy, right? I mean, you guys are saying it, other people were saying it. Yes and no, it's not, but not so much dynamic policy that exists in the database. It's more of discoverable policy in reasonable defaults for that policy that you can override the small amount and see what changes over time, et cetera, et cetera. And the flexibility in being able to, outside of changing the code of the software, make policy changes and how a consumer consumes the cloud. And make it easier to maintain and also to make it discoverable so that I don't have one copy of my NOVA policy with NOVA and another copy of my NOVA policy with Horizon and drift happening, causing very odd things. Paul, can I also want, Paul, can you make it so? Yeah, I also want, well, so I think that the people that wrote the original policies top should be shot in the face, but this is just a terrible idea in the first place, but it wasn't you, yeah. I didn't know who it was, it was, it was what? No, it was. But in any case, the thing that I think that we're missing that is related to that is so we have policy and we have roles and those are the hammers that we're using to hit everything and the thing that we don't have is we don't have ACLs, right? We don't have a way, so like if you go to GCE, right, and you create a, like to create an instance and create an instance user for that, you like you do with other things in any of those web services, you say, this user can create this, not create this, do this other thing and there's like 12 or 14 different things that you can give different ACL things for and we just don't have that concept at all, right? We have roles that are defined in a policy file, you can get a list of roles, you have no idea what those roles can do and you can assign those roles to users. That's hence the discoverability part. Exactly, yeah, so at least if we can get the discoverability of what does this predefined role do, that'd be neat, but if we could have ad hoc, rather than just roles, if we could have ad hoc ACLs, I'd be a really happy person, but then these guys might want to kill me for making their lives harder, so I don't know, you know. We just want policy around creating the ACLs. Yeah, but you want policy for creating the policy? Yeah. That'd be great, yeah. Can we have roles for who can create the policy to create the roles so that your roles can create policy? Who gets admin access from that? You. And another problem that I see and maybe I'm wrong here, which is something I'm not grasping correctly, but you know you have the other per domain back end in Keystone, right? So I create domain whatever and let's say I have ADFS federation set up with that, right? So I'm authenticating my human users against my IDP, which I should be doing, right? It's the right thing to do. But then let's say I did want to create service users for the non-human tasks. Do I have to create them in AD, right? Which is a no-go for us, at least in my company, right? So is there a way to have a kind of a split? I know we could have different back ends, but only for different domains. What if I want to have a different back end within the same domain? And maybe this way, maybe I'm hallucinating. Maybe it's not a problem, but. Hopefully Adam's not here because he hates this. We did ours before, I don't think domains are a thing back then, but we basically have a driver that talks to LDAP and the MySQL. Yeah, we forked it from SUSE's driver a long time ago. And I think eventually we should probably switch to using domains, but I haven't really seen a clear path in what we have kind of works. So service accounts are in MySQL and employee accounts are in LDAP, AD. I don't think so. Adam wants to, yes. The Keystone guys don't really like it, but it does solve our problem. Congratulations, you have brought me the thing that brings me despair and unhappiness in this session. There's always got to be at least one thing that makes me less happy about the world in every session, so. And that's worth a book if you don't have one. I have the book, I have the book, all right. Do you have any other questions? I have a question. Please. I have two questions. The first one is about role assignment. So right now the role assignment, you need to specify a target. So say a group, a role, and a target. The target has to be a project or a domain. And it makes sense for a project level admin, but if I want something like a global admin who can manage domains and control, you know what I mean. And you cannot have an assignment of that sort. And I know that there is this way you can configure your policy files so that you can specify that, you know, specify your admin to a particular domain or project and give them all the powers in the world. But that seems more like a workaround than the right way to do it. So has this concept already been discussed and thought about? Yeah, there was a session just in the other building where there's an open spec for trying to define the idea of a global admin type role. And it's, actually you guys probably can talk about this more than I can, right? The is admin role, yeah. It's a very long running conversation. Yeah, and there's an additional problem of a lot of hard coded code all over a different open stack project with checks for is admin. And that is not actually controlled by the policy JSON file. And the is admin check comes from the is admin context role that is set in the policy JSON file. So that would mean that your RBAC does not completely come from policy JSON file. And then you would have to actually go and fix all those projects to get the actual multi-tenancy concept working. Yes, the second question is a consequence of the first. We all I think agree that we need a higher level admin and a really good definition of it for like global root access across your cloud. And then we need domain level admins below that. We've tackled that a couple of different ways. We don't have a crazy elegant solution. So it's an ongoing conversation. There are other sessions about it. And we have at least a session about that at every summit it feels like. So. Yeah, just to further that it's a huge thorn in our side and it's a huge part of that just because it's backward. We have to be backwards compatible. And I agree the is admin check is probably the worst thing in my opinion. And we do have to go in and fix the individual projects. I don't know if it's we have to do that but someone has to fix them. Yeah. There's a cross project effort around this in what we sort of went forward with is identifying in all the things that use policy to file the bugs against the direct in the code check for admin like that step one, stop doing that. Use policy files instead and step two is to implement the defining a project within your cloud that is the admin project. And if you exist in the admin project you gain global view of things whether it's global admin or global observer or global member you get just some that's your trigger for being global. And then that's a feature flag that either yes you support this or no you don't support this your policy either works as it is today if you don't support it or it breaks if you don't change it if you do support it but there's a way to carry that forward between two releases that you can do the right deprecation cycle. So there's the path forward is becoming clearer at least for me as an operator point of view whether or not the code can be written to match the path is a deeper question. Okay, and the second question I think it's been discussed many times but I would still want to raise it. This is about being able to customize the policies and files. So right now using the rest API you can just go ahead and create a new role but then what do you make out of that role? You would still have to say let's say on a particular open stack installation you're running five or six open stack projects you would have to open each of the policies and file and manually edit each of the rules to actually give any value to the role and then restart all the services. It doesn't seem like a real way to do it. It kind of doesn't make sense at all and that's one thing which customers always ask I mean okay how do we customize it and there's no real way to customize it other than giving more granular control by creating many number of roles which ultimately gets really complex. Yes, everyone's kind of mumbling that you don't actually have to restart services when you change their policy files. They're read on every request I believe. So you can just change them but yes you totally have to go customize all your policy. The session we had earlier today one of the driving goals was to resolve that operator complaint which really came up at the Tokyo summit. Basically every operator is customizing policy to some extent and shares your pain and so we want to get what the community perceives as like here's the conventional roles that we're all using anyway. Get those into all of the services policy files so that you're not having to customize so much and the second half of your pain that you didn't really describe is like okay then you go to upgrade open stack and you've got to resolve the conflict of migrating all of your changes that you customized in the last release of open stack and then applying those very security sensitive changes on top of new policy files from the new release. That's a really delicate process. So hopefully we can resolve both of those things over the next release. And one more question is there are still a lot of projects which does not use the policy engine at all. So for example Swift does not have support for the policy engine and all it does is in the confile you can just specify the roles. So it's just a role. You can just control it based on roles. So that sounds kind of weird that everything is not consistent and you don't really have our back control on a popular open stack project like Swift. Yeah, so it would be really great if you'd give the Swift team the feedback that it would be important for them to do the same things as everybody else in open stack because they take the point of view that nobody cares and that it's not important for them to conform to the rest of things like that and to their credit they usually claim that none of their users request it. So on the one hand I'm being snarky and negative and that's in poor form on my side but on the other hand I'm being quite honest. I believe that the Swift team cares very deeply about their users, the Swift users, not necessarily the open stack users and so the more feedback Swift users can give the Swift team that this is paying for them I believe is actually the feedback that they need like they're waiting for people to tell them that it is important because they're also trying to balance their long time users. They have users that were there before open stack was even a thing so users outside of open stack and very large installations that predate some of these shared services. So there is a cost, an opportunity cost there for them so more communication to the Swift folks I think is the way to help them. Yeah I think it would always be something that's optional if it did support Keystone's policy or the Oslo policy it would always be something that's optional for Swift cause I can't see them not supporting their long time users. So whether it's and it would probably be off by default I imagine because again backward compatibility and all that. Yeah and if I could just add a little bit to that I believe Mike Perez who works for the foundation is looking at things that are cross project consistency type items and I think we ought to try and feed that back to Mike it might be another one for him to track. And just like a theme on that point speaking as both someone who works on an auth project and someone who in other lines of work like consumes off if you have a business case that you're trying to solve and it doesn't have anything to do with auth then you don't care about auth. You go solve the problem you're trying to solve and auth is a solved problem check box is admin true you don't care. So that actually explains like a lot of the historical precedents and laziness around how auth is consumed across not just OpenStack but like in software period and that's just a reality of auth so. Just one more point it should be only Swift that doesn't use the policy if it's not if there's another project that's not Swift that is not using the policy checker or the engine then let us know because. Does Swift have some special probabilities? Would you like your book? I got one from the last release. So six years ago OpenStack started by taking some folks at NASA who had written Nova and some folks at Rackspace who had written Swift and smushing them together into a thing that we then called OpenStack. So most of the rest of OpenStack has basically as it's parent lineage the things in Nova and the Swift team had a running production service that was not, that did not do things the way that the Nova stuff did and again it's really easy to sort of get into sort of a snarky and I really place that they have a very good point. They had a production service running while we were still doing the very early iterations on all of the rest of the services. And so as we were building out the thing that we all think of as OpenStack right now they were running in production a very large cluster. And so as we were getting this stuff going they were like, no, we're in production. And that's admirable. Like that's them actually really, really caring about their users and really doing a good job of that. It is an unfortunate artifact of the way that that worked that we continually have to say things like, oh yeah, and also Swift, right? And that frustrates them too. Like they don't like it when we have to say that but there are some good historical reasons. It's always frustrating when the answer to why is something different? Well, six years ago we were all in a room and 20 of us, blah, blah, blah. And you're like, oh my gosh, that doesn't really help my problem, right? But there's some real non-trivial differences that the cost of solving them hasn't really been outweighed by the pain of the divergence. And so it's one of those things that sort of persists to this day. And it's probably only, like it's not gonna get any easier because there are now a bazillion really big Swift installations out there. It's a really good product, right? And so as we talk, and we have very honest, frank, and deep conversations about these things. Like, okay, well, that's interesting, this thing that you've got here, but how do we roll that out to our billions of massive Swift clusters and we're gonna have a good answer for that, right? So until we do have a good answer for how they deal with that, then that divergence, that historically-based divergence is gonna continue until we have a good story that doesn't involve pain for their operators or users. So on the one hand, I can be snarky, beer, let's go have a beer and I'll rant. But it's actually all very much stemmed in the very strong caring about their operators and their users that I think that is very important. Excellent. And I think we are out of time. We're a little bit over. Oh, audience impression, that's awesome. Wasn't that awesome? That was awesome. So thank you all for coming and the great participation and we really enjoyed the questions. All right. And if you needed a book, we've got two.


Want to live over 100 in a healthy way and enjoy your life free of cancer, obesity and diabetes? Listen up, I will discuss the people of Hansa Valley in northern Pakistan and the Sardinians. That resides in one of the world's longest living people. Sardinia is, if you didn't know, the second largest island in the Mediterranean Sea. Hi guys, I'm Dr. Ahmad Ergin. I'm an anachronologist at diabetes and a metabolism specialist practicing in Florida. Well, if you think about it, people in this part of the world or this part of Pakistan are pretty isolated and they don't have much access to health care. No helicopter will come pick them up and take them to the cat lab in 90 minutes, which is what we are so proud of here in the United States. Hell yeah, we know how to open an artery unless the heart attack ends up with sudden death. And we have chemotherapy that can cost tens of thousands of dollars per month to give a few more years of life to the victim. But wouldn't it be nicer and easier if we did not actually have to deal with the clogged arteries or cancer? Anyhow, let's talk about these Hansa people. They live at a high altitude. They are cut off from the rest of the globe. And Sardinians on the other hand, for example, they're not so isolated, but they both live long. So Hansa people live over a hundred years of age typically. But let's ignore the age for a second because the health is more important than the chronological age. The fact is that the Hansa people's elder generations are in perfect health, vitality, and they are disease free. These folks do not develop cancer. The doctors have determined that the Hansa Valley residents are the only ones who are cancer free, not the rest of the Pakistanians. What do they consume? Right, that's the question. Hansa people eat largely uncooked and plant-based meals.  Fruits and vegetables they eat as well as unprocessed cereals and cheese are the main state of their diet. Did I say cereal? Wait a minute. Well, remember, cheese and cereals made in those villages are not the same as those you buy at grocery stores. Especially if you are diabetic, there is no such thing as good cereal for you that comes in a package. Cheese is great, especially goat cheese. Again, with moderation, excessive eating of anything is the major cause of health problems including diabetes and heart disease. What else do they eat? They eat raw fruits and vegetables throughout the summer. They eat dried apricots, sheep cheese, which is high in omega-3, and sprouting cereals in the winter that they make themselves. They make do with what they have because they are isolated. Most importantly, they do not have access to the processed foods we have in the grocery stores. They eat a lot of fresh foods, mostly fruits and vegetables, and they are mostly vegetarian with occasional meat consumption. Again, nothing against meat, but it is common to see that pattern in populations living longer. They must go also without food for three months. That's a long time. So, calorie restriction for a long time induces what? Autophagy, right? We talked about that. They go for roughly three months without eating and just simply drinking dry apricot juice. Why? Because there are not many options out there. In the Western world, we call that what? Juicing, right? They juice.  The problem with the sugar is that people really over-consume it. For example, they will eat cheese, which is fine, breakfast for example, then they'll eat some bread with it. Okay, well then some juice.  Sorry if I offended anyone with if you're a sausage lover or anything, but I mean after that what do they do? They sit down and watch CNN or Fox to get even more pissed off with the other party, either Republican or Democrat, whichever they hate, unfortunately that's the case here, to raise their cortisol levels due to stress and more anger. Nothing comes good out of that. Of course the blood sugar will be high. The Hansa people do not eat or do any of that. To make that apricot juice, they probably have to walk a while to get to those apricots and use a lot of effort to make that juice because they don't have machines and to finally drink it.  Well, Hansa people do not get any of that. Do they think that they are missing on something on a western diet like these bagels and stuff? I don't think so. They've never been exposed. Do you miss crack? No, because he never tried it. I hope so. Bottom line, fasting and eating for very little part of the year or part of the week, whatever it may be, is what they do. We call that intermittent fasting, right? A quick reminder everyone, put your comments and questions below and that way we can learn from each other. Just follow the community guidelines and be respectful of each other. I love seeing your comments actually and I learned from you too. We will also talk about Sardinians shortly, but before that let's answer another question. What is this Hansa people's secret? Is it all about food? The Hansa peoples, they're content. They're stress-free and they're in good mood most of the time. They appear to have obtained an optimal diet for their health as a result of this setting and environment they had to live in, but one interesting fact is that they also take cold baths, which happens to activate the brown fat, which increases the metabolism. I do not recommend taking cold baths right away, especially if you have heart disease or if you're not used to it, but you can slowly get into it, which may benefit you in the long term.  And yes, genes play a role, but healthy environment play a greater role in making these folks live longer and even look younger. What else? Not only they live and work in the natural world and are quite active, but they walk a lot every day. Nonetheless, nutrition appears to be the key to their good health. Let's talk about Sardinians. They are also known for their long, long longevity and their healthy lives. We refer to those regions as blue zones. What do they do? Well, they eat a lean, plant-based diet with meat as a supplement, meaning that the meat is not the start of the dish. It is more like a small portion when eaten once or twice a week. They also eat whole grain bread that they make, legumes, garden vegetables and fruits, and olive oil. Sardinians also eat pecorino cheese, which is manufactured from grass-fed sheep, and is high in omega-3 fatty acids. Remember that? Similar to tons of people, right? Meat is typically saved for Sundays and other special occasions. They also consume goat's milk. Now, notice, a glass of goat's milk contains compounds that may help protect against inflammatory and aging-related disorders like heart disease and Alzheimer's disease. What else do they do? Well, they drink wine. The amount of artery-cleansing flavonoids in the canal wine is two to three times higher than any other wine. Small dosages of this antioxidant-rich beverage throughout the day that they drink could explain why men, especially men in this corner of the world, have fever heart attacks and they are less stressed. What else gives them a long life other than their diet? Remember the Honsa people? Just like them, Sardinia people also have strong values. They ensure that each family member is looked after. People who grow up in a strong, healthy homes are less likely to experience despair, suicide or stress. The elderly should be honored in these families. Living alone as an elderly person is probably not the best way to live your life. If that's the case and if your goal is to be able to live longer and healthier life, do not be alone. Here are a few words for people that do not have a good relationship with their parents. Listen up. Grandparents can provide affection. They provide childcare, sometimes financial assistance even, wisdom and motivation to help youngsters keep their traditions alive and thrive in their life. All of this could lead to children who are healthier, more well adjusted and they will live longer. This practice has the potential to even increase the general population's life expectancy. An activity is the next thing that I'm going to talk about, of course, that will add to their lifespan we think. For example walking eight miles or more a day that typical Sardinian shepherds do, that's all they need for cardiovascular benefits that you would anticipate, plus it improves your muscle and bone metabolism without the joint pounding marathons that we do hear sometimes, right? Lastly laugh with your friends. The men in this blue zone are known for their sarcasm.  Laughter lowers the stress levels which can lessen the risk of cardiovascular disease. Well I hope this video helped you understand a little more what matters and what makes or breaks to have a long healthy life. Regardless you have diabetes or not, following these principles we discussed will help you obtain a healthier and hopefully a longer life. I hope you learned something today and if you did remember to like, subscribe, share, write a comment and we will see you in the next video. Hey guys I hope you're enjoying this channel so far and I hope you subscribed already. If you didn't do it and if you did watch this video right there I think that will help you too.


The thing where I'm curious and kind of conflicted to is that where do, you know, that unique output that we have as creative, you know, comes in. Anybody today, as we know it, could load a Word document into Amazon and write a book. And then all of a sudden you're an author. Yeah, and then you can pay all this money and be like an Amazon retailer, right? And it's all money and marketing. But what kind of writer do you want to be? Is this really your passion? You're doing it for what reasons? So it comes down to purpose and what kind of artist you are, right? So there's the Van Goghs and there is other types of artists. And I think there's space for everyone, but I think you have to be honest with yourself. I feel the creative process is important. So like for me, I'm always going to stay with being really truthful to your art.