Okay, thank you all for coming. This starts or continues the bicentennial celebration of Fort Allen and we're starting at this cemetery 1812 cemetery There was established in the war of 1812, of course But the British had a very successful fight in Queenstown, Canada And the militia did not do as well and they were gonna do a prisoner swap in Boston We're gonna swap the American prisoners for the British prisoners and the British ship coming down a Lot of the folks on board were sick and they dropped off 26 soldiers At this site what they called Mount Joy at a pest house Which was located resting right here and a pest house wasn't for animals or pasty people It was for quarantines. So they were quarantined here out of the 26 Five survived and went about their business for the rest of their life But 21 of them died right here at the hospital and they were put in a mass grave behind me here Pretty much unmarked just kind of had a little fence around it the Marine Corps League for the women Detachment a few years back Built the cemetery to look like it does now they supported it and got it started The engineers from the 133rd who you read about in Iraq and in the main in Afghanistan Actually did all the construction work and there was donations from the local community But there's 21 marking of stones With the names of the soldiers on them, but eight of them are still blank reading unknown So there's still eight unknown POWs that rest here So it's really a solemn site if you're up here by yourself sometimes just walk down the area It's not as great as visiting the Vietnam wall But it has that same kind of feeling of solace and solitude So I encourage you to experience some time and a lot of people even that live on a hill don't know It's here. So I just thought it was appropriate to start off ceremony here We'll start this off with the posting of the colors colors post We'll now have the wreath laying and the wreath layers will be the mayor of this great city of Portland mayor Michael Brennan In our honorary chair of the Bicentennial Committee bring it our general James Campbell We now have the planning of taps by one of our local Portland high school there in high school combined bare members, Ileana. Thank you color guards post Okay, we're gonna do we'll start off the ceremony I just want to welcome you to the Bicentennial of Fort Allen And as you know, it's 200 years of the militia man this fort at the time It was eight we now have two civil war cannons that the friends of the Houston promenade took care of restoring and The lineage of the fort continues into a National Guards 133 It was a grand marshal today Neighborhood travel around with my father and probably my grandfather too is a longshoreman And it's just a great neighborhood to be into and we have been discovered a lot of those people that From away and those that have a little more cash in our pockets than as they grew up here I've moved into the area, which is really added to it. Of course, but But we'll commence with the the revelry and the raising of the flag Just as the militia would have started their day with the call to duty for the day And we'll have the national anthem played and a little bit of history the national anthem Was of course written after the battle of in Baltimore, Portland, Fort McHenry And it was also published for the very first time in the Baltimore record or the Baltimore paper on this very day in 1814 so really appropriate with the timing and Nicely weather than it would be for the fort, which is actually October. So we thought would have a little warmer than it is today But if the gentleman will please stand remove your hats and be prepared to we'll start revelry. It's a revelry post Flag raising you notice you had to fire boat firing a salute of water in the in the harbor and Most of if not all at least most of the military personnel that you see here today Have served in Iraq and Afghanistan So if you take a moment, wow Look at that, but if you take a moment to chat with them later, it would be good Okay, we'll start off with the the introductions and the fine speeches They were about to be held George Campbell the friends of the Houston promenade president past city counselor past mayor past Department of Transportation and Maine in New Hampshire and all kinds of other good duties and a very good benefactor and a businessman of the city of Portland George is Combinating on my height when I'm standing next to the giant from the Coast Guard at least I can see over the podium and I've I Was all excited when I was mayor because I was in transportation and mayors get to welcome groups in the first group Was a group that came to the holiday in and transportation and international turnpike group I'm all excited and I get there 500 people in the holiday in I couldn't see over the podium. That was my first welcoming But I managed We're so excited to have you here today. We've got some Great people that have visited with us and I just want to say before I began that Among the other things I've done. I'm also proud to say I'm a veteran of the US Navy and Today is about our veterans and the history the 200-year history of this great park and So many people have helped and you're going to hear from different perspectives of those People that have helped us But I just want to say that the city of Portland has stood tall to make sure that this park was brought back and The Friends of the East and Prom are honored to be their partner in helping fund it and restore it Without further ado, let me introduce The governor of the great state of Maine Governor Paula Page and I want to thank him publicly For the work that he and the First Lady have done for our veterans and our service people He's made it a signature a hallmark piece of his administration to support our veterans And our military and all the assignments that they have to deal with and his wife can't be with us today because he tells me She's down in Old Orchard with a POW MIA so Thank you governor for being here and please join us up and look forward to hearing from you Come right ahead She'll podium Thank you very much and good morning and my wife does say she regrets not being here, but she is Doing an event in Old Orchard scheduled at the same time It's a great sets of Maine pride That brings us all back together here today. I Am very proud of the strategic defense role of Fort Allen has played in our history To my family and I there's no greater privilege Than to honor our military men and women They deserve to be remembered long beyond the time they spent with us on earth these flags Flying today Represent the freedom That our soldiers have preserved for us These are the men and women of great courage Who I am very proud to call our American soldiers They and their family sacrifice a great deal for the sake of liberty and in particular in the last decade Many have gone two three four times to war During a decade. I've met one gentleman who's been deployed six times That is an incredible Request that is the country is made on these this family we in future generations are Completely indebted To our soldiers our military all the way back from to the Revolutionary War I want to thank you for dedication to honoring American heroes and a place where they have served With matchless bravery There is a saying that I like to repeat often time at these times in our history It's attributed Sometimes to George Washington, but frankly, I'm not really sure who the author was Regardless it goes like this The willingness with which our young people are likely to serve in any war No matter how justified Shall be directly proportional to how they precede the veterans of earlier wars Where they're treated and appreciated by their neat nation You know, we must remember our past And we must learn from our history But we must also invent the future so that we may live in peace Thank you all here today We'll raise up a new generation of Maine people who will stand ready to continue the fight To preserve the freedom that we enjoy in America God bless all our servicemen and women God bless the great state of Maine and God bless America. Thank you I'd also like to Mention our grand marshal governor Joseph Brennan. Would you please stand up governor? He's a he's a Mungoy Hill boy as you all know and the dirty little secret is when I interviewed for him I came from Brewer, Maine Originally, and I interviewed and I never told him I didn't know where Mungoy Hill was So I got the job and ended up working for him one of the best honors of my life was to work for governor Brennan I'd now like to introduce the the mayor of Portland, Maine our elected mayor Mike Brennan, and I just like to say that Under his leadership with the support of the council the city has invested Over a million dollars to help bring this back this whole area and If you study the history of the park, you know that in one of its key Days about a hundred years ago and Herbal talked better about this to me another mayor James Phineas Baxter had a lot to do with this park and the mayors of this city and the councils and their staff have been Important to this particular park and the whole eastern prom over its history and I'm honored to welcome Mike here today To join us your honor Thank you very much Thank you for being here Thank you all for being here This is a terrific day for the city of Portland and a terrific event and I want to thank the governor for being here I want to thank the former governor and My namesake For being here as well. I also want to recognize the fact that Justin Alfon the Senate president I don't know if he is still here, but he was here Diane Russell who's a state representative from this district is also here Nick Mavidonis a former mayor of the city of Portland and on the city council is here and finally Kevin Donahue who is a city council district representative for the Monjoy Hill is also here and You know George, I truly would be embarrassed to say publicly that I didn't know where Monjoy Hill was But but we'll let you get away with it on this particular day After I'm done speaking We will hear from Herb Adams and at Herb will talk a lot I think about the recorded history of This park and it's important for us to understand the recorded history of This spot in the city of Portland in this park in the city of Portland and the governor has also pointed out It's also important for us to pay tribute To all the people that have served this country and served the state of Maine But I also want to talk for just a second to all of you about the importance of the personal history of this park and The importance of personal history To the tens of thousands and hundreds of thousands of people That have visited this park When I was five years old my grandmother lived on Kellogg Street and My aunt used to bring me to this park and I used to climb on the cannon From the USS Maine and I thought this hill coming up here was the biggest hill in the United States I've now I know it's still a big hill, but it's not the biggest one in the United States I My oldest son was married in this park The first apartment I ever rented as an adult in the city of Portland. I rented from Dan Haley senior right next to the Portland house My cousin proposed to his wife and the bandstand here in Fort Allen Park And I bet there's not a person here That doesn't have a personal story about visiting this park and Recollecting the magic that this part brought to their personal life And that's the part of this history that will never be recorded That will never be written somewhere But that we all carry in our heart and At why this place in this park is so important to the city of Portland so important to Monjoy Hill and Today today Marks the next generation of that personal history That each of us will carry About this park and The people that not only live here in Portland on Monjoy Hill But the tens and hundreds of thousands of people The visit from other parts of the state other parts of the country and other parts of the world that come here and Are smitten and mesmerized By the beauty and the mystery of this park So I'm humbled to be here today To kick off that next generation of personal history that people will carry from this park and Finally and lastly I want to thank Diane Davidson George Mitchell of George Campbell and all the people That partnered to make this possible Because oftentimes People have a number of different ideas about what we should do or shouldn't do as a city But we are greatest as a city when we all come together and recognize a common goal and Achieve that common goal by working together and this is one of the best examples of us all coming together to achieve a common goal and To act as stewards For the next generation of this park so thank you very much for all of you being here and Thank you to everybody that made this day possible well-spoken your honor and It reminded me to say that I was honored to Officiate the wedding of my daughter and the gazebo behind us So I do I have learned certainly where my Joe Hill is having represented it and fallen in love with it along with everybody else It's now my pleasure to introduce adjutant general James Campbell tells me as a Colby graduate the first Army ROTC graduate from there and Mary to a Greenville person where I started my career. So glad to have you here today. Thank you George and I introduced it ourselves to each other this morning and and without him saying a word I knew that he was a great guy because his name is Campbell. I Just want to speak briefly about Something that I think is important about today and that is the importance that we all place on Place and place in history and and the mayor just spoke about that a little bit and the governor spoke about it, too I want to thank the folks who made this possible and restored this park and keep this as an important place Not just for Portland, but for the state of Maine Because of its of its personal history, but also because of its recorded history For us who wear the uniform particularly those of us who were in the main state militia meaning the National Guard These sorts of places around the state Have an emotional importance that that transcends some of the mundane things that we do every day It's interesting if you look out across the harbor you can see the fort that's out there All of you who live in this area understand that that many of the islands out here have lots of military Fortifications on them and if you travel up the coast of Maine you'll see a number of other major military fortifications that still exist and In some cases in not such great repair, but in others pretty good repair Every single one of these locations was manned by the main National Guard at one point or another The 240th Coast Artillery Group was with us. In fact, it's still with us in another embodiment and It it manned these these locations from the 1800s all the way until World War two And Fort Allen is just another one of those places, but it's an incredibly important place for us because of its its Resonance with the independence of the state of Maine that we gained after the war of 1812 Fort Allen was created during that war. It was first manned by Maine militia from this area during that war and As many of you know the war of 1812 is considered by many historians really to be the the war of independence for Maine from Massachusetts that because of the citizens of Portland, Cumberland County, York County and their defense of Falmouth and Portland in places like Fort Allen from the British it developed a sense of Statehood and and a desire for independence from Massachusetts, which did not support the the elements of the then Massachusetts militia That we're here trying to protect Portland This is an incredibly important place and and and as such for us again in the Maine National Guard the Maine militia its places like Fort Allen that we look to as as the The birthplace of the Maine National Guard as an independent institution We have units in the Maine National Guard that predate the existence of the United States but in a sense none of them predate the existence of Fort Allen and and the fortifications around Portland because they are the really the birthplace of an independent Maine militia and Maine National Guard so a great day great not sunny main day Hopefully hopefully it won't rain today, but I want to thank everybody for being here I especially want to thank the band you guys sound great. Thank you very much for spending your Saturday here And I would also be I would make a big mistake if I didn't thank our great color guards from the Portland fire department From the Portland Police Department from our great partners in the United States Coast Guard and Then of course our very own Maine State Select Honor Guard from the Maine Army National Guard right back here behind me So again, thank you to the committee for and to the city for doing this and making this place of Enduring importance something that's going to last for future generations and thank all of you for being here to support this event Next I'd like to introduce Captain Brian Gilder of the US Coast Guard and as he comes up Let's all reflect on how important the Coast Guard is to our community and our area When I was on the council and mayor I got to work a lot with Captain Russell and and to really understand the role that the Coast Guard plays in our day-to-day lives here is It's hard to overstate and so I'm really honored that you were willing to come this morning captain and speak to us So right up ahead Thanks, and I'd say that you know the community is very important to the Coast Guard because we live here we serve here with the modern-day Coast Guard's roots roots connecting back 224 years to the revenue cutter service establishment. We've a shared connection with this community for a long time This fort was built by sea Fensibles which I'm sure you'll hear a little bit more about later, but Fensibles was short for Defensibles and Really that organization Created was created to fill a gap in our country's security and the sea Fensibles were very much like Many aspects of the modern-day Coast Guard When they established it they there was a thought that there are a large number of seafaring men Who from their hardy hood and habits of life might be very useful in the defense of this seaboard? Today the Coast Guard continues in much the same traditions of innovation Layered security and skilled crews with strong connections to the community Noting that we've learned that seafaring women with the same hardy hood and habits of life are equally useful today On this day of bicentennial celebration Over 225 Coast Guard men and women are standing the watch along mains coast and in the Gulf of Maine Protecting the people from the sea protecting the sea from people and protecting us from those wishing to use the sea as an avenue to do us harm This morning, I'd like to especially recognize petty officer Toledo who's holding our Coast Guard incident in the color guard Last night he was on watch in our command center in South Portland and after he got off duty He came over to join our other petty officers and the other Coast Guard and Other color guards to be with us. And so I would like to thank him especially for his dedication And his vigilance. Thank you petty officer Toledo I Congratulate the city of Portland and the friends of the Eastern prom on marking the special occasion We the Coast Guard will remain Semper paratus always ready. Thank you. May God bless America. Thank you very much I've been really looking forward to hearing this morning from Legislator and friend and historian Herb Adams talk to us and help us Really understand the significance of being here today and what 200 years truly means And make it Something that we can digest and understand and enjoy so we'll no further ado the honorable Herb Adams Welcome sir. Thank you. Thank you. Thank you. Mr. Mayor. Mr. Former Mayor Mr. Many governors Mr. Many mayors Mr. Many counselors Mr. And Mrs. Many politicians here today and fellow citizens If we had stood here almost 200 years ago to this very day Around us would be marching troops in blue with black plumes streaming from their hats swords flashing Fipes shrilling and above us the snapping national flag of the United States the 15 stars and 15 stripes of the banner Before us would be the broad blue of Casco Bay and beyond that the British the British Just off Portland headlight The HMS Bulwark the HMS Rattler the HMS Tinnados flaunting the Union Jack just beyond that lighthouse we can see here because they could This is wartime if we were here that day. This is what we would have seen Two batteries dedicated this day one below us on what is called fish point Been erected by volunteers who threw up earth into berms much like these It was named that day Fort Lawrence for a captain James. Don't give up the ship Lawrence a Substantial and handsome marine battery said the Portland Gazette of that day Calculated for 10 guns 24 or 32 pounders so named for the iron spear that they could fire When the name was pronounced the colors were hoisted in a salute fired on the hearty cheers of a numerous concourse of citizens for the new and commanding battery above this one The same ceremonies were held This work writes the Gazette is of a semi-circular form and Subsequently sufficiently spacious to contain eight guns. It has been completed in the course of 20 days by fatigue parties that is volunteers who threw up the earth 20 days and it's lasted 200 years They were super intended by the officers of the Portland see Fensibles these are mariners who joined the local militia and served here The public it is said is indefinitely more indebted to James Deering Esquire of the family that later gave the oaks to the city than any other individual by wealth For money and means to complete works of defense like this We would say to such as scold and fret and prowl about exchange street That nothing gets done by the government. Well, then go there and do likewise Should this remark wrap some of your gentlemen over the knuckles says the newspaper He is perfectly welcome to the hit But we may know many poor individuals or persons of small property who've continued more Toward the defense and the security of this town such as in this fort then those worth a hundred thousand dollars at least Why the name It is not named our fort for Ethan Allen worthy man famous yet But William Henry Allen the hero of that hour so long ago William Henry Allen Born in 1784 Providence, Rhode Island the revolution had been over less than a year and a half The constitution was still three years away his father Was a Revolutionary War general of all Rhode Island his mother was sister to the governor of Rhode Island and Young he went to see at age 14 rose fast Serving on the USS Constitution old iron sides itself and the USS Chesapeake a board which he once Snatched a live coal from a fire to ignite the one cannon his ship had time to fire at the British closing in on them He bore the marks all his life He was alive coal himself He burned with ambition at age 28 He was given command of the United States Brig Argus in the war of 1812 That war was a grim affair the British seized and held a third of Maine east of the Penobscot Boston abandoned us the British burned Washington burned the White House But the Argus shot across the sea like an arrow and took the war to British shores In June July and August 1813 the little Argus did indeed twist the lion's tail From Ireland down to England's West Coast the Argus took 20 ships rich prizes some military many merchant Infuriating the lords in London until it sails into the lion's mouth on the 14th of August 1813 off Wales near st. David's headland It sails into the purview of the Brig HMS Pelican and There William Henry Allen met Captain John Fordus maples The ship was bigger the captain older bolder luckier The Argus crew had been up late the night before Offloading loot from their latest prize and legend says had been into the bottled wine cargo a little When at 6 a.m. With the dawn the pelican closed upon the Argus guns ablaze with broadsides 16 guns that could throw almost 300 pounds of solid hot iron at a single blast and Reload in about 45 seconds That kind of iron broadside would blow your ship to splinters Tear your rigging to rags shred your sails the air Concussion of one of those shells passing near your head was enough to kill you William Henry Allen Four minutes into the fight is struck in the leg by one of those 32 pound red hot cannonballs And it takes his left leg off at the knee Holding himself up on one elbow sprawled in the deck sands scattered for traction from the seawater and the blood He fought his ship until the darkness closed around him and under another officer The Argus demastid sails shredded rigging a wreck was taken into Plymouth, England a Prize now herself From that very port Plymouth, England Allen's pilgrim ancestors had sailed to the United States Or what would be America? 200 years before God bless you Goodbye lads. He said as he was carried ashore We shall never meet again And indeed they never did this side of the bar William Henry Allen died 11 p.m. August 18th 1813 in Mill Prison Hospital in Plymouth, but His story goes on Lieutenant Allen was carried to rest with full British military honors Escorted by two companies of Royal Marines with the Royal Marine Band His coffin draped in the Argus's torn stars and stripes on top of which laid Allen's hat and his sword Followed by the officers of the Argus Be ribboned officials and a large concourse of British citizens To solemn music. He was laid to rest in Plymouth Church yard Beside one of his crewmen the American Eagle was carved on his stone He sleeps there still He was 29 young ambitious Impetuous impatient eager a good artist the only drawing that we have of him on that sign was done by himself Bold on deck. He was bashful in person. He never did express his love for a certain young lady Back in Providence who was waiting for him So he has no direct descendants today a short little street in New York City and This boy by the sea today are all that bear his name You know I cannot find that he ever once saw The coast of Maine or this promontory or this spot It was youth. It was ambition that filled his eyes and filled his heart and something else When you shall hear that I have ended my earthly career He once wrote to his sister and that I exist only in the kind Remembrance of my friends You will in time forget my follies forgive my faults Call to mind some little instance dear to reflection to excuse your love for me and Shed one tear to the memory of Henry Memory is an elusive thing History recedes from us Like a tide like the tides of the Casco Bay behind us The war of 1812 has long passed the gates between memory and history All that there is left of it is here in our hearts and here in this fort And in the work of people like James P. Baxter who founded the Portland Park system in the way We remember it today and all those whose names Appear upon the sheets of paper that you will take home from this event and tuck in the family Bible or put in a book and Find again years from now and say you know I Was there that day such is history and Such as youth such as war and here stands his fort in England Stands his monument it reads there here sleep the brave well here lives his memory as Henry Wadsworth long fellow wrote who used to spend many hours here as a youth Looking out at the bay behind us when this fort was nothing but a romantic ruin a boy's will is the wind's will and The thoughts of youth are long long thoughts Sleep well Captain Allen, this is his day again 200 years after the first God bless America quite something isn't it I Am next on or to introduce to you The director or the executive director of the greater Portland landmarks Hillary Bassett and I'd be remiss and not saying How much? greater Portland landmarks has done for us over the years for preservation in this area and In particular under her leadership For a number of years is brought to the point where this very year The greater Portland landmarks can celebrate 50 years of amazing contributions to our city Hillary welcome up. It's good to see you Thank you everybody. It's a great to be here and Representing greater Portland landmarks which which has a mission to preserve and revitalize historic buildings neighborhoods and landscapes This is to enhance our community vitality and keep Portland one of the most livable cities in America I want to say that Fort Allen is a triumph. I've lived in the neighborhood myself for now Almost nine years and this is really an absolutely stunning project It's an excellent example of historic preservation and the very best practices It's guided by a very carefully considered master plan These this was developed according to national standards for the treatment of historic landscapes It is established a period of significance between 1819 90s 1930 And there was lots of public process in the development of the plan It restores the character defining features of the park and that includes the beautiful cast iron Rodiron fence the coupled gutters the central path the benches the horseshoe drive It embraces newer additions such as the monuments that you in memorials you see around the site It adapts to modern uses. So there's now electricity for the bandstand lighting along the pass The Mugo pine couldn't be given up because kids love to play there during the concerts out here It addresses environmental concerns and also integrates plantings Not an invasive species and that fit well within the context And it creates a place for people for all walks of all walks of life to enjoy It's also an important very important example of a public and private Partnership the city of Portland and the Friends of Eastern prom both have done what they do best The city has managed an excellent project the Friends have provided that amazing community support that really Makes things happen. It's a combination of advocacy nagging and vision that get things to happen and they have done an excellent excellent job They have also mobilized private citizen support hundreds of thousands of private contributions to make this happen Now places like Fort Allen, and we've heard several of our speakers almost all of our speakers talk about how important a place is This is what makes Portland, Maine Different from anywhere else in the world Historic preservation is part of the way that we connect as people to the past live our present and the future Fort Allen tells our story and I think Mayor Brennan said it right on that our personal story is Mixed in with the history that Herb has so eloquently told us Portland is an amazing place and this project and this park are part of our personal history The city's history in the nation's history, and it's beautiful and now here for all of us to enjoy for the future. Thank you You're her. Thank you. Hillary. You've heard Hillary mention how important it is to tie The history through the right landscaping and the right vision to what we have today and the person that really Visioned and shepherded that for us is architect Martha Lyons. So I'd like to introduce now little did I know When I was called almost four years ago to make a trip to Portland to see some old fort that was crumbling and ill repair That I would be coming to one of the most spectacular places on the Eastern Seaboard and Also, little did I know that the call came from one of the most formidable and indefatigable park advocates I'd ever met Diane Davidson Oversaw the design process the selection process got me hired Attended meeting after meeting listened to concern after concern mediated arguments. There were many She's not an ag by the way and single-handedly engineered the funding of this Million-dollar plus restoration project It helped that our dogs wrestle in Alice demand daily visits to the prom and now my dog Who's in attendance today is enjoying it too? But no joking the success of this project and why we celebrate today is largely because of the persistence in the selflessness of this single amazing woman and It's been a privilege It's been a privilege to be involved I'm going to let Most of my the work you see here today really speak for most of myself But I do want to acknowledge a couple of other people First of all so many individuals worked hard to make this happened city employees Girl Palmer consulting engineers who are the engineers on the project Members of the friends private donors the list is really too long to read. I Also want to make two very special Acknowledgements and these are two people who Tend to want to work behind the scenes But are just really the foundation of what you see here today First are you Coleman was the contractor the crew of Bill Bradshaw Rod Coleman the Mason? Scott LeBrecht who did the incredible work on the walkways we built the overlook and the stairs an amazing craftsman and the metals fabricator mccann foundry that rebuilt and Restored rebuilt the original Fencing that you see over at the overlook all of their work was absolutely superb And I felt so fortunate to have them doing the project Finally my teammate Regina Leonard who I think is here I worked with Jimmy off and on for 20 years and her level of skill and design with design execution is just phenomenal Much of the beauty and the attention to these hills that you see here today was because of Regina You never got tired. You never backed down. You never gave up Portland and Maine are so lucky to have you and have such a fine landscape architect in their midst Thanks, so this four-year odyssey has come to an end and It's time to turn the back back to the people to be enjoyed the way its founders and Original designers wanted it to be and with the hope that the work will continue along the prom There's meant much more work to be done and many many ways to get involved, so please do. Thank you Portland Before I introduce our last speaker, I'd just like to thank some people that I work with a lot on This it is the friends of the Eastern prom. We have a very robust membership We have been a board that works hard two members of our board and Doyle and Dan Haley our Chairs of the Bicentennial Committee and have done it just a great job Organizing all of this. I want to thank you so much I just learned this morning that Joe Sikakis got pulled in at the last minute to coordinate everything So thanks for stepping up Joe Thank you all board members. I really appreciate your help I would like to also and I don't know if he's still here, but my dear friend Dick Anderson I was here somewhere earlier this morning brought the governor Brennan with him Dick Anderson any of you that know him know the most impassioned person in your life if you meet Dick and Two years ago at a strategic retreat of the friends of the Eastern prom He said and he demanded that we make sure we don't miss this date of Celebration and we have honored his drive to make that all happen And I'm sorry. He's not here right at this moment, but he has been here and he's been the spiritual force behind this for two years now There's not much more. I could say about Diane Davidson that Martha didn't hit on but I will say this that No major good Project ever in my experience happens without a Champion somebody that lives and breathes it and believes in it and we're blessed We're blessed as a community that years ago. Diane Davidson stepped up put in countless hours worked through every single problem including all the construction issues this year and I'd like I think it's fitting that Diane Have the last word to say this morning and to introduce Diane the executive director of Friends of the Eastern prom Wow Thank you everyone for your kind remarks and comments and for your support The Eastern promenade is truly a sacred landscape James Finney Baxter identified that Olmstead Also identified that and supported it and we all appreciate it Especially today Friends of the Eastern promenade have the honor of being the stewards of this and who advocate for this most sacred landscape We have an amazing board that we work with we have a strong community here on Munjoy Hill and beyond and As George mentioned, we've had an amazing Bicentennial committee comprised of Ann and Dan That chaired that committee to bring not only today's events that you see before us, but last night We had a wonderful symposium at the main Jewish Museum Also, the other members of the committee just want to recognize them and maybe they can give a shout out and a hello to Joe Succoskis Joe Pier Grossi who won a trip to New York last night at 10 o'clock He's not here, but he's having a great time in New York Both Sally Nelson Sally Wright Richard Anderson was helpful Tika Douglas and of course Jessica Sorako our marketing and development coordinator who all worked countless hours to bring this program to you today I'm grateful Thanks for them It's been an honor and I'm so grateful for the tremendous effort and the spirit of collaboration That brought this project together and there's a lot of hard work But indeed we have a truly amazing city that we work with we have outstanding project partners The Department of Public Services and the staff that went above and beyond to make sure that everything got pulled together especially in these last weeks City and State Historic Preservation Boards as Martha and Hilary mentioned we went through Lengthy public process to make sure that we heard from everybody about the details of the project the design team working with Martha Lyon and Regina Leonard was Remarkable and you know none of those efforts stand alone. It's because we all work together to pull this off We're Ari Coleman. I'm going to mention them again because they went above and beyond doing the construction on the on the project Jonathan Taggart the conservator who restored the Civil War cannon barrels and the barrel for the USS Maine The Becker engineering who helped us craft the base of the USS Maine to restore it to its beautiful ornate sculpt structure that it should be Cody Crane corporation from Auburn who donated not one but two cranes to deliver Both the base of the USS Maine and the cannon just last week. We've got that in by the hair of our chinny chin chin And I'm especially thankful to Mayor Brennan and our city counselors For believing in the significance of this historic landscape And this was a project that couldn't be done and just you know it needed to be done in one phase It couldn't close the park off in two different phases and have people wait to have this be Completed so Allowing us to finish the project with city support of about 1.2 million dollars Friends of the Eastern prom is about three-quarters of the way there to our $300,000 goal to finish the project with the furnishings such as the cannons that we brought back Interpretive exhibits, which will hopefully be installing before the 4th of July next year There are still some sections of the wrought iron fence that we need to finish And there's still opportunities to contribute to that if you'd like they're offered at our website eastern prom and odd org or you can stop over at our table and talk with any of our board We created our unique recognition program to also help fund this project and we're grateful to the many Foundations and corporations who helped us pull this together Davis family foundation main community foundation Norway savings bank The boolest family Martin's Point health care Ed Gardner, candle to Thaker and The many people who are supporting our bench and calendar club recognition program Fort Allen Park is An aglowing example that the city of Portland indeed supports its parks and green spaces Thank the city of Portland for the support We hope that you'll come back in the summer when it's warmer if not of course during the winter We'll be bringing the concerts back to Fort Allen next summer And I just want to thank everyone both near and far for their patience and support during the construction phase Dan Haley is going to come up and conclude this portion of the event, but thanks everyone for this day It's truly history in the remaking and Please enjoy Thank you I thought it was a little warmer than December 7th the last time we had a little ceremony down here But I'm not quite sure as they sat there with the wind blowing on the back We're going to conclude with God bless America by the combined deer in Portland high school band And encourage the audience to join in you don't want to hear me saying but I encourage all you to do that And then after that if you please stay in place and we'll retire the colors and they'll come up through the crowd a bit but again, thanks for being here the Chandler's band will play at Shortly after this ceremony. There's kids 1800 games next door and the games are designed as they were in the 1800 I found out that they were designed to build strength so you could work on the farm or Muck a stall or whatever, but all the games were designed with a purpose unlike today with two thumbs, but okay, so With that great little band up there with star God bless America Retire the colors. Thank you to all of you and appreciate the participation and all the support and the great speeches today Thank you very much We are Chandler's band.  So please enjoy yourselves. This is Star Spangled Banner. Please join us in singing


That was the first year that I started hitting for power and the hitting coaches at the time and Miami were Barry Bonds and Frank Menekino and obviously everybody was watching this, you know, Barry is and you know, regardless of your feelings, a guy that's hit more homers than anybody on planet earth, you know, or at least hasn't played majorly, at least majorly baseball. You know, you're going to listen and this, he really knows, he really knew a lot about the game. Like anybody can go out there and hit a homer. You can go deep in a game and you can have no idea why. Like, yeah, sure. I hit the ball hard and it went over the fence. And by definition, that's a home run. But why did that happen? Like what allowed that to happen? And as a young player, I never really knew. I was like, Oh, yeah, that felt good. That was a good swing. But why was it a good swing? We're in this cage and it's like tarped in and it's this probably 120 in this thing. And I was trying to find it again. I was kind of struggling a little bit and trying to do some drills in the cage. And Barry was in there with me with Frank. And you know, I thought I always thought as a young player, when I wanted to drive the ball, I would do it with my body.  Because you're just straight. And that's the complete opposite of what you want to do when you're trying to hit a homer. And so Barry got me in there and spread me out really wide.  And I was like, uh, okay, you know, so I think he had Frank flip and he was watching. And so I'm pretty, I'm spread out to the part of my landing point. So if I did my leg kick and you stride out to where your foot landed, that's where that's how wide I was. And I'm just sitting there and this is, it was a no stride drill. And it was just like, hit the front of the plate. And I was like, okay, cool. He throws me the ball.  And I hit it maybe six feet out in front of the plate, like bounce and goes into the screen, whatever. And he goes, I said the front of the plate.  All right. So back again, hit it this time, probably like two or three feet. And he was like, I said right off the plate. I was like, I'm trying dude. And so I do it again. I miss again. And he grabs the bat and he does it.  And I'm like, what is going on right here? I'm just going to ride this out. Right. You're right. He grabbed it. He like showed me what he was talking about.  All right. Let's do that. So I get in. I start doing that.  And we slowly did that. And we brought the ball up to probably about a line drive level where it was just like, and I still had that chopping feeling. But I wasn't actually like steep down.  And it was his way of cleaning up his bat path when he played. And it's a feel, you know, and thinking that of swing down, because you hear the swing down, some guys say that still, like if you hear the old school, I wouldn't say old school, but A-Rodge, berries, like these guys, I'll talk about chip early, I'll talk about swing down. And that's why they're kind of against the Instagram Twitter people because they're, they're so anti that. And if I hit a ball off the top of this cage and this drill, I might have got punched in the face. You know what I mean? Not literally, but it would have been just like a, what are you doing moment? And so it was like, it was creating like true backspin.  And I was like, damn, like I'd never really done that before. And if I had, it was a pure luck accident. I never really understood it. I was always a guy that just hit and could feel when it felt good, not good. And I just hit. I had no, I had no reasoning behind anything. And I was like, man, that feels pretty good. And like my, I wasn't, I was hitting against my front side in a sense of where like it wasn't leaking first before I went to the swing. And that's why everything was so true. And I was short and I could pull the ball correctly instead of top spinning it or hooking it foul. And I took it in BP that day. And it was the best batting practice I'd probably ever had in my entire life. It was like just homers, like everywhere, all parts of the field.


Hey, Marina. How are you doing? I'm good. How are you? Okay. Let's go ahead and get started. I Put down some agenda items. I think the first few items shouldn't take too long So we can spend the bulk of the time Going through the document you pulled you wrote and then I can share some Comments there. So I think the the first thing that I wanted to cover was you know, we've been starting to discuss prototypes in other aspects of notary I Put together an outline for the key management components that we would want to prototype and the stages that we could go through them in so the Do you have the notes visible by any chance or would you like me to share my screen? So yeah, okay So the ones that I proposed are one first one like, you know, let's have keys available for signing For the client. So this would be addressing like, you know, can we have keys stored? On the device or in sort of like a cloud HSM So less about how we manage the keys are more about just kind of having access to the different areas that we expect Keys to be stored in so I think that's a first prototype A second one would look at key rotation And so this could be either through tough for any other mechanism that we agree on but essentially making sure that you know as these keys are expiring and I'm talking more about sort of the The signing keys and not necessarily the root but the signing keys time stamp keys any other keys that you want We want to have a prototype that rotates these and makes is available for signing The third component of the prototype that I saw was kind of having the on the deployment side Having the trust or being configurable And using that for signature source validation and I call out signature source validation here because I think the First version of the signature validation, which is where you're just looking at the signature that's presented and determining whether the artifact is Integrity has been compromised. I think that's something that can be handled outside of key management and then the key revocation or allow list denialist I think can be a separate prototype We may end up doing both at the same time. I think tough allows for both at the same time But I want to track these as separate prototypes So if we end up with an approach that takes parts of tough but has other components for a lawless denialist We can implement the separate prototypes So those are the four components that I think from a prototyping perspective Made sense to me, but I want to get your thoughts on it and see sort of like, you know, what we want to go back to the larger working group with Yeah, totally. I think for the from kind of the tough perspective anyway I think mostly the key management that we need is for the root keys because kind of the root manages keys for other roles Within kind of how it's designed, but I think there's still this big Like the kind of the original key distribution question for those root keys. I think there's definitely You know still still a question And so I think yeah, I guess my question is kind of like the scope of it And then I guess like the key rotation that could happen both within tough and within those those root key Situations and we can kind of discuss those cases Right Yeah, I think the what I want to kind of set here is what are the scope for each one of these prototypes and then like, you know We're we're gonna have I think two key conversations I think that are refed are like, how do we do key rotation and how do we do key a lawless denialist, right? Or signature a lawless denialist to be more specific and I think those conversations aside Which I think kind of like, you know bleeds in sort of like Whether we can use tough or tough needs modifications or we need to go back to the drawing board. I think Those are separate conversations, but in terms of like, you know, let's say even like let's say we agree on tough, right? Would these four components make sense as like, you know things we want to prototype to you um Well, I guess like my question be like because it Kind of depends a little bit on what tough is scoped for because with our idea of scoping tough more for the organization level A lot of the like developer key management would then be done within the organization and then kind of chained up to that root key But then for that root key, I think these questions do make sense like, you know, especially something like a trust store for root keys I think could be really valuable. Definitely something we should prototype and make sure that that works Um, I think the question of the you know, like the exact keys used for signing images might be kind of more within the scope of the tough prototype piece Mm-hmm of this, but I guess those can really be done in tandem I think like the tough prototype as well as the kind of root key management right Like I think the the the one that you've when you talk about like the signing key management I think that plays more into the keys used for signing piece and then when you talk about the root key management I think that plays more into the key rotation component, right? And from my understanding of tough those are things that you know, we can rather than prototyping like an entire end-to-end Tough based workflow. We could potentially do sort of like parts of tough And then you know because we know how the remaining architecture works We can say here's where we're gonna scope this prototype to and as a next step We're gonna address the next step of integration So I think logically or sequentially like do these different components then kind of like align with what you would envision for a prototype Yeah, exactly like for tough you could do you could implement kind of all the targets metadata pieces first Right the exact signing of images and then things like the timestamp and snapshot I know we've had some discussion about where exactly those should be Generated and things like that and that could be like into the piece of that prototype Okay All right, I want to keep the prototype scope very generic for now And then as we kind of align on the key rotation and signature a lot of this deny this conversations We can start adding in more around what we expect those implementations to look like So what I'll take a crack at is then based on these four components. I will put together a Pull request later today Take a look at that. I think we can iterate on it offline and then present that to the larger working group on Monday But this should be a small doc and I think this should be easy to kind of pull through Okay the next one I Wanted to go back and revisit the pull request that I have open and I think the The thing that I put there as a to-do for discussion was the key rotation component Let me go ahead and pull up that pull request Yeah Just the updated key management scenarios. Yes Yeah, lots of comments in here. Let's see I'm Are you still there? Sorry? Yes, sorry. I always struggle to kind of pull this Yeah, no worries document up finding the right place for it. Okay. There we go I think most of the comments we had Covered in the previous discussion But looking at the file itself The area where we're I'd like to get some more feedback is the to-do scenario, right? So I've listed out I Think six areas that we need to cover Let me actually share my screen. Give me one. Yeah, which section? Actually gonna just edit this document live so we have notes Okay, so I think this is the area that we want to refine further so We called out that we want to have a discussion between Having a mechanism for rotating a key versus not having a mechanism the the challenges here, I think like, you know, we have some Assumptions that are baked into purchase. We are used to Which I think need to get called out. So for example from, you know, the traditional X509 certificate based assumptions There are things like you have a CRL or OCSP endpoint that's defined in the certificate Which is something that we just kind of consider as part of the root key sort of definition, right? I think from the tough perspective that's slightly different in the sense that the Pointing to where the signature or the key repository is if you will Kind of gives you that information. So I think those are things we want to call out and I think the The the comment that I had more in here was oriented more that a Root key itself should not be Designating what the next route is, right? Like you shouldn't be having to sign off on an update with the existing root key But if there's like a shared repository of keys or some other trust mechanism that you have to validate where what the what a valid route is I think that's useful In in in getting your roots and things like that in place. Yeah, so Sorry Go ahead. I think that part of the reason the tough mechanism is what it is is that we we really expect there to be multiple root keys Preferably like three or four of them and when you do that key rotation that that root rotation You're you are technically rotating the keys, but you're most likely not rotating all over the keys You're saying okay, you know this one key Maybe needs to be updated and kind of we collectively are then updating That key and it just kind of makes it a little bit more transparent to the user just to have that all Yeah, I think like you know when I think about multiple routes when you have some when you have large Organizations like multiple routes make sense to me because you can have isolated roots You can potentially put the shoots in different HSM's give different people axes like that's where I think the multiple route really becomes a A good mechanism for addressing that But if you think about like the individual developer, right? If you're asking them to handle multiple routes, they're likely being stored in the same key store And in the event of a root compromise like I think we I would work with the assumption that all Roots would be compromised at the same time, right? I think that the that's part of why like root delegates to those targets metadata is which are given to the individual developers I think the idea there is that By making root a little bit bigger. You can you can do more of that kind of secure key management stuff Right, and I think that's the that's the that's the call out here is that in that model You're expecting that individual developers and and I'm using developers loosely here when I say individual Developer, I'm saying like a publisher is like a single developer, right? Right So like let's even call it a team like even in the in the in the aspect of like a team contributing software They may not necessarily have the same Key hygiene that like someone like a registry operator like Docker might have or like, you know Large enterprises publishing software might have right and I think when we talk about Multiple Roots, I think we want to also add in requirements that says The multiple Roots is a great use case as long as these additional things are in place, right? And calling out what those additional like separation of keys are and how they're managed I think that's where that that becomes useful calling that out and also saying like, you know in this scenario We're expecting either registries or some central root authority to kind of really manage the roots and issue more of the Delegates to developers that then need to sign with it So I think that's really what we need to call out in this root key rotation discussion is Who is taking advantage of these? So let me take take some notes here Yeah, I think that makes a lot of sense and if you have like a really small one organization registry situation Maybe that's a little bit different but for like the dockers or whatever of the world I feel like it makes sense just to kind of Allow them to do that kind of management I think Roots So who's handling Roots? Yeah, I guess yeah, do they have the infrastructure to store them in separate hardware and I think that you know whether or not we allow Root key rotation there. I think there are definitely going to be situations Where it won't be able to you know, we have to actually revoke the keys manually Right. Inevitable Hopefully rare, but you know Yeah, and I think we can further refine this by We want to call about providing mechanism for configuring and Rotating a root key right because those are two separate conversations So adding a mechanism to configure slash rotate keys I think pros for the rotation section that can figure Yeah And I think a call out here is consider whether this mechanism Needs to rely on existing Root or Roots Make the distinction Okay, and then not adding a mechanism. I think It goes pretty broadly. I think Right now We'll want to capture more data to make each one of these clear and really make it very Precise from the developers perspective and from the perspective of the different personas I think what it what what this means In terms, sorry go ahead. I was just agreeing. Sorry Yeah And then in terms of scenarios to consider because I think I found the scenarios to be very helpful and Kind of walking through like what different use cases would be So far I've got publisher loses key Needs to update key for you know maintenance reasons whether it's like, you know Your keys expiring or you need want to move to like a more secure key type And then sort of like some of the compromise scenarios anything else you think we should consider here Um, I guess I mean, I think it's not really. Yeah, I think that those are the main ones I think for the root key rotation that are that are kind of relevant And this expiration, but that's kind of I think tied into the need to update it for some other reason Right So this let me let's kind of like keep adding here includes Expiration that's probably actually the most common case here, right? So, okay All right So I think this is a good doc to start collaborating on What I will Hmm. I wonder what a good way to have like collaborative docs are have you had success in working in git or Have you used other mechanisms for like a shared doc? I've used both git and git No, sorry git and Google Docs They have pros and cons I Think that the git history is a little bit easier if you have a lot of people but Google Docs I think is a little faster edits. So depends on Okay, I Found like git to be useful for tracking comments but I've also found it very difficult to kind of like take someone and Take someone's requirements and edit What I'll do is I will create a doc In my repo for this one If you don't mind kind of like submitting pull requests against that And I'll merge them in as soon as they come in and then we can go through comments and stuff And then we can merge that into the main repo Once we once we're aligned and sort of like this doc has all the information That we feel is needed to present to the larger working group. Does that work? Yeah, that sounds good. Okay This one I'll likely get done by tomorrow and I think we'll probably need like a week to kind of get this in place. So Yeah And then let's go ahead and review your full request Oops, let's save these I'm gonna stop sharing my screen as I go through this Yes, this is basically just my like putting on paper some of the discussion we had and some other thoughts I had key revocation Kind of break it into those three big categories We kind of talked about the expiration lists and I called it like distribution of trespass keys I think you're allow a list denialist is kind of a similar idea Big options there. I think that the key expiration is like it's it's not sufficient, but I think it's a nice addition to either of the other Solutions so that you know with no other action keys don't last forever. I mean, there's just the long expiration times, but They I think they added a nice benefit there Yeah, I think these are good call outs What I think like to kind of make sure that we are Focusing on the right area here like key expiration like I think regardless of whatever Mechanism we go through right like all the whether it's like x509 inserts or whether it's tough. I think key expiration is Fairly well understood Where I don't think we have a lot of debate there, I think calling out what keyword key expiration is and what the expectations are I think are good because it's going to drive a conversation around Do we want to look at a time stamp authority because there are two implications of key expiration, right? one Was the key expired when you generated the signature or is the key expired when you validate the signature, right? If you do the latter, you don't need a timestamp authority But then that means you're on the hook to re-sign every artifact that you've ever signed With the key, which is a pretty daunting task And you can't actually you can't really do revocation with just expiration. It's not exactly revocation. It's like expiration. Yes And so expiration is just I think like a way of controlling What are the signatures that you need to track actively because you're essentially saying I have I'm I'm putting fervor to contract that says Up until this point, I'll give you more information on this artifact that I've signed or the keys that I've used to sign it Beyond that you're using it at your own risk because I'm no longer going to give you that information, right? I think that's how We've typically viewed key expiration so I I Think for a overarching doc key expiration makes sense and I would call out sort of like the Where the timestamp authority comes in and I think tough handles timestamp authority with the timestamp key And so just kind of calling out that you need a timestamp from a trusted source To show that when the when the signing was done that the key was still valid. Yeah Actually the timestamp, I think even more so for then for expiration is really important for both revocation and For both of these other scenarios because whether you're distributing a list of trusted keys or a list of untrusted keys You have to know that that list is current and you can't it can't be certified by the key itself It has to be kind of some external Yep, otherwise it's kind of meaningless. So that's really where the timestamp service comes in and I think we'll need that Kind of with either solution. Yeah, I think I would call that out for a separate doc and Because I think in key revocation What I what we want to What I'd like to kind of deep dive on is the allow list denialist model Which essentially says as long as something has passed through this expiration check And it fits with the trusted keys that have been distributed We still need a mechanism to track whether a signature is valid or not, right? And that's sort of like the dynamic updates that even when you've set expiration time Even when you said here's my trusted set of keys, you may still want to say I don't trust this for a multitude of reasons For example for tough. We're saying we're only trusting. Let's say the last X number of updates That's your lawless model from a revocations perspective You're saying I don't trust X Y and Z updates because they have some security issue I think both models work, but we just want to capture what the trade-offs of those approaches are Yeah, for sure. And I think that that's kind of my goal here is to kind of describe both of those models and What the trade-offs are I do think that mentioning time-stipping here is important because I think it's important to understand that You know a list of things that are revoked or a list of things that are valid is Like it has to have actually a short validity time. Otherwise, it can very easily be replayed and Lose a lot of its security properties Yep, I agree. I think I Would call out timestamp and I would say let's actually do a separate doc if you let's do a separate doc for this and I think we want to actually review this overall doc first. So to set context, I think this is a good overall doc and I would call this Actually, what is this like signature validity, right? Because you're you're touching on everything So this is Source expiration A lot less than I listed it pretty much covers everything which I think is a good overall doc Okay So key expiration, I think the distribution can be handled in the The key rotation mechanism doc because I think we want to set some context on how keys are being distributed So I think that my kind of my point here basically is that if you have a distribution mechanism that's updated on every like refresh cycle That can be used as a relocation mechanism Kind of like the way tough handles it where you read down the you know, for example root metadata And if something has been expired in there, you then get those new ones as part of your new allow list of keys Okay, I think that's a The That's a good point and I think we want to track that But I think we're in terms of thinking through sequentially. I think the first step we want to track is the Allow list and I list models, right? So if we break it down into What do we want to do right like in terms of sharing? Let's have that conversation first. So I think if you think Where do we put this? Yeah, and I guess it kind of the distribution is is relevant but it's definitely a separate question but because basically if you're doing the Allow list, you only need one distribution mechanism for for keys Whereas if you do the denied list, you now need two mechanisms one for distributing keys and one for distributing this relocation list um I think for a law list you may There are other considerations to take into place, right? So if you for example when we Right now when you're expecting the allow list to be shared by the registry There's a question of like, you know, once the artifact gets to multiple registries What are the requirements we're proposing for that allow list to be propagated, right? So let's take the scenario that I push a signed artifact to docker hub Someone else pulls some information someone else copies that that that artifact into some other registry Then now I am pushing My latest updates into tough. I'm pushing the allow list in sorry. I'm pushing the allow list into a Docker maintained sort of tough repository, right? Someone else then has to pull in that information into their registry and keep that Tough repository updated as well, right? So I think there's a couple of options there But I think that that's definitely the easiest the other would be that the registry kind of performs its own verification Um and trust it independently, but I think that the better solution is to definitely to to pull those lists across Right and if you start kind of looking at how this starts chaining down I think that's where the separate the separate mechanism allows you to kind of rely On a centralized distribution for trust Whereas the tough model is kind of going to a chain model Where you're essentially having the registries update information as artifacts are moved through so I think That one I think rather than look at distribution of trusted keys Well, here's a question, right? I think I think this one I think you're actually kind of putting on a fourth area here so Distribution of the the one is an allow denialist for key revocation And then the second one is a distribution of this allow and denialist Um, I think tough is merging together distribution of trusted keys as well as distribution of the list Which I think we can call out, but I think we want to look at those two separately um The reason I say that is that when when you need to rotate your keys is different from when you need to kind of update this allow or denialist um I I think that they need they they should have some areas of overlap when we look at it in the overlap In the overall document and we make a final decision But I think in terms of calling out the key revocation list the The the the separate the distribution of that list is this is probably closer in that doc So I think you're you're calling out a need for three docs here Um, does that sound reasonable? Um, maybe or maybe like a section to document or some such, but yeah, right different sections um, I think another um interesting question is what are is keys are trusted for what and I think that that's another um piece of the puzzle here because um Like you might say, you know, you might temporarily want this key to be trusted for this service and then say Oh, no, it's not trusted for that, but it's still trusted for this other service And I think making sure that that fits into the model I guess one option would be to require people to generate new keys, which is Which is fine, but I just think that that's a scenario that we should think about um, I think that should be covered in the uh key requirements doc or say the the the initial requirements doc in terms of um, how we are configuring trust in the deployment environment, right? Like I think we called out that we want to make sure that for um, whether you want to specify it for a registry for repository or for sort of like um, I forget uh, what the correct terminology is like the individual artifact or image you can you can go down and specify What key or what root you want to validate against, right? Yeah, but I think the question is like if you If a key is revoked for one role, is it universally revoked? Um, and like that that's just it's just a question of um Of scope of what vocation means kind of in this context How would you um Not revoke a key like what's sorry, I'm I'm a little bit confused and help me understand this Uh, where do you envision sort of like having like a partial revocation of the key? Oh, so like for example, so say, um, one key is you like one team develops both I'm trying to give an example project name, but yeah, so let's go with like the like Ubuntu stable and the Ubuntu like, um Nightly whatever. I don't know if they have a nightly, but you know Some project has a stable and a nightly Release and they might both be signed by one team to start with and then maybe Um, like you want to have some additional checks on the stable Build so you you revoke the other people like their access to Sign the stable and give it to you know, some other qa team or something Uh, that's where you're revoking access to use the key, right? You're revoking the key, but yeah access to it for that. Yeah, I think that gets, um I think that might fall outside the scope of like how um keys get They you know distributed and set up, um My expectation here was that we give a model and we give some best practices and guidance and let Uh, let publishers decide how they implement it, right Again, that could be done to just be okay like to just making new keys for new purposes. Yeah and and I think like if we start thinking about like um, like the big challenge here is going to be like, you know, how do we set this up for Um, open source projects, right? Because I think that's when when one where that we expect a lot of churn like Who owns a route there who owns sort of like individual keys? And I think this is where having like an example implementation That can be lifted and shifted. I think is is is is going to be helpful um, but I think like when you start looking at, uh, enterprises like let's say Uh, Microsoft or Ubuntu, uh, not necessarily Ubuntu, but like Microsoft like Um, where you know, you have where you have like designated employees and designated sort of like credentials Um, there's probably already a mechanism that you want to tie into for distributing sort of like keys and for key management So, um, I think there the question is well, how does Microsoft share that root information with the rest of the of of all the employers that are uh, consuming Microsoft software And so I think that's that's that's where we want to define the specifications for and then say well, you know If you want to use something like, uh Tough for this key management, here's how you would do it and here's what the information would need to Kind of be shared in so I think that's that's how it addressed that Yeah, like here's how you should set up those delegations so that you know, I'm using keys and and doing all of that. Yeah Yep. Okay. Um, I will go ahead and put some more detail feedback in for this talk then I think this is a good starter and this is this is doing well to kind of address the areas um, but where I would like to kind of see, uh, a little bit more is, uh, the pros and cons of the Allow list and I list and I think your key revocation list is a good starting point for that And then let's consider some scenarios, uh and see sort of like what that would mean Um, I think from a scenario perspective, we have concerns around You know as we're pushing out updates like what you know, are people moving to the latest update? Um Is having an allow list the right model for that or should we have signature expiry as like as a way of enforcing hygiene? or a combination of both? um, and then for Um, also for sort of like security updates like, you know, what do we consider insecure? Right? I think there's a there's a broad term in saying like in if software is old It's insecure versus like in if software has a known cv. It's it's in cure Um, and I think to a certain extent you're right on both But like cvs are more like a a burning like, you know fire versus sort of like older software You know if you have like your own cv scanning and things you may have more acceptable processes for deploying them So I think coming into sort of like a consensus on what we want a signature to convey and what we consider insecure Will help that so I think that's something I'd look for in this doc Okay, that makes a lot of sense. Okay. All right. Awesome. Uh, I think this is great. Um, I will get you the detailed feedback first, uh, and uh, then I'll go ahead and kind of create the The different prototypes doc And I'll share that with you. Uh, and then lastly I'll work on the outline doc for Key rotation and I think that can actually handle some of the distribution of trusted keys as well So, uh, you can point to that doc if you want over here as well Okay, that's good Great. Well, thanks for bringing the time and uh, yeah, this is uh, I'll see I think we may want to actually have this conversation on an ongoing basis. So, uh, is this a good time for you on a regular basis or? Yeah, yeah, I can make this work Okay, uh, I'm gonna go ahead and share this at the I shared this time, uh At the next meeting on monday And ask that we just kind of like, you know, have anyone that's interested in participating in some of these conversations and potentially picking up some of these work that we're identifying, um to kind of join us in this but Uh, yeah, this this this was great All right All right, you too. Bye. Bye


Welcome to Affector from the Electronic Frontier Foundation. This is the audio edition of EFF's email newsletter geared towards keeping you on the bleeding edge of your digital rights. Check the show notes for links to all of our stories. This is Affector Volume 34, Issue 3, titled, How to Prevent Twitter from Going the Way of the Dodo. This issue was published on Tuesday, May 3, 2022, and I'm your host, member, outreach assistant, Christian Romero. Let's start with our top feature. Twitter has a new owner. Here's what he should do. EFF staff responds to the latest news about Twitter with suggestions on how to move towards more privacy, safety, and control for users. In order to treat free speech as anything more than a slogan, social media platforms need to take user privacy and control seriously and take their hands off user data. Without any interoperability principle and end-to-end encryption, hot air about free speech is just a dead letter. Next up, we've got some EFF updates. Install MITM, Intercepting Your Android App Traffic on the Go. This post details the steps involved to configure an Android device to audit the traffic of any app installed on it, requiring no other device to be physically present. We offer technical guidance for Android users hoping to secure their privacy. Next, Victory. Maryland legislature says police must now be trained to recognize stalkerware. Maryland's legislature has unanimously passed a bill that will require law enforcement agencies to learn, as part of their standard training, to recognize the common tactics of electronic surveillance and the laws around such activities. This victory will help provide survivors of domestic abuse, intimate partner violence, and electronic stalking with much-needed support. Next up, podcast episode, Making Hope with Adam Savage. On this episode of How to Fix the Internet, Adam Savage, the maker extraordinaire best known from television shows Mythbusters and Savage builds, joins EFF Cindy Cohn and Danny O'Brien to talk about the right to repair, tinker, and innovate. He says a fear-based approach to invention, in which everyone thinks secrecy is the path to a big payday, is exhausting and counterproductive. Savage challenges us to create a world in which we incrementally keep building on each other's work and keep making things better through collaboration. Next, scraping public websites still isn't a crime. Court of Appeals declares. After a series of volleys in the courts, a federal court has once again declared that the scraping of public websites is legal. The question at hand was whether access to a public website can ever be without authorization under the Computer Fraud and Abuse Act. The court noted that access without authorization implies a baseline requirement of authorization, and that public websites like LinkedIn Profiles do not require any permission to begin with. Therefore, access to public information online is unlikely to be a violation of the law. Next, Google fights dragnet warrant for user search histories overseas, while continuing to give data to police in the U.S. While Google is fighting court orders in Brazil that are demanding wide-ranging keyword search dragnets, we can't be too quick to offer the company credit. That's because it continues to collaborate with U.S. law enforcement in phishing expeditions. We aren't aware of any cases in which Google has pushed back against keyword search warrants in the U.S. In fact, we have no idea how many keyword warrants Google receives or how it responds to them at all, because Google has kept that information entirely secret.  First up, EFF's 6th annual Tech Trivia Night. EFF is pleased to let Bay Area residents know that we will be holding our annual Tech Trivia Night in person in San Francisco on May 5th. This event will not be available online. Next up, SFPL Tech Week, Protecting Your Account. Join Alexis Hancock, Director of Engineering on CERTBOT at EFF, for a virtual presentation on using password managers and multi-factor authentication to keep your account secure. This will be a virtual event, so everyone's invited to join at 11 a.m. Pacific Time on Friday, May 13th. Next, EFF at a New Hope. EFF is excited to be a part of this year's Hope Conference. We'll be at the Expo Hall and have various talks, so if you're interested in attending, be sure to register soon. Hope is donating 10% of all ticket sales to EFF through Friday, May 6th, 2022. Now we've got one job opening, Associate Director of Institutional Support. EFF is looking for a full-time Associate Director of Institutional Support to join our development team to develop and prospect institutional funders, organizational members, and donors. This includes traditional Philanthropic Foundations, Corporations, and other institutional funders. Next up, we've got a few mini-links. First, Artificial Intelligence is creating a new Colonial World Order. MIT's Tech Review has a new series about the role of AI in further dispossessing marginalized communities. Next, Tennessee lawmakers aim to take oversight of police technology away from local governments. Tennessee State Legislature is floating a bill to preempt municipal authorities from creating oversight over or restricting law enforcement technology. Next, OIG Audit Report on the U.S. Postal Inspection Services' Online Analytical Support Activities. The USPS Inspector General issued a report showing abuse of their social media surveillance program, featuring Clearview AI, including searches for protest with no nexus to the post office. Next, Video Doorbell Cameras Record Audio II. Consumer Reports writes on their concerns about the audio recording of conversations up to 25 feet away by increasingly popular doorbell cameras. And for our last mini-link, Mainstream Coverage adopts Elon Musk's free speech framing despite his anti-union, anti-speech, anti-worker history. Media Matters looks at the press response to the bank-financed Elon Musk purchase of parts of Twitter to see if they're covering the news, or just offering up press relations and clickbait. And that's it. Thanks for listening. If you like what you're hearing, be sure to sign up for the email version of Effector, which includes links to in-depth coverage of these stories and more. See past issues and subscribe at EFF.org slash Effector. Before we end this issue of the newsletter, I just want to let you know that EFF is a member-supported non-profit organization and you can help us protect digital privacy, security, and free expression for everyone. Donate to EFF today and even grab a bit of gear by heading over to EFF.org slash Effect. That's EFF.org slash EFF ECT. You can become a member for as little as $25 or even sign up as a monthly or annual donor. Thanks for your support and I hope you'll join us for the next issue of Effector.