Welcome to this session. So in this session we come back to the game take away introduced in the previous session. In the previous session we played this game and one of the player has won. But the question that reminds here is that is there an optimal way of playing? So what is an optimal way? Let us say if player 1 can follow a strategy such that whatever player 2 does if player 1 is going to win then of course that is player 1's optimal strategy. So similarly if player 2 can find a strategy if he plays that whatever player 1 plays player 2 is going to win the game then that will be optimal strategy for player. Now in this game who is going to win? So let us check. So we will come back to the take away game. So as I said there are 21 we have used the sticks and the moves is basically taking 1, 2, or 3 sticks then who wins? Who wins is the question or who has winning strategy? So this is the problem that we would like to see it. So to give a motivation to the proof let us think there are only one stick obviously player 1 wins. If there are 2 sticks player again 1 wins because he can remove both the sticks similarly if 3 sticks are there again player 1 wins 4 sticks. Now situation changes. Whatever player 1 does he may pick 1, 2, or 3 there is always one stick at least maximum of 3 sticks remaining on the table therefore in this case player 2 will win. What about 5 sticks? If there are 5 sticks so player 1 would like to pick 2 sticks in the first this thing and then player ok let us be careful. So if there are 5 sticks now let us look at player 1 let us use the blue for player 1. So player 1 can take 1 stick or 2 sticks or 3 sticks. Now if he picks 3 sticks there are only 2 remaining and then player 1 can immediately take this. So if naturally the player 1 certainly would not like to pick 3 sticks. So he will let us say if he picks 2 sticks then once again there are only 3 sticks remaining therefore player 2 will remove immediately. So that is also not good. So player 1 will only pick this one only one stick then it goes to a position where there are 4 sticks that goes to this one and we know that there when there are only 4 sticks we know that the player 2 wins. Now let us look at the following thing when I say player 2 wins is it the person who is it is not about the person it is the person who makes the second move. First person to make a move is the player 1 the first person second person to make move is the second player. So if you look at that one for the player 1 with 5 sticks he will always pick 1 stick and then there are 4 sticks then the player 2 will pick 1, 2 or 3 and then player 1 again pick. So in this case it becomes a player 1. Now you can check this thing with 6, 7 also the same thing happens but with 8 sticks player 2 again wins. So now this should give us a clue. So what is the theorem what can we say it in if there are n sticks then if there are n sticks the winner is decided by the following is n a multiple of 4 or not. Now if n is a multiple of 4 then going back to this thing we can see that the player 2 is winning and if n is not a multiple the player 1 is winning. So that is essentially the theorem. So let us write down the theorem. Suppose we start with n sticks then the first player has a winning strategy n is not a multiple of 4. If n is a multiple of 4 then player 2 win. When I say wins means player 2 has a winning strategy. How do we prove this? The proof of this actually requires a very important proof technique in mathematics called principle of induction. So what this principle of induction says is that let us say let me write down the state what exactly this induction principle is. Suppose let S be a subset of natural numbers and with the following thing properties 1 belongs to S, second is k belongs to S implies k plus 1 also belongs to S. Then the principle of induction says that S is nothing but set of natural numbers. So in fact this is a very, very powerful proof technique. In fact several beautiful results can be proved using this simple idea. So we will use this technique for proving our result. So let us see how we go for. So as I said we will start with if n is equals to 1, 2, 3 we know that player 1 has a winning strategy. Let me abbreviate saying that winning strategy, player 1 has a winning strategy. If n is equals to 4 we know that player 2 has a winning strategy. We have seen this already. Now let us assume the theorem is true for all k less than n. By the principle of induction we need to show that theorem is true n. How do we prove this? So the proof is very simple. So because n is a number positive number so we can always say that when I divide by n there is a reminder and quotient so we can use this division arithmetic and say that n is nothing but 4a plus b where b is anything between 0 and 3. So let us see there is a possibility. If b is not equals to 0 let us consider if b is not equals to 0 means what let us go back to this one if b is not equals to 0 means this will be n is equals to 4a plus some reminder that means n is not a multiple of 4, n is not a multiple of 4. Let us look at the this example that we have seen here, look at it. Here if something is involved if let us look at this 5 case if there are 5 sticks what will happen? The player 1 has removed only one stick so that 4 sticks are still there. So that is exactly the idea here. So what he will do is that player 1 will remove number of sticks. So when he removes b number of sticks what will happen let us look at it. So let me write it. So basically 0, 1, 2, 3 and 4 let me put here 5, 6, 7, 8 let me put here 9, 10, 11, 12 of course let us say. Now what I am saying that suppose let us say the player 1 if n is 9 he is removing only one stick and he comes here. Now player 2 can remove either one stick or 2 sticks or 3 sticks and then player will always remove one stick and come to this one. So in each when he removes b what happens is that the position I mean the number of sticks becomes a multiple of 4 that is the idea here. Now player 2 will remove some sticks some number of sticks that means it again he will bring down this that means player 1 is basically trying to bring to a multiple of 4 whereas player 2, player 2 smooth necessarily makes it non-multiple let me write it a 4. So each time player 1 will make a move so that the number of sticks will be a multiple of 4 then the player 2 smooths disturb this and he brings to a non-multiple of 4 and with this process if you really look at it all it goes down every time whoever makes a move the number of sticks go down and eventually in fact this itself will give an idea but then we need to use this principle of induction what is really happening is that look at this one player 1 has brought to a multiple of 4 that is let us say 4A in this case. Now remember 4A is less than n and by the induction hypothesis we know that if K is less than n as I said here if K less than n the result is true it depends on the multiple. So if I use that idea 4A is a multiple of this thing the player whoever is making the first move with the number of sticks at 4A that guy is loser so at 4A the second player is going to make the move so therefore he will be a loser and this leads to player 1's win. So this is a very very simple idea it depends on the principle of mathematical induction and we are able to prove this simple result in fact this completes the proof. So let us really look at the proof how we did it the entire thing depended on this fact that we are looking at the game we are removing either 1 or 2 or 3 sticks and this is the whole idea. Now because this actually forced us to consider the multiple of 4 so let us that is exactly here 1, 2, 3 sticks player 1 is winning if there are 4 sticks player 2 is winning and then 5, 6, 7 again player 1 and that is the theorem. So the entire idea depended on 1, 2, 3 this thing. Now let us also ask the following question instead of 1, 2, 3 let us take I think something else. So now let us take that the moves can be anything from 1 to 4 sticks. Now if you we go back to the idea of the proof we can immediately say that if n is a multiple of 5 then player 2 will win otherwise player 1 will win. So this is a interesting thing about this one. So now actually this game this proof introduces some important ideas related to this game. So let us look at this once again. So it again will once again go back to this definition of a combinatorial game. So from this example we can easily see that combinatorial games have perfect information. This is a important fact. So what this perfect information means is that both the players know what is happening in the game. So there are no incompleteness of the information. So the perfect information is a very, very important thing. And the another thing would like to say is that there are no chance elements. What I mean is that there are no moves which take certain randomness. Every move is fixed. So all the moves if you really look at it everything is fixed. There are no randomness involved. Let us look at another thing. As I said here this is where typically there are no draws. So just to recap no draws available. So we will initially we will look at the games having these properties and then how do we really define. So now here is where the take away game helps us to go further. How it is there? So let us see. As I said the take away game is determined by the number of sticks. So this is nothing but the position. We can call this as a position. Position of the game is nothing but the number of sticks in the take away game. So then so let us look at it. So initially if I start with 21 then basically player 1 can from 21 it can go to 20 or it can go to 19 or it can go to 18. From 20 it can go to 19 it can go to 18 or it can go to 17. Now from 19 it can go to 18 or it can go to 17 or it can go to 16. Now look at it, so the both the positions here let us say whether player 1 is there on in the 17 or player 2 it makes no difference for them. From 17 they can only go to 16 or 15 or 14 whether it is a player 1 or player 2 it makes no difference and from 17 they can go to any of these 3 positions. So in that sense the players are not there is no distinction between the moves for them. Contrary to this one look at chess positions the in the chess game the white the places that white can occupy the blacks need not blacks may not be able to do it. So this game is very different from this take away game ok. So what is this, these games are known as impartial games and this chess and this thing are called partisan games. We will come back to this partisan games later but initially we start with impartial games. So let me tell you once again what is an impartial game. In impartial game is a commutorial game where the moves there is position there is no difference between the players whoever occupies that particular position the moves available to them are same one and the same ok. So one more thing let us look at it 4 if the position is at 4 this let us say is a sub we are still arguing with the take away game only if the number of sticks available is 4 and then let us say player x is making a move ok the position of that number of sticks available is 4 who is going to win is the player x let us say x could be 1 or 2 I am not saying who it is ok. So who is going to win will x win obviously x cannot win x cannot win let me write player x cannot win if the position is 4 what does that mean ok the other player is going to win player x is the one who makes the move now player x has to make the move at 4 that means he can make he can remove 1 2 or 3 but then immediately the next player the other player is going to win. So here what brought to 4 which player the previous players move has brought this to 4. So therefore 4 is a winning position for the previous player and 4 is a losing position for the player to make a move. So this is a this position is known as P that means the previous player wins from this position now look at this another position which is 5 if it is at 5 who is going to win player let us say if you start with play with 5 the player the whoever is making a move he is going to the winner 5 somehow it came to 5 and from 5 player whoever is playing there he will remove 1 and then it goes to 4 and this thing that means this is a player to make the move is going to be winner ok the player to make a move is the winner ok. So this position is called n basically the next player to make a move and the P is basically previous player to make a move the next player to make a move and previous player to move. Now with this we can easily start introducing more terminology in this thing let us say 1 is basically a is it P or so where the next player to make a move is winning here this is here n n is the answer is again n like that we can do what about 21 ok I have written 25 here 25 is not a multiple of 4 if you recall the theorem because 25 is not a multiple of 4 it is the first player whoever is going to make the move is winner this is a n position. So in this P and n positions are very important in combinatorial games. So we will discuss about this P and n positions further in the next session.


Hi everyone, welcome to the session on Calico security policy best practices. My name is Adil Abdul Majeed. I'm a solutions architect with Tigera's customer success team helping our customers deploy Calico solutions. Okay, let's start off with the agenda for today's session. We're going to be looking at security challenges in Kubernetes and how Kubernetes disrupts traditional networking and security paradigms. We look at Calico security policies, the anatomy of a Calico security policy and the declarative policy language. Next, move on to best practices for security policy implementation with some examples, security policy patterns. I think one of the best ways to understand security policies is to look at some examples and how those examples can be incorporated into your environments and build a security policy model. Once we have the model built, we will then look at how you can introduce policy governance to that policy model. Just have a brief look at the Kubernetes networking model. The model stipulates that pods can communicate with all of the pods on any other node without the requirement for network address translation. Agents on a node such as system demons and kubelet can communicate with all pods on that node. And the most common container runtimes use container networking to first plugins to manage their networking and security capabilities. Calico being one of the most widely adapted CNI plugins for Kubernetes. So at a high level, the Kubernetes networking model provides for a flat network where pods in the cluster can freely talk to each other. There are benefits to this model. It alleviates the complexities that could have been due to the underlying network. However, the model also introduces certain security challenges. Kubernetes distrops traditional networking and security paradigms in traditional networks. When security is enforced, it's done so at certain choke points in the network. And controls are enforced to when traffic traverses or transits those choke points, typically using some form of networking construct. Now, in Kubernetes, pod scheduling is dynamic, IP addresses are ephemeral and scheduling is typically non-deterministic. What that means is you can't bind a workload identity to a networking construct anymore. Also firewalls external to the cluster cannot map IP addresses to workload identity. So when traffic egresses the cluster, upstream firewalls cannot enforce security policies based on IP addresses because the IP addresses for a pod are non-deterministic. With those challenges also comes an opportunity and we'll look at Calico a bit in this slide. Calico, among certain other functionalities, primarily offers the container network interface for Kubernetes IP address management and the security policy engine. Now Calico is quite flexible in the routing modes that it supports, as well as the data plane it supports for policy enforcement. So for routing you can choose between IP in IP, VXLAN overlay modes or native BGP and for the data plane you can choose between EDPF, IP tables and Windows HNS if you have Windows nodes in your clusters. Now the primary benefit of this tight integration with the orchestration plane being that workload identity is tightly coupled to networking and security in a way that was never before possible prior to Kubernetes. And this offers a number of advantages that we will explore in the subsequent slides. All right moving on let's look at the characteristics of security policies. Security policies are label-based and the key value pairs are the primary selectors to scope policies and refer to source and destination endpoints in policies. The policies are declarative so Calico offers a very flexible declarative policy language and what that means is that the underlying implementation of the policy is abstracted from the user. The underlying implementation being the data planes. For example EDPF, IP tables or Windows HNS that is abstracted from the user. What the user gets is this declarative policy language that can be used to define security intentions. And policies are highly dynamic and what that means is the underlying policy implementation in the data plane is for every pod in the cluster. So as pods are created so are policies and as pods move so do the policies. So the policies are highly dynamic but you as a user you only have to specify the security intention using the declarative policy language and Calico will take care of the underlying policy implementation using a data plane of your choosing. Okay so these are some of the characteristics of security policies. All right next let's move on to Calico security policy features. Calico supports network policy and global network policy and when I say security policy I'm referring to both network policy and global network policy. Support policy ordering. Now Calico policies are an extension of Kubernetes policies however Calico offers several more extensions than what's available in native Kubernetes policies and policy ordering being one of those and we'll look at how you could leverage policy ordering when building a policy model. Policies can be applied to any kind of endpoint being pods, VMs or hosts external to the cluster okay and policy rules support allow denied log and pass actions. When you're specifying source and destinations in a policy rule there are a number of match criteria for example you can match a port and this could be based on port numbers, range of ports or even named ports in Kubernetes. You can specify a protocol such as TCP, UDP, ICMP for example, HTTP attributes, ICMP attributes, IP versions, IPs, ciders, network sets and global network sets. We'll explore some of these in some of the subsequent slides. Endpoint selectors and this is where you'd use label expressions to select pods, VMs or other host interfaces, namespace selectors or service account selectors okay. Now policies also support optional packet handling capabilities such as disabled connection tracking, apply before NAT, apply to forward traffic etc and these primarily apply to host endpoint policies. Now there's a lot going on in this slide and it's not possible to cover all the policy features in a single session so in this session we're going to focus on policies for pods and containers all right we're not going to be discussing about policies for host endpoints or VMs or policies for nodes outside the cluster and in terms of actions we're primarily going to be focusing on the allow and deny action we're also not going to be discussing about the optional packet handling capabilities. Now I'll link the docs site and the best place to learn about policies and all that it's capable of is the project calico docs site okay so there's a link to that down below okay so let's have a look at the anatomy of a calico security policy. So a security policy has a scope it could either be a namespace scope policy which applies to a specific namespace or a global network policy which could apply to multiple namespaces or even all the workload endpoints in the cluster. Now there are a few selector options you could use endpoint labels to select specific workload endpoints if it's a global network policy you can also use namespace selector to limit that global network policy to specific namespaces you could also use service accounts as selectors. Now a policy is going to have one or more ingress and or egress rules and if you look at a particular rule in a rule you could have either an allow deny log or pass action and in an egress rule if you look at the destination there's a two field there where you could specify the destination and the destination protocol is also a from field there that you can use to specify the source. Now when specifying the source again you can use endpoint selectors or namespace selectors, service accounts could be networks, network sets or global network sets. Now network sets and global network sets are a way of grouping either IP addresses or cider blocks and we'll explore some examples in the subsequent slides. When it comes to protocols again we looked at some protocols in the previous slide for example you could choose between TCP, UDP, ICMP even HTTP match if you're using layer seven policies. All right so quite a bit going on here right just park this for the moment I think we'll be able to bring this together when we look at the examples in the subsequent slide but the idea being that there's a lot of flexibility within a policy and understanding some policy patterns is the best way you could approach implementing a secure depositing model for your environments okay. Alrighty so before we look at some examples let's look at security policy behavior. Now if no network policies or global network policies with that matter are applied to a pod then all traffic to and from that pod is allowed so by default if a network policy is not applied to a workload all traffic is allowed that's that's a default whitelist behavior in Kubernetes. Now if one or more network policies apply to a pod containing ingress rules then only ingress rules or ingress traffic rather specifically allowed by those policies is allowed for those endpoints. If one or more network policies apply to a pod containing egress rules then only egress traffic specifically allowed by those policies is allowed for those endpoints. What this simply means is that once the endpoint is matched by a policy only flows allowed by that policy or any other subsequent policy is allowed for that endpoint. So once you've matched a policy or rather matched an endpoint in a policy there's a default deny behavior for those endpoints okay. All right best practices for security policy implementation. So you should look at grouping all the rules that apply to a given workload or a group of workload into a single policy instead of having multiple security policies. So inside the policy you can have one or more either ingress and or egress rules and you should look at using rules for a given workload or a group of workload and making sure that you have a single policy for those workloads with multiple rules okay. Implement a hierarchical design that allows for optimizing the number of security policies by filtering out non-compliant flows at the top of the funnel. When we look at the policy model in subsequent slides you will look at how for example global network policies are used to implement certain high-level controls so that we can filter out unwanted or non-compliant flows at the top of the funnel. Use global network policies to implement high-level guardrails and network policies to implement fine-grained controls okay. So global network policies are what spans across multiple namespaces or even all the workloads in the cluster. So you could use global network policies to enforce high-level security intentions and network policies for fine-grained controls that apply to very specific workloads. Leverage policy order with allow and deny actions when developing security policies right. This is a powerful capability in Calico policies also use network sets and global network sets to group IPs and ciders so that they could be referenced by even multiple policies okay. It's just a bit more efficient doing it that way right. So with these best practices in mind let's look at some example security policy patterns. Now the cluster shown here will be used as an example to demonstrate certain security policy patterns. This particular cluster has two tenants and a tenant is simply a logical isolation so it could be any form of logical isolation. For example in your environment it could be a PCI environment that you'd like to isolate from the rest of the cluster workloads. If you're a hosting provider a tenant could be a customer so if you have multiple customers you have to make sure that they remain isolated in a shared cluster. Also if you're having a shared cluster that's shared between various development teams you may want to have a logical isolation all right. So a tenant is any form of logical isolation that you'd like to create for your cluster. Now a tenant could have one or more namespaces. So for example in this cluster tenant one has two namespaces it's a shop and yow back and tenant two has a single namespace called book info okay. Now the applications in these tenants are exposed using an ingress controller in the ingress nginx namespace right. So hopefully this cluster is similar to your environment of course you could horizontally scale you can have more tenants more namespaces but the pattern hopefully is similar to your environments okay. All right so now let's look at some example policies. Before we implement policies I'm kind of assuming this is a live production cluster so I don't want to break anything and that's why I've started off with a default allow here and the default allow is simply a policy that allows all traffic. Now remember in Kubernetes by default Kubernetes has a white list behavior however once you've matched pods in a policy there is a default deny behavior okay and implicit deny behavior. I'm using this default allow as a failsafe so that I don't impact any live production traffic in this cluster okay. So my first policy is a denialist policy and the denialist policy is a calico global network policies which applies to all cluster endpoints more the reason for that default allow. So now I have a policy that applies to all cluster endpoints what that means is all cluster endpoints now have a default deny behavior for egress traffic since this policy matches egress traffic okay. So this policy has egress an egress rule which denies traffic. Two IPs and siders in the IP denialist global network set and I've shown the global network set on the right hand side as well. Now recall that global network sets are a way of organizing could be IPs or cider blocks and referencing those in policies. Now the selector field is used in the egress rule to match the global network set based on the GNS equals IP denialist label. So if you look at the global network set we have a GNS equals IP denialist label which is referenced in the egress rule implemented in the security policy. But there's also a namespace selector in the security policy and the namespace selector uses a global match criteria and that's because this particular network set is a global network set okay. So what this policy does is if any of the cluster workloads try to connect to the IP addresses specified in this global network set those flows are going to be denied by this policy. For example if you could retrieve these IPs from a threat feed and update the global network set then you could effectively deny all cluster workloads access to those malicious IP addresses. Now if you look at the actual underlying policy implementation the policy is implemented for every endpoint in the cluster using the data plane okay. However for simplicity I've grouped all the endpoints and shown that traffic is denied to the IP denialist global network set okay. All right so this is the first example let's move on. The second example is the kube dns policy. Now the kube dns policy is a global network policy which applies to all cluster endpoints. It has an ingress rule which allows DNS traffic from all endpoints to kube dns. It has an egress rule which allows DNS traffic from all endpoints to kube dns. The selector field is used to match the kube dns endpoints using the k8s app equals kube dns label. The namespace selector field is used to select all cluster endpoints using the all match operator okay. So if you look at this policy this is a global network policy and in the ingress direction the destination is kube dns and we've allowed UDP port 53 so the protocol is UDP. If you were to kind of visualize this policy you have a kube dns endpoints and you have created this pinhole on the ingress direction from all cluster endpoints to kube dns. So we've matched all cluster endpoints by using the namespace selector with the all match operator. Now on the egress direction the source of the egress rule again is all cluster endpoints and the destination again is kube dns on port 53. So on the egress direction for all cluster endpoints we've created this pinhole permitting traffic if it's testing to kube dns on port 53 on UDP port 53. Again recall that the pinhole is in fact created for all endpoints in the cluster. However for simplicity I've grouped those endpoints and shown a single pinhole. So this is the kind of visual representation of this policy if you'd like to kind of visualize what the policy looks like and this would be it and this policy is quite powerful isn't it. You now have a single declarative policy that's protecting all dns traffic in the cluster. So you may have thousands of polls and thousands of dns flows in the cluster that are now protected by this single policy. Okay let's look at the next policy. This policy is called tenant one restrict. So this is a calico global network policy which applies to all cluster endpoints in tenant one. The namespace selector field is used in the security policy with the project calico.org forward slash name label to select endpoints in the tenant one namespaces. It has an ingress rule which denies all traffic except from the specified namespaces. It has an egress rule which denies traffic except to the specified namespaces and the not selector field is used in ingress and egress rules with the project calico.org forward slash namespace label to exempt endpoints that should not be denied. Okay so this is a global network policy and in the policy and in the policy the namespace selector is used to specify the hipster shop and yaw bank namespaces. So this policy applies to the hipster shop and yaw bank endpoints. In the ingress direction there is a deny action however the not selector is used to exempt the endpoints that should not be denied. Similarly in the egress direction the action is a deny again the not selector is used to exempt endpoints that should not be denied. Now the project calico.org label is a label that can be used to identify namespaces and endpoints in those namespaces. Now the value of the label is the name of the namespace. So you could use the project calico.org forward slash name key with the value of the namespace and calico will then select all the endpoints inside that namespace to scope the policy or the rule. Okay now the project calico.org name label is something that can be used to specify or select endpoints. It's a label that calico associates with an endpoint and the value of the label is the name of the namespace that endpoint belongs to. Okay so since we're using a not operator we're using the project calico.org forward slash namespace label and we're providing the name of the namespace so that those endpoints are exempted from the security policy. Now if you want to visualize this policy we have the tenant one endpoint selected using the namespace selector so basically endpoints in hipster shop and yaw bank. All traffic to other endpoints are denied except for what's exempted using the not selector. So this policy does not permit any traffic right? Given that you've specified a policy for tenant one restrict a subsequent policy must permit traffic flows that should be permitted for tenant one workloads. Okay all this policy does is it isolates the tenant one workloads and denies traffic to all other cluster endpoints except for what's exempted using the not selectors in the rule. Now we're going to have a similar policy for tenant two as well again a global network policy using the namespace selector with project calico.org forward slash name label to select the tenant two endpoints has ingress and egress rules again with not selectors using the project calico.org forward slash namespace label to exempt endpoints that should not be denied. So similar to the previous rule you know the book info and the ingress engine x namespaces are exempted now of course we're exempting the ingress engine x namespace even in the previous case because the applications are exposed via that namespace okay so we'd expect to receive inbound traffic from that namespace again we are not permitting that traffic and when you look at subsequent policies you will see how traffic from ingress engine x is permitted to workloads that are exposed to external consumers okay however with this policy what we've done is similar to the previous policy isolated tenant two endpoints from the rest of the cluster okay so the two restrict policies you know with the two restrict policies you've created a certain level of isolation so high level guardrail demarcating those workloads from the rest of the cluster workloads okay all right so now we have a policy called the front end policy now the front end policy is a network policy which applies to the front end endpoints in the hipster shop namespace in tenant one now the selector field is used to select the front end endpoints using the app equals front end label has an ingress rule which permits traffic from the ingress controller the namespace selector field is used in the rule with the project calico.org forward slash name label to select the ingress engine x namespace and the selector field is used with multiple labels to select the ingress controller egress rules with the selector field matching app equals x meaning we've got multiple labels being matched to select other endpoints in the same namespace that the front end endpoints communicate to okay so let's go through this policy a bit this is a network policy which means it applies to a specific namespace the namespace being the hipster shop namespace however in the policy we are using an endpoint selector so we're using the selector field and using the app equals front end label what this means is that the policy applies only to the front end endpoints okay in the ingress direction you are using a namespace selector to select the ingress engine x namespace however we're also using endpoint selector so we're using the selector field and using an end operator specifying a couple of labels to match the ingress controller okay so when you're using selectors and when you're using labels you could use an or not operators in this case we're using an end operator to make sure that the controller has two labels and that's how we are identifying the ingress controller for in this particular rule okay now in the egress direction front end is sending traffic to ad service service specified a port here similarly sending traffic to checkout service now this rule continues i've truncated the rule what's important is not the number of services it's talking to in the same namespace there's quite a bit of them for this particular application but the idea being that the pattern is is the same it kind of repeats and what we're doing is given that this policy applies to the hipster shop namespace we're using the selector field to select other workloads that the front end workload can communicate with in the same namespace now bear in mind that just because traffic is permitted from the front end workload doesn't mean that we've allowed end-to-end communication okay so if you're to visualize this policy you know we have the front end endpoints and in the ingress direction we've created a pinhole so that the front end endpoints can receive traffic from ingress nginx and on the egress direction we've created a pinhole so that the front end endpoints can send traffic to other services in the same namespace however for those services and we look at this in a subsequent policy you also have to make sure that you create an ingress pinhole for those endpoints okay which we've not done yet so just because there's an egress rule permitting traffic from front end to a checkout service it doesn't mean that the rule or the floor rather is allowed end-to-end all right so now let's move on to the checkout service policy again this is a network policy which applies to the checkout service endpoints in the hipster shop namespace the selector field is used in the security policy to select checkout services endpoints using the app equals checkout service label has an ingress rule with the selector field to select the front end endpoints using the app equals front end label and several egress rules with the selector field matching app equals x labels to select other endpoints in the same namespace the checkout service endpoints would need to communicate with all right so in this example the policy is a network policy very similar to the policy we saw for the front end service however if you look at the ingress rule we are simply permitting the front end service to talk to the checkout service so there's a pinhole now created in the ingress direction for the checkout services endpoints however if you recall the previous policy the egress pinhole for the front end endpoints were created in the front end policy okay so now with this policy we now have end-to-end communication or the end-to-end flow from the front end to checkout permitted okay and the checkout service endpoint has an egress rule so pinhole in the egress direction for the checkout services endpoint to permitting it or allowing it to communicate with the other endpoints in the same namespace that it should be able to communicate with okay again the same logic holds right so for example if it's communicating with payment services in the policy that we have for payment services we've got to make sure that that flow is allowed in the inbound direction okay so the policies we're developing for the hipster shop namespace are very fine-grained granular policies right the policies apply to select endpoints endpoints representing a particular microservice and for those endpoints we are applying rules in both the inbound and the outbound directions right so these are very granular policies okay now of course for the checkout service we are not permitting traffic from the ingress because it's the front end that communicates or the front end that receives traffic from the ingress okay however the checkout service will receive traffic from front end and on the egress direction communicate with other microservices or endpoints in the same namespace all right so let's move forward so I've not shown the rest of the policies for the hipster shop namespace those policies you know will continue however the pattern remains the same okay so assuming that we've completed the policies for the hipster shop namespace let's now look at the policies for the yaw bank namespace this policy is a network policy which applies to all endpoints in the yaw bank namespace has an ingress rule which permits traffic from the ingress controller the namespace selector field is used in the rule with the project calico.org name label to select the ingress engine x namespace and the selector field is used with multiple labels to select the ingress controller traffic permitted to the customer endpoints using a selector with label equals app equals customer label now the policy also has an ingress rule which permits traffic from all other endpoints in the same namespace using the selector field with the all match operator similar it also has an egress rule which permits traffic to all endpoints in the same namespace using the selector field with the all match operator so this is a interesting pattern so very similar to the front end policy we looked at however with a distinction so this is a network policy applies to the yaw bank namespace and in the ingress direction if you look at the rule given that this policy applies to all endpoints in the yaw bank namespace we've not specified a selector and what that means is all endpoints in the namespace are matched for this policy if you look at the ingress rule very similar to some of the ingress rules we looked at previously we are using the namespace selector and the endpoint selector to select the nginx ingress controller however this particular rule also has a destination field that's used and the destination for the ingress rule is the customer endpoints okay if you look at the second ingress rule what this means is that all endpoints in the yaw bank namespace can receive traffic from all other endpoints in the yaw bank namespace given that this is a network policy and we've not specified selectors all endpoints can receive traffic from all other endpoints and the egress rule is similar to that as well there are no selectors and what this means is that all endpoints can send traffic to all other endpoints in the yaw bank namespace so this is what the pattern looks like the ingress nginx can send traffic to the customer endpoints that's governed by the first rule in the ingress direction however the endpoints within the namespace can freely talk to each other since we've permitted or allowed outbound and inbound communications from all endpoints in the same namespace so this is what this pattern looks like now this is a bit of a coarse-grained policy at times you may want to implement such policies right if you trust all the workloads inside the namespace if it's a namespace that is not too critical however has several workloads you can create a guardrail around the namespace rather than for every group of endpoints inside the namespace now this differs from the policy we created for you know front end and checkout and the services in the hipster shop namespace because those policies were very specific to a group of endpoints within the same namespace and even when they had to communicate with other endpoints in the same namespace it had to be explicitly permitted using rules or policies all right so moving on to the book info policy very similar to the yaw bank it's a very similar pattern again traffic from the ingress is permitted this time to the product page deployment which is exposed to external consumers and all communications inside the namespace who went from all the endpoints inside the namespace is allowed okay so very similar pattern to what was seen in the yaw bank policy so it's not important that you kind of understand all the microservices involved in some of these examples the idea is that you understand the pattern right so in the yaw bank example it was the custom endpoint that was exposed to external consumers and in the book if for example it's the product page endpoints that's exposed to external consumers and those are the endpoints that have the pin hold in the ingress direction permitting traffic from the ingress controller all right so we've looked at a few policy patterns right so we started off with the denialist we had a pattern for qdns build policies to restrict tenant one and tenant two workloads we looked at some granular policies for the endpoints in the hipster shop namespace and then look at some coarse grain policies for yaw bank and book info once you're done building policies for a certain set of namespaces you could then enforce a default deny for those namespaces so in this case we're first enforcing a default deny for tenant one and what this says is that deny all traffic in the ingress and egress directions for the tenant one workloads this policy is a global network policies and the workloads identified using the namespace selector in this case we've matched the hipster shop and yaw bank namespaces similarly we have a tenant two default deny very similar logic it's a global network policy we've matched the namespaces using a namespace select in this case it's just a booking for namespace and all ingress and egress traffic is denied all right so hopefully now you understand the reason for this default deny right sorry default allow if you look at this policy model i have policies where we've matched all the endpoints in the cluster for example cube dns however we've not built all the policies for all the endpoints in the cluster right and what this means is that if that default deny sorry the default allow wasn't there right i would be denying all other flows in the cluster so the idea being that you take a progressive approach when developing your policy model you may want to restrict certain environments so in this case assuming that the one the tenants were actually customers you'd want to secure those custom environments and isolate them from the rest of the cluster so that's what we've done and now you can continue with the rest of the policy development however hopefully the patterns that we've shown with the global network policies and network policies and how environments were isolated from the rest of the cluster the course grant policies and the fine grant policies hopefully those patterns help you think about how you should be approaching policies for your environments all right so with the policy model built now you're in a position you know to introduce security policy governance okay and when you're thinking about governance you gotta think in terms of the policy model rather than individual policies and leverage security policy ordering role-based access control and admission control to enforce policy governance okay for example if application developers are authoring policies and if they're authoring policies for a particular namespace you could for example assign a certain order for the policies that they are allowed to author okay that kind of ensures that they're not able to circumvent high-level controls that you have enforced for example controls such as the restrict and the denialist may be under the purview of the security team and when you're permitting other authors to apply policies you may want to have some governance around that and policy ordering is a feature that you could use to create a governance structure okay of course policies are Kubernetes resources and as such are subject to Kubernetes are back again when allowing other authors to apply policies you could control which authors can apply policies to which namespaces using are back of course tie all of these together with admission control alrighty so there's a lot going on in a calico policy I think we've simply scratched the surface here the best place to understand all the features all the capabilities all the fields and operators available in a calico policy is to refer to the documentation I've put the link here to the network policy and the global network policy documentation for project calico all right so with that you know let's talk a bit about calico enterprise and calico cloud calico os s is the foundation for calico enterprise and calico cloud we look at the policy features in calico os s and calico enterprise and cloud builds on top of this and offers certain advanced security policy features for example you could use policy tiering so when we build policies this time the policy model was in a single tier with calico enterprise and cloud you have the option to have multiple policy tiers there's a policy ui editor a policy recommender to such as policies based on active flows in the cluster policy dashboards with prometheus metrics policy auditing login capabilities and endpoint browser to identify which policies are applied to certain endpoints service craft to identify and understand security policy evaluation flow visualization for travel shooting and compliance reporting so add on functionality however the functionality provided by calico os s remains the foundation for this additional capabilities all right with that i think we're going to wrap this session again thanks for your time i hope it was beneficial for more information you can find us on the project calico slack channel and also the project calico documentation for further information around some of the policies and the policy features that we discussed in this session with that thanks for watching i hope you have a good rest of the day thank you


Hundreds of lawmakers have been sworn in to a newly created national parliament in South Sudan. It's a long overdue condition of a peace deal that ended civil war in the country. And in all 588 MPs took the oath of office at a ceremony in Jubbra presided over by the Chief Justice. And 62 lawmakers stayed away from the swearing-in ceremony and some of them became because of squabbles with the government. The inclusive parliament has made up of delegates from the ruling party and former rebel factions who signed a 2018 cease-fire that paused five years of bloodshed. About 400,000 people are reported to have died in those years. The challenges ahead of us are enormous. To confront and overcome those challenges, the situation demands that we, as the representatives of our people, should look beyond political, partisan and tribal expediencies and focus keenly on the common good of all.  As their representatives, we ought to be the people at the front of the efforts to recognize that plight. Hit the notification button so you get notified about fresh news updates.


Five best winter fragrances for men. Number one, Ralph Lauren Polo Green. It's got notes of pine and leather. It's one of my all-time favorites and what can I say? It smells like the season. Number two, Arquist Misfit. Smooth and sexy, one of the most refined, elegant and softest patchoulias you'll ever smell. Number three, Frederique Moll French Lover. It opens fresh but dries down into a really masculine woody, musky and earthy scent. That's good. Number four, Santa Maria Novella Tobacco Toscano. Tobacco Vanilla, very soft. If you wear this, you will get compliments. Number five, Tom Ford for men. It's warm, spicy and aromatic. A classic gentleman's scent that's great for wearing every day.


So I'm going to do a quick talk just about this project that we did very recently. I think it started in autumn, I jumped in in January. This was a project to develop a couple of fixes and resources for WordPress Core. So this was our roadmap. We cannot make WordPress sites compliant, but we can provide site administrators and users with the tools they need to help them bring their sites into healthy compliance. Any given WordPress site is a combination of core and plugins and themes and no to our life, there's different ways that they're capturing information, processing it and sharing it. And we can't save people from themselves. All we could do was deal with core and also at the same time set a best practice example for others to follow. So we were working towards Friday's deadline of GDPR to that definition, but throughout the journey, we did discover various other issues that are equally important as general privacy principles but didn't necessarily fit into that rubric of GDPR. So we've sort of bookmarked all those issues and held those thoughts that we're now going to start coming back to. So that was our roadmap. We did have a few constraints for this project. Number one, as I said, we cannot make WordPress sites compliant. We can only deal with a couple of things in core. No tool achieves compliance in and of itself. GDPR is about your business processes. It's about how you work internally, how you collect information, how you process it, how you share it, how you train your staff, how you delete the information. You can't automate that. And no tool removes the user's responsibility for compliance. Everyone wants the magic plugin. Everyone wants to just push a button and say, I'm compliant, that is not how it works. So we were very, very keen to keep it about personal responsibility while giving people the tools they needed so that they didn't have to be developers or lawyers or both. I always tell people there's no such thing as compliance. There's no such thing as being GDPR compliant. It is only a best practice journey. The quickest way to fall out of compliance is to think you are. It's about how you do things every day, every week, in your month. I encourage people to even put calendar reminders like every three months just renew our processes, look at what we're doing. So we steered away from anything that actually offered compliance even though you kind of had to say, we called it GDPR compliance for lack of a better term. It was a hard sell because the WordPress project as a whole is allergic to anything legal. It is an international borderless project. So you can't really work to any one set of legal rules or restrictions or constraints. It's also very largely American dominated and a lot of American developers don't want to deal with politics or law in any regard. But the way to sell the project was to sell again about best practice, not about taking a European box. And to be fair, no open source CMS project has given GDPR or privacy really proper resourcing. They are now, I'm speaking at a Drupal conference next weekend about this project. So we were sort of the least worst. Which is kind of a backhand compliment, but nobody really got on this as they should have, but we did the most. I've just repeated. So we had four aims to the project. Number one was to add tools to core, still take compliance and privacy in general. Number two, add tools for creating a privacy policy. Number three, create some guidelines for plugins on compliance because anything you're doing now really is a retroactive fix. What we want to do is look at how can we better define things so that you don't have to go back and delete that data because it's never captured in the first place. And add some documentation and help for site owners on how to use these tools. Again, we don't want people to be developers or lawyers or both to have to understand this. So we shipped 496 last week. Yay. And I know you've all updated because except for Queens, we're apparently running 3.7.1. So she's throwing behind that. I actually only set up one platform with Queens on WordPress and mainly because it was so easy to find it. And I moved jobs. Oh, jobs? Okay. You're all free, Dr. It sounds like you're hearing Tim Dash screaming across the audience. So when you look in your WordPress dashboard now because you've all updated, you will see privacy notice tool, a data export tool, and a data eraser tool. So here's the tool to export personal data. So if somebody files a request to see what data you hold about them, this tool will collect all that data in an exportable file. And this is a good example of how we had to sort of wrap our heads around how to do this. You can always export a block, which is your post in your pages, but when you're coming to the personal data, we had to build in the hooks so that this tool could get the data. And we had to build in that functionality into core and hopefully plug-in so that that data could be sent. So it was about building back and forth functionality on the front-end. And again, this is about best practice, giving developers the tools so that this becomes the development standard from now on. So this is what you'll see. You'll see pending, confirmed, failed, and completed. And we put in that it has to be a request through the administrator through a dashboard to protect against abuse from people saying, I am this person. So it works like a comment. And the same for eraser. So if somebody requests their data to be deleted, this tool will basically do the same thing and remove it from the database. So remember that the right to be forgotten is not absolute. If somebody requests to have their account deleted and, for example, you have a little commerce shop, you may be required to keep their sales records for seven years for tax purposes. You don't have to delete their sales and purchasing records. Don't do anything thinking you are complying with this law, which will actually cause you to be in violation of another law, whether that's taxation or otherwise. Another question I got is abuse. I do suspect someone has been misusing systems, abusing users, and they file a right to be forgotten request to try to delete the evidence trail. You don't have to do that. So this was my baby, my good care final one, the Pryosy Notice Tool. One of the requirements of GDPR is the right to be informed. So you have to inform your users of everything you are doing with their data.  But that's a gift and a challenge because people have to write these on their own now. They can't copy and paste someone else. They can't download a template. They can't get a lawyer to charge you 2,000 pounds honest of God, 2,000 pounds for a page of legal gibberish that bears no resemblance to what's happening on the site. So we can't write these privacy notices for people, but what we could do is provide them with number one, the tool to do it, and number two, the prompts so they know what to do. So we've provided a starter tool for a GDPR-ready privacy notice, and as I said, it's not a template. There's headers and there's prompts and there's a tutorial linked to in the dashboard, but it's just that. We're building in the functionality to feed in info from plugins and themes, for example. So your comment form entries, oh my God, the newest Windows feature update is ready to install. Not now. Because, example, your comment form entries are stored on the database, but a site administrator might not know that, and that could get them in trouble, as we certainly saw. So, again, we don't want people to have to be developers and go into the gubbins of their sites and find out what's on the database, what's this. So we want to build it in, so that if a plugin is capturing personal data, that will show up in the privacy notice tool, saying comments are stored here, whatever is stored here. And again, the admin is responsible for publishing this. We only provide the page and the tool and the prompts. The admin still has to write it and hit publish. So you will see this, privacy policy page. Why did we have a hard time with this text? So we explain what this is for, what you do with it. So check out our guide, is the link to the tutorial that I wrote. That was very hard to find. So that guide will tell you what you need to write and what you need to write it. We have it so you select an existing page or create a new one. Okay, here's my guide for the start of it. So this text template will help you to create the website's privacy policy. And I've had some really good feedback on this that people are finding it very, very helpful that they appreciate that we're not going to do it for them or we're going to tell them what to do. So yeah, this is a bit of a whole screen chat. So we have a bit of a UX debate about, I mean we know full well that people don't get published with that text in. So we try to put in a tweak or two so they get the hint. So I'm really, really proud of that because we've made it possible for everyone with the WordPress website to provide their users with the clarity and the transparency that they need to trust the site. And we've probably put a lot of lawyers' noises at joint two, which is worth it. So the next area of work we focused on was guidelines for plug-ins on privacy. So some great members of the team wrote some good documentation for developers. So that when they're developing a plug-in that they know how to feed in these hooks and functionality for the privacy notice for the data export tool. We're looking at the plug-in guidelines and what they say and don't say. Again, any work being done now is just a fine fix as to whatever's been done. So this is something we're going to turn our attention to now, keeping in mind that it is a very contentious issue. Some people don't think we should be telling developers how to develop plug-ins and some of us. If you look at them right now, they're very fit on the ground about what they say about various privacy issues. So we're going to take a look at that. This I am really, really proud of. I work with Mika Epstein on the plug-in review team to get compliance removed from guidelines so that you can no longer say that a plug-in makes your site compliant in anything.  You can say that the plug-in assists with aspects of the journey as it should. You can say it provides tools and workflows to help parts of it, but you cannot say this will make you compliant. So Mika did a scrub. The first, I think she got about 1200 plug-ins with the word compliance in them and after she removed all the false positives, she got it down to about 250. One of them has half a million installs. So she's had to be in touch with 250 plug-in developers about changing their descriptions. They're still welcome to keep their plug-ins in the repo, but they're not allowed to say this will make you compliant. It's not just GPR and cookies and privacy.   That's not what plug-ins are meant to do. Somebody else on the compliance team found a plug-in that was offering to make a site ADA compliant, which is the Americans with Disabilities Act, and the plug-in was not ADA compliant. So I've been ranting on word count stages about this for about eight years, and I'm so glad we've sort of killed the problem with the root. So the next area we took a look at is documentation and help, which I would be writing right now if I wasn't here with you. We've provided some information for users, information for site administrators, and information for developers, both on things like how to use the hooks and the plug-ins and then more broad things like how to conduct a privacy impact assessment. And Automatics Legal Department has started a site called Privacy.log, which is sort of modeled on their transparency report as well, just being a little more clear about how the project and how the product uses data. So what is next for the project? It's important to remember that GDPR does not mean privacy. So the core group that did the GDPR compliance project is we are continuing as a permitted privacy subgroup. So I think we need to edit this now because there's a new one for privacy as a principle, not as a means of meeting the requires of one specific law. Small P, privacy as a concept. But this is something I think difficult about and I'm going to continue to be difficult about it because it's worth it. We have to define what privacy means. Privacy can mean many things to many different people. There are legal aspects. There are cultural aspects. So before we just start throwing track tickets around, I want us to work on defining what falls under the group of privacy. Is it consent? Is it transparency? And possibly it spans to an open source standard. I've been given the contact addresses of some people in the Drupal community who I'm going to be meeting with next week in the Netherlands to see if maybe we can get this common language going. And you're welcome to join us. Our office hours are 1,500 UTC on Wednesdays in making WP Slack. Right now the Slack group is called GPR compliance. We're going to change it to privacy in about a fortnight just in case people are confused. So we have, as of this morning, 91 privacy track tickets open. Most of which are bug fixes some of which are enhancements and we have two tickets placed in 5.0 out of way to register if you request information or anonymization of the private data, make the export delete functionality available in network whites for super admins. So we have a couple tickets we're going to look at. Those are bug fixes, as to admins and unit tests. There's issues like portal imagery. We are going to continue poking a stick into that behind. So next up for me, as Abba said, is I'm running a three hour workshop on developing for data protection privacy in Belgrade. As I said, you technically have to register in advance, but if you're there and you're not on the slide, we'll get you in. I want to encourage you to stay in this room after this session for Dave Potter's talk about, it's kind of a privacy by design talk about building and responsible data process workflows so that you don't have to clean up these messes to begin with. So please use the tools for what they are worth. Please get involved in the privacy core group. We are having some tickets. We are having our first ever WordPress Contributor Day in September. Not as part of our camp, just come by. Thank you very much. Very good.


Let's talk about some interesting questions. Like how is the poverty line decided in a country? Or how are the exam cut offs are decided? We often wonder why somebody just over a particular line is considered say not poor and just below that line is considered poor or for that matter when you apply to some college Just by one mark. You may lose the seat or you might get the seat Just consider the days data set that I've drawn here I've shown it using different dots and that's not the point basically But the idea is let's say this is say some college and we have got so many applications and these dots are showing marks Let's just say these are marks and the college wants to segregate and just divide the data into two so that say a line like this a vertical line line like this and Everybody on the left of that line doesn't get the seat Doesn't get the seat everybody above the line gets the seat or probably is considered for the next round gets the seat so which data do you choose to draw the line in between and that's where we want to study median and median is also major of central tendency and It is usually used to divide the data into two major groups mostly Where mean or mode might not be the best cases just consider if these are marks and if I decided That I'll consider the mean of the marks But let's say this student here at the top just go way more than everybody else So the mean would move upwards the mean probably will be somewhere here And there is a chance that if I decide the mean everybody above mean gets to the next round and everybody below that doesn't get Then there is a risk of losing out on many good candidates And if the same thing happens at the lower level that this student has scored way lesser Then mean might move to the left and this could be the mean and we might lose on to Like we might just get through a lot of students and we will have to consider a lot of students in the next round So my objective is to select just half of the students about some median mark so that I can limit the applications Let's see how we can do this So to formally define median we can say median is the observation in the data set where half of the Observations are above it and rest half Of the observations are below it and this is basically The definition formal definition for the median So quite clearly now we will just have a data set and our objective will be to decide the observation Which just separates the data into so let's just have a data set So you see a data set like this we have different numbers and now the question is can I just draw a line somewhere and say Okay, these are the half observations and these are the half observations and I'll just choose value in the middle No, that's not a correct way to do this And we'll have to modify this definition of median that we just wrote Basically what we want is half of the observations Below the median should be lesser than the median and half of the observations which are on the other side of the median Say at the upwards of the median should be greater than the median And so half of the observations are greater than the median and the other half is lesser So now what we'll have to do is to arrange the data in the increasing or a decreasing order So let's just arrange the data in increasing order So let's write Two and then we will have the rest of the twos. So we have one two three four twos So that's how we'll write twos Which is the least which is the least value in the data set and then we'll go for three So there is one two threes. I guess so yes two threes Then we'll go for five because we don't have a four five and then another five and Another five. So there are three fives then we'll go for six One two and there are two sixes. So two sixes then sevens So I think there are two sevens Perfect, then I don't think there is a there is a eight but there is a nine one nine and The second one. So there are two nines and two tens So this is how we have arranged the data in the increasing order and now We can easily select a data observation which separates the data in two parts If you notice we are working with odd number of observations because it's easier to spot the middle value So let's count how many data observations we have We have one two three four five six seven eight nine ten eleven twelve thirteen fifteen sixteen seventeen So because we have seventeen observations If you choose some middle value, there should be eight values to the left of it and eight values to the right of it So let's just go for the ninth value from the left And that will be this five here. So this is the median and easy to see that these are eight observations and these are eight observations here and the eight observations on the left are less than five and eight observations on the right are greater than five and this is the median that we have found and median was the ninth number from the left And because we have n observations where n is odd Then the position of the median value would be n plus one divided by two I'll encourage you to find out What is the position of the median when we have even number of observations? Just a hint the median is a value that is available in the data set when the number of observations are odd But when the number of observations are even The median is not available in the data set and then you will have to find out the Median from two values in the data set two mid values So I'll encourage you to find out how we can do that


During the next four years, it was really good.  It's $17.99, it's a US dollar, but I bet you can get it for free at your library. Get it from the library while the library's still here. It's a great book and Carol got it so I can give it to my son if you have kids or friends or both. It's a wonderful gift. And Lynn gave me this wonderful food. I'm going to be a nasty woman right now. So, you know, we continue. We continue. This is Watch Me Work. Who hasn't been to Watch Me Work before? Anybody? We haven't been here. You haven't been to Watch Me Work. Are you here for Watch Me Work or are you just like hostages in the lobby for things? They're like, I just came for a drink and I'm trapped here. It didn't come. Oh, you mean it didn't come? No, you are. Well done. I'm well done. Thanks for coming. So, I'll give you a quick write down of what it is. So, because we have a velvet snake, that means it's a play. That's all you need to make a play, really. So, this is a play. It's also a free writing workshop, okay? So, or a free creativity workshop, actually, because we have people who are doing all kinds of work, not just writers, all right? So, what we do first is we create the action of the play together. So, what we do is we, for 20 minutes, we work to time it, we work together. So, whatever you're working on, a dance piece, a song, a writing project, whatever, whatever, whatever, you work on it, okay? And we also have people online who sometimes tweet in. They've been shy lately. We know you're out there. It's okay. Shy, you know, it's okay. So, we work together for 20 minutes and then we create the dialogue together because it's a play. And the dialogue is basically you guys' asking me questions about your creative process. I'll do that just again, okay? So, it's you guys' asking me questions about your creative process. So, if any of you want to ask me a question about my creative process, those of you who have been here before know I'm going to make it about you. Okay? So, that's kind of all there is to it, kind of, kind of. And Melissa is going to tell the folks online how to tweet in and tell them like, not if you want to tweet in, but when you tweet in. If you follow us on Twitter, you would know because I give you a little heads up as to where we are in the performance. But anyways, if you'd like to tweet in, you can tweet into us. Our Twitter handle is at what we work SLP and then make sure to hashtag howlground and that's one word. It's H-O-W-L-R-O-U-N-D. And please, please, please send us your questions. Yes, please, please. Please, please, please, please, please send us your questions. Don't. Because there are a lot of people here today and if you don't, that's fine. But here we are. There are people, you can hear the sound of somebody. Someone who is not shy already. So, there you go. So, someone is already taking the lead. Shout out to Alicia Nash. Alicia? Alicia? I have a call.  But anyway, so we're going to work for 20 minutes. I'm going to use my phone today as a timer, okay? And we're going to work. I'm going to, usually I type on the typewriter, but today I have some manuscripts to correct, so that's what I'm going to do. Right. So, pretend you hear the sound of a typewriter. Okay, begin. Let's go. So that everybody can hear you. Anybody? Are you here for watching? We studied some of your plays in our theater class. Oh, wow. I know. Where do you go to, where do you teach? We're at a public school in Bushmore. Oh, right on. Yeah. Thanks for coming. Thank you. Welcome here. These are some of the interesting things, right? Oh, right on. So, you guys do some playwriting of your own. Yeah. How's it going? Good. Good. Yeah, is that all right? Yeah. Do you write on the typewriter or do you write on a typewriter? Do you write on the computer or by hand? On the, by hand and on the computer? Yeah. Which do you prefer? Yeah. Handwriting, your hand gets tired, she said. That's true. And when you type, it's like, it's already there. You don't have to like write it and then type it, you know, right? It's like one stop shopping. That's smart. Yeah. Sometimes ideas can flow more freely when you're just like, anybody else? So, we're just going to talk and feel free to like, raise your hand or like, blur it something out. It's not formal. It's very informal here. Okay. Anybody else have any questions about, hey, Stacey Rose. Your question, your work, your creative process. You got a good amount of people here. Does the Twitter person have a question? They just say, hey. I say hi. Yes, you have a question. What's your name? Hi, I'm Susan. Earlier this spring, I came back from a six month trip to Brazil. I came back with six notebooks and I was going to work on a manuscript of like poetry and travelogue. I was procrastinating this summer and going to get back into it. But as of a week ago and after our election, I'm feeling a combination of both futility and fervor. I feel like I need to be of service. I'm no longer interested at all in my manuscript. I do understand the need for like art and literature in the world, but it somehow feels irrelevant to me right now. So, I don't know how to deal with that. Do I take a break? Do I go back to this thing? Do I take conflict resolution classes like that? Disgusting. Conflict resolution with yourself. Well, that's where it all starts. Conflict resolution begins at home. Susan, that's a really good question. Did everybody hear Susan's question? She came back, we're a trip away.  And hey, hey, hey, hey. Hey, Alexis. Alexis is here. Because that's how cold it is outside. So, she came back from the trip with notebooks full of really great ideas. And she had a manuscript in mind. And then she didn't jump on it right away, we say. And then the election happened. And now she feels like, eh, I should be of service. And doing art doesn't feel like it's the way to be of the most service. It just feels like my energy is no longer there. I don't know whether to, you know, create an outlet to discipline myself and do that or take a break and do whatever is calling to me, which is not completely clear. But it's not the manuscript at the moment. It's funny. I appreciate you telling us a whole story of the journey. And, yeah, Stacy's going in.  I mean, the only, the thing that gives me a hint to what you might be more inclined to do that might be right. Because you were procrastinating before the election, it might not be the thing you're supposed to be doing right now.  Oh, it is. You know, Europe. Then that would say, let's find a way to get you back on the horse, you know. But because you hit a wall before that, then I would say maybe you're not ready to write it yet. So you can do an experiment. This is fun. So you can do an experiment where you can experiment with not writing it and tell yourself, you know what, I'm going to put you away and I'm going to put you in my notebooks. Do you have a nice tote bag or a cloth tote bag or a nice cloth in a little box or something? Give it sort of a cold storage above brown. Don't burn it. Just put it away. I'm going to leave you alone for, I don't know, what's a good date? What do you think? A month? Yeah? A month? Today is the what? The 21st of my best? 21st? Okay. So you could give yourself to the 21st of December. I'm not going to think about it.   You're calling me to do something what? If it's not that, then what is it? Talk to me. I'm listening. I'm not getting muddled up with this other project. Doesn't seem like it's ready for that yet. Here we are. What is it that you want me to do? Okay. Give yourself a month and see what happens. Okay. Just again, I think that's a great question. So, where a lot of us are at, it's like, what do I do now? You know, so give yourself a pause and see, just actively communicate with what you think might be the other project. You know? Yeah, that's good. Okay. We'll see. It's always fun and it's like a special day for other people too. Great. Perfect. Perfect. Okay. Okay, that's good. And check back in, you know, if you can come back here or check in with us on Twitter and tell us how you're doing. Okay. Thanks for asking a question. Anybody else? Yes, Sam. I'm just like, oh no.  I have things to say about that. And I think I'm thinking about what it's going to be like on 9-11 for me as a first responder to have to deal with him at ground zero. Right. So, that's been kind of what's been interesting about that is like, I've freed myself from research because I can just watch it in real time. And that's kind of what I'm trying to encourage people around me, but I'm mostly trying to encourage myself. So, I mean, I don't know, it's been a very, it's been a very strange experience to look at what may or may not happen and have to, you know, go through and try and figure out what, what does this mean? Like what, it's, I guess, I just kind of looked at everything and I have a, I have a scene I now like have to write. I have to write it. So, now it's just a matter of, I kind of sat here and said, okay, maybe my issue is I don't feel it. I keep going, this happened, this happened, this happened and it's something that had, you know, at 22 to be in a foreign country and be faced with something so ridiculous. And then 30 years later say, okay, I'm putting, I was in Kenya, it's not something I've really talked about and I was offered money for my passport. And it's been a very, like, I've started to talk about it because I think it's important that people know that 9-11 didn't just happen out of the clear blue sky. It was, you know, they've been working on it for 30 years. And, you know, I think about that and it's, it's not that I made a decision that I felt was the right decision, which is to say, no, don't ask me again. It's how, how am I implicated in the people on that trip that did? So, I mean, I'm trying to figure out to not feel like, okay, I'm not responsible for anybody's actions other than my own. But how I have to figure out how, how do I like navigate that? I don't want you to talk about how you're going to get your writing done. Well, that's, that's part of it. Because that somehow- I'm writing and scrolling in a notebook and that's, I'm trying to make sense of it. Right. Because somehow something happened in the way that it has, is important to talk about. And it's important to go through and process. But I, I want to talk about, you know, give you tools to take those steps out of the pit so you're not in the swirl of what happened. You know what I mean? Because that's not a good place to be. You know, we want to, we want to move forward as best, as best we can. So how is your play going? It's a, it's a difficult, I didn't realize how difficult it was because I had to just shut down and leave. And now I go, how did I end up with that and writing it down what happened each day and going through all of it. It's just getting it and having it make sense to someone other than myself. Well, I think that's the exact way, that's what I was going to guess at.  And you want it to be good or you want to reread it and think it's pretty good, right? We got to let go of that if it's going to be anything at all. We got to let go of the need for it to make sense to anyone other than ourselves. We got to let go of the need for it to be good and we got to just embrace the need for it to be eh. I'm usually here in this part of the conversation, I use another word but I'm not going to use it because, because we have friends in the audience who are, or you know, how are you guys? 10? Yeah, you're 10. So okay, cool. So we're going to, you know, we're going to like amend our choices here to accommodate our also people who come who are 10.  I mean any of you have like a cat or a dog, you have a dog.  Like, and you go look, yuck, right? So sometimes when we're right, it kind of looks like that. And that's okay. That's okay. It's okay. You just have to keep moving forward. This is something that you might tell yourself as you're talking to your project, you know, but you have to keep moving forward. I keep telling you guys that you just have to keep moving forward and writing to the end and then seeing what you got and make it better from there. Okay. Tracy had questions. Yeah. Remember last week I was telling you that I was having a really hard time getting back into it and taking a little bit and doing all that and not been doing that. And a lot of the issue I was having was around the election and was around everything that was swirling around it. But what I came to find and what I discovered through just meeting with friends and hanging out and reading profusely, going to see shows, just involving myself and determining what I, like I thought about it and I was like, well, I'm 40 and I'm going to die.  So what can I do to make, like, what do I want to do at this time and how can I be more productive? Well, I can't think of anything I'd rather do than right place. And so it's like investing myself in that has helped me one calm down and to find a voice for what it is I want to say and who I want to help. And so it's sort of like I can't change the political construct of this country with one play. I just can't. No matter how long I write it, no matter how long I rewrite it, I can. But I can push and help others push to make their art and express themselves and go into communities I feel concerned for and be of help in that way, whether it's with my art or whatever. But it makes me feel useful. And so yeah, I just, you know, just dig in, just dig in deeper into what you were already doing and just find what you love and do it. Like, for me, this just the week, it just feels different. Like, I just decided to dig in. And it's just been such a great week. It's not been a great week, but it's just been a week where I feel like I have some type of hold on something and that this election and this new president and his administration is not going to dictate who I am as an artist for the rest of my life. Yo, I was wrong about you, man. I apologize. I apologize sincerely. You know, I apologize. My son says, I apologize. Will you accept my apology? I would love to be proven wrong. You know, I will apologize to that man every day of my life. If I am proven wrong, I don't mind being wrong. So let's bring it on. Let's see. Yeah. Yeah. Because I remember your name. Hey, hey. I did. I couldn't hear. And it was like the book section. And I was like, well, in case another book comes through, I better be ready. So I just had a workshop of a play I've been working on for too long, I think, maybe not so. But nonetheless, a play I've been working on for a while and I'm like, okay, I've looked at you for a long time. And I didn't like that too. And I think I found the way to fix it.  Right. Yeah. Okay. Well, I'll say something about it. It's tricky because when I have a grab through something that I mean, this question is, why did you bring it to a workshop if you weren't relatively pleased with it? Was it the deadline? Had someone commissioned it and said, you must bring it on the 10th of November. It was a deadline. Deadline and then election. So don't, don't, don't, we, we, we, we, we let us promise to ourselves and everyone we love that we will not blame the election for any short of our own shortcomings. Why did you bring it to a workshop if you weren't happy with it? Why did you bring it to a workshop? This is because it's a question that you have to ask yourself. Why did you bring it to the workshop if you were not happy with the play? So a structural flaw, perhaps, but when you're in that situation, when you're in the church. Okay. So you were going to say it was a, that was a construct of the, yeah. Writing pages, bringing it to a workshop. Right. Okay. So you were kind of like, it had to happen when it happened because you decided it was a workshop. Yeah. Okay. So so you're in a situation that's far from perfect. Okay. So what you did here, and people are reading your work and you're like, not alone with it. That would happen? Yeah. Okay. And so what do you do? Right? That's the question. What? Yeah. What do you do? Yeah. So what do you do? No, what do I do? I'm not doing anything. I'm over here. Yeah. So what do you do?  And you're like, oh man, or, or a ambulance goes by really, really loud or firetrucks, they're going to save somebody. Right. And you hear that.  And you see people all around you going like that. Okay. That might be effective. What is also effective is to hum a tone in your head. I just started doing this because I didn't want to be one of those people. I just wanted to keep walking. I wanted to keep walking. Right. So I started to hum a tone in my head, any tone. So I've been doing this for years. So my now fiance, I, we were walking down the street like that and he goes, I just made it up. He said, no, Bose noise canceling headphones. It's built around the same idea. The noise. Right. So this is what you do when you're in a workshop where it's really, really hard, you give yourself a tone that you can hold on to. So you're not listening to the voices that are negative, not the voices of the actors. They're wonderful.  This is awful. So you give yourself a tone to hold on to. This is good. I'm only going to make it better. I'm so proud of myself for writing these five pages or whatever. I'm going to write five more. The actors are going to teach me so much. Isn't it great that I got accepted to this workshop? This is wonderful. I'm happy to be here. Look, I'm healthy. Look, I live in such a cool city. Whatever you want to say, give yourself things to say that are positive, encouraging, uplifting and will encourage you to go forward. Right. Okay. And they will cancel out those sounds that you don't need entering your head. Okay. Even if you have to write in your notebook, I'm only going to make this better. Oh, that was a silly line. It's only going to get better. It's only going to get better. You know, right? It's only going to get better. Okay, there you go. So there you go. So you got it already. The tone of your head. Bose noise canceling headphones. And they're, you know, you know, but that's basically what you're doing. You're giving yourself a mantra is called, what is the, what is actually the, I think it's mind vaccine mantra. Yeah, mind vaccine.  So I don't know if anybody's an anti-vaxxer in the house. I don't know what were you, whatever your parents did, that's cool. But um, yeah, so mind vaccine, it helps you inoculate yourself against the SSIT. I know you guys can spell. So a bunch of questions, but I'll just pick one for time's sake from Alicia Nash. And she says, how do you break up scenes? How do you know a scene is complete? Because she's afraid that sometimes she's boring and sometimes has early conflict. Early conflict. Yeah. I don't know. How do you know? So how do you know when it's, Alicia says how do you break up scenes? Okay, so there's different ways. You can do it by math, right? Scenes, you can do it by, they're called, if you go to grad school or talk to people who go to grad school or undergrad school, they'll talk, they'll use a term called French scenes, which might be like, well, French K, SS, ING, but I don't know. French scene has been an actor exits the stage, right? And that's usually means a scene is over or a scene, there's a demarcation over the end of the scene. I think of it like a throw a ball in the air and it lands, you know, an actor is trying to do something and they reach, they're trying to cross the river and they step from one stone to another, their foot goes down, right? It's an organic thing. I would say, I have a big question about that. Read a lot of well-structured plays. I know it can be expensive to go to plays these days, but you could certainly, at the library again, read a lot of well-structured plays. They can be classics, they can be contemporary plays, and you'll see there's a pattern that emerges. You'll see the pattern, the organization of action. Sometimes, yeah, your scenes are going to be too long, you work that out in workshop, you know, where you see, oh, this is so boring, and you can do cuts, so don't worry about getting a perfect before you go to the workshop. But if you have a real question about it, read some well-structured plays and you'll see how the action rises and falls in a scene. Okay. It's a craft thing, but no crafting. Anybody else? Yeah, I'm not, I'm not sure what that means, I mean, I mean, I'm trying to think, what great plays have like early cards left, right, right away, like, and then Hamlet, he's like, what, what? There's a ghost? What? I mean, that's like in the first, like, seven pages, right? I mean, that's swear, or swear, or swear. The ghost goes, swear, or swear, or swear. I mean, that's, that's the first rush. And then you bring up something else that has nothing to do with the argument just to like start something, like that can happen sometimes, and like play their movies, like if you watch a really crappy movie sometimes, and like, it's like, okay, why are they fighting, like, I don't know, I think that's what she, I'm not sure. Okay, okay, that's what, that's what seems to you. And maybe that, do you have, Dan? Yeah, maybe that's it. The early conflict thing, I mean, as you said, like, it's, most plays have like conflict baked into the structure of it, like it immediately is happening. And so I guess if we're talking about like early conflict, maybe like what you're thinking is that you're like laying it bare too quickly, where it's like very clear, like, okay, this character is this problem, this character is this problem. And I guess what I'd recommend, like when you look at a play that seems like there's not action happening at the beginning, if it's a good play, this is a generalization, but if it's a good play, usually the conflict's already happening, they're just not talking about it directly. So then when you're going back, I suppose, over like writing like exposition or stuff like that, if you make sure that like, okay, they're fighting over an apple in this first scene, like, halfheartedly, like it's a joke that it did. But if it's actually like speaking to what's going to happen later in the play in some way that the conflict is already there between these two characters, they're already not seeing eye to eye, then you're on the right track. You know, so we're trying to figure out everything without having to go, you know, going all the way to the end. So go to the end and then you can just move things around instead of trying to rewrite that first seven pages and make them perfect because you don't know. You know, early conflict is so, you know, I mean, it's like you're dating, that's the other man goes, and I'll be like, just pretend, pretend, well, pretend I'm here, but I'm saying other things. So it's like you're, you're meeting somebody new, right?  You don't want to tell like everything about yourself, right? You want to tell a few things, you know, because they're your new friend, right?  And that's, that might be like early conflict, I don't know, but sometimes early conflict works out great. It's hard to tell.  The darn thing.  I recently started writing about a family trauma that's still going on. And I'm writing it obviously for myself because I need to write it. It could be good or whatever, important one day. I'm writing it now because it needs to be because I, I don't know how long it will go on. So why wait? The challenge I'm having is that one of the family members, I feel fine with the other family member. I feel like I'm betraying them by writing their part into the story. And I know this is something people deal with a lot, but I'm just, you know, I keep having that conflict inside, not knowing if I should just write it all, or maybe focus on one part of what's going on so that I feel better about what I'm writing. That's a great question. Miasha. Miasha, how about? That's a really great question. Everybody here can answer the question. She's writing a story about a play, about a family trauma that's still going on. A story about a family trauma that's still going on. And she wonders, she, she feels some kind of apprehension because she doesn't want to be unjust to some of the people who are involved, right?  It's lucky for us that people ask this question a lot because there are answers. Like Long Day's Journey into Night. You've never heard of that play? Right. So he wrote Long Day's Journey into Night. Eugene O'Neill, the faculty's writer, Eugene O'Neill. And he wrote Long Day's Journey into Night. And he said, yo, I need to see yo. What did he did? Yo, don't put on this play. Ever, I think. Oh, too weird. Ah, I see people know this.  Right, until I'm dead, after I'm dead, 25 years after my death. Right, exactly. Okay, so that's, and he died, and then people put it on right away, which, you know, but, but you can do, what you can do is write the story or whatever and just put it in an envelope and put it away. You don't have to show it to the world. You have to send it to the New Yorker and get it published or send it to the public theater and get it, you know, work to get a show or do a workshop, not at all. Write it, write it fully as you think it should be written, and then just put an envelope and put it away. And maybe like there's Susan doing, check back in with it in six months or a year and see how you feel about it. No? But that not, that doesn't need to stop you, though not wanting to do it justice to people at all. That's a great question. So this is, the thing about this, I make it about you. So when you ask me a question about me, I make it about you. So the question was how many plays have you written? So this is the question, how many plays have you written? You've written three plays, what's your favorite part of writing? Do you like the first draft or the rewriting or what's your favorite parts? Do you like having a public? A lot of people get to see your ideas when you're hanging up on the board at school. Yeah, yeah, that's really cool. I know that it's kind of the fun part, right? And it makes all that hard work worthwhile, all the like, oh gosh, what are you doing? You know, I got to keep writing. The payoff, we call it, you know, is when you get the publisher, you get them on the board at school. You know, how many people like that part in the best? Getting it done? Yeah, some people say, I like having written. Some people say that a lot. I like having written. Really? You like that part? No. Yeah, you like having, you got like getting up on the board and having it published? Yeah, I like writing the best. I like writing. I like the actual thing of the end of it, more than anything else. I like to release about by now, which is why I'm like, I'm like, I'm like, I'm like, you know, I tell you guys, yeah, we voted for love on Election Day. So we went, what we found out was the dark tower. We went to Tiffany, which is right next to the dark tower and got the ring. So that's the Lord of the Rings saga. Well, my, my relationship now, we went to the dark tower and got a ring. So we're going to be all right. Yeah. So anyway, but yeah, I like writing that writing that is fun because you get to sort of commune with that spirit is always talking to you. Spirit is whispering in your ear saying, keep going, keep going. You're doing great. I'm going to tell me for a time. And you've got so much for coming. So we're going to be here and not next week. We're going to be here next week at 5pm. Bye. Thank you. Thanks for your tweets, too. Thank you guys. You guys were great. Yeah, they really, they rock.