Hi guys, this is Maryleigh Ellis here with the 21 Convention and Damien Degas, day one of fantastic speeches, your first time speaking right? At the 21 Convention absolutely, yeah, number one. Great, we loved your speech though, I think we're going to have a hard time topping that speech. There's just a couple of things that I definitely wanted to ask you for, for our viewers out there if you didn't get to catch the whole speech. You talked a little bit about epigenetics, and what do you think is the best way to either fight the epigenetics or try and use it in your advantage? Okay, so I'll just be clear on epigenetics itself. So epigenetics is this idea that we can inherit things, either behavioral or physical, that are not genetically coded and not genetic coded. So sometimes they're just paid, like I mentioned before, you can inherit neuroticism epigenetically. But other times it can actually be physically deformed, is that we can actually pick up. But okay, so you've asked me how do we work with it? Exactly the same way we would work with any other type of genetic variants. So for example, you may be born tall, you may be born short, you may be born with great hair, you may be born with bad hair, you may be born with all sorts of different things. You may be like me and your hair starts to bend when you're 30, you get all these different things. So the way to work around them is first of all to never fight with them. So again, I'm a big fan of Buddhist philosophy, and fighting with anything in life is the surest way to become very dissatisfied with them. The key is to learn to work with and around what you've got, because we all have strengths, we've all got weaknesses, you know. I can work with men and women who are very attractive people, very intelligent, very intelligent and very attractive. But they've got other things going on that they use, they hold on to. Is it C, undamaged? Or C, this is a problem. That's where you become, if you label yourself, if you assume, hey, because I inherited being short, I'm going to have a short person way of thinking, or because I inherited neuroticism, because I inherited this ability to be scared very easily, or all these things. It's very easy to then say, hold on to it, and what can I do? I mean, we all know examples of any variance, we know people who aren't very attractive, people who are very successful in dating, we know people who aren't very intelligent, who have been hugely successful in the business world. And we know all these examples, the standards of variance in people, like I talk about neuroticism, and it's big, I'm quite far up that scale in terms of normal, but in the schemes of things, that doesn't mean I can't accomplish anything. As I talked about in the speech, there's a way around, there's a way to work around what you've got working for you, and not working for you. The key is to actually look for research, whatever you've got, find examples of someone who has whatever it is, neuroticism, tall, someone who's short, whatever it is, and look for examples of people who have done what you want to do, but feel like you can't promise you they're out there. Yeah, they're definitely out there. And that leads me into my next question. What do you think is the biggest mistake people make when they're trying to achieve happiness? To me, the biggest mistake people make, and this comes back a little bit to the talk, but the biggest mistake people make is they focus on these end point outcomes. So their whole lives get built around when I get this car, when this girl likes me, when I achieve this role at work, when I have this percentage body fat. The difficulty is that the control that we have over the world, the reality is the world is a very unpredictable place.  And the key is worrying about that, worrying about what you can't control is the best way to actually teach yourself, they have very little control over your world. Famous research was done one time. If you interview people who are clinically depressed and you look at how much control they believe over the world, it's almost zero. It's everything, nothing, everything's out of control. When you look at people who are hugely successful, how much control they believe they have over their lives, it's over everything. It's they believe they have control over the way people think, over the weather, over the stock market, over everything. And so it's about perceived control, what we believe. So the biggest mistake we make is we set goals where we don't have complete control over what does life teach us. So you don't have much control over that. That's perfect. That also goes also into my next question. You just keep rolling these one right into the other. I don't even need to say anything. It was, what do you think about the difference between the influence versus control? Right. So as I was just saying, our control over the world is actually very small. In fact, life is depressingly full of lack of control. Things go wrong all the time. But we certainly get better at influencing the world around us. So another mistake that people make, which is perfect, right into this, is they become people who life, the world around them influences them. So they are a result of the world around them that's they might say, well, my world's like this and it's made me like that. That is not the path to being successful, happy, anything. The best way to be successful is to be someone who focus on influencing the world around them. You know, I can't go and do a talk like I've done just now and have everyone in that audience like me. I have everyone in that audience think that was amazing. Some people are gonna listen and go, I'm not convinced. That's human nature, I don't have control of that. But I can influence and get better at influencing as many people as possible and that becomes my goal. Can I influence as many people as possible? Can I influence as many people? How can I improve? Not can I control and make sure everyone, because you can't. We could have a room full of people who have just listened to a talk just like mine. What influence will I have? Okay, that's fantastic. I don't know, everybody in there seem to really like what you're doing and talking about. You got such just great, great feedback from the audience and their questions were great too. So go to the actual interview and you'll see those questions. The last question I wanted to ask was just on the topic of goals, you like to set short term goals rather than long term goals. How do you feel about that? And what do you think people should do? Okay, so you know, I've always believed, I mean, I started out with the typical way of thinking is you set these long, big goals. And what I found was that you usually don't achieve them because they're always overly optimistic. We get excited and we get optimistic when we set goals. We all do that as human to them. What happens is you get this reach for the stars and get to the moon concept.  Because you always fail to achieve what you want to achieve. So what I like to focus on is the next week. In one week, you know what's gonna happen that week. Okay, you know what you want for that week. What I want today and what I want in five days is not very likely to change. And what we can do in that week is we can actually plan it, we can plan it very specifically. Again, only things we're in control of planning, like our time, right? Yeah. We're in control of our time. Not like getting a raise this week. Yes, exactly. It's gotta be stuff you're in control of. But when you set that, you can, every week can be full of these little wins. So if you go through a week, for example me, I've got to have two wins a day. A win is I go to gym and I meditate. Two wins done, right? A win is I go here and I do a really good job, right? That's like a win. Being here, it's doing something really great. I need at least two a day. I'll usually shoot four more, but you could plan that out in a week. And these little wins, they add up. When you become someone who actually does what I win, by the way, is moving towards something you really love. And when you do that consistently, you get there. And are you moving towards happiness then? Exactly. Great. Exactly, yeah. So this is the 21 convention. This is Damien Dica. If people want to find you, if they like you, where do they go? So the best place to find me is at a school of attraction. So schoolofattraction.com.au. I do do life coaching. I run that through my name, DamienDica.com. And you can find me there. But if you're interested, get in contact with me. I love responding to emails. I love giving feedback to people. It's not like I have to charge for it because this is my passion. Great. Bye guys. See you later.


So good morning everyone and welcome to this session of Selenium Conference 2020. So today's my topic is Rise of Shadow Dome and let's solve it through by using two different approaches. First is WebDriver Selenium we can say and second it's WebDriver IO it's a wrapper over WebDriver itself. So without wasting time let's move ahead. So before starting this session let me introduce my company where I am currently associated. So currently I am working with 3 pillar global it's a service based company. So we are implementing products for our clients and so that they can enhance their revenues and they can grow in this competitive market. So in short we can say we are a product lifecycle management and a software product development company. And this company is founded in 2006 and we have four global centers it's one it's in India, one it's in Costa Rica, one it's in Romania and the headquarters in USA Fairfax. In my company we are implementing different different products by using latest technologies. We are implementing web based applications we are implementing native mobile applications like iOS, Android and some hybrid by using React Native. And we are also giving cloud services to our clients and last but not least we are also giving Q automation services by using different different open source tools. So 3 pillar global has been recognized as a great place to work certified organization in India. So this is for its outstanding company culture for it's a second straight year. And this prestigious certification from the great place to work institute is awarded to those companies that foster excellent workplace environments for their employees. So we are lucky we have good culture in my company and let me introduce myself. My name is Virender Singh professionally I have a good experience in area of Q automation and currently I'm associated as a senior Q automation lead with 3 pillar global and as my company following agile culture. So this culture always motivates me to explore new technologies, new tools and which is coming new to the market. And being a leader like I'm working as a senior Q automation lead. So leadership always push me to help my juniors to help my peers so within the project or whether it is within the company or whether it is outside of the company through the social networking and etc etc. I am always open to help anyone in my field. And apart from this professional things I am also a triathlete and currently preparing for iron man 70.3 miles competition which is which will be held in next year now. And these are my contact details. If anybody wants to reach out to me then can email me at virender.pnnu at gmail.com or can approach me through the LinkedIn. So today's agenda it's today's agenda it's like I'll be covering three main topics there first topic it's web components and custom elements with shadow dome. So this is the one thing the second thing then will solve it by using web driver and the third thing will solve the same shadow dome by using web driver IEO. So let's have brief idea about it but what we are going to discuss today. So first of all we'll talk about web components then custom elements and the shadow dome. And how this shadow dome is different from the light dome we'll discuss more about it as well and how it creates problems for the automation guys will see all these things as well. So basically all these things are new age HTML which is creating problems for key automation guys will solve it through by using two different approaches. So first approach it's like we usually encountered problems because of this shadow dome. Suppose we are web driver guys and we face problems because of the shadow dome then how web driver interact with this shadow dome and we will we would have a demo at the end and second approach it's like the problems encountered to the web driver IEO guys those are working on this tool and then we will see like how this web driver IEO tools natively support how to handle this shadow dome then we will see the demo about it. So moving ahead before moving ahead let me tell you the problem statement which I encountered few months or around one year back like I was sitting in my company and someday and one of my cooly came to me like he has to prepare some POC on his new application actually he was even not able to interact with the elements by using our simple selector approaches like X paths or CSS selectors he was not able to find those elements it's a like it's a weird situation for him because because if one of us is not able to find out the elements itself then it's a shame for us so I was quite busy at that time but I asked him to provide me their application URL so that I can look at it when I will get some time so when I came back to home then I looked at that URL and I also tried to find out those elements by using same simple approaches like X path and CSS selectors even I tried JavaScript but I was not able to find those elements then finally what I have seen on the web developer tools like there is one thing which is written like shadow root then I google that the term and then I came across like oh so this is the shadow dome and we cannot interact directly shadow dome elements by using these simple selectors we have to use some we have to take a different approach for it okay so this is the problem statement which I encountered before moving ahead first of all we need to discuss about the web components so what are the web components so whenever any application renders on a browser then it always contains three things first thing it contains HTML so this is the structure of the elements second thing it always contains CSS like styling of those elements third thing it always contains the JavaScript like through JavaScript we can take actions on those elements so we always see these three things in our web browser through the web developer tools as we know like dome is it's a very unknown term to each and every one like it's a structured representation of an HTML document and through JavaScript we can interact with those elements and we can manipulate those elements within the dome because JavaScript has a complete access of the dome okay let's talk about web components now web components are basically it's a W3C standard feature that is being incorporated in HTML5 it's because it's a new HTML it's also in the Google's polymer library it's also in the Google's lit element library and there are some more libraries in the market where we can see these web components web components are a set of APIs that facilitate the creation of new custom reusable HTML elements like we can see here reusable HTML elements we can see header we have used header twice we have here and we have header here we have putter here we have putter here and that can be used in web pages and web apps with your functionality and that is isolated from the rest of your application code we can see here so these are completely modular and the reusable components we can see on this web application or we can say web page basically this web page it's divided into different different web components or we can say different different smaller modules we can say and these modules these modular components are reusable across the web application and this web component has four different building blocks we can see here one is the custom HTML elements second is the shadow dome third is the HTML templates and fourth one is the HTML imports but in this session we'll only talk about these two building blocks because we need those we don't need these two so we'll talk about the custom HTML elements we'll talk about the shadow dome okay so here we can see these web components can interact with each interact with each other very easily and but they cannot access each other's properties for example one web component has one property and let's say color is red and another web component has a different color maybe the color is green then they can interact with each other if they require it but they cannot impact each other's properties right suppose but here is here is one hack for example if we have any global properties on that application let's say it's color is black so in that case that property would be applicable to each and every web component in that application because it's a global property and as well as it's an inheritable property we have known in inheritable properties also like background color it's a non inheritable property but if we make it global then it won't impact any of the web component okay let's say color is a global property but we can override this property within the web component for example in header itself if we override that property then we can change it we can in line override it in any web component it's all up to you okay yeah moving ahead so let's talk about the custom elements custom elements are here we can see custom elements are like these are very kind of HTML elements with custom templates behaviors and tag names made with set of JavaScript APIs here we can see we have used HTML element class to make those custom elements here we have inherited this we have extended this HTML element class right there and by using this class we are creating a new custom elements by using this method we can see here custom elements to define we are defining this new tag my element and before and just below that we can see my element is it's a this is the HTML which will be rendered on the browser itself by using this code we can see right there let me open one file there here we can see this page what I have done here it's the same code which I have mentioned in the slide itself we can see my element right there and under that under that custom element we have one button if you try to access this by using xpath then we can very easily find this button right and if you try to find by using css maybe let me use css right there then again we are able to find this button because still the shadow dome is not applied on that code it is just a custom elements which we can access by using any selector like xpath or like or css or by using the javascript we can easily access those elements here we can see we haven't applied any shadow dome right there and that's why we are very that's very easy for us to access those custom elements now let me apply shadow dome on this so here we can see the same code the class extending again HTML element and below that we can see the same custom element but here in between this method we have applied we have attached shadow dome we can see right there and we can see the mode is open we'll talk about the mode as well down the line so currently the mode is open I mean the shadow dome is openly applied on those custom elements and here we can see the shadow is appended with that button as well okay let me open this let me go there right now so this is the same code which I have mentioned in the slides if we click on that element then we can see under this custom element we have a shadow root now and the mode is open for it now we can see the button is under the shadow root it's a part of that shadow dome if we try to access this directly then we cannot access it let me try to find out the x path first we can see it is not visible like we are not able to fetch this element by using x path now let me try this css again css sorry it's a javascript let me try css as well like nothing is fetchable by using these simple selectors so this is the problem like it's a super annoying for everyone like if we are not able to find the elements by using our different different approaches then it's a it's a really a big problem for us now the question arises in mind that if the custom elements gets encapsulated after attaching shadow dome then how to interact with these custom elements inside the shadow dome so we have one thing like as we have seen query select rates entry point for the whole dome I mean I'm talking about the main dome which we usually see in the developer tools so query select rates API it's entry pointer for any dome now what is the entry pointer for the shadow dome so we have a shadow root API this is the entry point it's it's again API this is the entry point to enter into the shadow dome so we need shadow root API with query selector method to fetch the elements although shadow dome is a useful solution for web developers because it's there are some security issues but it becomes a challenge for automating testing because those elements inside a shadow root technically do not exist in the main or the light document dome it's a problem for us so let's try to fetch this element by using shadow root here we can see the query selector then the my element this is the out of shadow dome and now we can see the button button this is inside the shadow dome so that's why we have used shadow root dot query selector if you try to fetch this then we can easily see it is visible to the user we can find the elements very easily so one thing the mode is open currently if I make the mode closed let me make it closed here we can see the mode is open if I'm making it closed yeah I can hear you Shweta just moment let me try this I think I'm not able to move this thumbnail because no I'm not able to try okay thank you Shweta okay so now I made it closed now we can see the mode is closed and let me open this element again if I refresh it and if I try to fetch this element by using this shadow root then we are not able to interact or the fetch that element because closed mode means the shadow root is in that case shadow root is always null I mean the element is not available to the user so what is the use of open mode and the closed mode so we can ask the developers for example they do this because of some security issues we they make it closed mode so that we any any person cannot interact with those elements so in that case what we can ask to ask to the developer suppose we have to automate those pages in that case we can ask developers to make the mode is open on the sandbox or the we can say on the test environment but on the production environment they can make it closed mode so in that case like security would be fixed by the developers and also we can automate our scripts very easily we can verify our regression speeds on the sandbox itself or on the test environment itself we can ask to the developers about this okay if I make it open again if I save it if I refresh it and if you try to fetch it once again then it's visible to the user again like we can interact with those elements okay let me move to the next slide okay so let's understand the how shadow dome works within the browser so here we can see at the top it's a light or the main dome which we usually see and there is a document interface that is entry point for the light dome or the main dome but within the main dome we can have any number of shadow dome so there is one entry point for any shadow dome it's a shadow host so in our case it's a we can see here just moment it's in our case my element it's a shadow host for us because this is the entry point into the shadow okay so here we'll talk talking about the shadow host it's a it's a kind of entry point in into the any shadow dome and below that entry point we can see any number of shadow roots and we can have single level shadow roots here we can see it's a single level shadow root and we can have multiple shadow roots as well for example in one shadow root we have we can have another shadow root and we can have multiple elements in another shadow roots so here I would say again like shadow dome it's a shadow dome is a kind of web standard that developers use to encapsulate dear custom stml code and style components and with JavaScript as well and shadow dome elements are not visible to the documents.query selector API because these are only visible to the shadow root I mean the documented shadow root API okay and here we can see the scoping like we have boundary for these shadow root elements so if we have to enter into this boundary then we have to use shadow root API without this we cannot enter into the boundary and we cannot interact with those elements let me open one application just moment I have already opened I think so to do app okay so so this application it's it's implemented in the by using the polymer library it's a it's a google's library and the earlier which we have seen these are the stml 5 based app code which we have seen so in this here we can see we can see the multiple level of shadow roots here we can see we have to do app it's a entry point or we can say shadow host and under that we can see one shadow root then one element another shadow root then there are loads of elements we can see the text area here and if you try to fetch these elements if I try to fetch these elements it's a multi-level shadow roots just moment let me make it bigger here we can see one ID then we have another ID shadow root query selector adds items then shadow root query selector enter text area we can see here it's a it's a multi-level shadow roots so so this is what I have shown right there let me go to the next slide so this is all about like like which browsers are supporting this shadow dome here we can clearly see we have two versions of shadow dome it's a version zero which is already deprecated maybe it is used by some developers still on already implemented applications but currently the developers using its shadow dome version one and here we can see it's a almost supports every browser like we can see edge the latest versions of edge browser the firefox we can see the chrome safari opera we can see safari isafari as well it's a partially support to this shadow dome maybe not fully but there are few which is not supporting maybe it's opera mini but it is supported by android browsers opera mobile chrome for android and we can see a list of browsers which is supported by this shadow dome like we can in short we can say shadow dome can be rendered on any kind of latest browsers so that's why it's getting popular nowadays and developers using it the two purposes one is security and maybe second thing it's supported by each kind of browsers nowadays let me go to the next slide okay so it's time to talk about the web driver approach with the shadow dome okay we can interact with the shadow dome by using JavaScript which we have already seen and then how the web driver can interact with those elements the web driver can only interact with those elements by using JavaScript executor API we can we have to use this with the web driver then only we can interact with those elements and we can take actions on those elements because there is no native support by web driver itself but we have work around for it and we can very easily interact with web elements shadow dome web elements let me show you one quick demo here i have written like very basic code about it i have used this local application which is implemented in polymer library and below that we can see this is the method which i have used to return the shadow root elements so that the driver can take actions on it and which i'm using these elements right there it's very basic code i i haven't improved it a lot but just to show you the demo guys and here we can see after getting the shadow root elements then we can append another elements and we can take actions on those let me execute it by using testNG so this is the same application which i have shown you guys it's in the blue color colored here we can see it will add some it will add some test plans on the right side it will add two test plans for today and two plans for later i have applied some weight on these scripts so that you guys can see it okay this is done and we can see it is passed so the main thing is interaction with those shadow dome elements and later we can just apply JavaScript executor and we can take actions so this is the approach which we have taken by using web driver and let me move ahead now it's time to take another approach it's by using web driver IO so web driver IO basically it supports natively by using two different two different approaches one is the shadow dollar here we can see it has two different inbuilt commands one is shadow dollar one is the shadow double dollar shadow dollar basically we use to access an element inside a given element shadow root it it will fetch the element which is a single element if there are multiple elements kind of list of the elements in that case we have to use shadow double dollar and we can fetch those elements one by one by our regular approaches so here we can see we are getting here we i have used javascript i am just fetching one element by using shadow dollar this is inside the shadow root and again we have another shadow root element it's enter text area so there are multi multi-level shadow roots and we are fetching those elements by using this shadow dollar let me open the code and let me show you the demo here we can see here we are fetching we are returning those elements by using shadow dollar and below that we are just taking actions on those found elements and finally we are calling these methods inside the test script which i have used there let me run this so it will open the same application then it will take the same actions but this time it is by using javascript and then web driver we have used java so it will add two test plans for today and then later and it is passed and we can see all of the actions has been taken and it is successfully executed so now we have seen two different approaches first is by using web driver second approach is by using web driver io so here i just want to suggest one thing to everyone for example if you guys any one of you guys using web driver already by using java as a technology and some of the pages the developer implements by using this maybe any library maybe a stml5 or maybe lit element library maybe polymer library and in that case you can take the first approach because you have no need to write you have no need to change your tool in that case you can continue with your automation scripts by using the first approach but if in case you know the javascript and you are starting your project automation from scratch in that case you can go with the second approach because web driver io it's giving native support for the shadow dome but i have seen the code the shadow i have seen the code for web driver io internally it is using the same thing which we are using with the selenium web driver because it is it has written some just wrapper method over the same thing and internally it is using the same javascript and all so here i have mentioned some references you guys can go through these references like about shadow dome if anybody wants to know about the shadow dome then can go through this link if anybody wants to take a shadow dome approach with selenium then there are some methods which you guys can have dependencies by using form dot xml file and here you guys can see the shadow dome approach by web driver io so you will see these shadow doler and the shadow double doler methods and below i have this is my github account where you guys can see the test applications which i have shown you guys and the selenium approach and the web driver io approach so i'll i'll make it public today so that you guys can get this and you can try at your end so that's all about this session if you guys have any questions or any doubts about it and i hope i have cleared each and everything but i am open for any kind of questions thank you virender for that i think the audience had a question regarding whether the code would be available so i think you've answered that towards the end yeah okay so we have quite some questions posted so i'll take them one by one so the maximum vote is for the question what is the difference between light dome and shadow dome okay so light dome basically it's our the main dome which we usually see forget about shadow dome first suppose i want to automate my application the first of all i always look at it it's a light dome or we can say it's a main dome so the entry point for the main dome still it's a query it's a it's a what i would say like like i'm not getting exactly now but still i would say like for shadow dome it's a shadow dome it's a part of the light dome we can say it's but it renders separately that's the reason we cannot interact with the shadow dome elements and another thing it's like developers make the mode is closed in that case we cannot interact with any element at any cost but if the developers make the mode is open then then only we can interact with those elements by using a java script shadow dome basically it's a part of light dome we can say it renders inside that light dome okay uh we have another question again on the differences what is the difference between shadow dome and iframe okay iframe it's a like it's an older technology earlier the developers using iframes but nowadays they are not using iframes because there are some cross-site scripting issues but now they have started using shadow dome it's it's a kind of iframe but it is completely quarantined from the light dome this is this is what i can say now it's kind of similar things but it's completely quarantined but iframe was not quarantined from the light dome so this is the only difference between iframe and the shadow dome elements okay the next one is what is the purpose of creating shadow dome okay uh purpose of the creating shadow dome is that suppose i am creating one of my plugin and i just want to sell these plugins to different different vendors or we can say different different web applications in that case what will happen this plugin won't won't interact with their html codes and their code won't won't interact with this plugin code plugin html or the gss or we can css so they they will render on the same browser on the same uh on the same dome but they won't interact with each other they can work flawlessly with each other but they they won't hamper anything of each and like they won't hamper uh each other's code so that is the reason they are using shadow dome nowadays so this is kind of security issues we can say and second is they are they are not accessing each other's properties so this is the main reason okay um another one how to check if the shadow dome element is closed can you please come again swetha i didn't get this question so uh how to check if the shadow dome element is closed okay even i have uh shown there just moment let me open it once again if i make it closed i have made it closed and if i just refresh it then we can see the shadow root it's closed we can clearly see right there and in that case if it is closed then we cannot access this element this is the simple thing which we can see by using the developer's tools okay um we'll take a couple of more is that um why and when do i think web developers use shadow dome i think that is also answered broad yeah i think it is already covered because there are two reasons okay how many ways we can find these uh shadow dome elements here uh i would say like uh javascript is the only uh scripting language which has complete access of the dome so javascript we can use javascript and we can access those elements at any point of time but we have to use uh shadow root api to fetch those elements that's the only thing which we have to use otherwise the javascript works well with it because simple uh selectors strategies like xpath and css they won't work at any cost so the it's a it's a useless for shadow dome elements okay um then if shadow dome is closed it means we cannot access with any workaround yeah in that case we don't have any work around to access those closed elements so so that's why i have explained earlier if this is mandatory to make the elements closed mode so in that case we can talk to developers and we can ask them to make it open on the sandbox or the test environment and they can make it closed for the production environment this is the only solution which we did in in our company in my in my project otherwise there is no work around to interact with the closed elements okay thank you so much virender for answering those questions um it was a wonderful session we already have a lot of good feedback coming in on the channel uh on discuss thank you so much shweta and thank you so much everyone for joining this session i hope i did not waste your time and i hope you learned something new uh for your career uh the session was brought to you by sauce labs


The COVID-19 pandemic caused by SARS-CoV-2 has created global chaos, leading to a state of medical emergency and prompting countries to allocate resources towards developing immunotherapeutics and immunomodulators for prophylaxis and treatment. This article was authored by ModicBalutu, Zenat Hamid, is our rather and others.


Hi, I'm Shane Harris with Alabama Cooperative Extension System and today I'm standing by a large patch, right on the edge of course, a large patch of poison ivy. I'm also standing near some poison ivy running up this tree. Poison ivy is a poisonous plant and it can be a major problem around the garden if you go camping or maybe even hiking in the woods. You may come across poison ivy this summer. Let's take a moment to talk about how to control this poisonous plant. Anyone who works outdoors or participates in outdoor activities needs to be able to identify poison ivy. The most recognizable trait of poison ivy is its three leaves. In a compound leaf, it has three leaves with the middle leaf typically a little larger in size. The preferred habitat of poison ivy is moist deciduous forests and wooded areas but it also can be found along pastures, fence rows, and ornamental plantings around the home. You will find poison ivy climbing trees as a vine or growing along the ground as an individual small shrub or large patches and look like ground cover. A very distinctive trait of poison ivy, especially noticing in the winter time, is the hairy-like structures along the vine as it attaches itself to a trunk of a tree. Poison ivy is often confused with another native vine called Virginia Creeper. Virginia Creeper has five leaflets whereas poison ivy has only three leaflets. Virginia Creeper is not poisonous as poison ivy is. Do know that all parts of a poison ivy plant, its leaves, stem, fruits, and roots all produce an oil that can cause the skin irritation in some people. So basically all parts are poisonous to the skin. To control poison ivy, often herbicides are used. Often herbicides labeled for poison ivy control include glyphosate, 2,4-D, and chocolate peer. Many of these products are labeled as brush control. For non-chemical control methods, considered repeated tillage, cutting, and mowing, poison ivy will not tolerate constant suppression and will eventually die. Enjoy the outdoors this spring and summer but be sure to watch where you step and where you put your hands. This is an itch you want to avoid. For more information visit us online at aces.edu or contact your local county extension office.


Hello everybody. Welcome Bonjour. Welcome to my talk. Why barricade the door if the window is open? Why indeed? The next half an hour we're going to talk about various ways to get into the Kubernetes and also we'll try to make sense of those ways to come up with some kind of framework that will help us think about them. My name is Shay Berkovitz. I am a threat researcher in WIS. You might know me through one of these projects. Right now, as I said, I'm happy to be the part of the amazing WIS threat research team where I'm responsible among other things for the main of Kubernetes threat research. Okay, let's talk about clusters. So I was told that every good talk needs to have a hook to something to engage the audience, to explain the motivation. But I think in this case, we don't really need that much motivation because it's kind of obvious, right? The same way that you don't want to get burglars in your house, you don't want to get attacker to give them access into your cluster. Be it your first cluster that you're staging through some kind of click in the cloud UI by choosing the default options or be it your cluster number 5000 that you're staging through some kind of fancy terraform. Your primary security concern, the first security concern is to make sure that it's not easy to get into your cluster, of course, before you run some kind of fancy case PM and audit security solutions. And so we'll use this house as a metaphor for the cluster. By the way, did somebody recognize what's this house? Which movie is this from? That's right. Yeah, McAllister's house. So we'll use them as fortunes of that. Those red bandits, Marv and Harry, I think their name was, that we're trying to get into the house. And Kevin was trying to fend them off. So we'll use those analogies as an analogies to the potential attackers that try to get into your clusters. Just something to make the talk more engaging and more perhaps intuitive as well. So now the first reason is obvious, of course, but there are a couple more reasons of more subtle. So for example, these are the numbers from our 2023 security report. It takes 22 minutes for attacker or for malicious scans to reach newly staged EKS cluster. So if you have the cluster that reachable publicly, assume attacker Snow about it. That's your assumption. And then there's another even more subtle reason, again, from the same security report. I'll explain about report first.  We processed it and mapped that data on the stages of the typical attack chain in the Kubernetes cluster. So initial access lateral movement, privilege escalation and impact. And what we found out is that the lateral movement and privilege escalations were the weakest points in this attack chain, probably because of the multitude of options inside the Kubernetes cluster to move laterally or privilege escalate privileges, but also because of the lack of security controls that customer employ, even the controls that already exist like network policies, using the same namespace, et cetera, which puts pressure on initial access. So we're saying here, let's first secure the initial access and make it harder just to get first. Okay. Now, house as a metaphor is nice, but we still need to remember the original architecture, of course, right? Because so we'll talk about the control plane, the blue components, the blue ports, but also about data plane and maybe a bit more. Now to extract the maximal value from this talk, we're not just only going to talk about the technique, like how the attackers can actually get into your cluster, but also about the detections and protections, because ultimately we want to know what to do about this, how we can protect our clusters. So when you see those icons, this red lamp and the green bucket, you'll know what that means. For every initial access vector, I'll share with you the detection methods and protection methods. All with the final goal after half an hour to have some kind of framework and means to think about future misconfigurations and vulnerabilities in the context of initial access so that the next, when the next leaky vessels will come out and they will, you'll be able to think about it, okay, to put it into perspective and say, okay, I have to patch my worker nodes immediately, for example, or upgrade in a cluster, or I can ignore it for now and it won't affect my initial access, okay? All right, before we jump in into the control plane, very quickly, our Wata.utl toolbox, we have typically sensor or EDR solution that's visible on the kernel level. It knows about containers. It's probably Kubernetes aware and cloud aware, perhaps even. We have on the Kubernetes level, we have Kubernetes admission controller and the audit log, of course, and on the cloud level, we also have various logs, cloud detections, I don't know, various detection streams, but also VPC flow logs, et cetera.  It's good to keep that in mind. Okay, let's dive in into the control plane. Of course, we're going to start with Kubernetes API access. Why? Because it's like a front door to your cluster, basically. And we want to secure our front door. Now, front door is only front door if it's a publicly accessible cluster, of course. However, what we found out is about 70% of the clusters are publicly accessible. Now, it's not immediately a problem because, let's say, attacker anonymous user reach your cluster, they get something like this, 403 or 401. So if anonymous authentication enabled, like on EKS or GKE, for example, then they'll get 403 and they'll get mapped automatically to the system anonymous user. Okay, what can they reach? What can they get from this? Well, they can probably fingerprint your cluster, okay, in slash version endpoint, fine, they know health of your cluster, okay, maybe something in certificate details. Not very interesting. However, the Kubernetes RBG misconfiguration can interfere. How? What happens if system anonymous or system unauthenticated group that's anonymous is mapped to are actually assigned a non-trivial role? So there are three trivial roles assigned always by default, which are not very interesting, but there are non-trivial roles perhaps maybe assigned. And in that case, the external unauthentic user, instead of getting 403 or 401, they will get something like this, the actual list of pod specifications, Jason, which might contain, of course, some sensitive data. So it's like leaving your front door open. Now, in truth, this is extremely rare condition. This is what our data shows, because people are already aware about this misconfiguration, it's got enough publicity, I guess, okay. So chances are, if you see something like this, think about Honeypot first and then cluster. But of course, if it's in your environment, then it's not a Honeypot. Okay. How can we detect that type of access? Everything related to Kubernetes API access is Cuboid log. Okay. So this is how it looks like for people who have never seen Cuboid log. It has user, username, group, action, and the resource. So that's what we're looking for. And we have all the information to put some kind of rager rule to detect this access. Great. However, sometimes your provider, your cloud provider can butcher those audit logs. So in this case, this is how the audit log looks in the GKE version, unfortunately. And so, yes, you need to maintain several versions of your rager rules in this case. All right. What are we doing with this? How can we detect the access? Let's say attacker is abused this misconfiguration and they accessed it. Okay. How can we detect them? Well, anomaly rules is your friend here because this is, because that's how you know that system anonymous doing something, something weird. But also KSPM, because this misconfiguration is relatively easy to find or ARBA coded tool. Okay. So that was the first one. Now let's move on to KubeConfig. KubeConfig is the file that tells Cubelet, right? How to authenticate into the remote cluster. And it's typically saved in .cube slash config. Okay. Great. It's structured as follows. It has three sections. First, list of clusters. Second, list of context. And third, list of users. And the third session is the most interesting one because it actually tells Cubectl how to authenticate into the cluster, how to use that user material. So let's see how it's implemented in the big three solutions. For RikiS, it looks like this. So we have this exact session under the user, which basically tells Cubectl run AWS thick client with the following parameters. Then it will get back some kind of exact credentials and it will use those exact credentials to actually authenticate into the cluster. So what can we learn from this? First, don't run untrusted KubeConfig. Simple as this. If you download it somewhere from the Github, right? Like there is execution context inside the KubeConfig. Second, you still need AWS credentials in this case. And same for GKE. It uses the same GKE and AWS credential that's already on your laptop. So there are no new credentials in this case. If KubeConfig is leaked, then nothing really happens. What I'm getting, too, is AKS. So AKS has three authentication modes. Local, Entry ID and couple Entry ID. In the local, which is the default mode, this is what you'll find in your KubeConfig. You'll find the client certificate, you'll find the token. Okay, short-term access. Now imagine this KubeConfig clicks. What are you going to do? The thing is that the certificate is valid for two years.  Basically, if you have AKS in local RBAC mode authentication, make sure you don't leak KubeConfig. And that happens a lot, actually. So these you can find on the Github. Various secrets checked into the public repositories. So you need to be very careful about it. How do you detect and protect against this? All to detect the access is anomaly rules against. Are you friends? But for protection, we're talking here about the developer practices, coding practices, and secret scanning. You need to scan everything before you check in in the public repositories, but also private repositories, of course, because then after that they can become public. So don't do this stuff, right, where somebody checked in GKE cash credentials into the public repo. Okay. Let's move on to the KubeNet API access. And for people here in the audience to say, what, KubeNet has API access? Yes, apparently it does. It's not documented, though. But it's there. To find the endpoints, you need to dig deep into the code and to look at those endpoints, okay? But they are there. And it's running on AKS, GKE, and EKS as well. Now, because it's not supposed to be accessible, right? There is a reason why they didn't document this. Because it's only for the internal controlling components. And so that's why I compare it to some kind of pet door inside the kitchen door. Because again, it's not for the humans. It shouldn't be there. If it's there, that it's some kind of serious misconfiguration. Or developers did something funny or DevOps. And you better be aware of it. So in terms of detection, KubeNet will be blind to this, because it goes straight to the KubeNet. It doesn't go through the Kubernetes API access. So sensor is your friend in this case, because it will probably monitor your local access if there is some kind of local access to the port, typically 10 to 50, 10 to 54, those are the ports that KubeNet API is served. To protect this, we're talking here about network exposure management and VPC flow logs. And perhaps some kind of secondary protections. All right. Moving on. Management interfaces. So there's this case of Tesla open dashboard that's being told again and again. And I'll use it again. Since 2018, I think. It doesn't happen anymore, because you kind of need, it's not there by default. You need to install the dashboard, and you need to actively expose it. But there are other types of dashboards. I'm talking MLflow, Kubeflow, Airflow, various add-ons. This is just so handy.  But you need to remember to keep it closed. So to detect this again, we're talking about anomaly rules on Kube, audit, same old. To protect, we're talking about network exposure management. If you see some kind of management port open, that's your clue here. All right. So that's management interfaces. And now the last access factor on the control plane is KubeCuddle proxy. So KubeCuddle proxy, I don't know how many of you have heard about it, but it's a weird beast. It's like the zipline, if you guys remember, like the zipline, which Kevin used to exfil traits after the burglars got in. But the same zipline can be used to get in, right? And it's kind of hard to notice. It's not big, because we're looking at the windows, doors, garage, but there are also ziplines sometimes into your house. And that's this KubeCuddle proxy. Because the thing is that everybody can run it. Everybody with access can run it on their local laptop or some kind of cloud VM jumper. Give it dash, dash port, 9001. And that's it. And that's the connection into your cluster. And the thing is this action of KubeCuddle proxy opening, KubeNet's API server doesn't see it. It could be any port, depending on the dash, dash port option. And this laptop or jumper station, it can be outside of the scope of your security solutions. Okay, that's why I'm saying it's like a zipline. Because it's going to be super hard to detect. So make sure to cut it if you have it. Now, KubeBody is blind to proxy opening. But sensor should detect the moment the proxy is open, because it's like open port. So we're again talking about network exposure management. But this case, we're also talking about anti-fission, anti-malware techniques on the laptop of the developer that opened this proxy. All right. So to sum up the control plane, we talked about multiple initial access factors. And we also associated the major risks to each of them. Let's see what we learned. Let's see how we can apply what we learned on the case of system authenticated misconfiguration that was discovered back in February, I think. The thing is, any user with a Google account or Gmail, and I think pretty much everybody here has one, can access the cluster, can authenticate into any cluster on the GKE. They will be automatically assigned to the system authenticated group. Now, because of the name system authenticated, of course, it sounds safe enough, like way safer than system unauthenticated. And so this misconception that people thought about it, and so they assigned admin level privileges to the system authenticated group. And so imagine what attacker can do. They go to GCPM, get the token with the token, authenticate to the Kubernetes API server, and do whatever the system authenticated is allowed them to do. So let's check the demo how it looks like in practice. All right. So here, on the right side, I have a cluster access kubectl get. I'm just showing that if I provide any token, any random token, of course, I won't be authenticated into the cluster, because it doesn't know what to do with this token. On the left side, I'm the external user or attacker, and I have Gmail account. Hello? Okay. I'm using this API to get my own token. I'm getting the token, and I'm passing it into the kubectl. I still don't have access, but I'm user, some kind of user, weird number, but it kind of shows that something happened there, right? So now let's simulate this bad misconfiguration. So I'm creating this danger cluster all binding, literal danger, where I'm signing system resource tracker rule to the system authenticated group. All right. And I'm trying the same get pods, and now I have access because the system resource tracker, which is embedded role in most clusters, it has some kind of privileged access there. It can do a bunch of stuff. So we are one misconfiguration away from the disaster on the key clusters in this case. So that made waves in the community. And I don't forget to quickly delete that misconfiguration, of course. Okay. And we're stuck. Okay. So where can we place this in our framework? What we learned? Well, we are talking about Kubernetes API access. So it's got to be misconfiguration in the Kubernetes API access. And we're talking about RBAC misconfiguration. Okay. So for detection, of course, once we're talking about Kubernetes API server, we're talking about Kubernetes audit log. And to protect this, we just need to a good KSPM solution or RBAC audit solution that will detect that dangerous role binding. So the rule you might want to use is this tracker rule, which literally shows that, okay, we're looking at create cluster all binding create verb. We are looking at this group with the name system authenticated. And the role ref associated them shouldn't be one of those three roles that's already there, which are trivial roles. Okay. And this how the actual cluster role binding looks from the API perspective. Okay. So that's what KSPM solution is looking for. So now we know how to solve this problem. Once the next GKE misconfiguration coming along, we know how to address this. Okay. One second, breather. We're moving on to data plane. Okay. Data plane is like the business that you run from the garage, right? Like Amazon or eBay, where you send packages, trucks are moving in, trucks are moving out. And some packages can't slip through and stay in your house, perhaps even malicious packages. What I'm getting at, I'm getting to the data plane access, right? That you're exposed through the services. And if attacker, if there's an application RCE on your data, plane, attacker of course can abuse it and find itself in the context of the pod execution, typically associated with some kind of service account in the namespace on the worker node. And from there, the name of the game is lateral movement. Okay. Or privilege escalation. Depends what they can do with those associated privileges. So now we're talking about how to confine the attacker, right? Like suddenly we're talking, okay, how do we protect from application RCE? Well, it's not really the scope of this talk. We're not going to talk about application security, but there are ways. Application logs, WAF, you name it, fuzzing. But in terms of Kubernetes, KSPM for pod isolation can work. And protecting from some kind of secondary activities past the RCE exploitation. Okay. Let's say we don't have RCE in our data plane. Some vendors actually offer execution as a service. Okay. And our vulnerability research team has detected multiple cross tenant vulnerabilities in services like Azure Cosmos DB, where they were running Jupyter Notebook. So that's juicy service. And at this point, we're talking about escape protections and protections and gains lateral movement and cross tenant violations. And in this, in this context, I just want to say about, to talk about pitch quickly, that it's the hardening framework for the multi-tenant cloud applications and deployments. And we recently updated it and extended to the Kubernetes as well. And there's this namespace hound, which is a Qt tool that we released and open sourced a couple of weeks ago, that basically tests your multi-tenancy setup. And for the red timbers in the crowd, it basically can help you find all kind of lateral movement scenarios inside the cluster once the attacker is inside the cluster. Okay. Good. Now, switching direction a bit, Noteport. Okay. Noteport is just another way to expose your data plane. But typically, you expose the data plane through the load balancer or, I don't know, gateway API. There is a way to expose it through the Noteport as well. It's a bit weird. Typically, the sign of some kind of diagnostics or debug access.  But what we found that about 6% of clusters do have Noteport configured and exposed. We're just hoping that those are not production but test clusters. So now, because it shouldn't be there, I would compare it to some kind of basement door under the garage and just let's just hope that the attackers won't find it. Or if they find it, then they'll broke their neck by trying to get there to detect it. So, it's like similar to the Kubelet. Because to detect it, you need local detection, which means sensor. To protect it, though, KSPM sees the Noteport, right? So, good KSPM solution should detect this. And, of course, classic APSEC protection if this application is authenticated. Okay. And, of course, since we're talking about initial access, we have to talk about malicious images. So, malicious images in your cluster, every cluster uses the images. Of course, pod is starting, Kubelet pulls the image. Okay, how do you know if it's malicious or not?  You're basically giving them too much. Now, how this could happen? Well, it could be public registry with some kind of maintainer credentials that leaked or somebody owns the account of that maintainer happens. We saw this with NPM a lot as well. It could be image name confusion. This is super popular image, right? Or it could be image pull secret that leaked knownly or unknownly that has write permissions. And we saw our vulnerability team as well. So, multiple instances where image pull secret had write permissions to the registry. In this case, attacker can override that image. And there you go. You have a malicious image. Now, the important point here is that private clusters are also affected. So, don't think that you can stage the private cluster. You don't expose it to the Internet, but it still pulls images, right? So, keep that in mind. Now, in terms of detection, how can we detect this scenario? Well, think about what malicious image would do when it starts, when it instantiates. Well, it doesn't know where it is. So, it probably will first connect to the C2 instance, okay? So, you can detect that connection. The sensor or network monitoring tool, that's your way. To protect, of course, you can use image integrity verification, but also the registry security is also the answer here. Okay. So, to sum up, we talked about apps, execution as a service, images, and now I want to show you again the use case. We're going to talk about leaky vessels. Leaky vessels is a set of serious, pretty serious vulnerabilities that were discovered back, I think, at the end of January by SNCC researchers that allow attacker build time and container, sorry, start runtime escape from the container to the host. And that's what we're going to use in our attack chain, okay, in our demo. Perfect. Okay. So, on the bottom right side, I'm starting my C2 server, NC-LVP, everybody knows it, okay. Great. At the top, I'm pretending to be cluster operator. All the cluster operator does, runs some kind of image, innocently named. It's named CV202421626, just regular image, which I built, of course. That's our malicious image. So, at the bottom left, you see, that's how this, the Docker file looks like. All it does is runs one command. Upon start, it curls, it sends the it's a shadow to my C2 image. So, it's a shadow, of course, is a sensitive file, but the key here is that it's a shadow is not from the pod. This is a shadow from the node file system. You see the path traversal dot, that means that from inside the container, the container will go up to the node file system and send it, it's a shadow to my C2 instance. So, pretty cool if you ask me, okay, where can we place it in data? Well, of course, we're talking about image poisoning, image name confusion, so it's going to be there, and what's the primary protection about from this? Image integrity verification. Okay, now very quickly, other angles. Of course, you rarely run your clusters alone, right? You probably have multiple clusters, maybe thousands, but you don't run them in isolation. You have some kind of continuous delivery solution that stage them. You have some kind of users and cloud roles that interact with those clusters. So, you don't run the clusters in isolation, and those two vectors can also be initial access vectors. So, now I don't want to discourage you from, like, it's not like everything that we had here is legit initial access, but keep an eye that those access, those vectors can also be abused by the attackers, from the cloud to the containers, and from the CICD to your Kubernetes. So, keep that in mind. Okay, so to wrap it up, this is probably the most important slide that I want you to take from this lecture. We talked about control plane, we talked about data plane, and we highlighted the most important risks for every initial access vector. We also touched a bit on cloud access and CICD. Okay, so I hope that will help you to make sense in various initial access vectors for the Kubernetes cluster. These are some of the links that I talked about. Thank you so much. If you have questions, I'm here. Thanks a lot.


Andrew, how much pride does the bottom half of the order take in the production from tonight offensively? Um, I think as an offense as a whole we all take pride in what we do. So I think um Today was fun. I mean today was fun seeing Wade make a couple players on the field. I got I got really good seats to those But yeah, we take pride we all take pride in it Meredith you have anything else? You good Meredith. Oh Oh, she's done. I'm sorry Ken Ken David off.  Uh, something that was given to me and and like my second year in pro ball, um Some coaches from the Diamondbacks gave it to me. Uh, it's a lot of stories behind that, but um I guess the the safest one is Just comes from my last name The last squeeze squid. Yeah Okay, there's got to be a less boring one than that Yeah, it's probably a couple. Uh, could be hands, you know defense so Okay, I'll buy that All right, thanks. Yeah Other questions for Andrew Back to Meredith. Go ahead Can you just describe the the feeling in the clubhouse right now this team's really rolling winners of seven in a row Doesn't seem like you guys are showing any signs. It's slowing down Right. I mean even on the field a lot of smiles today. Everybody was kind of upbeat I had a great time out there. I mean Like I said, like the other day we just come to the field and we expect to win right now And if that's what I feel when I come and when we see the lineup and we see the opponent, we expect to win Where does that mentality come from? Is it just a product of the fact that you guys had been winning had been playing? Well, or is it more than that? Yeah, I mean, uh You can argue that confidence comes from results, but You can also argue the other way around. So if if we come in with that mentality I think is what we've been doing for the past few games is is going to happen most of the time


Do you want to be up here, too? I have to get this sensitive one. Is it an original idea? No, but is it the video that we all want to see? Yes! Karmic move! Every year for Halloween, I feel like I spend way more time or money on my outfit than I do on my dogs. And everyone always tweets at me, they're like, what are the dogs mean for Halloween? And it's always like an afterthought. So this year, I wanted to make sure that it was a forethought, that they got their costumes before I did. Mabo, would you like to join us? Cool shirt, wow. So I went out and I bought a bunch of different costumes for the dogs, and we're just gonna have a little fashion show because this is what I want to do with my time. My eyebrows, by the way, are so very bleached. I just penciled them in because I tried to do a bleached brow look like this and I looked terrifying. All right, I think that we're gonna do this dog by dog and we're gonna start with a little Goyelle here. All right, peachy. So the first costume that I got you was this beautiful Princess Leia. Now the sizing of these are a little weird because they're just like extra small, medium, large, which for dogs is like, it can mean anything.  Like every costume is a Star Wars costume. They're raking it in over there.  Are you except? She's eating it. Okay, you have to go on the ground, okay? I'm very sorry. Let go of me. All right, let's get your wig, honey. Don't worry, peach. Here's look number one. Wow, Ms. Witch. That's what she's standing there.  But how, can she walk around? Peachy girl, come here. Can you do stuff in that or are you just? Stand next to her because I nearly think I'm a mother, daughter, portrait. Oh my God. I like love this wig. This one is so good. Wow. She looks like a painting. Is that her foot? Yeah. He looks so pretty. Oh, I've had it with this wig. Okay. Peachy girl, come on. Okay. Peachy girl, come here. Come here.  This costume looks incredible.   Oh, these are wings. Oh, cute. Hey, peach. I wonder if she tried to chew it. It's like nasty. It's like something she's been chewing on for months. It's like feathers, but hair. That's not shaped for an eggy head, huh? There she is. All right, sit, honey. Wow, what a good girl.  Peach, she's having a lot of fun too. Yeah, she really looks like she's thoroughly enjoying herself. It's like so adorable, but I don't think she can move. Come on, can you move in it? Wow, can you sit? Excuse you. All right, so she can move in it. She just doesn't want to. Does that make your head itchy? Yeah, my head is itchy. Get out. Peach was already married to Kermit in a previous video, and I did make her wedding gown. But this is the pre-made bride costume with hands. Do you want to relive your wedding?  Why didn't it come with a veil or anything to dress up her beautiful face with? Good girl. Her feet keep getting so, oh. Wow. Oh my God. So beautiful. No one invited you. No one invited you. That's what she's saying now. Kermit. It's like a level five Kermit. Like a level five wearable. Like she can move her legs. She can walk around in it. She's not like comfortable in it. It's very cute, but it's still not my favorite. Just felt girl, honey. Nice and tight on your breastuses. All right, peach. What do you think? She's a peach-za. Peach-za. Do you like it? It just looks like a pizza on her back. I thought it was gonna be a little bit cuter than it is. Yeah, this is kind of a lazy costume. Right? It should just be like a piece of pizza from her face down. Yeah. Yeah, this is kind of weak. I'm kind of disappointed. So this last one, again, Star Wars. This claims to be one size, but we had to try it because, I mean, look at it.     They're like, the reins need to be shorter. Your reins were so long. What are you doing, Doc? What is that knot? Who are you fighting?  I think that's as good as we're gonna get it. Peach-za, come here. Wow, it's awful. Giddy up, Peach. Come on. Oh, so realistic. She's walking sideways. I guess just vote in the comments what you think Peach should be for Halloween. I'm gonna have to go with the first Princess Leia. But I also really liked the bat dog. It was really cute. Yeah, bat dog was cute. Pretty cute. All right, Peach, you girl.  You're all done. He's the only dog that we have that actually appreciates a shirt. We'll be judging them on fit, comfort, and cuteness. Because if it's not comfortable, we don't want you to wear it. This one's a football player. All right, now your legs are gonna fit in here, honey. Here comes your helmet. All right, bud. Your ears definitely don't fit in those ear holes. How do you feel? What's he doing? Literally nothing. Wow, show us your tail. Bubble. Why is he not even standing up? Marble, did you forget how to stand up? Marble. Bubble, bud. Marble. Marble, bud. Hey, hey. Oh my God. Hey, hey. Did you just try to like end it? Kermit, get out. Marble, listen to my voice, okay? Do you want to take the hat off and just try the outfit? What? Is that better? Is that better or worse? Still not feeling it? Kermit, move. Go, no, it's not up there. Not a choice, not a choice, go. Kermit. So the next one I found you is a bear. This goes around here. Hello. You're just like, how is this an extra small? What's with these sizes?  It just looks like a really sad, depressed bear. What do you think, bud? Not your favorite? At least this one's like soft. Oh, here he goes. He's laying down. Marble, Marble. Kermit, what do you have in your mouth? Kermit, you're so extra. I love you so much, but you test me every day, boy. Kermit, what's in your mouth? What is it? It's like that meme, what do you have in your mouth? Choose furiously. He swallowed it. Go. He swallowed it. There you go. Why are you still with us? This one's just like a shirt. It looks like it might be a little big on you, but at least it'll be comfortable, honey. Who made this? What dog is shaped like that? These long arms. I'm sorry. I'm sorry. Generation. How's it look? Okay, Spock's hair is not this long. Do you like the wig, Marble? Do you want to stand up or? He can't. His sleeves are too long. Marble, Marble. Stay with us, Marble. Marble. Marble. Marble. Just like be quiet for a second. I just want to see if he really goes to sleep. This is like why he likes t-shirts. You put it on him and he just gets really relaxed, you know, but I think this is too relaxed. This is like a dangerous level of relaxed. Want to try your last one? Oh, I want to sit on this mat. It's a dinosaur. Oh, this is never going to fit him. This looks like a lot for you, huh? Okay, it's okay.  What do you think?  What do you think? Marble, you've been working out, right? Oh, God. Marble. Marble. Marble, I'll stay with him. The re-costum makes him tired. Marble. He will back up. This looks like a costume. There's no dog. Fairies. He's melted into the pub. This is an incredibly threatening dinosaur. It's a rare breed. That looks really cute. Oh, my God. He's like, leaving. Marble. He's leaving. Marble, honey. You don't hate it. You just, you want to sleep in it. You're such a good boy, honey. Say, maybe this is good for a dog with a little more energy, right, Marble? All right, Kermit, it's finally your turn. This was the other version of what Marbles just had on. It's just a Triceratops head. It's a Triceratops. Triceratops. In his eye. Poor thing. Yeah, it needs more dinosaur, huh?  But I do like the idea of having a Triceratops. Triceratops. Triceratops. Again, a Star Wars costume again is all they have. Okay, this is not gonna fit.   I don't know. That's awfully cute. You look like a pretty cute Ewok, honey. Okay, so far, honestly, just this headpiece is like the most functional costume that we've gotten. Like, he can wear that and not freak out the whole time. You wanna be an Ewok for Halloween? Oh, Ewok!  This is a little like that, but it comes with its own glasses, so I don't have to make you any. Now, do your glasses first. These are really cute. I mean, this is a lot to ask of you, bud, but you're doing amazing, sweetie. Wow, there he is, the most beautiful guy there ever was. Kerm, how do you feel? Do you feel handsome? Do you feel beautiful? Can you move in it? Good boy. This one's fantastic. Kermit, you look great. You've never looked better. Kermit, Kermit.  Like, I put up with him and he puts up with me. Like, he knows the deal. This is like 10 out of 10, but like the fact that he endures this at all, he's a real good boy. He's a 10 out of 10 good boy. Wait, can we take a picture together? How do we look? I love you, honey. This, I feel like, is the perfect outfit for Kermit because he's actually high-key very creepy. This is for when you follow me into the bathroom and try and smell my underwear. It's not really exciting, but it's fitting because that's a creepy outfit. I mean, it's cute. He's reached his final form. This one is sushi. This is supposed to go like this. Like a bandana on it? Yeah. Kermit! Wow, that's pretty handsome, bud. That's what a sushi chef wears. But he is the sushi. What are you? Are you a sushi guy? Is it your favorite or no? Do you want to be Waldo? You kind of want to be Waldo, don't you? No. It's pretty comfortable for him because it's just a band in the neck piece. Now, even though that was the last costume, I did get them all matching costumes in the style that I think is most comfortable for them. All right, guys. What do you think? Marble, how are you feeling, bud? Iggy's, you guys are looking great. You're looking adorable. All right, let's see. Did they glow in the dark? I think they do. Barely. Wow. They look so cute, though, and way more comfortable, right? Yeah, these are like onesies. They like this style of costume. They like this. You like your costume, bud? Wow, you guys are very scary skeletons for Halloween. So spooky. 10 out of 10 scary, scary costumes, guys. I know you guys think that I like to torture my dogs, but I really don't that much. I like them to be comfortable for Halloween. Let me know what your guys' favorite costume was. I think mine was probably Kermit's Waldo costume. And Peach's layout. It's pretty great. That wig is pretty great. I'm excited for Halloween. I'm excited to make my costume now that I've figured out the most important part. You know what I'm saying? Yeah, make sure you subscribe to my channel. I put out a teaser Wednesday slash Thursday, and yeah, I know this wasn't too exciting, but you know what? It's got a lot of what I wanted to do, and I kind of did it, so let's look at it. They're scary. They like don't move at all. You guys want to give us one good Halloween howl?


The reason I want to bring up Charlie Hebdo today is because it's in the news and the reason it's in the news is that Five and a half years after the attack on Charlie Hebdo and I'll remind you that in January of 2015 Islamic terrorists Attacked the offices of Charlie Hebdo to gunman attack the officers in the name of Islam in the name of Defending the honor of the Prophet Muhammad and a slaughtered slaughtered twelve people who were working there on that day Charlie Hebdo is a satirical magazine That has been published kind of on and off since the since the 1970s And had published various cartoons of the Prophet Muhammad had done satirical articles about him But also had done the same thing made fun of Jews made fun of Christians made fun of pretty much everybody, but I don't know if you know, but in Islam making fun of the Prophet drawing the Prophet is sinful and It's a sin.  What was that? All right. This is so this is the cartoon the Charlie Hebdo published in 2011 and In the in the bubble there what you see is Muhammad is saying a hundred lashes if you don't die laughing a Hundred lashes if you don't die laughing For publishing this cartoon 12 people lost their lives sadly Oops. Oh, I have to do here This is the cartoon that the magazine put out a week after The slaughter a week after the terrorist attack and this says and this is horrible This is horrible. We forgive you or you are forgiven To ask pardon. I don't know. I shouldn't speak French These and I'm not I don't have large images of this and I can't these are some of the cartoons They were published in 2005 in Denmark. These are the famous Danish cartoons There were published you see this one in particular The one in the middle with a black turban and a bomb in it was particularly viewed in the city But think about it Muhammad with a bomb is that so weird given all the suicide bombers that have been happening So I just wanted to show those for reason not because you need to see cartoons of Muhammad But because right after Charlie Hebdo happened Millions of people went out to the streets and everybody on Twitter said Yes, we Charlie. I am Charlie in support Charlie Hebdo the magazine and yet I mean New York Times was just we Charlie the many publications in the US was just we Charlie and yet None of these publications had the bars. None of these publications had the audacity the courage really not the dacity courage Just publish the cartoons People were slaughtered about cartoons The nature of those cartoons is news it is their moral responsibility To show those cartoons and not succumb to fear not succumb to the threats of The Islamist by not showing them It is horrific Horrific that nobody who said yes, we Charlie was willing to show the cartoons It means that they're not Charlie. They were not just we Charlie They were cowards They were compromises. They were appeasers And I wanted to show the Charlie the the Muhammad cartoons because yes, we Charlie because I stand with those people Who in my view? This is a battle about free speech. It's not a battle about Islam this is not a battle about Muhammad That's a different battle. There is a battle there, too. This one is about free speech And if you feel fear to publish the cartoons and your government won't defend you for publishing the cartoons That is a violation of free speech the government are protecting it and Unfortunately, the US government has a long history of this Which I've recited in the past, but what the hell let's do it again when Solomon Rushdie published his book and There was a far to against him by the leader of Iraq by a total humanee a Fatwa, you know the gave a prize to somebody anybody who killed him the United States did nothing the United Kingdom where Solomon Rushdie was hiding did nothing. Oh, you say well, Selma Rushdie was an American So it's not the job the American government to do anything. Okay, but what about the threats of their total humanee towards our publishers if they Published the book they would be killed the firebombing of bookstores in New York Agama did nothing indeed George HW the father Bush came out and said You really shouldn't insult Islam. It's not nice. People shouldn't do it. Don't do it. Don't do it in other words appeasement compromise cowardice instead of living up to your responsibility To protect the right of people to insult including the insult Islam there were many examples after that of Self-censorship of people refusing to show because they were afraid and they knew their government would not protect them all over the west including in the United States of America and In 2005 in order to illustrate This self-censorship in order to bring the topic to the forefront Fleming Rose Who was a editor at a Danish? Journal published 12 cartoons and Muhammad now Fleming has become a good friend since then Well a friend anyway, I think he's a good friend I don't see him very often, but but he is a good friend Fleming published those cartoons The response was immediate not immediate. It took a few months, but wowed up in the Muslim world You got demonstrations all over the middle of the world the burning of their tax and embassies the killing of people Threats on Fleming Rose's life threats on the cartoonist life cartoonists were actually attacked and almost killed No American publication agreed to publish the cartoons Yes Fleming wrong was an Ocon at my invitation as I said Fleming became a good friend He's a he's a fan of Ayn Rand. He's no he's not an objectivist, but he's a fan of Ayn Rand He's right out of the shrug. He's just a good guy one of these pro reason probably Moderately on the left on economic issues But just a good guy George Bush Son this time came out I said, oh, we shouldn't really publish these cartoons. Why do we need to offend Muslims? Why should we offend people? This is George Bush the tough George Bush the cowboy in 2012 Charlie Hebdo published some cartoons on Muhammad in the nude The White House and Obama actually said, you know, we shouldn't really offend them Basically, the West has been sending a single signal to Islam That yeah, we agree with you these publications these individuals It's too much Indeed ultimately Fleming goes out to leave his publication in Denmark because they wouldn't fully support him even the publication wouldn't fully support him in defending his decision to publish those cartoons and To continue making an issue of it indeed Over the last 20 years free speech has declined significantly in Europe not in the self-censorship way It's declined in the United States but much more From the perspective much more in Europe because of government's government's imposing hate speech laws government Requiring institutions to take down paintings of Muhammad or not to show oppers that might depict or harm I do not basically massive appeasement across the board from government on down Towards Islam and Towards the worst elements within Islam so over the next few months France is gonna have a show trial they are trying 14 people who were Accused of helping the people who committed the murders in January 2015 The actual shooters were killed then the day after I think by the French authorities Three other people who helped them directly escaped France and made it to ISIS They're probably still in Syria Iraq or they might be and might probably are dead Killed during the struggles over there These 14 or I think three are in absentia the three that any rock is Syria part of ISIS the others are people that it what major helpers But helped in these attacks, but this is gonna opportunity for the French justice system To put the whole issue of Charlie Hebdo the whole issue of free speech on The table these will be the first trials in French history There will be broadcast to the public where video cameras are allowed So these are gonna be two show trials in a sense that the whole French public is gonna be invited to participate And I hope I Hope that they use this opportunity to strengthen the idea of free speech to Strengthen the right of Charlie Hebdo to publish any cartoons of anybody to publish any cartoons That unless you incite for violence to say anything Particularly in France where free speech is under constant attack particularly in Europe where free speech is massively in decline But it'd be good for Americans too As we limit people's speech online Not by the government, but by internet companies that shouldn't be doing it. I Don't think they should be broken up for it They have every right to do it But I think they're wrong in doing it and suddenly they're wrong in not having criteria objective criteria for what they're doing But it is also an important lesson for all of us to learn because the government is not that far Whether it's Trump or the Democrats From coming out and restricting free speech from slowly Chipping away at free speech for example Regulating Facebook and Twitter on what they can and cannot put up on their platforms Would be regulating free speech in America We are there we are close to there. There's talk about hate speech laws We need to pay attention America. I know this is not anybody's top of the anybody's agenda But we need to pay attention. This is a crucial issue. This is an issue of life or death and If we need to be reminded through this trial of what's at stake Then we should be reminded then let's take this opportunity to remind ourselves There's nothing more important to civilization Right now Then the ability to speak that my ability to do the show my ability to shoot it show these cartoons I hope YouTube doesn't take the show down. I'm sure it won't monetize it But let's hope that you can still show the cartoons on YouTube without YouTube You know stopping us restricting us What we need today what I called a new intellectual would be any man or woman who is willing to think Meaning any man or woman who knows that man's life must be guided by reason by the intellect Not by feelings wishes women's or mystic revelations Any man or woman who values his life and who does not get want to give in to today's cult of the spare cynicism and impotence and does not intend to give up the world to the dark ages and to the role of the collectivist All right before we go on Reminder please like the show. We've got 163 live listeners right now 30 likes That should be at least a hundred. I think at least a hundred of you actually like the show Maybe they're like 60 of the Matthews out there who hate it, but but at least the people who liking it You know, I want to see I want to see a thumbs up. There you go. Start liking it I want to see that go to a hundred all it takes is a click of a click of a thing whether you're looking at this And and you know the likes matter. It's not an issue of my ego It's an issue of the algorithm the more you like something the more the algorithm likes it So, you know, and if you don't like the show give it a thumbs down Let's see your actual views being reflected in the likes But if you like it, don't just sit there help get the show promoted. Of course, you should also share and You can support the show at your own book show com slash support on patreon or subscribe star or locals And and show you support for all for for the work for the value. Hopefully you're receiving from this and And of course, don't forget if you're not a subscriber Even if you even if you just come here to troll or even if you hear like Matthew to defend marks Then you should subscribe because that way you'll know when to show up You'll know what shows are on when they're on you'll get notified, right? so Yes, like share subscribe support like share subscribe support. There you go easy Do one or all of those please?